S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
42-23
Cisco MDS 9000 Family CLI Configuration Guide
OL-16184-01, Cisco MDS SAN-OS Release 3.x
Chapter 42 Configuring iSCSI
Configuring iSCSI
responds to the iSCSI host with the list of targets. Each will have either a static iSCSI target name
that you configure or a dynamic iSCSI target name that the IPS module or MPS-14/2 module creates
for it (see the
“Dynamic Mapping” section on page 42-6
).
•
iSCSI session creation—When an IP host initiates an iSCSI session, the IPS module or MPS-14/2
module verifies if the specified iSCSI target (in the session login request) is allowed by both the
access control mechanisms described in the
“iSCSI-Based Access Control” section on page 42-21
.
If the iSCSI target is a static mapped target, the IPS module or MPS-14/2 module verifies if the
iSCSI host is allowed within the access list of the iSCSI target. If the IP host does not have access,
its login is rejected. If the iSCSI host is allowed, it validates if the virtual Fibre Channel N port used
by the iSCSI host and the Fibre Channel target mapped to the static iSCSI virtual target are in the
same Fibre Channel zone.
If the iSCSI target is an autogenerated iSCSI target, then the IPS module or MPS-14/2 module
extracts the WWN of the Fibre Channel target from the iSCSI target name and verifies if the initiator
and the Fibre Channel target is in the same Fibre Channel zone or not. If they are, then access is
allowed.
The IPS module or MPS-14/2 module uses the Fibre Channel virtual N port of the iSCSI host and does
a zone-enforced name server query for the Fibre Channel target WWN. If the FC ID is returned by the
name server, then the iSCSI session is accepted. Otherwise, the login request is rejected.
iSCSI Session Authentication
The IPS module or MPS-14/2 module supports the iSCSI authentication mechanism to authenticate the
iSCSI hosts that request access to the storage devices. By default, the IPS modules or MPS-14/2 modules
allow CHAP or None authentication of iSCSI initiators. If authentication is always used, you must
configure the switch to allow only CHAP authentication.
For CHAP user name or secret validation, you can use any method supported and allowed by the Cisco
MDS AAA infrastructure (see
Chapter 32, “Configuring RADIUS and ”
). AAA
authentication supports a RADIUS, , or local authentication device.
The
aaa authentication iscsi
command enables AAA authentication for the iSCSI host and specifies the
method to use.
To configure AAA authentication for an iSCSI user, follow these steps:
The sections included in this topic are:
•
Authentication Mechanism, page 42-24
•
Local Authentication, page 42-24
•
Restricting iSCSI Initiator Authentication, page 42-25
Command
Purpose
Step 1
switch#
config t
switch(config)#
Enters configuration mode.
Step 2
switch(config)#
aaa authentication
iscsi default group RadServerGrp
Uses RADIUS servers that are added in the group called
RadServerGrp for the iSCSI CHAP authentication.
switch(config)#
aaa authentication
iscsi default group TacServerGrp
Uses servers that are added in the group called
TacServerGrp for the iSCSI CHAP authentication.
switch(config)#
aaa authentication
iscsi default local
Uses the local password database for iSCSI CHAP
authentication.
