Qlogic SANbox 6142, User Manual

Page: 289 / 314

FI0054601-00 A C-1
Appendix C
Configuring CHAP
C.1
CHAP Definition
In challenge handshake authentication protocol (CHAP), the authentication agent
sends the client program a random value that is used only once and an ID value.
Both the sender and peer share a predefined secret. The peer concatenates the
random value, the ID, and the secret, and calculates a one-way hash using MD5.
It sends the hash value to the authenticator, which in turn builds that same string
on its side, calculates the MD5 sum, and compares the result with the value received
from the peer. If the values match, the peer is authenticated.
By transmitting only the hash, the secret cannot be reverse-engineered. The ID
value is increased with each CHAP dialogue to protect against replay attacks.
C.2
Configuring CHAP Using CLI
The following sections describe the procedure for configuring CHAP from the
command line interface (CLI).
C.2.1
CLI—Discovery Session—Bi-directional CHAP
The following procedure describes the steps for configuring bi-directional CHAP
used during a discovery session:
1. On the router,:
a. Enable CHAP on the port
b. Create a secret (for example, secret_port)
c. Using Set Chap , choose the iSCSI node that represented the GE port
d. Use Show Iscsi to find the iSCSI node name of the GE port.
2. Use Initiator add to add the initiator that is about to do discovery.
a. Enable the CHAP for this initiator
b. Create a secret (for example, secret_initiator )
c. Use Set Chap to update the CHAP settings of the initiator.
3. Go to the Microsoft iSCSI (MS) Initiator and perform the following steps: