Skip to main content
SANtricity software

Configure iSCSI authentication in SANtricity System Manager

Contributors netapp-driley netapp-jolieg
PDFs

For extra security in an iSCSI network, you can set authentication between controllers (targets) and hosts (initiators).

System Manager uses the Challenge Handshake Authentication Protocol (CHAP) method, which validates the identity of targets and initiators during the initial link. Authentication is based on a shared security key called a CHAP secret.

Before you begin

You can set the CHAP secret for the initiators (iSCSI hosts) either before or after you set the CHAP secret for the targets (controllers). Before you follow the instructions in this task, you should wait until the hosts have made an iSCSI connection first, and then set the CHAP secret on the individual hosts. After the connections are made, the IQN names of the hosts and their CHAP secrets are listed in the dialog box for iSCSI authentication (described in this task), and you do not need to manually enter them.

About this task

You can enable CHAP authentication and then specify the Target CHAP secret for one-way authentication, or you can specify both the Initiator CHAP secret for two-way authentication between the controller and the iSCSI hosts.

One-way authentication allow the controller to authenticate the identity of the iSCSI hosts (uni-directional authentication).

Two-way authentication allows both the controller and the iSCSI hosts to perform authentication (bi-directional authentication). This option provides a second level of security by enabling the controller to authenticate the identity of the iSCSI hosts; and in turn, the iSCSI hosts to authenticate the identity of the controller.

Steps

  1. From the left panel, select System.

  2. Under iSCSI settings, click Configure iSCSI authentication.

    The Configure Authentication window appears.

  3. Select the Enable CHAP authentication checkbox to enable authentication.

    If you do not want to enable CHAP authentication, leave the box unchecked.

  4. If you enabled one-way authentication, enter the Target CHAP secret for authentication of the initiators that connect to the target. The CHAP secret must be between 12 and 57 printable ASCII characters.

    Under the Confirm target CHAP secret field, re-enter the same CHAP secret to confirm it.

  5. If you want to enable two-way authentication between the controller and the iSCSI hosts, enter the Initiator CHAP secret for authentication of the controller by the initiators. The CHAP secret must be between 12 and 57 printable ASCII characters.

  6. Click Save.

Results

Authentication occurs during the iSCSI login sequence between the controllers and iSCSI hosts, unless you specified no authentication.