vSphere Storage - ESXi 5.1 - Documentation - VMware

vSphere Storage
6 Rescan the iSCSI adapter.
If the static target was dynamically discovered, you need to remove it from the storage system before
performing the rescan. Otherwise, your host will automatically discover and add the target to the list of
static targets when you rescan the adapter.
Configuring CHAP Parameters for iSCSI Adapters
Because the IP networks that the iSCSI technology uses to connect to remote targets do not protect the data
they transport, you must ensure security of the connection. One of the protocols that iSCSI implements is the
Challenge Handshake Authentication Protocol (CHAP), which verifies the legitimacy of initiators that access
targets on the network.
CHAP uses a three-way handshake algorithm to verify the identity of your host and, if applicable, of the iSCSI
target when the host and target establish a connection. The verification is based on a predefined private value,
or CHAP secret, that the initiator and target share.
ESXi supports CHAP authentication at the adapter level. In this case, all targets receive the same CHAP name
and secret from the iSCSI initiator. For software and dependent hardware iSCSI adapters, ESXi also supports
per-target CHAP authentication, which allows you to configure different credentials for each target to achieve
greater level of security.
Choosing CHAP Authentication Method
ESXi supports unidirectional CHAP for all types of iSCSI initiators, and bidirectional CHAP for software and
dependent hardware iSCSI.
Before configuring CHAP, check whether CHAP is enabled at the iSCSI storage system and check the CHAP
authentication method the system supports. If CHAP is enabled, enable it for your initiators, making sure that
the CHAP authentication credentials match the credentials on the iSCSI storage.
ESXi supports the following CHAP authentication methods:
Unidirectional CHAP In unidirectional CHAP authentication, the target authenticates the initiator,
but the initiator does not authenticate the target.
Bidirectional CHAP In bidirectional CHAP authentication, an additional level of security enables
the initiator to authenticate the target. VMware supports this method for
software and dependent hardware iSCSI adapters only.
For software and dependent hardware iSCSI adapters, you can set unidirectional CHAP and bidirectional
CHAP for each adapter or at the target level. Independent hardware iSCSI supports CHAP only at the adapter
level.
When you set the CHAP parameters, specify a security level for CHAP.
NOTE When you specify the CHAP security level, how the storage array responds depends on the array’s
CHAP implementation and is vendor specific. For information on CHAP authentication behavior in different
initiator and target configurations, consult the array documentation.
Table 11-4. CHAP Security Level
CHAP Security Level Description Supported
None The host does not use CHAP authentication. Select this
option to disable authentication if it is currently enabled.
Use unidirectional CHAP if
required by target
The host prefers a non-CHAP connection, but can use a
CHAP connection if required by the target.
Software iSCSI
Dependent hardware iSCSI
Independent hardware
iSCSI
Software iSCSI
Dependent hardware iSCSI
102 VMware, Inc.