vsphere-esxi-vcenter-server-55-storage-guide

Chapter 10 Using ESXi with iSCSI SANDiscoveryA discovery session is part of the iSCSI protocol, and it returns the set of targets you can access on an iSCSIstorage system. The two types of discovery available on ESXi are dynamic and static. Dynamic discoveryobtains a list of accessible targets from the iSCSI storage system, while static discovery can only try to accessone particular target by target name and address.For more information, see “Configuring Discovery Addresses for iSCSI Adapters,” on page 90.AuthenticationiSCSI storage systems authenticate an initiator by a name and key pair. ESXi supports the CHAP protocol,which VMware recommends for your SAN implementation. To use CHAP authentication, the ESXi host andthe iSCSI storage system must have CHAP enabled and have common credentials.For information on enabling CHAP, see “Configuring CHAP Parameters for iSCSI Adapters,” on page 92.Access ControlAccess control is a policy set up on the iSCSI storage system. Most implementations support one or more ofthree types of access control:• By initiator name• By IP address• By the CHAP protocolOnly initiators that meet all rules can access the iSCSI volume.Using only CHAP for access control can slow down rescans because the ESXi host can discover all targets,but then fails at the authentication step. iSCSI rescans work faster if the host discovers only the targets it canauthenticate.Error CorrectionTo protect the integrity of iSCSI headers and data, the iSCSI protocol defines error correction methodsknown as header digests and data digests.Both parameters are disabled by default, but you can enable them. These digests pertain to, respectively, theheader and SCSI data being transferred between iSCSI initiators and targets, in both directions.Header and data digests check the end-to-end, noncryptographic data integrity beyond the integrity checksthat other networking layers provide, such as TCP and Ethernet. They check the entire communication path,including all elements that can change the network-level traffic, such as routers, switches, and proxies.The existence and type of the digests are negotiated when an iSCSI connection is established. When theinitiator and target agree on a digest configuration, this digest must be used for all traffic between them.Enabling header and data digests does require additional processing for both the initiator and the target andcan affect throughput and CPU use performance.NOTE Systems that use Intel Nehalem processors offload the iSCSI digest calculations, thus reducing theimpact on performance.For information on enabling header and data digests, see “Configuring Advanced Parameters for iSCSI,” onpage 95.VMware, Inc. 73