HP Cisco MDS 9140 Cisco MDS 9000 Family Fabric Manager Configuration Guide - R - Page 1095

Chapter 50 Configuring iSCSI Configuring iSCSI Send documentation comments to [email protected] • IPv6 address Note For a transparent mode iSCSI initiator, if both Fibre Channel zoning and iSCSI ACLs are used, then for every static iSCSI target that is accessible to the iSCSI host, the initiator's virtual N port should be in the same Fibre Channel zone as the Fibre Channel target. , To configure access control in iSCSI using Device Manager, follow these steps: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Select IP > iSCSI. You see the iSCSI configuration (see Figure 50-10). Select the Targets tab. You see the iSCSI virtual targets. Uncheck the Initiators Access All check box if checked. Click Edit Access. You see the Initiators Access dialog box. Click Create to add more initiators to the Initiator Access list. You see the Create Initiators Access dialog box. Add the name or IP address for the initiator that you want to permit for this virtual target. Click Create to add this initiator to the Initiator Access List. Enforcing Access Control IPS modules and MPS-14/2 modules use both iSCSI and Fibre Channel zoning-based access control lists to enforce access control. Access control is enforced both during the iSCSI discovery phase and the iSCSI session creation phase. Access control enforcement is not required during the I/O phase because the IPS module or MPS-14/2 module is responsible for the routing of iSCSI traffic to Fibre Channel. • iSCSI discovery phase-When an iSCSI host creates an iSCSI discovery session and queries for all iSCSI targets, the IPS module or MPS-14/2 module returns only the list of iSCSI targets this iSCSI host is allowed to access based on the access control policies discussed in the previous section. The IPS module or MPS-14/2 module does this by querying the Fibre Channel name server for all the devices in the same zone as the initiator in all VSANs. It then filters out the devices that are initiators by looking at the FC4-feature field of the FCNS entry. (If a device does not register as either initiator or target in the FC4-feature field, the IPS module or MPS-14/2 module will advertise it.) It then responds to the iSCSI host with the list of targets. Each will have either a static iSCSI target name that you configure or a dynamic iSCSI target name that the IPS module or MPS-14/2 module creates for it (see the "Dynamic Mapping" section on page 50-8). • iSCSI session creation-When an IP host initiates an iSCSI session, the IPS module or MPS-14/2 module verifies if the specified iSCSI target (in the session login request) is allowed by both the access control mechanisms described in the "iSCSI-Based Access Control" section on page 50-26. If the iSCSI target is a static mapped target, the IPS module or MPS-14/2 module verifies if the iSCSI host is allowed within the access list of the iSCSI target. If the IP host does not have access, its login is rejected. If the iSCSI host is allowed, it validates if the virtual Fibre Channel N port used by the iSCSI host and the Fibre Channel target mapped to the static iSCSI virtual target are in the same Fibre Channel zone. OL-17256-03, Cisco MDS NX-OS Release 4.x Cisco MDS 9000 Family Fabric Manager Configuration Guide 50-27