Dell EqualLogic PS6210XS EqualLogic Group Manager Administrator s Guide PS Ser - Page 102

Different access methods are available depending on the needs of your environment: • An access policy consists of a set of extended access points. Each extended access point enables users to provide a set of access attributes describing the endpoints, such as an IQN initiator name, CHAP name, and IP addresses. After an access policy is associated with a volume, all the endpoints described by the extended access points will have access to the volume. • An access policy group is a set of access policies that can be associated to a volume. When an access policy group is associated with a volume, all endpoints described within those access policies have access to the volume. • A basic access point provides the traditional direct method for connecting a single endpoint to a single volume. Basic access points cannot be reused, transferred, or shared with other volumes. They are associated directly with the volume to which they provide access, and if that volume is deleted, the basic access point is also deleted. All of these access methods can be used with each other to fulfill the particular needs of your computing environment. The main distinction between access policies and basic access points is that access policies exist independent of the volumes to which they provide access. This flexibility offers the following significant advantages over traditional basic access points: • Access policy reuse - A single access policy can now be associated with multiple volumes and all the access attributes are specified only once, requiring less manual configuration and less possibility of data entry errors. • Single point of change - Changes to access attributes, IP address, initiator IQN name, or CHAP user name are all specified at one place and not repeated across volumes. You can now change these attributes at one place, and the changes are instantly propagated to all volumes using those access policies. About Access Policies In earlier versions of the PS Series firmware, security protection was accomplished by individually configuring an access control record for each volume to which you wanted to secure access. Each volume supported up to 16 different access control records, which together constituted an access control list (ACL). However, this approach did not work well when large numbers of volumes were present. To address that issue, Group Manager incorporates access policies and access policy groups that can be applied to one or more volumes. Each access policy lets you specify one or more of the following authentication methods: • CHAP user name (Challenge Handshake Authentication Protocol) • IP address • iSCSI initiator name When you create a volume, you can assign it to an existing access policy, which determines which hosts will have access to that volume. In addition, you can allow or disallow volume access from multiple initiators, depending on your configuration needs. An access policy can apply to the volume, its snapshots, or both. For example, you can authorize computer access to a volume and its snapshots or only to the volume. Access Policies: Use Cases The following use cases show different ways of working with access policies. Study 1: Grant volume access to a single host using its iSCSI Initiator Name or IP address Scenario: A group administrator wants to grant volume access to a host that is using a software iSCSI initiator. The admin wants to define access using either the iSCSI initiator name or IP addresses. Solution: 1. Click Group → Group Configuration. 2. Click the Access Policies tab. In the Access Policies panel, create an access policy for the host. 3. Add an access point to the access policy that specifies either the initiator name or a list of IP addresses for each of the interfaces on the host. 4. With the access policy selected, go to the Targets panel and click Add. 5. Select the name of the volume to which you want to grant access and click OK. 102 About Volume-Level Security