Dell EqualLogic PS6210XS EqualLogic Group Manager Administrator s Guide PS Ser - Page 111

2. Click Group → Group Configuration. 3. Click the iSCSI tab. 4. In the iSCSI Authentication panel, select Enable RADIUS authentication for iSCSI initiators. 5. (Optional) Select Enable local authentication and check local first. 6. Click RADIUS settings to configure the group to use a RADIUS server (if you have not already done so). 7. Add at least one RADIUS server by clicking the RADIUS settings button and adding the IP address of the RADIUS authentication server. 8. Click OK to save the changes. After creating the CHAP account, create an access control policy for a volume and specify the CHAP user name in the policy. NOTE: In the iSCSI Authentication panel, you can select either Enable RADIUS authentication for iSCSI initiators, Enable local authentication and check local first, or both. Make sure that at least one of these options is selected. If neither option is selected, the PS Series group will lock out all CHAP logins. Configure Target Authentication If you configure initiator authentication though a local CHAP account or a CHAP account on a RADIUS authentication server, you can also allow the iSCSI initiator to authenticate iSCSI targets in a PS Series group. The combination of initiator and target authentication is called mutual authentication and provides additional security. With target authentication, when the initiator tries to connect to a target, the target supplies a user name and password to the initiator. The initiator compares the user name and password to mutual authentication credentials that you configure in the initiator configuration interface. The iSCSI connection succeeds only if the information matches. A group automatically enables target authentication using a default user name and password, which you can change. Whether the initiator requires target authentication depends on the initiator configuration settings. To display the current target authentication user name and password: 1. Click Group → Group Configuration. 2. Click the iSCSI tab. 3. In the iSCSI Authentication panel, click Modify. The Modify Target CHAP Account dialog box opens. 4. In the dialog box, type the target authentication user name and password. 5. Click OK to save the changes. About iSNS Servers In a shared storage environment, you must control computer access to iSCSI targets (volumes and snapshots), because multiple computers writing to a target in an uncoordinated manner might result in volume corruption. When an initiator tries to log in to a target, the group uses access control policies to determine if access should be authorized. However, access control policies do not prevent multiple initiators, either on the same computer or different computers, from accessing the same target. Therefore, by default, the group disables multihost (shared) access to a target. Only one iSCSI qualified name (IQN) can connect to a target at one time. If all group members are not running PS Series firmware version 5.0 or later, the group allows multihost access to targets. An iSNS (Internet Storage Name Service) server can facilitate iSCSI initiator discovery of iSCSI targets in a SAN. About Volume-Level Security 111