HP EVA P6550 HP P6300/P6500 EVA User Guide (5697-2486, September 2013) - Page 132

Linux version, ATTO Macintosh Chap restrictions, Recommended CHAP policies, iSCSI session types

Get HP EVA P6550 PDF manuals and user guides View all HP EVA P6550 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 132 highlights

Linux version • CHAP is supported with Linux open-iscsi Initiator and the iSCSI or iSCSI/FCoE modules. • CHAP setup with Linux iSCSI Initiator is not supported with the iSCSI or iSCSI/FCoE modules. ATTO Macintosh Chap restrictions The ATTO Macintosh iSCSI Initiator does not support CHAP at this time. Recommended CHAP policies • The same CHAP secret should not be configured for authentication of multiple initiators or multiple targets. • Any CHAP secret used for initiator authentication must not be configured for the authentication of any target; and any CHAP secret used for target authentication must not be configured for authentication of any initiator. • CHAP should be configured after the initial iSCSI Initiator/target login to validate initiator/target connectivity. The first initiator/target login also creates a discovered iSCSI Initiator entry on the iSCSI or iSCSI/FCoE modules that will be used in the CHAP setup. iSCSI session types iSCSI defines two types of sessions: • Discovery. SCSI discovery allows an initiator to find the targets to which it has access. • Normal operational session. A normal operational session is unrestricted. CHAP is enforced on both the discovery and normal operational session. The iSCSI or iSCSI/FCoE controller CHAP modes The iSCSI or iSCSI/FCoE modules support two CHAP modes: • Single-direction. The target authenticates the identity of the initiator with the user-provided CHAP secret. To enable single-direction CHAP, you need to enable CHAP for a specific initiator record on the iSCSI or iSCSI/FCoE modules and input a corresponding CHAP secret from the iSCSI host. • Bi-directional. The initiator and target authenticate identity of each other with the user-provided CHAP secrets. To enable bi-directional CHAP for a discovery session, you need to provide a CHAP secret for the initiator and for the iSCSI port for which you are performing discovery. To enable bi-directional CHAP for a normal session, you will need to provide a CHAP secret for the initiator and for the iSCSI-presented target that you are trying to log in to. • Once CHAP is enabled, it is enforced for both the normal and discovery sessions. You only have the choice of what type (single or bi-directional) of CHAP to perform: ◦ Single-direction CHAP during discovery and during normal session ◦ Single-direction CHAP during discovery and bi-directional CHAP during normal session ◦ Bi-directional CHAP during discovery and single-direction CHAP during normal session ◦ Bi-directional CHAP during discovery and during normal session Enabling single-direction CHAP during discovery and normal session Table 22 (page 133) lists the parameters you use to enable single-direction CHAP. 132 iSCSI or iSCSI/FCoE configuration rules and guidelines

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
  • 286
  • 287
  • 288
  • 289
  • 290
  • 291
  • 292
  • 293
  • 294
  • 295
  • 296
  • 297
  • 298
  • 299
  • 300
  • 301
  • 302
  • 303
  • 304
  • 305
  • 306
  • 307
  • 308
  • 309
  • 310
  • 311
  • 312
  • 313
  • 314
  • 315
  • 316
Linux version
•
CHAP is supported with Linux open-iscsi Initiator and the iSCSI or iSCSI/FCoE modules.
•
CHAP setup with Linux iSCSI Initiator is not supported with the iSCSI or iSCSI/FCoE modules.
ATTO Macintosh Chap restrictions
The ATTO Macintosh iSCSI Initiator does not support CHAP at this time.
Recommended CHAP policies
•
The same CHAP secret should not be configured for authentication of multiple initiators or
multiple targets.
•
Any CHAP secret used for initiator authentication must not be configured for the authentication
of any target; and any CHAP secret used for target authentication must not be configured for
authentication of any initiator.
•
CHAP should be configured after the initial iSCSI Initiator/target login to validate initiator/target
connectivity. The first initiator/target login also creates a discovered iSCSI Initiator entry on
the iSCSI or iSCSI/FCoE modules that will be used in the CHAP setup.
iSCSI session types
iSCSI defines two types of sessions:
•
Discovery.
SCSI discovery allows an initiator to find the targets to which it has access.
•
Normal operational session.
A normal operational session is unrestricted.
CHAP is enforced on both the discovery and normal operational session.
The iSCSI or iSCSI/FCoE controller CHAP modes
The iSCSI or iSCSI/FCoE modules support two CHAP modes:
•
Single-direction.
The target authenticates the identity of the initiator with the user-provided
CHAP secret. To enable single-direction CHAP, you need to enable CHAP for a specific initiator
record on the iSCSI or iSCSI/FCoE modules and input a corresponding CHAP secret from the
iSCSI host.
•
Bi-directional.
The initiator and target authenticate identity of each other with the user-provided
CHAP secrets. To enable bi-directional CHAP for a discovery session, you need to provide a
CHAP secret for the initiator and for the iSCSI port for which you are performing discovery.
To enable bi-directional CHAP for a normal session, you will need to provide a CHAP secret
for the initiator and for the iSCSI-presented target that you are trying to log in to.
•
Once CHAP is enabled, it is enforced for both the normal and discovery sessions. You only
have the choice of what type (single or bi-directional) of CHAP to perform:
◦
Single-direction CHAP during discovery and during normal session
◦
Single-direction CHAP during discovery and bi-directional CHAP during normal session
◦
Bi-directional CHAP during discovery and single–direction CHAP during normal session
◦
Bi-directional CHAP during discovery and during normal session
Enabling single–direction CHAP during discovery and normal session
Table 22 (page 133)
lists the parameters you use to enable single-direction CHAP.
132
iSCSI or iSCSI/FCoE configuration rules and guidelines