Administrator Guide

• For each Storage Center iSCSI control port and virtual port, a unique public IP address and TCP port pair must be reserved on the
router that performs NAT.
Steps
1. If you are connected to a Data Collector, select a Storage Center from the drop-down list in the left navigation pane of Unisphere
Central.
2. From the SYSTEM menu, click Ports.
The Ports view is displayed.
3. Click the Front End Ports tab.
4. Expand iSCSI and click the fault domain link.
The Fault Domain view is displayed.
5. On the Summary tab, click (More Actions) and select Configure NAT Port Forwarding.
The Configure NAT Port Forwarding dialog box opens.
6. In the Port Forwarding Configuration area, modify port forwarding information for a Storage Center iSCSI port.
• To add port forwarding information for an iSCSI port, click Add.
• To modify port forwarding information for an iSCSI port, select the port, then click Edit.
• To delete port forwarding information for an iSCSI port, select the port, then click Remove.
7. In the Public Networks/Initiators area, add or modify iSCSI initiator IP addresses or subnets that require port forwarding to reach
the Storage Center because it is separated from the Storage Center by a router performing NAT.
• To add an iSCSI initiator IP address or subnet, click Add.
• To modify an iSCSI initiator IP address or subnet, select it, then click Edit.
• To delete an iSCSI initiator IP address or subnet, select it, then click Remove.
8. Click OK.
Configuring CHAP for iSCSI Fault Domains
When Challenge Handshake Authentication Protocol (CHAP) authentication is enabled, the Storage Center challenges each iSCSI initiator
in the fault domain for a shared secret (password). When CHAP is enabled it applies to all servers and remote Storage Centers that
connect to the fault domain.
NOTE:
When CHAP is enabled for an iSCSI fault domain, all iSCSI initiators in the fault domain (servers and Storage
Centers) must be configured to use CHAP. All iSCSI initiators that are not configured to use CHAP are no longer able to
communicate with the Storage Center iSCSI ports in the fault domain.
Configure CHAP for Servers in an iSCSI Fault Domain
When Challenge Handshake Authentication Protocol (CHAP) authentication is enabled (for unidirectional CHAP only), the Storage Center
(target) challenges each iSCSI initiator for a shared secret (password). Servers (remote initiators) must provide the correct shared secret
to access Storage Center (target) volumes. To enable bidirectional CHAP authentication, unique shared secrets (passwords) must be
configured for the remote initiator and the target Storage Center.
About this task
NOTE:
Changing CHAP settings will cause existing iSCSI connections between SAN systems using the selected fault
domain to be lost. You will need to use the Configure iSCSI Connection wizard to reestablish the lost connections after
changing CHAP settings.
Steps
1. If you are connected to a Data Collector, select a Storage Center from the drop-down list in the left navigation pane of Unisphere
Central.
2. From the SYSTEM menu, click Ports.
The Ports view is displayed.
3. Click the Front End Ports tab.
4. Expand iSCSI and click the fault domain link.
The Fault Domain view is displayed.
5. On the Summary tab, click (More Actions) and select Configure CHAP.
The Configure CHAP dialog box opens.
Storage Center Maintenance
147