Users Guide

Broadcom DRVLin-UG128-100
120
Emulex Drivers for Linux User Guide
Appendix E: FC-SP-2 Authentication (DH-CHAP) Support
Fibre Channel Security Protocol-2 (FC-SP-2) DH-CHAP is a secret-based authentication and key management protocol that
uses the CHAP algorithm augmented with an optional Diffie-Hellmann algorithm with hash priority (MD5 and SHA1).
NOTE: The following information applies to DH-CHAP authentication:
 DH-CHAP is available only for physical ports, not for virtual ports.
 The authentication driver parameters are available only on local hosts and not for remote hosts.
 Boot from SAN is not supported when DH-CHAP authentication is enabled.
 DH-CHAP is not supported on FA-PWWN ports.
 DH-CHAP is not supported if Dynamic D_PORT is enabled.
You can configure FC-SP-2 DH-CHAP authentication between an adapter and a switch.
FC-SP-2 DH-CHAP authentication is disabled by default. To enable DH-CHAP on Linux systems, the lpfc_enable_auth
parameter must be passed to the driver by typing the following command:
insmod lpfc.ko lpfc_enable_auth=1
For a permanent configuration on Linux systems that persists across system reboots, create the /etc/modprobe.d/
lpfc.conf file, and place the following line into it:
options lpfc lpfc_enable_auth=1
After DH-CHAP has been activated and configured, you can manually initiate authentication per adapter, and you can get,
set, update, or delete a password using the Emulex HBA Manager application. For more information on manually initiating
authentication, refer to the Emulex HBA Manager Application User Guide.