Administrator Guide

Using a RADIUS server to manage CHAP accounts is helpful if you are managing a large number of accounts. However,
computer access to targets depends on the availability of the RADIUS server.
NOTE: If you use CHAP for initiator authentication, you can also use target authentication for mutual authentication,
which provides additional security.
Display Local CHAP Accounts
To display local CHAP accounts:
1. Click Group → Group Conguration.
2. Click the iSCSI tab.
The Local CHAP Accounts panel lists all current CHAP accounts.
NOTE: Starting with rmware v9.1.x, the CHAP password is no longer displayed in clear text format.
Create a Local CHAP Account
CHAP accounts are a method of ensuring that only authorized users can access a PS Series group. You can create local CHAP
accounts or you can use a RADIUS server.
Before you create an account:
• You can decide whether to verify iSCSI initiator credentials against local CHAP accounts rst (before verifying external CHAP
accounts on a RADIUS server).
• You need the following information:
– CHAP user name
– Password (otherwise known as a CHAP secret). For optimal security, passwords must contain at least 12 characters
(preferably random). Individual iSCSI initiators have their own rules and restrictions for length and format. Consult your
initiator documentation for details.
To create a local CHAP account:
1. Click Group → Group Conguration.
2. Click the iSCSI tab.
3. (Optional) Select Enable local authentication and check local rst in the iSCSI Authentication panel.
4. In the Local CHAP Accounts panel, click Add to open the Add CHAP Account dialog box.
5. Type a CHAP user name and, optionally, a password.
• The user name can be up to 63 printable characters (any characters except space and colon).
NOTE: If the user name contains a pound-sign character, enclose the name in quotation marks (for example,
“chap#user”). Otherwise, the system will read the characters after the pound sign as a comment and not
include them in the user name.
• The password can be up to 255 printable characters (any characters except space and colon). If you do not enter a
password, the group automatically generates a password that is 16 characters long).
6. Select whether to enable the account. You must enable an account to use it for initiator authentication. You can modify an
account and enable or disable it later.
7. Click OK.
8. Click Save all changes.
NOTE: In the iSCSI initiator authentication area, you can select Enable RADIUS authentication for iSCSI initiators,
Consult locally dened CHAP accounts rst, or both. Make sure that at least one of these choices is selected. If
neither option is selected, the PS Series group will lock out all iSCSI initiator logins.
After creating the CHAP account, you can:
• Create an access control policy and use the CHAP user name in the policy
About Volume-Level Security
109