Administrator Guide

Dierent access methods are available depending on the needs of your environment:
• An access policy consists of a set of extended access points. Each extended access point enables users to provide a set of
access attributes describing the endpoints, such as an IQN initiator name, CHAP name, and IP addresses. After an access policy
is associated with a volume, all the endpoints described by the extended access points will have access to the volume.
• An access policy group is a set of access policies that can be associated to a volume. When an access policy group is associated
with a volume, all endpoints described within those access policies have access to the volume.
• A basic access point provides the traditional direct method for connecting a single endpoint to a single volume. Basic access
points cannot be reused, transferred, or shared with other volumes. They are associated directly with the volume to which they
provide access, and if that volume is deleted, the basic access point is also deleted.
All of these access methods can be used with each other to fulll the particular needs of your computing environment.
The main distinction between access policies and basic access points is that access policies exist independent of the volumes to
which they provide access. This exibility oers the following signicant advantages over traditional basic access points:
• Access policy reuse — A single access policy can now be associated with multiple volumes and all the access attributes are
specied only once, requiring less manual conguration and less possibility of data entry errors.
• Single point of change — Changes to access attributes, IP address, initiator IQN name, or CHAP user name are all specied at
one place and not repeated across volumes. You can now change these attributes at one place, and the changes are instantly
propagated to all volumes using those access policies.
About Access Policies
In earlier versions of the PS Series rmware, security protection was accomplished by individually conguring an access control
record for each volume to which you wanted to secure access. Each volume supported up to 16 dierent access control records,
which together constituted an access control list (ACL). However, this approach did not work well when large numbers of volumes
were present. To address that issue, Group Manager incorporates access policies and access policy groups that can be applied to
one or more volumes.
Each access policy lets you specify one or more of the following authentication methods:
• CHAP user name (Challenge Handshake Authentication Protocol)
• IP address
• iSCSI initiator name
When you create a volume, you can assign it to an existing access policy, which determines which hosts will have access to that
volume. In addition, you can allow or disallow volume access from multiple initiators, depending on your conguration needs.
An access policy can apply to the volume, its snapshots, or both. For example, you can authorize computer access to a volume and
its snapshots or only to the volume.
Access Policies: Use Cases
The following use cases show dierent ways of working with access policies.
Study 1: Grant volume access to a single host using its iSCSI Initiator Name or IP address
Scenario: A group administrator wants to grant volume access to a host that is using a software iSCSI initiator. The admin wants to
dene access using either the iSCSI initiator name or IP addresses.
Solution:
1. Click Group → Group Conguration.
2. Click the Access Policies tab. In the Access Policies panel, create an access policy for the host.
3. Add an access point to the access policy that species either the initiator name or a list of IP addresses for each of the
interfaces on the host.
4. With the access policy selected, go to the Targets panel and click Add.
5. Select the name of the volume to which you want to grant access and click OK.
About Volume-Level Security
111