Administrator Guide

Table 22. Access Requirements for iSCSI Targets
Security Condition Description
Network access To discover targets, the initiator must have network access to the group IP address.
Initiator access controls (Optional) If the initiator enabled target authentication (sometimes called mutual authentication),
the target authentication credentials in the group must match the credentials that were
congured in the initiator. These credentials apply to all group targets.
Target access controls The initiator must meet all the conditions in one access control policy for the target. (See About
Multihost Access to Targets.)
Enable the iSCSI Discovery Filter
To enable the iSCSI discovery lter:
1. Click Group → Group Conguration.
2. Click the iSCSI tab.
3. In the iSCSI Discovery panel, select Prevent unauthorized hosts from discovering targets.
Disable the iSCSI Discovery Filter
To disable the iSCSI discovery lter:
1. Click Group → Group Conguration.
2. Click the iSCSI tab.
3. In the iSCSI Discovery panel, clear Prevent unauthorized hosts from discovering targets.
About Multihost Access to Targets
In a shared storage environment, you must control computer access to iSCSI targets (volumes and snapshots), because multiple
computers writing to a target in an uncoordinated manner will result in volume corruption.
When an initiator tries to log in to a target, the group uses access control policies to determine if access should be authorized.
However, access control policies do not prevent multiple initiators, either on the same computer or dierent computers, from
accessing the same target. By default, the group disables multihost (shared) access to a target. Therefore, only one iSCSI qualied
name (IQN) can connect to a target at one time.
If you disable multihost access to a volume, when an initiator tries to log in to the volume:
• If an iSCSI initiator is not connected to the volume, the group uses access control policies to determine whether to authorize
access.
• If an initiator is connected to the volume, the group compares the IQN of the current connection to the IQN of the incoming
connection. If the IQNs are not the same, access is denied. If the IQNs are the same, the group uses access control policies to
determine whether to authorize access.
However, some environments might need multihost access to a target. You can enable multihost access to a target if you meet one
of the following conditions:
• Your cluster environment gives the initiators on each cluster computer a dierent IQN, and the environment can manage multiple
connections to a target. For example, the environment uses a Distributed Lock Manager or SCSI reservations.
• Your multipathing solution does not use the same IQN on all initiators, and you cannot modify the names to be the same.
• You use an environment, such as a virtual server, that can manage multiple connections to the same iSCSI target (for example,
through SCSI reservations).
• Initiators on a single computer do not use the same IQN.
In all cases, use access control policies as the primary method of protecting iSCSI targets in a group.
122
About Volume-Level Security