HP StorageWorks Fabric OS 6.1.1 administrator guide (5697-0235, December 2009)

Fabric OS 6.1.x administrator guide 273
iSCSI initiator-to-VT authentication configuration
Fabric OS 5.2.0 or later supports both one-way and mutual CHAP authentication for iSCSI initiator-to-iSCSI
VT target sessions. The authentication method (CHAP or none) is set on a per-iSCSI VT basis.
Setting the user name and shared secret
Authentication depends on a user name and shared secret. When an iSCSI VT authenticates an iSCSI
initiator, it checks the user name and shared secret against all configured CHAP values. To enforce
authentication of iSCSI initiators, set each iSCSI VT authentication to CHAP. The iSCSI initiator can use any
user name and shared secret for any iSCSI VT configured on the fabric.
1. Connect and log in to the switch.
2. Issue the iscsiCfg --create auth command with the -u and -s options to configure a user
name and shared secret:
switch:admin> iscsicfg --create auth -u username0001 -s usersecret0001
The operation completed successfully.
3. Issue the iscsiCfg --modify tgt command with the -t and -a options to set CHAP as the
authentication method:
switch:admin> iscsicfg --modify tgt -t iqn.2006-10.com.brocade:example-disk001 -a
CHAP
The operation completed successfully.
4. To verify that CHAP is enabled for the iSCSI VT, issue the iscsiCfg --show tgt command with
the -t and -v options:
switch:admin> iscsicfg --show tgt -t iqn.2006-10.com.brocade:example-disk001 -v
Number of records found: 1
Name: iqn.2006-10.com.brocade:example-disk001
State/Status: Online/Defined
Auth. Method: CHAP
Binding user names to an iSCSI VT
For additional security, you can bind specific user names to an iSCSI VT. When you do this, the specific
user name and CHAP secret combination is required for authentication during the iSCSI login phase. The
maximum number of user names that can be bound per iSCSI VT is 16.
1. Connect and log in to the switch.
2. Issue the isciCfg --addusername tgt command with the -t and -u options to bind a user
name:
switch:admin> iscsicfg --addusername tgt -t iqn.2002-10.com.brocade:tgt -u
”isisctgt1;hello123”
This operation completed successfully
3. Issue the iscsiCfg --commit all command.
4. Issue the iscsiCfg --show tgt command with the -t and -v options to verify that a user name
has been bound to the iSCSI VT:
switch:admin> iscsicfg --show tgt -t iqn.2002-10.com.brocade:tgt -v
Number of records found: 1
Name: iqn.2002-10.com.brocade:tgt1
CHAP Users CHAP Status
1. iscsitgt1 Online/Committed
2. hello123 Invalid