User manual

iSCSi CHAp
Challenge-Handshake Authentication Protocol (CHAP) is a security
protocol used for authentication of iSCSI initiators, targets, or both. If
CHAP is used, be sure to enable uni-directional or bi-directional CHAP
authentication in the iSCSI Node Settings menu.
Setting up CHAP for iSCSI clients
1. From the Storage tab, click iSCSI Target > CHAP
2. Complete the required settings in the Add CHAP menu, then click
the Submit button. The new user will appear listed below in a table
of CHAP users.
To change the password for an existing CHAP user or to delete it, move
your pointer over the Setting button to display the CHAP Settings
menu.
CHAP
Settings Description
User Name
The user name used for CHAP authentication.
Password
This is the secret character string that is shared by the
target and initiator but is not passed over the network. It
functions as a user password.
Type
Choose to apply the user name and password to the peer
seeking authentication or to the DataGuard Appliance
(local) attempting to authenticate its identity.
SeCurity ConSiderAtionS For iSCSi
Any iSCSI SAN should be used with security measures to protect data
in addition to segregating the iSCSI SANs from LAN traffic. To use any
or all of the security measures supported by the DataGuard Appliance,
make sure that the initiators also support use of CHAP (authentication),
IPsec (encryption), Access Control and LUN mapping and LUN masking.
network ConSiderAtionS For iSCSi
The switches and network infrastructure connected to the DataGuard
Appliance should be configured for best SAN performance. Use Gigabit
Ethernet or faster switches. The configuration recommendations listed
below apply to switch, connected ports and network configuration for
the SAN.
• Disable unicast storm control (normally this is disabled by default
on most switches)
• Enable Flow Control
• Enable Jumbo Frame support
• Turn off spanning tree
• Segregate SAN and LAN traffic
• Make sure the NICs used are Server class and preferably designed
for storage
✓
42