6.0

Table Of Contents
vSphere Command-Line Interface Concepts and Examples
62 VMware, Inc.
Securing iSCSI Ports
WhenyouruniSCSIdevices,theESXihostdoesnotopenportsthatlistenfornetworkconnections.This
measurereducesthechancesthatanintrudercanbreakintotheESXihostthroughspareportsandgaincontrol
overthehost.Therefore,runningiSCSIdoesnotpresentanadditionalsecurityrisksat
theESXihostendof
theconnection.
AniSCSItargetdevicemusthaveoneormoreopenTCPportstolistenforiSCSIconnections.Ifsecurity
vulnerabilitiesexistintheiSCSIdevicesoftware,yourdatacanbeatriskthroughnofaultoftheESXisystem.
Tolowerthisrisk,install
allsecuritypatchesthatyourstorageequipmentmanufacturerprovidesandlimitthe
devicesconnectedtotheiSCSInetwork.
Setting iSCSI CHAP
iSCSIstoragesystemsauthenticateaninitiatorusinganameandkeypair.ESXisystemssupportChallenge
HandshakeAuthenticationProtocol(CHAP),whichVMwarerecommendsforyourSANimplementation.
TheESXihostandtheiSCSIstoragesystemmusthaveCHAPenabledandmusthavecommoncredentials.
DuringiSCSIlogin,theiSCSIstoragesystem
exchangesitscredentialswiththeESXisystemandchecksthem.
YoucansetupiSCSIauthenticationbyusingthevSphereWebClient,asdiscussedinthevSphereStorage
documentationorbyusingtheesxclicommand,discussedin“EnablingiSCSIAuthentication”onpage 82.
TouseCHAPauthentication,youmustenableCHAPon
boththeinitiatorsideandthestoragesystemside.
Afterauthenticationisenabled,itappliesfortargetstowhichnoconnectionhasbeenestablished,butdoesnot
applytotargetstowhichaconnectionisestablished.Afterthediscoveryaddressisset,thenewvolumesto
whichyouadda
connectionareexposedandcanbeused.
ForsoftwareiSCSIanddependenthardwareiSCSI,ESXihostssupportperdiscoveryandpertargetCHAP
credentials.ForindependenthardwareiSCSI,ESXihostssupportonlyonesetofCHAPcredentialsper
initiator.YoucannotassigndifferentCHAPcredentialsfordifferenttargets.
Whenyouconfigureindependent
hardwareiSCSIinitiators,ensurethattheCHAPconfigurationmatches
youriSCSIstorage.IfCHAPisenabledonthestoragearray,itmustbeenabledontheinitiator.IfCHAPis
enabled,youmustsetuptheCHAPauthenticationcredentialsontheESXihosttomatchthecredentialson
theiSCSI
storage.
Supported CHAP Levels
TosetCHAPlevelswithesxcli iscsi adapter setauthorvicfg-iscsi,specifyoneofthevaluesin
Table 51for<level>.OnlytwolevelsaresupportedforindependenthardwareiSCSI.
MutualCHAPissupportedforsoftwareiSCSIandfordependenthardwareiSCSI,butnotforindependent
hardwareiSCSI.
I
MPORTANTEnsurethatCHAPissettochapRequiredbeforeyousetmutualCHAP,andusecompatible
levelsforCHAPandmutualCHAP.UsedifferentpasswordsforCHAPandmutualCHAPtoavoidsecurity
risks.
Table 5-1. Supported Levels for CHAP
Level Description Supported
chapProhibited HostdoesnotuseCHAPauthentication.Ifauthenticationis
enabled,specifychapProhibitedtodisableit.
SoftwareiSCSI
DependenthardwareiSCSI
IndependenthardwareiSCSI
chapDiscouraged HostusesanonCHAPconnection,butallowsaCHAP
connectionasfallback.
SoftwareiSCSI
DependenthardwareiSCSI
chapPreferred HostusesCHAPiftheCHAPconnectionsucceeds,but
uses
nonCHAPconnectionsasfallback.
SoftwareiSCSI
DependenthardwareiSCSI
IndependenthardwareiSCSI
chapRequired HostrequiressuccessfulCHAPauthentication.Theconnection
failsifCHAPnegotiationfails.
SoftwareiSCSI
DependenthardwareiSCSI