6.0.3

Protecting an iSCSI SAN
When you plan your iSCSI conguration, take measures to improve the overall security of the iSCSI SAN.
Your iSCSI conguration is only as secure as your IP network, so by enforcing good security standards when
you set up your network, you help safeguard your iSCSI storage.
The following are some specic suggestions for enforcing good security standards.
Protect Transmitted Data
A primary security risk in iSCSI SANs is that an aacker might sni transmied storage data.
Take additional measures to prevent aackers from easily seeing iSCSI data. Neither the hardware iSCSI
adapter nor ESXi iSCSI initiator encrypts the data that they transmit to and from the targets, making the
data more vulnerable to sning aacks.
Allowing your virtual machines to share standard switches and VLANs with your iSCSI conguration
potentially exposes iSCSI trac to misuse by a virtual machine aacker. To help ensure that intruders
cannot listen to iSCSI transmissions, make sure that none of your virtual machines can see the iSCSI storage
network.
If you use a hardware iSCSI adapter, you can accomplish this by making sure that the iSCSI adapter and
ESXi physical network adapter are not inadvertently connected outside the host by virtue of sharing a
switch or some other means. If you congure iSCSI directly through the ESXi host, you can accomplish this
by conguring iSCSI storage through a dierent standard switch than the one used by your virtual
machines.
In addition to protecting the iSCSI SAN by giving it a dedicated standard switch, you can congure your
iSCSI SAN on its own VLAN to improve performance and security. Placing your iSCSI conguration on a
separate VLAN ensures that no devices other than the iSCSI adapter have visibility into transmissions
within the iSCSI SAN. Also, network congestion from other sources cannot interfere with iSCSI trac.
Secure iSCSI Ports
When you run iSCSI devices, ESXi does not open any ports that listen for network connections. This
measure reduces the chances that an intruder can break into ESXi through spare ports and gain control over
the host. Therefore, running iSCSI does not present any additional security risks at the ESXi end of the
connection.
Any iSCSI target device that you run must have one or more open TCP ports to listen for iSCSI connections.
If any security vulnerabilities exist in the iSCSI device software, your data can be at risk through no fault of
ESXi. To lower this risk, install all security patches that your storage equipment manufacturer provides and
limit the devices connected to the iSCSI network.
Masking and Zoning SAN Resources
You can use zoning and LUN masking to segregate SAN activity and restrict access to storage devices.
You can protect access to storage in your vSphere environment by using zoning and LUN masking with
your SAN resources. For example, you might manage zones dened for testing independently within the
SAN so they do not interfere with activity in the production zones. Similarly, you might set up dierent
zones for dierent departments.
When you set up zones, take into account any host groups that are set up on the SAN device.
Zoning and masking capabilities for each SAN switch and disk array and the tools for managing LUN
masking are vendor specic.
See your SAN vendor's documentation and the vSphere Storage documentation.
Chapter 9 Best Practices Involving Multiple vSphere Components
VMware, Inc. 251