6.5

You can also congure your iSCSI SAN on its own VLAN to improve performance and security. Placing
your iSCSI conguration on a separate VLAN ensures that no devices other than the iSCSI adapter can see
transmissions within the iSCSI SAN. With a dedicated VLAN, network congestion from other sources
cannot interfere with iSCSI trac.
Securing iSCSI Ports
You can improve the security of iSCSI ports by installing security patches and limiting the devices connected
to the iSCSI network.
When you run iSCSI devices, the ESXi host does not open ports that listen for network connections. This
measure reduces the chances that an intruder can break into the ESXi host through spare ports and gain
control over the host. Therefore, running iSCSI does not present an additional security risks at the ESXi host
end of the connection.
An iSCSI target device must have one or more open TCP ports to listen for iSCSI connections. If security
vulnerabilities exist in the iSCSI device software, your data can be at risk through no fault of the ESXi
system. To lower this risk, install all security patches that your storage equipment manufacturer provides
and limit the devices connected to the iSCSI network.
Setting iSCSI CHAP
iSCSI storage systems authenticate an initiator using a name and key pair. ESXi systems support Challenge
Handshake Authentication Protocol (CHAP).
Using CHAP for your SAN implementation is a best practice. The ESXi host and the iSCSI storage system
must have CHAP enabled and must have common credentials. During iSCSI login, the iSCSI storage system
exchanges its credentials with the ESXi system and checks them.
You can set up iSCSI authentication by using the vSphere Web Client, as discussed in the vSphere Storage
documentation or by using the esxcli command, discussed in “Enabling iSCSI Authentication,” on
page 94. To use CHAP authentication, you must enable CHAP on both the initiator side and the storage
system side. After authentication is enabled, it applies for targets to which no connection has been
established, but does not apply to targets to which a connection is established. After the discovery address is
set, the new volumes to which you add a connection are exposed and can be used.
For software iSCSI and dependent hardware iSCSI, ESXi hosts support per-discovery and per-target CHAP
credentials. For independent hardware iSCSI, ESXi hosts support only one set of CHAP credentials per
initiator. You cannot assign dierent CHAP credentials for dierent targets.
When you congure independent hardware iSCSI initiators, ensure that the CHAP conguration matches
your iSCSI storage. If CHAP is enabled on the storage array, it must be enabled on the initiator. If CHAP is
enabled, you must set up the CHAP authentication credentials on the ESXi host to match the credentials on
the iSCSI storage.
Supported CHAP Levels
To set CHAP levels with esxcli iscsi adapter setauth or vicfg-iscsi, specify one of the values in
Table 5-1 for <level>. Only two levels are supported for independent hardware iSCSI.
Mutual CHAP is supported for software iSCSI and for dependent hardware iSCSI, but not for independent
hardware iSCSI.
I Ensure that CHAP is set to chapRequired before you set mutual CHAP, and use compatible
levels for CHAP and mutual CHAP. Use dierent passwords for CHAP and mutual CHAP to avoid security
risks.
vSphere Command-Line Interface Concepts and Examples
72 VMware, Inc.