6.7

Access Control
Access control is a policy set up on the iSCSI storage system. Most implementations support one or more
of three types of access control:
n
By initiator name
n
By IP address
n
By the CHAP protocol
Only initiators that meet all rules can access the iSCSI volume.
Using only CHAP for access control can slow down rescans because the ESXi host can discover all
targets, but then fails at the authentication step. iSCSI rescans work faster if the host discovers only the
targets it can authenticate.
Error Correction
To protect the integrity of iSCSI headers and data, the iSCSI protocol defines error correction methods
known as header digests and data digests.
Both parameters are disabled by default, but you can enable them. These digests pertain to, respectively,
the header and SCSI data being transferred between iSCSI initiators and targets, in both directions.
Header and data digests check the noncryptographic data integrity beyond the integrity checks that other
networking layers provide, such as TCP and Ethernet. They check the entire communication path,
including all elements that can change the network-level traffic, such as routers, switches, and proxies.
The existence and type of the digests are negotiated when an iSCSI connection is established. When the
initiator and target agree on a digest configuration, this digest must be used for all traffic between them.
Enabling header and data digests does require additional processing for both the initiator and the target
and can affect throughput and CPU use performance.
Note Systems that use the Intel Nehalem processors offload the iSCSI digest calculations, as a result,
reducing the impact on performance.
For information on enabling header and data digests, see Configuring Advanced Parameters for iSCSI.
How Virtual Machines Access Data on an iSCSI SAN
ESXi stores a virtual machine's disk files within a VMFS datastore that resides on a SAN storage device.
When virtual machine guest operating systems send SCSI commands to their virtual disks, the SCSI
virtualization layer translates these commands to VMFS file operations.
When a virtual machine interacts with its virtual disk stored on a SAN, the following process takes place:
1 When the guest operating system in a virtual machine reads or writes to SCSI disk, it sends SCSI
commands to the virtual disk.
vSphere Storage
VMware, Inc. 73