How iSCSI authentication works

Vserver : Configuration > Protocols > iSCSI : Understanding iSCSI : How iSCSI authentication works

During the initial stage of an iSCSI session, the initiator sends a login request to the storage system to begin an iSCSI session. The storage system permits or denies the login request according to one of the available authentication methods.

The authentication methods are as follows:

•	Challenge Handshake Authentication Protocol (CHAP)—The initiator logs in using a CHAP user name and password.

You can specify a CHAP password or generate a hexadecimal secret password. There are two types of CHAP user names and passwords:

•	Inbound—The storage system authenticates the initiator.

Inbound settings are required if you are using CHAP authentication.

•	Outbound—This is an optional setting to enable the initiator to authenticate the storage system.

You can use outbound settings only if you defined an inbound user name and password on the storage system.

•	deny—The initiator is denied access to the storage system.

•	none—The storage system does not require authentication for the initiator.

You can define a list of initiators and their authentication methods. You can also define a default authentication method that applies to initiators that are not on this list.

The default iSCSI authentication method is none, which means any initiator not in the authentication list can log in to the storage system without authentication. However, you can change the default method to deny or CHAP.