NetApp
Configuration : Protocols > iSCSI : Understanding iSCSI : How iSCSI authentication works
How iSCSI authentication works
During the initial stage of an iSCSI session, the initiator sends a login request to the storage system to begin an iSCSI session. The storage system permits or denies the login request according to one of the available authentication methods.
The authentication methods are as follows:
•
Challenge Handshake Authentication Protocol (CHAP)—The initiator logs in using a CHAP user name and password.
You can specify a CHAP password or generate a random password. There are two types of CHAP user names and passwords:
•
Inbound—The storage system authenticates the initiator.
Inbound settings are required if you are using CHAP authentication.
•
Inbound—The storage system authenticates the initiator.
Inbound settings are required if you are using CHAP authentication without RADIUS.
•
Outbound—This is an optional setting to enable the initiator to authenticate the storage system.
You can use outbound settings only if you defined an inbound user name and password on the storage system.
RADIUS can be used in conjunction with CHAP for initiator authentication. With this method, the initiator logs in using a CHAP user name and password, but authentication is managed from a centralized RADIUS server rather than locally on the storage system.
•
deny—The initiator is denied access to the storage system.
•
none—The storage system does not require authentication for the initiator.
You can define a list of initiators and their authentication methods. You can also define a default authentication method that applies to initiators that are not on this list.
The default iSCSI authentication method is none, which means any initiator not in the authentication list can log in to the storage system without authentication. However, you can change the default method to deny or CHAP.
If you use iSCSI with vFiler units, the CHAP authentication settings are configured separately for each vFiler unit. Each vFiler unit has its own default authentication mode and list of initiators and passwords.
To configure CHAP settings for vFiler units, you must use the command line.
For information about managing vFiler units, see the sections on iSCSI service on vFiler units in the Data ONTAP 7-ModeMultiStore Management Guide.
Related Link:  
Data ONTAP documentation on NetApp support site -- support.netapp.com

Was this topic helpful? Send comments to NetApp.