iSCSI Authentication Setup Guidelines and Scenarios
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m .
No Authentication
Set the iSCSI authentication method to none to configure a network with no authentication.
switch(config)# iscsi authentication none
CHAP with Local Password Database
To configure authentication using the CHAP option with the local password database, follow these steps:
Set the AAA authentication to use the local password database for iSCSI protocol.
Step 1
switch(config)# aaa authentication iscsi default local
Set the iSCSI authentication method to require CHAP for all iSCSI clients.
Step 2
switch(config)# iscsi authentication chap
Configure the user names and passwords for iSCSI users.
Step 3
switch(config)# username iscsi-user password abcd iscsi
Note
Verify the global iSCSI authentication setup.
Step 4
switch# show iscsi global
iSCSI Global information Authentication: CHAP <----Verify
Import FC Target: Disabled
...
CHAP with External RADIUS Server
To configure authentication using the CHAP option with an external RADIUS server, follow these steps:
Configure the password for the Cisco MDS switch as RADIUS client to the RADIUS server.
Step 1
switch(config)# radius-server key mds-1
Configure the RADIUS server IP address.
Step 2
switch(config)# radius-server host 10.1.1.10
Configure a server group.
Step 3
switch(config)# aaa group server radius iscsi-radius-group
switch(config-radius)# server 10.1.1.1
Set up the authentication verification for the iSCSI protocol to go to the RADIUS server.
Step 4
switch(config)# aaa authentication iscsi default group iscsi-radius-group
Set up the iSCSI authentication method to require CHAP for all iSCSI clients.
Step 5
Cisco MDS 9000 Family Configuration Guide
35-46
If you do not specify the iscsi option, the user name is assumed to be a Cisco MDS switch user
instead of an iSCSI user.
Chapter 35
Configuring iSCSI
OL-6973-03, Cisco MDS SAN-OS Release 2.x