SAN Boot Implementation and Best Practices Guide ... - IBM Redbooks

Draft Document for Review June 27, 2012 9:05 am SG247958-iSCSI_DS5000-CL.fm
Note: All iSCSI HBAs and software initiators configured on the same machine must share
the same IQN name.
Figure 6-2 shows the example of a qlogic iSCSI HBA (initiator).
Figure 6-2 iSCSI Initiator
Security
Unlike FC SANs or direct SAS connection, Ethernet networks can be more open, so in order
to provide additional security, you can configure the following additional authentication
protocols on the DS5000 storage subsystems:
► The Internet Storage Name Service (iSNS) protocol allows for automated discovery,
management, and configuration of iSCSI devices on a TCP/IP network. iSNS servers offer
additional security services through explicitly defined initiator-to-target mappings and
simplified asset locators, similar to that provided by DNS and WINS for IP address lookup
facilities
► Currently, IBM DS Storage Manager 10 has only one iSCSI authentication method called
Challenge Handshake Authentication Protocol (CHAP). CHAP is an authentication
scheme, used by several types of servers, to validate the identity of remote clients. This
authentication occurs when you establish the initial link. The authentication is based on a
shared secret and is bi-directional.
CHAP: An initiator-target authentication protocol that uses a challenge to verify that
systems have access to each other, either one way or both ways. CHAP happens
constantly without user interaction.
Chapter 6. iSCSI SAN Boot Implementation with IBM system Storage DS5000 395