Cisco Systems MDS 9000 Access Control in iSCSI

Send documentation comments to mdsfeedback-doc@cisco.com.

20-16

Cisco MDS 9000 Family Fabric Manager Configuration Guide

OL-6965-03, Cisco MDS SAN-OS Release 2.x

Chapter 20 iSCSI Configuration

Configuring iSCSI

To configure the proxy initiator, follow these steps:

Step 1 From Fabric Manager, select Interfaces > FC Logical from the Physical Attributes pane. You see the

Interface tables in the Information pane.

From Device Manager, select Interfaces > Ethernet or iSCSI. You see the interfaces dialog box.

Step 2 Click the iSCSI tab. You see the iSCSI interface configuration table.

Step 3 In the Initiator Proxy Mode section, check the Enable check box.

Step 4 Click the Apply Changes icon in Fabric Manager or click Apply in Device Manager to save these

changes. Or click Undo Changes in Fabric Manager or click Cancel in Device Manager to discard

changes.

Access Control in iSCSI

You can control access to each statically mapped iSCSI target by specifying a list of IPS ports on which

it is advertised and specifying a list of iSCSI initiator node names allowed to access it. Fibre Channel

zoning-based access control and iSCSI-based access control are the two mechanisms by which access

control can be provided for iSCSI. Both methods can be used simultaneously.

Note This access control is in addition to the existing Fibre Channel access control. The iSCSI initiator has to

be in the same VSAN and zone as the physical Fibre Channel target.

Zoning is an access control mechanism within a VSAN. The zoning implementation on the switch

extends the VSAN and zoning concepts from the Fibre Channel domain to cover the iSCSI domain. This

extension includes both iSCSI and Fibre Channel features and provides a uniform, flexible access control

across a SAN. There are two Fibre Channel zoning access control mechanisms--static and dynamic.

•Static—Statically map the iSCSI host to Fibre Channel virtual N port(s). This creates permanent

nWWNs and pWWNs. Next, configure the assigned pWWN into zones, similar to adding a regular

Fibre Channel host pWWN to a zone.

•Dynamic—Add the iSCSI host initiator node name as a member of a zone. When the IP host Fibre

Channel virtual N port is created and the Fibre Channel address (nWWNs and pWWNs) is assigned,

Fibre Channel zoning is enforced.

To register an iSCSI host initiator as a member of a zone using Fabric Manager, follow these steps:

Step 1 Select Zone > Edit Local Full Zone Database.

Step 2 Select the VSAN and zone you want to add the iSCSI host initiator to.

Step 3 From the list of available devices including iSCSI host initiators, click the initiators that you want to add

to the zone and click the Add to Zone or Alias button.