SANRAD V-Switch manual Authentication, Volume Exposure and Security 113

read-only, depending on the positioning of the identities. If Identity A is assigned position 1 and Identity B is assigned position 2, Identity B is scanned first by the V-Switch. A match is made and the scan is stopped. No further identities will be scanned. Therefore, iSCSI initiator WWUI8 will be granted read-write access.

If the positions are reversed and Identity B is assigned position 1 and Identity A is assigned position 2, iSCSI initiator WWUI8 will be granted read-only access.

Authentication

The V-Switch supports the authentication methods CHAP and SRP for the iSCSI initiator. The credentials for CHAP and SRP are the combination of user name + password. An authentication method is assigned per identity and not per iSCSI initiator. An identity can be assigned one or both authentication methods. If no authentication method is assigned, all listed iSCSI initiators in an identity will have un-authenticated login rights.

When an iSCSI initiator logs in to a target, its WWUI is checked against the identity initiator list. After the iSCSI initiator passes the identity stage, if credentials are configured, the iSCSI initiator must authenticate itself. The credentials list is checked for the iSCSI initiator’s user name + password. The list can contain a separate user name + password for each initiator; a few user name + password pairs common to a few initiators or a single user name + password for all initiators in the identity.

Initiators

wwui3

wwui4

wwui6

wwui7

wwui8

wwui9

Ident B

		Credentials
	CHAP			SRP
Sarah C6H12O6			Dinos RockOn		10155
Dinos RockOn			Albert energy

Figure 60. Identity with iSCSI Initiators and Credentials

In Figure 60, there are six iSCSI initiators in Identity B but only four user name + password credentials. Certain initiators have the same user name + password configured on them.

Default Identity

When you create a target, it is automatically coupled to a default identity. The default identity gives un-authenticated read-write access to all iSCSI

Chapter 7: Volume Exposure and Security 113