SANRAD V-Switch manual Changing the Default Identity, Acl set, Acc, Pos

If you are working in

aV-Switch cluster, the default access rights must be

disabled on both V- Switches.

In the event of a failover, if the default access rights are not modified on both V- Switches, all volumes attached to the target will be read-write accessible to all iSCSI initiators.

Changing the Default Identity

When a target is created, a default access control identity is automatically assigned to its position 0. The default identity allows all hosts read-write access to the target and its underlying volume(s).

If you want to specify other access rights, you must change the general read-write access. Use the CLI command acl set to modify a target’s access rights and identity position.

If you add or modify identities on a target after its volumes have been exposed, the access rights will take effect only at the next login for each iSCSI initiator. Therefore, it is recommended to modify the default access rights for a target first before creating new identities to insure that it will not inadvertently be exposed to all iSCSI initiators in the beginning.

acl set

You need to define four parameters to modify an identity:

SWITCH	PARAMETER	DEFINITION	STATUS	EXAMPLE
-ta	TARGET	ALIAS OF TARGET	MANDATORY	finance
		TO CONNECT WITH
		ACL IDNETITY
-id	IDENTITY	ACL IDENTITY	MANDATORY	DEF_ALL
-acc	ACCESS	ACCESS RIGHTS TO	OPTIONAL	na
		TARGET:
		DEFAULT=RW
		RW =READ-WRITE
		RO = READ-ONLY
		NA =NOT
		ACCESSIBLE
-pos	POSITION	IDENTITY RANK IN	OPTIONAL	0
		ACCESS RIGHT
		EVALUATION SCAN
		DEFAULT=NEXT
		HIGHEST AVAILABLE
		NUMBER

Example

The default access rights for the target finance are changed to not accessible meaning a non-specific host is not allowed access to the target finance.

acl set –ta finance –id def_all –acc na

Chapter 7: Volume Exposure and Security 119