HPlogo HP-UX iSCSI Software Initiator Support Guide: HP-UX 11i v1 & 11i v2 > Appendix A Login Key Configuration

Configuring iSCSI Login Keys
» 

Technical documentation

Complete book in PDF

 » Table of Contents

 » Index

spacerspacerspacer
spacer
spacer
  		 
 

In accordance with the iSCSI protocol, an iSCSI initiator must negotiate iSCSI login keys with each iSCSI target to:

  • enable an iSCSI connection

  • authenticate the parties

  • negotiate the session’s parameters

  • mark the connection as belonging to an iSCSI session

All of the iSCSI login keys configured by default by the iSCSI Software Initiator apply to all of the targets connected to the iSCSI host node. Currently, there are three iSCSI login keys that may be configured by the user on a per target basis.

The three user configurable login keys are:

  • HeaderDigest

  • DataDigest

  • AuthMethod      (Authentication Method)

The default value for HeaderDigest is:

  • None,CRC32C

The default value for DataDigest is:

  • None,CRC32C

The default value for AuthMethod is:

  • None

The user configurable login keys may be configured in one of the following ways:

  • For all targets on a global basis

  • For a particular Operational target.

  • For a particular Discovery or Operational target address.

NOTE: A login key configured for all targets, applies to all targets and all target addresses that are not already configured for that login key.

A login key configured for a particular Operational target will apply to all Operational target addresses that are not already configured for that login key.

Unique iSCSI Sessions are opened for each Operational target address. The login keys configured for a particular Operational target address correspond to the unique iSCSI Session opened on that Operational target address.

The usage to configure the login values for the user configurable login keys is as follows:

# iscsiutil [iscsi-device-file] -t <login-key> <login-val-1> <login-val-2> ...<login-val-N> [-T <target-name> [-I <ip-address>] [-P <tcp-port>] [-M <portal-grp-tag>]]

The order in which the login values are listed in this command defines the order in which the iSCSI initiator proposes them to the target. The login keys and values are not case-sensitive.

The configurable login keys currently available are:

  • HeaderDigest

    A header digest that can be negotiated during iSCSI login. The list of parameters that the HeaderDigest key can accept are:

    None

    CRC32C

  • DataDigest

    A data digest that can be negotiated during iSCSI login. The list of values that the DataDigest key can accept are:

    None

    CRC32C

  • AuthMethod

    An authentication method that can be negotiated during iSCSI login. The list of values that the AuthMethod key can accept are:

    None

    CHAP

The order of precedence of login key configuration is as follows:

  • (a) iSCSI Target Address level

  • (b) iSCSI Target level

  • (c) Global level

Configuration of login keys at the Discovery target level is not possible, because Discovery targets are not identified by iSCSI target names.

Configuration of login keys for Discovery target addresses does not involve defining the iSCSI target names. For Operational targets (addresses), the target names should be defined.

NOTE: One or two login key values may be specified for each of the login keys listed above, however, no more than two login key values can be specified for a login key.

Header and Data Digest Configuration Examples

Configure the HeaderDigest key with "None,CRC32C" as the value for all targets:

# iscsiutil -t headerdigest None CRC32C

Configure the DataDigest key with "CRC32C,None" as the value for a particular Discovery Target Address which is already configured:

# iscsiutil -t datadigest CRC32C None -I 192.1.1.58 -M 2

Configure the DataDigest key with "CRC32C,None" as the value for an Operational Target:

# iscsiutil -t datadigest CRC32C None -T iqn.2003-11.com. hp.stor:iSCSI.Storage

Configure the HeaderDigest key with "CRC32C" as the value for an Operational Target Address:

# iscsiutil -t headerdigest CRC32C -I 192.1.1.58 -M 2 -T iqn.2003-11.com.hp.stor:iSCSI.Storage

Configure both the HeaderDigest and the DataDigest keys with "CRC32C" as the value for an Operational Target Address:

# iscsiutil -t bothdigest CRC32C -I 192.1.1.58 -M 2 -T iqn. 2003-11.com.hp.stor:iSCSI.Storage

Authentication Method Configuration Examples

Configure the AuthMethod key with "CHAP,None" as the value for all Targets:

# iscsiutil -t authmethod CHAP None

Configure the AuthMethod key with "CHAP" as the value for a particular Discovery Target Address, which is already configured:

# iscsiutil -t authmethod CHAP -I 192.1.1.58 -M 2

Configure the AuthMethod key with "None,CHAP" as the value for an Operational Target:

# iscsiutil -t authmethod None CHAP -T iqn.2003-11.com.hp. stor:iSCSI.Storage

Configure the AuthMethod key with "CHAP" as the Authentication Method for an Operational Target Address:

# iscsiutil -t authmethod CHAP -I 192.1.1.58 -M 2 -T iqn.2003-11.com.hp.stor:iSCSI.Storage

Displaying Login Keys

NOTE: The values displayed for the login keys by the following commands are the values proposed by the iSCSI Software Initiator to the iSCSI target, in order of preference. The target MUST respond with the first value that it supports. If the login keys are configured on a per target basis, the login keys displayed by "iscsiutil -l" are overridden by the login keys displayed by the other display commands.

To verify the login key configuration, execute any of the following login key display commands.

To display login keys common to all Targets:

# iscsiutil -l

To display login keys of all Discovery Targets:

# iscsiutil -pD

To display login keys of all Operational Targets:

# iscsiutil -pO

To display login keys of all Sessions:

# iscsiutil -pS

To display login keys of a particular Operational Target identified by its Target Name:

# iscsiutil -p -T <target-name>

Among the various login keys displayed by the commands described above, the parameters of interest are:

  • Authentication Method

  • Header Digest

  • Data Digest

Displaying Negotiated Login Key Values

After executing the "ioscan" command, which initiates a login negotiation, the following command can be executed to display the negotiated login keys for all sessions (provided login negotiation is successful):

# iscsiutil -pVS



Appendix A Login Key Configuration
  		 


Appendix B Transport Statistics