You can set up all targets to receive the same CHAP name and secret from the iSCSI initiator at the initiator level. By default, all discovery addresses or static targets inherit the CHAP parameters that you set up at the initiator level.

The CHAP name must be fewer than 511 alphanumeric characters and the CHAP secret must be fewer than 255 alphanumeric characters. Some adapters, for example the QLogic adapter, might have lower limits, 255 for the CHAP name and 100 for the CHAP secret.

Prerequisites

  • Before you set up CHAP parameters for software or dependent hardware iSCSI, determine whether to configure one-way, also known as normal, or mutual CHAP. Independent hardware iSCSI adapters do not support mutual CHAP.
    • In one-way CHAP, the target authenticates the initiator.
    • In mutual CHAP, both the target and the initiator authenticate each other. Use different secrets for CHAP and mutual CHAP.

    When you configure CHAP parameters, verify that they match the parameters on the storage side.

  • Required privileges: Host.Configuration.Storage Partition Configuration

Procedure

  1. Click Storage in the VMware Host Client inventory, click Adapters, and click Configure iSCSI.
  2. To configure one-way CHAP, expand CHAP authentication to display all parameters.
    1. Select the CHAP security level.
    2. Enter the CHAP name.

      Make sure that the name you enter matches the name configured on the storage side.

    3. Enter a one-way CHAP secret to use for authentication. Use the same secret that you enter on the storage side.
  3. To configure mutual CHAP, select Use CHAP as an option for one-way CHAP. Expand Mutual CHAP authentication to display all parameters.
    1. Select Use CHAP.
    2. Enter the mutual CHAP name.
    3. Enter the mutual CHAP secret.
      Use different secrets for the one-way CHAP and the mutual CHAP.
  4. Click Save configuration.

Results

If you change the authentication settings for an iSCSI adapter, you only use the updated credentials for new iSCSI sessions. Existing sessions persist until either the connection is lost due to some outside factor, such as force re-authentication, or you remove and add the adapter iSCSI targets.