Dell PowerVault ME5 Series Storage System CLI Reference Guide

PDF

create chap-record


Description	Creates a CHAP record to authenticate iSCSI login requests. When CHAP is enabled, the record enables authentication between the originator (initiator) and recipient (target) of a login request. This command is permitted whether or not CHAP is enabled. NOTE:For information about setting up CHAP for use in a peer connection, see the topic about creating a peer connection in the Administrator's Guide. The CHAP record can specify one name-secret pair to authenticate the originator only (one-way CHAP) or two pairs to authenticate both the originator and the recipient (mutual CHAP). For a login request from an initiator to a storage system, the initiator is the originator and the storage system is the recipient. Because CHAP works during login, to make CHAP changes take effect you must reset any active iSCSI host links. In a peer connection, a storage system can act as the originator or recipient of a login request. As the originator, with a valid CHAP record it can authenticate CHAP even if CHAP is disabled. This is possible because the system will supply the CHAP secret requested by its peer and the connection will be allowed.
Minimum role	standard
Syntax	create chap-record name <originator-name> secret <originator-secret> [mutual-name <recipient-name> mutual-secret <recipient-secret>]
Parameters	name <originator-name> The originator name, typically in IQN format. The name is case sensitive and can have a maximum of 223 bytes, including 0–9, lowercase a–z, hyphen, colon, and period secret <originator-secret> The secret that the recipient uses to authenticate the originator. The secret is case sensitive and can include 12–16 bytes. The value can include spaces and printable UTF-8 characters except: " < mutual-name <recipient-name> Optional; for mutual CHAP only. The recipient name, typically in IQN format. The name is case sensitive and can have a maximum of 223 bytes, including 0–9, lowercase a–z, hyphen, colon, and period. To determine the IQN of a storage system, use the show ports command to view the Target ID value for an iSCSI port. This parameter and mutual-secret must be set together. mutual-secret <recipient-secret> Optional; for mutual CHAP only. The secret that the originator uses to authenticate the recipient. The secret is case sensitive, can include 12–16 bytes, and must differ from the originator secret. The value can include spaces and printable UTF-8 characters except: " < A storage system secret is shared by both controllers. This parameter and mutual-name must be set together.
Examples	Create a one-way CHAP record to enable a storage system to authenticate a host initiator. # create chap-record name iqn.1991-05.com.microsoft:myhost.domain secret 123456abcDEF
See also	delete chap-records set chap-record show chap-records show iscsi-parameters show ports