Configuring CHAP with External RADIUS Server

Detailed Steps

To configure authentication using the CHAP option with an external RADIUS server, follow these steps:

  1. Configure the password for the Cisco MDS switch as RADIUS client to the RADIUS server:
    1. In Cisco DCNM-SAN, choose Switches > Security > AAA > RADIUS in the Physical Attributes pane.
    2. Click the Default tab in the Information pane.
    3. Set the AuthKey field to the default password and click the Apply Changes icon.
  2. Configure the RADIUS server IP address:
    1. In Cisco DCNM-SAN, choose Switches > Security > AAA > RADIUS in the Physical Attributes pane.
    2. Click the Server tab in the Information pane and click Create Row.
    3. Set the Index field to a unique number.
    4. Set the IP Type radio button to ipv4 or ipv6.
    5. Set the Name or IP Address field to the IP address of the RADIUS server and click Create.
  3. Create a RADIUS server group and add the RADIUS server to the group:
    1. In Cisco DCNM-SAN, choose Switches > Security > AAA in the Physical Attributes pane.
    2. Select the Server Groups tab in the Information pane and click Create Row.
    3. Set the Index field to a unique number.
    4. Set the Protocol radio button to radius.
    5. Set the Name field to the server group name.
    6. Set the ServerIDList to the index value of the RADIUS server (as created in Step 2 c.) and click Create.
  4. Set up the authentication verification for the iSCSI protocol to go to the RADIUS server.
    1. In Cisco DCNM-SAN, choose Switches > Security > AAA in the Physical Attributes pane.
    2. Click the Applications tab in the Information pane.
    3. Right-click on the iSCSI row in the Type, SubType, Function column.
    4. Set the ServerGroup IDList to the index value of the Server Group (as created in Step 3 c) and click Create.
  5. Set up the iSCSI authentication method to require CHAP for all iSCSI clients.
    1. In Cisco DCNM-SAN, choose End Devices > iSCSI in the Physical Attributes pane.
    2. Select chap from the AuthMethod drop-down menu.
    3. Click the Apply Changes icon.
  6. In Cisco DCNM-SAN, choose End Devices > iSCSI in the Physical Attributes pane.
  7. Click the Globals tab in the Information pane to verify that the global iSCSI authentication setup is for CHAP.
  8. In Cisco DCNM-SAN, choose Switches > Security > AAA in the Physical Attributes pane.
  9. Click the Applications tab in the Information pane to verify the AAA authentication information for iSCSI.

To configure an iSCSI RADIUS server, follow these steps:

  1. Configure the RADIUS server to allow access from the Cisco MDS switch's management Ethernet IP address.
  2. Configure the shared secret for the RADIUS server to authenticate the Cisco MDS switch.
  3. Configure the iSCSI users and passwords on the RADIUS server.

Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.