Microsoft ISCSI Initiator

Microsoft iSCSI Initiator enables you to connect a Windows host to an external iSCSI storage array using Ethernet network interface cards (NICs). You can use Microsoft iSCSI Initiator in your existing network infrastructure to enable block-based Storage Area Networks (SANs) which provide iSCSI target functionality without having to invest in additional hardware.

This help file explains the tabs on the Properties dialog box and other common tabs in the Microsoft iSCSI Initiator interface.

This help file includes the following topics:

  • Targets Properties

  • Discovery Properties

  • Favorite Targets properties

  • Volumes and Devices Properties

  • RADIUS Properties

  • Configuration Properties

  • IPsec Advanced Settings

  • Properties Details

  • Devices - Targets


Targets Properties

Use Quick Connect to perform discovery, logon, and to make the target location a favorite location. Type the IP address or Domain Name System (DNS) name of the target, and then click Quick Connect. When the system restarts, it automatically attempts to connect to the Quick Connect target.

Note

A target must first be discovered, either through Quick Connect or through the Discovery tab, before you can view connections, sessions, and device information on the Targets tab.

Important

For advanced connections that use digests or require Challenge-Handshake Authentication Protocol (CHAP) security, the Connect feature must be used. Quick Connect does not support logon to devices that support CHAP security.

You can use Connect when a target appears on the list. This allows you to make non-persistent connections and to mark connections for supporting multi-path options, as well as additional advanced options.

Note

The Multi-Path I/O (MPIO) feature is only included with server versions of Windows.

Advanced options that are available via Connect include connection options such as the IP address and target port to use, header and data digest cyclic redundancy check (CRC) checks, CHAP logon information, and Internet Protocol security (IPsec) information.

CHAP requires the initiator to have both a username and a CHAP secret. The CHAP username is typically passed to the target, and then the target looks for the CHAP secret for that username in its private table. By default, the Microsoft iSCSI Initiator service uses the initiator node name as the CHAP username. You can override this action by passing a CHAP username to the login request. The Microsoft iSCSI Initiator kernel mode driver limits the CHAP username to 223 characters.

You can create multiple sessions with the same target. To create an additional connection, select the target under Discovered Targets, and then click Connect.

Note

Multiple sessions of the same target are dependent on whether the iSCSI target allows multiple session logins, and whether any limits on the number of connections have already been reached.

To disconnect an entire connection, select the target under Discovered Targets, and then click Disconnect.

Since it is possible to have multiple connections to a target, you can click Properties to view current sessions and disconnect individual sessions.

You can click Devices to view any devices that are associated with the target connection.

See Also

  • Microsoft ISCSI Initiator


Discovery Properties

You must first discover a target before you can view its connections, sessions, and device information on the Targets tab.

Target Portals - You can discover an iSCSI target device, and then connect to the target on the Targets tab.

iSNS servers - The use of an Internet Storage Name Service (iSNS) server operates similarly to that of a Domain Name System (DNS) server. The client computer that is running iSCSI Initiator requests that the iSNS server query for iSCSI targets that are accessible to the client. Adding an iSNS server allows for the automatic discovery of iSCSI targets that are accessible to the client. Removing the iSNS server would prevent automatic discovery, and would require you to manually enter the iSCSI target name for every iSCSI target.

Note

For a client to properly interact with an iSNS server, the iSNS server firewall exception must be enabled. This is done by allowing the iSCSI Service to communicate through the Windows firewall.

See Also


Favorite Targets properties

By marking a target as a favorite target, Microsoft iSCSI Initiator configures software and hardware initiators to always attempt to reconnect to a target whenever the computer is rebooted. The login information that is needed to connect to the favorite targets (for example, Challenge-Handshake Authentication Protocol (CHAP) secrets, portal information, etc.) is captured when you log in, and is saved by the software and hardware initiators in non-volatile storage. Hardware initiators can initiate a reconnection early in the boot process while the Microsoft Software Initiator kernel mode driver initiates a reconnection as soon as the Windows TCP/IP stack and the Microsoft iSCSI Initiator service loads.

See Also


Volumes and Devices Properties

You can view a list of the volumes and devices that are currently persistently bound by Microsoft iSCSI Initiator. If a volume in the list is currently mounted, then the drive letter and mount point are shown. If a volume is not mounted, the device interface is not shown. For each device, the device interface name is shown.

Note

If multiple partitions with drive letters exist on a single volume, only the first drive letter will be displayed on the Volume and Device Properties page.

See Also


RADIUS Properties

Remote Authentication Dial-In User Service (RADIUS) is a standard used for maintaining and managing user authentication and validation. Unlike Challenge Handshake Authentication Protocol (CHAP), authentication with RADIUS is not performed between peers, but between a RADIUS server and a client. When a user (an iSCSI initiator) wants to authenticate to a client (an iSCSI target), the client sends an authentication request to the RADIUS server. The RADIUS server is responsible for authenticating the client. Transactions between the client and the RADIUS server are also authenticated through the use of a shared secret key.

To use this level of security, you must have a RADIUS server running on your network, or you must deploy one.

See Also


Configuration Properties

The iSCSI client or host (also known as the iSCSI initiator) is a system, such as a server, which attaches to an IP network and initiates requests and receives responses from an iSCSI target. Each iSCSI host is identified by a unique iSCSI Qualified Name (IQN), analogous to a Fibre Channel worldwide name (WWN).

The Microsoft iSCSI Initiator service supports the usage and configuration of Challenge Handshake Authentication Protocol (CHAP) and Internet Protocol security (IPsec) for both the Microsoft iSCSI software initiator and iSCSI host bus adapters (HBAs). All supported iSCSI HBAs support CHAP, while some may or may not support IPsec.

If you are using RADIUS, setting the iSCSI Initiator’s CHAP secret is not necessary when using mutual CHAP.

Note

The CHAP secret must be 12-16 characters in length unless you are using IPsec, in which case, it can be as short as 8 characters.

See Also


IPsec Advanced Settings

Internet Protocol Security (IPsec) is a protocol that provides authentication and data encryption at the IP packet layer. The Internet Key Exchange (IKE) protocol is used between the peers to allow the peers to authenticate each other and negotiate the packet encryption and authentication mechanisms to be used for the connection. Since the Microsoft iSCSI Initiator uses the Windows TCP/IP stack, it can use all of the functionality available in this stack. For authentication, this includes pre-shared keys, Kerberos, and certificates. Active Directory can be used to distribute the IPsec filters to the Microsoft iSCSI Initiator computers. Triple DES (3DES) and Hash Message Authentication Code – Secure Hash Algorithm 1 HMAC-SHA1 are also supported, as are tunnel and transport modes.

Because an iSCSI host bus adapter (HBA) has its own TCP/IP stack embedded in the adapter, the iSCSI HBA has its own implementation of IPsec and IKE, which means that the functionality of the iSCSI HBA may vary. At a minimum, it supports pre-shared keys, 3DES, and HMAC-SHA1. The Microsoft iSCSI Initiator service has a common application programming interface (API) that is used for configuring IPsec, both for the Microsoft iSCSI Initiator and for the iSCSI HBA.

See Also


Properties Details

If the target supports multiple sessions, you can create an additional session by clicking Add Session.

To disconnect individual sessions, select the session in the list, and then click Disconnect.

For more information about devices that are associated with a session, select the session, and then click Devices.

Multiple Connections per Session (MCS) support is defined in the iSCSI RFC to allow multiple TCP/IP connections from the initiator to the target for the same iSCSI session. This is iSCSI protocol specific. This allows I/O to be sent over either TCP/IP connection to the target. If one connection fails, another connection can continue processing I/O without interrupting the application. Note that not all iSCSI targets support MCS. iSCSI targets that support MCS include, but are not limited to, EMC Celerra, iStor, and Network Appliance.

See Also


Devices - Targets

This tab includes information about the connected devices and provides access to the Multipath I/O (MPIO) configuration. (MPIO is only included with server versions of Windows.)

Using Microsoft Multipath I/O (MPIO), Microsoft iSCSI Initiator can log in on multiple sessions to the same target and aggregate the duplicate devices into a single device that is exposed to Windows. Each session to the target can be established using different network interface cards (NICs), network infrastructure, and target ports. If one session fails, another session can continue processing I/O without interrupting the application. Note that the iSCSI target must support multiple sessions to the same target. The Microsoft iSCSI MPIO Device Specific Module (DSM) support supports a set of load balance policies that determine how I/O is allocated among the different sessions.

This dialog box provides information about the disks that are currently connected via the iSCSI Initiator, and provides a mapping between the disk number and the address. You can also configure the MPIO path usage type from the Devices dialog box by clicking MPIO.

See Also