Data encryption is accomplished in iSCSI Software Target through the use of Internet Protocol security (IPsec). IPsec is a protocol that enforces data encryption and authentication at the IP packet layer to provide data privacy, integrity, and authenticity between the iSCSI initiator and iSCSI target. The Windows® TCP/IP stack includes IPsec and offers several encryption methods such as Kerberos, certification authority (CA), and preshared keys. iSCSI Software Target uses the Windows TCP/IP stack, taking advantage of the Windows Server 2003 built-in IPsec implementation and management model. IPsec is configured using the Local Security Policy snap-in or using Group Policy on each iSCSI initiator and iSCSI target. Additional IPsec configuration options are provided in Microsoft iSCSI Software Initiator, but no configuration is done in iSCSI Software Target. For more information about the IPsec configuration of the iSCSI initiator, see the documentation of the iSCSI initiator manufacturer.

For more information about IPsec, see the IPSec Technical Reference.

There are several levels of iSCSI security available. The basic level is based on the Challenge Handshake Authentication Protocol (CHAP). CHAP is a protocol that is used to authenticate the peer of a connection and is based upon the peers sharing a secret (a security key that is similar to a password).

In Microsoft iSCSI Software Target, neither CHAP nor reverse CHAP authentication is enabled by default. You can enable authentication using one of two CHAP authentication methods:

• Enable CHAP
  
  You can use CHAP to provide one-way authentication. With this method, the iSCSI target authenticates each iSCSI initiator, but the iSCSI initiator does not authenticate the iSCSI target. A shared secret is configured on the iSCSI target and all iSCSI initiators must use the same secret to start a session with the iSCSI target.
  
  
• Enable reverse CHAP authentication
  
  You can use reverse CHAP authentication to provide authentication of the iSCSI target by the iSCSI initiator. A separate shared secret is configured on the iSCSI initiator and each iSCSI target must provide the appropriate shared secret to the iSCSI initiator.
  
  

Caution
At a minimum, use one-way CHAP authentication between iSCSI initiators and targets. To provide better security, also enable reverse CHAP authentication.

For more information about the CHAP protocol, see Challenge Handshake Authentication Protocol (CHAP) For more information about iSCSI security and to learn more about iSCSI in general, see Microsoft Storage Technologies - iSCSI.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review the details in "Additional considerations" in this topic.

1. In Microsoft iSCSI Software Target, in the console tree, click iSCSI Targets.

2. In the results pane, right-click the iSCSI target for which you want to enable authentication, and then click Properties.

3. On the Authentication tab, select the Enable CHAP check box, or the Enable reverse CHAP authentication check box, or both check boxes.

4. For each authentication method you select, specify an appropriate name in User name, specify a secret and confirm it, and then click OK.

Note
If you enable both CHAP and reverse CHAP authentication, you must specify a different secret for each.

Managing Advanced iSCSI Initiator Access

IPSec Technical Reference

Challenge Handshake Authentication Protocol

Microsoft Storage Technologies - iSCSI