ISCSI
Encyclopedia
In computing, iSCSI is an abbreviation of Internet Small Computer System Interface, an Internet Protocol
(IP)-based storage networking standard for linking data storage facilities. By carrying SCSI
commands over IP networks, iSCSI is used to facilitate data transfers over intranets and to manage storage over long distances. iSCSI can be used to transmit data over local area networks (LANs), wide area networks (WANs), or the Internet and can enable location-independent data storage and retrieval. The protocol allows clients (called initiators) to send SCSI commands (CDBs
) to SCSI storage devices (targets) on remote servers. It is a Storage Area Network
(SAN) protocol, allowing organizations to consolidate storage into data center storage arrays while providing hosts (such as database and web servers) with the illusion of locally-attached disks. Unlike traditional Fibre Channel
, which requires special-purpose cabling, iSCSI can be run over long distances using existing network infrastructure.
860 and 3260). In essence, iSCSI simply allows two hosts to negotiate and then exchange SCSI
commands using IP networks. By doing this iSCSI takes a popular high-performance local storage bus and emulates it over wide-area networks, creating a storage area network
(SAN). Unlike some SAN protocols, iSCSI requires no dedicated cabling; it can be run over existing switching and IP infrastructure. However, the performance of an iSCSI SAN deployment can be severely degraded if not operated on a dedicated network or subnet (LAN or VLAN). As a result, iSCSI is often seen as a low-cost alternative to Fibre Channel
, which requires dedicated infrastructure except in its FCoE (Fibre Channel over Ethernet) form.
Although iSCSI can communicate with arbitrary types of SCSI devices, system administrators almost always use it to allow server computers (such as database servers) to access disk volumes on storage arrays. iSCSI SANs often have one of two objectives:
Storage consolidation
Disaster recovery
A separate DHCP server may be configured to assist interfaces equipped with network boot capability to be able to boot over iSCSI. In this case the network interface looks for a DHCP server offering a PXE
or bootp
boot image. This is used to kick off the iSCSI remote boot process, using the booting network interface's MAC address
to direct the computer to the correct iSCSI boot target.
Specialized iSCSI interfaces are available with built-in BIOS
functionality that allows the interface to be preassigned to an iSCSI target, and be able to boot from it without additional help from a boot server, thereby reducing the network configuration complexity.
device driver that uses the existing network card
(NIC) and network stack to emulate SCSI devices for a computer by speaking the iSCSI protocol. Software initiators are available for most mainstream operating systems, and this type is the most common mode of deploying iSCSI on computers.
) running on that hardware, to implement iSCSI. A hardware initiator mitigates the overhead of iSCSI and TCP
processing and Ethernet interrupts
, and therefore may improve the performance of servers that use iSCSI.
An iSCSI host bus adapter (more commonly, HBA) implements a hardware initiator. A typical HBA is packaged as a combination of a Gigabit (or 10 Gigabit) Ethernet NIC
, some kind of TCP/IP offload engine (TOE) technology and a SCSI bus adapter, which is how it appears to the operating system.
An iSCSI HBA can include PCI option ROM
to allow booting
from an iSCSI target.
A TCP Offload Engine, or "TOE Card", offers an alternative to a full iSCSI HBA. A TOE "offloads" the TCP/IP operations for this particular network interface from the host processor, freeing up CPU cycles for the main host applications. When a TOE is used rather than an HBA, the host processor still has to perform the processing of the iSCSI protocol layer itself, but the CPU overhead for that task is low.
iSCSI HBAs or TOEs are used when the additional performance enhancement justifies the additional expense of using an HBA for iSCSI, rather than using a software-based iSCSI client (initiator).
"iSCSI target" should not be confused with the term "iSCSI" as the latter is a protocol and not a storage server instance.
An iSCSI target is often a dedicated network-connected hard disk storage device, but may also be a general-purpose computer, since as with initiators, software to provide an iSCSI target is available for most mainstream operating systems.
Common deployment scenarios for an iSCSI target include:
, EMC
NS-series or a HDS
HNAS computer appliance
. A storage array usually provides distinct iSCSI targets for numerous clients.
, Solaris or Windows Server
) can provide iSCSI target functionality, either as a built-in feature or with supplemental software. Some specific-purpose operating systems (such as FreeNAS
or Openfiler
) implement iSCSI target support.
terminology, LUN stands for logical unit number. A LUN represents an individually addressable (logical) SCSI device that is part of a physical SCSI device (target). In an iSCSI environment, LUNs are essentially numbered disk drives. An initiator negotiates with a target to establish connectivity to a LUN; the result is an iSCSI connection that emulates a connection to a SCSI hard disk. Initiators treat iSCSI LUNs the same way as they would a raw SCSI or IDE hard drive; for instance, rather than mounting remote directories as would be done in NFS or CIFS environments, iSCSI systems format and directly manage filesystems on iSCSI LUNs.
In enterprise deployments, LUNs usually represent slices of large RAID
disk arrays, often allocated one per client. iSCSI imposes no rules or restrictions on multiple computers sharing individual LUNs; it leaves shared access to a single underlying filesystem as a task for the operating system.
iSCSI Qualified Name (IQN)
Naming String defined by
Type Date Auth "example.com" naming authority
+--++-----+ +---------+ +-----------------------------+
| || | | | | |
iqn.2001-04.com.example:storage:diskarrays-sn-a8675309
iqn.2001-04.com.example
iqn.2001-04.com.example:storage.tape1.sys1.xyz
iqn.2001-04.com.example:storage.disk2.sys1.xyz
Extended Unique Identifier (EUI)
T11 Network Address Authority (NAA)
IQN format addresses occur most commonly. They are qualified by a date (yyyy-mm) because domain names can expire or be acquired by another entity.
The IEEE Registration authority provides EUI in accordance with the EUI-64 standard. NAA is part OUI which is provided by the IEEE Registration Authority. NAA name formats were added to iSCSI in RFC 3980, to provide compatibility with naming conventions used in Fibre Channel
and Serial Attached SCSI
(SAS) storage technologies.
Usually an iSCSI participant can be defined by three or four fields:
SANs. In practice, administrators can satisfy many deployment goals for iSCSI without using iSNS.
protocol, which includes a mechanism to prevent cleartext passwords from appearing on the wire. By itself, the CHAP protocol is vulnerable to dictionary attack
s, spoofing
, or reflection attack
s. If followed carefully, the rules for using CHAP within iSCSI prevent most of these attacks.
Additionally, as with all IP-based protocols, IPsec
can operate at the network layer. The iSCSI negotiation protocol is designed to accommodate other authentication schemes, though interoperability issues limit their deployment.
s (VLAN). This mitigates authentication concerns; unauthorized users aren't physically provisioned for iSCSI, and thus can't talk to storage arrays. However, it also creates a transitive trust problem, in that a single compromised host with an iSCSI disk can be used to attack storage resources for other hosts.
In order to further differentiate iSCSI from the regular network and prevent cabling mistakes when changing connections, administrators may implement self-defined color coding and labeling standards, such as only using yellow-colored cables for the iSCSI connections and only blue cables for the regular network, and clearly labeling ports and switches used only for iSCSI.
While iSCSI could be implemented as just a VLAN cluster of ports on a large multi-port switch that is also used for general network usage, the administrator may instead choose to use physically separate switches dedicated to iSCSI VLANs only, to further prevent the possibility of an incorrectly connected cable plugged into the wrong port bridging the logical barrier.
for corporate accounting, HIPAA for health benefits information, and PCI DSS
for credit card processing. During an audit, storage systems must demonstrate controls to ensure that a server under one regime cannot access the storage assets of a server under another.
Typically, iSCSI storage arrays explicitly map initiators to specific target LUNs; an initiator authenticates not to the storage array, but to the specific storage asset it intends to use. However, because the target LUNs for SCSI commands are expressed both in the iSCSI negotiation protocol and in the underlying SCSI protocol, care must be taken to ensure that access control is provided consistently.
These problems do not occur only with iSCSI, but rather apply to any IP-based SAN
protocol without cryptographic security. Adoption and deployment of IPsec
, frequently cited as a solution to the IP SAN security problem, has been hampered by performance and compatibility issues.
† Target available only as part of Windows Unified Data Storage Server (WUDSS) for Storage Server 2003. Target available in Storage Server 2008 (excepted Basic edition).
Target available for Windows Server 2008 R2 as a separate download. Windows Server 8 has built-in iSCSI target version 3.3 (at least in preview versions).
†† MacOS X has neither initiator nor target coming from vendor directly. There are few MacOS X initiators and targets available but they are from third-party vendors only.
or Fibre Channel
interfaces are bridged by using iSCSI target software, external bridges, or controllers internal to the device enclosure.
Alternatively, it is possible to virtualize disk and tape targets. Rather than representing an actual physical device, an emulated virtual device is presented. The underlying implementation can deviate drastically from the presented target as is done with virtual tape library
(VTL) products. VTLs use disk storage for storing data written to virtual tapes. As with actual physical devices, virtual targets are presented by using iSCSI target software, external bridges, or controllers internal to the device enclosure.
In the security products industry, some manufacturers use an iSCSI RAID as a target, with the initiator being either an IP-enabled encoder or camera.
Internet Protocol
The Internet Protocol is the principal communications protocol used for relaying datagrams across an internetwork using the Internet Protocol Suite...
(IP)-based storage networking standard for linking data storage facilities. By carrying SCSI
SCSI
Small Computer System Interface is a set of standards for physically connecting and transferring data between computers and peripheral devices. The SCSI standards define commands, protocols, and electrical and optical interfaces. SCSI is most commonly used for hard disks and tape drives, but it...
commands over IP networks, iSCSI is used to facilitate data transfers over intranets and to manage storage over long distances. iSCSI can be used to transmit data over local area networks (LANs), wide area networks (WANs), or the Internet and can enable location-independent data storage and retrieval. The protocol allows clients (called initiators) to send SCSI commands (CDBs
SCSI CDB
In SCSI computer storage, commands are sent in a Command Descriptor Block .Each CDB can be a total of 6, 10, 12, or 16 bytes, but later versions of the SCSI standard also allow for variable-length CDBs. The CDB consists of a one byte operation code followed by some command-specific parameters.A...
) to SCSI storage devices (targets) on remote servers. It is a Storage Area Network
Storage area network
A storage area network is a dedicated network that provides access to consolidated, block level data storage. SANs are primarily used to make storage devices, such as disk arrays, tape libraries, and optical jukeboxes, accessible to servers so that the devices appear like locally attached devices...
(SAN) protocol, allowing organizations to consolidate storage into data center storage arrays while providing hosts (such as database and web servers) with the illusion of locally-attached disks. Unlike traditional Fibre Channel
Fibre Channel
Fibre Channel, or FC, is a gigabit-speed network technology primarily used for storage networking. Fibre Channel is standardized in the T11 Technical Committee of the InterNational Committee for Information Technology Standards , an American National Standards Institute –accredited standards...
, which requires special-purpose cabling, iSCSI can be run over long distances using existing network infrastructure.
Functionality
iSCSI uses TCP/IP (typically TCP portsTCP and UDP port
In computer networking, a port is an application-specific or process-specific software construct serving as a communications endpoint in a computer's host operating system. A port is associated with an IP address of the host, as well as the type of protocol used for communication...
860 and 3260). In essence, iSCSI simply allows two hosts to negotiate and then exchange SCSI
SCSI
Small Computer System Interface is a set of standards for physically connecting and transferring data between computers and peripheral devices. The SCSI standards define commands, protocols, and electrical and optical interfaces. SCSI is most commonly used for hard disks and tape drives, but it...
commands using IP networks. By doing this iSCSI takes a popular high-performance local storage bus and emulates it over wide-area networks, creating a storage area network
Storage area network
A storage area network is a dedicated network that provides access to consolidated, block level data storage. SANs are primarily used to make storage devices, such as disk arrays, tape libraries, and optical jukeboxes, accessible to servers so that the devices appear like locally attached devices...
(SAN). Unlike some SAN protocols, iSCSI requires no dedicated cabling; it can be run over existing switching and IP infrastructure. However, the performance of an iSCSI SAN deployment can be severely degraded if not operated on a dedicated network or subnet (LAN or VLAN). As a result, iSCSI is often seen as a low-cost alternative to Fibre Channel
Fibre Channel
Fibre Channel, or FC, is a gigabit-speed network technology primarily used for storage networking. Fibre Channel is standardized in the T11 Technical Committee of the InterNational Committee for Information Technology Standards , an American National Standards Institute –accredited standards...
, which requires dedicated infrastructure except in its FCoE (Fibre Channel over Ethernet) form.
Although iSCSI can communicate with arbitrary types of SCSI devices, system administrators almost always use it to allow server computers (such as database servers) to access disk volumes on storage arrays. iSCSI SANs often have one of two objectives:
Storage consolidation
- Organizations move disparate storage resources from servers around their network to central locations, often in data centers; this allows for more efficiency in the allocation of storage. In a SAN environment, a server can be allocated a new disk volume without any change to hardware or cabling.
Disaster recovery
- Organizations mirror storage resources from one data center to a remote data center, which can serve as a hot standby in the event of a prolonged outage. In particular, iSCSI SANs allow entire disk arrays to be migrated across a WAN with minimal configuration changes, in effect making storage "routable" in the same manner as network traffic.
Network booting
For general data storage on an already-booted computer, any type of generic network interface may be used to access iSCSI devices. However, a generic consumer-grade network interface is not able to boot a diskless computer from a remote iSCSI data source. Instead it is commonplace for a server to load its initial operating system from a TFTP server or local boot device, and then use iSCSI for data storage once booting from the local device has finished.A separate DHCP server may be configured to assist interfaces equipped with network boot capability to be able to boot over iSCSI. In this case the network interface looks for a DHCP server offering a PXE
Preboot Execution Environment
The Preboot eXecution Environment is an environment to boot computers using a network interface independently of data storage devices or installed operating systems.PXE was introduced as part of the Wired for Management framework by Intel and is described in the specification The Preboot...
or bootp
BOOTP
In computer networking, the Bootstrap Protocol, or BOOTP, is a network protocol used by a network client to obtain an IP address from a configuration server. The BOOTP protocol was originally defined in RFC 951....
boot image. This is used to kick off the iSCSI remote boot process, using the booting network interface's MAC address
MAC address
A Media Access Control address is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used for numerous network technologies and most IEEE 802 network technologies, including Ethernet...
to direct the computer to the correct iSCSI boot target.
Specialized iSCSI interfaces are available with built-in BIOS
BIOS
In IBM PC compatible computers, the basic input/output system , also known as the System BIOS or ROM BIOS , is a de facto standard defining a firmware interface....
functionality that allows the interface to be preassigned to an iSCSI target, and be able to boot from it without additional help from a boot server, thereby reducing the network configuration complexity.
Initiator
An initiator functions as an iSCSI client. An initiator typically serves the same purpose to a computer as a SCSI bus adapter would, except that instead of physically cabling SCSI devices (like hard drives and tape changers), an iSCSI initiator sends SCSI commands over an IP network. An initiator falls into two broad types:Software initiator
A software initiator uses code to implement iSCSI. Typically, this happens in a kernel-residentKernel (computing)
In computing, the kernel is the main component of most computer operating systems; it is a bridge between applications and the actual data processing done at the hardware level. The kernel's responsibilities include managing the system's resources...
device driver that uses the existing network card
Network card
A network interface controller is a computer hardware component that connects a computer to a computer network....
(NIC) and network stack to emulate SCSI devices for a computer by speaking the iSCSI protocol. Software initiators are available for most mainstream operating systems, and this type is the most common mode of deploying iSCSI on computers.
Hardware initiator
A hardware initiator uses dedicated hardware, typically in combination with software (firmwareFirmware
In electronic systems and computing, firmware is a term often used to denote the fixed, usually rather small, programs and/or data structures that internally control various electronic devices...
) running on that hardware, to implement iSCSI. A hardware initiator mitigates the overhead of iSCSI and TCP
Transmission Control Protocol
The Transmission Control Protocol is one of the core protocols of the Internet Protocol Suite. TCP is one of the two original components of the suite, complementing the Internet Protocol , and therefore the entire suite is commonly referred to as TCP/IP...
processing and Ethernet interrupts
Interrupt
In computing, an interrupt is an asynchronous signal indicating the need for attention or a synchronous event in software indicating the need for a change in execution....
, and therefore may improve the performance of servers that use iSCSI.
Host Bus Adapter
An iSCSI host bus adapter (more commonly, HBA) implements a hardware initiator. A typical HBA is packaged as a combination of a Gigabit (or 10 Gigabit) Ethernet NIC
Network card
A network interface controller is a computer hardware component that connects a computer to a computer network....
, some kind of TCP/IP offload engine (TOE) technology and a SCSI bus adapter, which is how it appears to the operating system.
An iSCSI HBA can include PCI option ROM
Option ROM
An Option ROM typically consists of firmware that is called by the system BIOS. For example, an adapter card that controls a boot device might contain firmware that is used to connect the device to the system once the Option ROM is loaded....
to allow booting
Booting
In computing, booting is a process that begins when a user turns on a computer system and prepares the computer to perform its normal operations. On modern computers, this typically involves loading and starting an operating system. The boot sequence is the initial set of operations that the...
from an iSCSI target.
TCP Offload Engine
A TCP Offload Engine, or "TOE Card", offers an alternative to a full iSCSI HBA. A TOE "offloads" the TCP/IP operations for this particular network interface from the host processor, freeing up CPU cycles for the main host applications. When a TOE is used rather than an HBA, the host processor still has to perform the processing of the iSCSI protocol layer itself, but the CPU overhead for that task is low.
iSCSI HBAs or TOEs are used when the additional performance enhancement justifies the additional expense of using an HBA for iSCSI, rather than using a software-based iSCSI client (initiator).
Target
The iSCSI specification refers to a storage resource located on an iSCSI server (more generally, one of potentially many instances of iSCSI storage nodes running on that server) as a target."iSCSI target" should not be confused with the term "iSCSI" as the latter is a protocol and not a storage server instance.
An iSCSI target is often a dedicated network-connected hard disk storage device, but may also be a general-purpose computer, since as with initiators, software to provide an iSCSI target is available for most mainstream operating systems.
Common deployment scenarios for an iSCSI target include:
Storage array
In a data center or enterprise environment, an iSCSI target often resides in a large storage array, such as a EqualLogic, NetApp filerNetApp filer
In computer storage, NetApp filer, known also as NetApp Fabric-Attached Storage , or NetApp's network attached storage device are NetApp's offering in the area of Storage Systems. A FAS functions in an enterprise-class Storage area network as well as a networked storage appliance...
, EMC
EMC Corporation
EMC Corporation , a Financial Times Global 500, Fortune 500 and S&P 500 company, develops, delivers and supports information infrastructure and virtual infrastructure hardware, software, and services. EMC is headquartered in Hopkinton, Massachusetts, USA.Former Intel executive Richard Egan and his...
NS-series or a HDS
Hitachi Data Systems
Hitachi Data Systems is a company providing mid-range and high-end storage systems, software and services. It is a wholly owned subsidiary of Hitachi Ltd. and part of the Hitachi Information Systems & Telecommunications Division....
HNAS computer appliance
Computer appliance
A computer appliance is generally a separate and discrete hardware device with integrated software , specifically designed to provide a specific computing resource. These devices became known as "appliances" because of their similarity to home appliances, which are generally "closed and sealed" –...
. A storage array usually provides distinct iSCSI targets for numerous clients.
Software target
Nearly all modern mainstream server operating systems (such as BSD, LinuxLinux
Linux is a Unix-like computer operating system assembled under the model of free and open source software development and distribution. The defining component of any Linux system is the Linux kernel, an operating system kernel first released October 5, 1991 by Linus Torvalds...
, Solaris or Windows Server
Windows Server
Windows Server is a brand name for a group of server operating systems released by Microsoft Corporation. All are part of Microsoft Servers.- Members :This brand includes the following software:* Windows 2000 Server* Windows Server 2003...
) can provide iSCSI target functionality, either as a built-in feature or with supplemental software. Some specific-purpose operating systems (such as FreeNAS
FreeNAS
FreeNAS is a free network-attached storage server, supporting: CIFS , FTP, NFS, rsync, AFP protocols, iSCSI, S.M.A.R.T., local user authentication, and software RAID , with a web-based configuration interface. FreeNAS takes less than 64 MB once installed on CompactFlash, hard drive or USB flash...
or Openfiler
Openfiler
Openfiler is an operating system that provides file-based network-attached storage and block-based storage area network. It was created by Xinit Systems, and is based on the rPath Linux distribution. It is free software licensed under the GNU General Public License version 2...
) implement iSCSI target support.
Logical Unit Number
In SCSISCSI
Small Computer System Interface is a set of standards for physically connecting and transferring data between computers and peripheral devices. The SCSI standards define commands, protocols, and electrical and optical interfaces. SCSI is most commonly used for hard disks and tape drives, but it...
terminology, LUN stands for logical unit number. A LUN represents an individually addressable (logical) SCSI device that is part of a physical SCSI device (target). In an iSCSI environment, LUNs are essentially numbered disk drives. An initiator negotiates with a target to establish connectivity to a LUN; the result is an iSCSI connection that emulates a connection to a SCSI hard disk. Initiators treat iSCSI LUNs the same way as they would a raw SCSI or IDE hard drive; for instance, rather than mounting remote directories as would be done in NFS or CIFS environments, iSCSI systems format and directly manage filesystems on iSCSI LUNs.
In enterprise deployments, LUNs usually represent slices of large RAID
RAID
RAID is a storage technology that combines multiple disk drive components into a logical unit...
disk arrays, often allocated one per client. iSCSI imposes no rules or restrictions on multiple computers sharing individual LUNs; it leaves shared access to a single underlying filesystem as a task for the operating system.
Addressing
Special names refer to both iSCSI initiators and targets. iSCSI provides three name-formats:iSCSI Qualified Name (IQN)
- Format: The iSCSI Qualified Name is documented in RFC 3720, with further examples of names in RFC 3721. Briefly, the fields are:
- literal iqn
- date (yyyy-mm) that the naming authority took ownership of the domain
- reversed domain name of the authority (org.alpinelinux, com.example, to.yp.cr)
- Optional ":" prefixing a storage target name specified by the naming authority.
- From the RFC:
Naming String defined by
Type Date Auth "example.com" naming authority
+--++-----+ +---------+ +-----------------------------+
| || | | | | |
iqn.2001-04.com.example:storage:diskarrays-sn-a8675309
iqn.2001-04.com.example
iqn.2001-04.com.example:storage.tape1.sys1.xyz
iqn.2001-04.com.example:storage.disk2.sys1.xyz
Extended Unique Identifier (EUI)
- Format: eui.{EUI-64 bit address} (e.g. eui.02004567A425678D)
T11 Network Address Authority (NAA)
- Format: naa.{NASA 64 or 128 bit identifier} (e.g. naa.52004567BA64678D)
IQN format addresses occur most commonly. They are qualified by a date (yyyy-mm) because domain names can expire or be acquired by another entity.
The IEEE Registration authority provides EUI in accordance with the EUI-64 standard. NAA is part OUI which is provided by the IEEE Registration Authority. NAA name formats were added to iSCSI in RFC 3980, to provide compatibility with naming conventions used in Fibre Channel
Fibre Channel
Fibre Channel, or FC, is a gigabit-speed network technology primarily used for storage networking. Fibre Channel is standardized in the T11 Technical Committee of the InterNational Committee for Information Technology Standards , an American National Standards Institute –accredited standards...
and Serial Attached SCSI
Serial Attached SCSI
Serial Attached SCSI is a computer bus used to move data to and from computer storage devices such as hard drives and tape drives. SAS depends on a point-to-point serial protocol that replaces the parallel SCSI bus technology that first appeared in the mid 1980s in data centers and workstations,...
(SAS) storage technologies.
Usually an iSCSI participant can be defined by three or four fields:
- Hostname or IP Address (e.g., "iscsi.example.com")
- Port Number (e.g., 3260)
- iSCSI Name (e.g., the IQN "iqn.2003-01.com.ibm:00.fcd0ab21.shark128")
- An optional CHAPChallenge-handshake authentication protocolIn computing, the Challenge-Handshake Authentication Protocol authenticates a user or network host to an authenticating entity. That entity may be, for example, an Internet service provider. CHAP is specified in RFC 1994....
Secret (e.g., "secretsarefun")
iSNS
iSCSI initiators can locate appropriate storage resources using the Internet Storage Name Service (iSNS) protocol. In theory, iSNS provides iSCSI SANs with the same management model as dedicated Fibre ChannelFibre Channel
Fibre Channel, or FC, is a gigabit-speed network technology primarily used for storage networking. Fibre Channel is standardized in the T11 Technical Committee of the InterNational Committee for Information Technology Standards , an American National Standards Institute –accredited standards...
SANs. In practice, administrators can satisfy many deployment goals for iSCSI without using iSNS.
Authentication
iSCSI initiators and targets prove their identity to each other using the CHAPChallenge-handshake authentication protocol
In computing, the Challenge-Handshake Authentication Protocol authenticates a user or network host to an authenticating entity. That entity may be, for example, an Internet service provider. CHAP is specified in RFC 1994....
protocol, which includes a mechanism to prevent cleartext passwords from appearing on the wire. By itself, the CHAP protocol is vulnerable to dictionary attack
Dictionary attack
In cryptanalysis and computer security, a dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by searching likely possibilities.-Technique:...
s, spoofing
IP address spoofing
In computer networking, the term IP address spoofing or IP spoofing refers to the creation of Internet Protocol packets with a forged source IP address, called spoofing, with the purpose of concealing the identity of the sender or impersonating another computing system.-Background:The basic...
, or reflection attack
Reflection attack
A reflection attack is a method of attacking a challenge-response authentication system that uses the same protocol in both directions. That is, the same challenge-response protocol is used by each side to authenticate the other side...
s. If followed carefully, the rules for using CHAP within iSCSI prevent most of these attacks.
Additionally, as with all IP-based protocols, IPsec
IPsec
Internet Protocol Security is a protocol suite for securing Internet Protocol communications by authenticating and encrypting each IP packet of a communication session...
can operate at the network layer. The iSCSI negotiation protocol is designed to accommodate other authentication schemes, though interoperability issues limit their deployment.
Logical network isolation
To ensure that only valid initiators connect to storage arrays, administrators most commonly run iSCSI only over logically-isolated backchannel networks. In this deployment architecture, only the management ports of storage arrays are exposed to the general-purpose internal network, and the iSCSI protocol itself is run over dedicated network segments or virtual LANVirtual LAN
A virtual local area network, virtual LAN or VLAN, is a group of hosts with a common set of requirements that communicate as if they were attached to the same broadcast domain, regardless of their physical location...
s (VLAN). This mitigates authentication concerns; unauthorized users aren't physically provisioned for iSCSI, and thus can't talk to storage arrays. However, it also creates a transitive trust problem, in that a single compromised host with an iSCSI disk can be used to attack storage resources for other hosts.
Physical network isolation
While iSCSI can be logically isolated from the general network using VLANs only, it is still no different from any other network equipment and may use any cable or port as long as there is a completed signal path between source and target. Just a single cabling mistake by an inexperienced network technician can compromise the barrier of logical separation, and an accidental bridging may not be immediately detected because it does not cause network errors.In order to further differentiate iSCSI from the regular network and prevent cabling mistakes when changing connections, administrators may implement self-defined color coding and labeling standards, such as only using yellow-colored cables for the iSCSI connections and only blue cables for the regular network, and clearly labeling ports and switches used only for iSCSI.
While iSCSI could be implemented as just a VLAN cluster of ports on a large multi-port switch that is also used for general network usage, the administrator may instead choose to use physically separate switches dedicated to iSCSI VLANs only, to further prevent the possibility of an incorrectly connected cable plugged into the wrong port bridging the logical barrier.
Authorization
Because iSCSI aims to consolidate storage for many servers into a single storage array, iSCSI deployments require strategies to prevent unrelated initiators from accessing storage resources. As a pathological example, a single enterprise storage array could hold data for servers variously regulated by the Sarbanes-Oxley ActSarbanes-Oxley Act
The Sarbanes–Oxley Act of 2002 , also known as the 'Public Company Accounting Reform and Investor Protection Act' and 'Corporate and Auditing Accountability and Responsibility Act' and commonly called Sarbanes–Oxley, Sarbox or SOX, is a United States federal law enacted on July 30, 2002, which...
for corporate accounting, HIPAA for health benefits information, and PCI DSS
PCI DSS
The Payment Card Industry Data Security Standard is an information security standard for organizations that handle cardholder information for the major debit, credit, prepaid, e-purse, ATM, and POS cards....
for credit card processing. During an audit, storage systems must demonstrate controls to ensure that a server under one regime cannot access the storage assets of a server under another.
Typically, iSCSI storage arrays explicitly map initiators to specific target LUNs; an initiator authenticates not to the storage array, but to the specific storage asset it intends to use. However, because the target LUNs for SCSI commands are expressed both in the iSCSI negotiation protocol and in the underlying SCSI protocol, care must be taken to ensure that access control is provided consistently.
Confidentiality and integrity
For the most part, iSCSI operates as a cleartext protocol that provides no cryptographic protection for data in motion during SCSI transactions. As a result, an attacker who can listen in on iSCSI Ethernet traffic can:- reconstruct and copy the files and filesystems being transferred on the wire
- alter the contents of files by injecting fake iSCSI frames
- corrupt filesystems being accessed by initiators, exposing servers to software flaws in poorly-tested filesystem code.
These problems do not occur only with iSCSI, but rather apply to any IP-based SAN
Storage area network
A storage area network is a dedicated network that provides access to consolidated, block level data storage. SANs are primarily used to make storage devices, such as disk arrays, tape libraries, and optical jukeboxes, accessible to servers so that the devices appear like locally attached devices...
protocol without cryptographic security. Adoption and deployment of IPsec
IPsec
Internet Protocol Security is a protocol suite for securing Internet Protocol communications by authenticating and encrypting each IP packet of a communication session...
, frequently cited as a solution to the IP SAN security problem, has been hampered by performance and compatibility issues.
Operating-system support
The dates that appear in the following table might be misleading. It is known for example that IBM delivered an iSCSI storage device (NAS200i) in 2001 for use with Windows NT, Windows 2000 http://www-900.ibm.com/cn/support/library/storage/download/200i%20iSCSI%20client%20for%20NT&2000%20Installation&User%20Guide.pdf and Linux http://www-900.ibm.com/cn/support/library/storage/download/200i%20iSCSI%20client%20for%20Linux%20Installation&User%20Guide.pdf| OS | First release date | Version | Features |
|---|---|---|---|
| i5/OS | 2006-10 | i5/OS V5R4M0 | Target, Multipath |
| VMware ESX VMware ESX VMware ESX is an enterprise-level computer virtualization product offered by VMware, Inc. ESX is a component of VMware's larger offering, VMware Infrastructure, and adds management and reliability services to the core server product... |
2006-06 | ESX 3.0, ESX 4.0 ESX 5.0 | Initiator, Multipath |
| AIX | 2002-10 | AIX 5.3 TL10 , AIX 6.1 TL3 | Initiator, Target |
| Windows Microsoft Windows Microsoft Windows is a series of operating systems produced by Microsoft.Microsoft introduced an operating environment named Windows on November 20, 1985 as an add-on to MS-DOS in response to the growing interest in graphical user interfaces . Microsoft Windows came to dominate the world's personal... |
2003-06 | 2000, XP Pro, 2003, Vista, 2008, 2008 R2, Windows7, Windows 8, Windows Server 8 | Initiator, Target†, Multipath |
| NetWare Novell NetWare NetWare is a network operating system developed by Novell, Inc. It initially used cooperative multitasking to run various services on a personal computer, with network protocols based on the archetypal Xerox Network Systems stack.... |
2003-08 | NetWare 5.1, 6.5, & OES | Initiator, Target |
| HP-UX HP-UX HP-UX is Hewlett-Packard's proprietary implementation of the Unix operating system, based on UNIX System V and first released in 1984... |
2003-10 | HP 11i v1, HP 11i v2, HP 11i v3 | Initiator |
| Solaris | 2005-02 | Solaris 10, OpenSolaris | Initiator, Target, Multipath, iSER ISCSI Extensions for RDMA The iSCSI Extensions for RDMA is a computer network protocol that extends the Internet Small Computer System Interface protocol to use Remote Direct Memory Access... |
| Linux Linux Linux is a Unix-like computer operating system assembled under the model of free and open source software development and distribution. The defining component of any Linux system is the Linux kernel, an operating system kernel first released October 5, 1991 by Linus Torvalds... |
2005-06 | 2.6.12 | Initiator, Target, Multipath, iSER ISCSI Extensions for RDMA The iSCSI Extensions for RDMA is a computer network protocol that extends the Internet Small Computer System Interface protocol to use Remote Direct Memory Access... |
| OpenBSD OpenBSD OpenBSD is a Unix-like computer operating system descended from Berkeley Software Distribution , a Unix derivative developed at the University of California, Berkeley. It was forked from NetBSD by project leader Theo de Raadt in late 1995... |
2010-09 | 4.9 | Initiator |
| NetBSD NetBSD NetBSD is a freely available open source version of the Berkeley Software Distribution Unix operating system. It was the second open source BSD descendant to be formally released, after 386BSD, and continues to be actively developed. The NetBSD project is primarily focused on high quality design,... |
2006-02 | 4.0, 5.0 | Initiator (5.0), Target (4.0) |
| FreeBSD FreeBSD FreeBSD is a free Unix-like operating system descended from AT&T UNIX via BSD UNIX. Although for legal reasons FreeBSD cannot be called “UNIX”, as the direct descendant of BSD UNIX , FreeBSD’s internals and system APIs are UNIX-compliant... |
2008-02 | 7.0 | Initiator, Target from NetBSD |
| OpenVMS OpenVMS OpenVMS , previously known as VAX-11/VMS, VAX/VMS or VMS, is a computer server operating system that runs on VAX, Alpha and Itanium-based families of computers. Contrary to what its name suggests, OpenVMS is not open source software; however, the source listings are available for purchase... |
2008-02 | 8.3-1H1 | Initiator, Multipath |
| Mac OS X Mac OS X Mac OS X is a series of Unix-based operating systems and graphical user interfaces developed, marketed, and sold by Apple Inc. Since 2002, has been included with all new Macintosh computer systems... |
2008-07 | 10.4 - 10.6 | N/A†† |
† Target available only as part of Windows Unified Data Storage Server (WUDSS) for Storage Server 2003. Target available in Storage Server 2008 (excepted Basic edition).
Target available for Windows Server 2008 R2 as a separate download. Windows Server 8 has built-in iSCSI target version 3.3 (at least in preview versions).
†† MacOS X has neither initiator nor target coming from vendor directly. There are few MacOS X initiators and targets available but they are from third-party vendors only.
Targets
Most iSCSI targets involve disk, though iSCSI tape and medium-changer targets are popular as well. So far, physical devices have not featured native iSCSI interfaces on a component level. Instead, devices with Parallel SCSIParallel SCSI
Parallel SCSI is one of the interface implementations in the SCSI family. In addition to being a data bus, SPI is a parallel electrical bus: There is one set of electrical connections stretching from one end of the SCSI bus to the other. A SCSI device attaches to the bus but does not interrupt it...
or Fibre Channel
Fibre Channel
Fibre Channel, or FC, is a gigabit-speed network technology primarily used for storage networking. Fibre Channel is standardized in the T11 Technical Committee of the InterNational Committee for Information Technology Standards , an American National Standards Institute –accredited standards...
interfaces are bridged by using iSCSI target software, external bridges, or controllers internal to the device enclosure.
Alternatively, it is possible to virtualize disk and tape targets. Rather than representing an actual physical device, an emulated virtual device is presented. The underlying implementation can deviate drastically from the presented target as is done with virtual tape library
Virtual Tape Library
A virtual tape library is a data storage virtualization technology used typically for backup and recovery purposes. A VTL presents a storage component as tape libraries or tape drives for use with existing backup software.Virtualizing the disk storage as tape allows integration of VTLs with...
(VTL) products. VTLs use disk storage for storing data written to virtual tapes. As with actual physical devices, virtual targets are presented by using iSCSI target software, external bridges, or controllers internal to the device enclosure.
In the security products industry, some manufacturers use an iSCSI RAID as a target, with the initiator being either an IP-enabled encoder or camera.
Converters and bridges
Multiple systems exist that allow Fibre Channel, SCSI and SAS devices to be attached to an IP network for use via iSCSI. They can be used to allow migration from older storage technologies, access to SANs from remote servers and the linking of SANs over IP networks. An iSCSI gateway bridges IP servers to Fibre Channel SANs. The TCP connection is terminated at the gateway, which is implemented on a Fibre Channel switch or as a standalone appliance.See also
- ATA-over-EthernetATA over EthernetATA over Ethernet is a network protocol developed by the Brantley Coile Company, designed for simple, high-performance access of SATA storage devices over Ethernet networks. It is used to build storage area networks with low-cost, standard technologies.- Protocol description :AoE runs on layer 2...
(AoE) - Fibre Channel over EthernetFibre Channel over EthernetFibre Channel over Ethernet is an encapsulation of Fibre Channel frames over Ethernet networks. This allows Fibre Channel to use 10 Gigabit Ethernet networks while preserving the Fibre Channel protocol...
(FCoE) - Fibre Channel over IPFibre Channel over IPFibre Channel over IP , is an Internet Protocol was created by the Internet Engineering Task Force as storage technology....
(FCIP) - HyperSCSIHyperSCSIHyperSCSI was a computer network protocol for accessing storage by sending and receiving SCSI commands.It was developed by researchers at the Data Storage Institute in Singapore in 2000 to 2003....
SCSI over Ethernet frames instead of IP (as iSCSI is) - ISCSI Extensions for RDMAISCSI Extensions for RDMAThe iSCSI Extensions for RDMA is a computer network protocol that extends the Internet Small Computer System Interface protocol to use Remote Direct Memory Access...
(iSER) - Internet Fibre Channel ProtocolInternet Fibre Channel ProtocolInternet Fibre Channel Protocol is a gateway-to-gateway network protocol standard, officially ratified by the Internet Engineering Task Force, which provides Fibre Channel fabric functionality to fibre channel devices over an IP network...
(iFCP) - Internet Storage Name Service (iSNS)
- Service Location ProtocolService Location ProtocolThe Service Location Protocol is a service discovery protocol that allows computers and other devices to find services in a local area network without prior configuration. SLP has been designed to scale from small, unmanaged networks to large enterprise networks...
RFCs
- RFC 3720 - Internet Small Computer Systems Interface (iSCSI)
- RFC 3721 - Internet Small Computer Systems Interface (iSCSI) Naming and Discovery
- RFC 3722 - String Profile for Internet Small Computer Systems Interface (iSCSI) Names
- RFC 3723 - Securing Block Storage Protocols over IP (Scope: The use of IPsec and IKE to secure iSCSI, iFCP, FCIP, iSNS and SLPv2.)
- RFC 3347 - Small Computer Systems Interface protocol over the Internet (iSCSI) Requirements and Design Considerations
- RFC 3783 - Small Computer Systems Interface (SCSI) Command Ordering Considerations with iSCSI
- RFC 3980 - T11 Network Address Authority (NAA) Naming Format for iSCSI Node Names
- RFC 4018 - Finding Internet Small Computer Systems Interface (iSCSI) Targets and Name Servers by Using Service Location Protocol version 2 (SLPv2)
- RFC 4173 - Bootstrapping Clients using the Internet Small Computer System Interface (iSCSI) Protocol
- RFC 4544 - Definitions of Managed Objects for Internet Small Computer System Interface (iSCSI)
- RFC 4850 - Declarative Public Extension Key for Internet Small Computer Systems Interface (iSCSI) Node Architecture
- RFC 4939 - Definitions of Managed Objects for iSNS (Internet Storage Name Service)
- RFC 5048 - Internet Small Computer System Interface (iSCSI) Corrections and Clarifications
- RFC 5047 - DA: Datamover Architecture for the Internet Small Computer System Interface (iSCSI)
- RFC 5046 - Internet Small Computer System Interface (iSCSI) Extensions for Remote Direct Memory Access (RDMA)
External links
- Generic SCSI target for Linux (includes iSCSI, FC, FCoE, IB)
- LIO Unified Target (LinuxLinuxLinux is a Unix-like computer operating system assembled under the model of free and open source software development and distribution. The defining component of any Linux system is the Linux kernel, an operating system kernel first released October 5, 1991 by Linus Torvalds...
standard, includes iSCSI, FCFibre ChannelFibre Channel, or FC, is a gigabit-speed network technology primarily used for storage networking. Fibre Channel is standardized in the T11 Technical Committee of the InterNational Committee for Information Technology Standards , an American National Standards Institute –accredited standards...
, FCoEFibre Channel over EthernetFibre Channel over Ethernet is an encapsulation of Fibre Channel frames over Ethernet networks. This allows Fibre Channel to use 10 Gigabit Ethernet networks while preserving the Fibre Channel protocol...
, IBInfiniBandInfiniBand is a switched fabric communications link used in high-performance computing and enterprise data centers. Its features include high throughput, low latency, quality of service and failover, and it is designed to be scalable...
)