Translate

Total Pageviews

My YouTube Channel

Friday, 26 July 2013

Understanding the vSphere Web Client Architecture

The vSphere Web Client architecture consists of a user interface layer and a service layer. Both layers reside on a Web application server, called the Virgo server. Each layer has a role in communicating with the vSphere environment, retrieving data, and presenting that data to the user’s Web browser.
The user interface layer consists of an Adobe Flex application that is displayed in the user’s Web browser. The Flex application contains all of the user interface elements with which the user interacts, such as menus, navigation elements, data portlets, and commands. The user can navigate through the various Flex elements in the user interface layer to view data on vSphere objects, send commands, and make changes to the vSphere environment.
The exact configuration of the elements in the user interface layer depends on the unique properties of the vSphere environment and other factors such as the level of privileges each user has.
The service layer is a collection of Java services that run in a framework on the vSphere Web Client application server, called the Virgo server. These Java services communicate with vCenter Server and other parts of the vSphere environment, as well as other remote data sources. The Java services gather monitoring data on the virtual infrastructure, which is in turn displayed to the user by the Flex user interface layer. When the user performs an action from the Flex user interface, such as a management or administration command, the Java services perform that command on the virtual infrastructure.

Thanks to Vmware Documentation

Using DRS Affinity Rules

You can control the placement of virtual machines on hosts within a cluster by using affinity rules.
You can create two types of rules.
■
Used to specify affinity or anti-affinity between a group of virtual machines and a group of hosts. An affinity rule specifies that the members of a selected virtual machine DRS group can or must run on the members of a specific host DRS group. An anti-affinity rule specifies that the members of a selected virtual machine DRS group cannot run on the members of a specific host DRS group.
See VM-Host Affinity Rules for information about creating and using this type of rule.
■
Used to specify affinity or anti-affinity between individual virtual machines. A rule specifying affinity causes DRS to try to keep the specified virtual machines together on the same host, for example, for performance reasons. With an anti-affinity rule, DRS tries to keep the specified virtual machines apart, for example, so that when a problem occurs with one host, you do not lose both virtual machines.
See VM-VM Affinity Rules for information about creating and using this type of rule.
When you add or edit an affinity rule, and the cluster's current state is in violation of the rule, the system continues to operate and tries to correct the violation. For manual and partially automated DRS clusters, migration recommendations based on rule fulfillment and load balancing are presented for approval. You are not required to fulfill the rules, but the corresponding recommendations remain until the rules are fulfilled.
To check whether any enabled affinity rules are being violated and cannot be corrected by DRS, select the cluster's DRS tab and click Faults. Any rule currently being violated has a corresponding fault on this page. Read the fault to determine why DRS is not able to satisfy the particular rule. Rules violations also produce a log event.

Raw Device Mapping option is greyed out (1017704)

Symptoms

  • You cannot create a raw device mapping (RDM).
  • If you connect vSphere Client directly to an ESX host, the Raw Device Mappings option is greyed out.

    Note: To access the Raw Device Mappings option, right-click on a virtual machine, choose Edit Settings > Add Hard Disk > Raw Device Mappings
     
  • If you navigate to Configuration > Storage adapters, you cannot see LUNs that are not used as VMFS volumes.
  • If you navigate to Configuration > Storage > Add storage > Disk/LUN, you cannot see LUNs available in the list.

Resolution

The Raw Device Mapping (RDM) option is greyed out if:
  • Your storage type does not support RDMs. For more information, see Comparing Types of Storage in the Configuration Guide for your version of VMware ESX.
  • There are no available LUNs to be presented to an ESX/ESXi host. They may have already been committed to storing VMFS, or have already been mapped to other virtual machines as RDMs.
  • vCenter Server has an older cache of known devices which can be used for RDMs, not including the intended LUN. Rescan your storage to pick up the changes. For more information, see Performing a rescan of the storage (1003988).
  • You are using a SAS Direct Attached Storage (DAS) array that is being detected as Local Storage. For more information, see Creating Raw Device Mapping (RDM) is not supported for local storage (1017530).
  • The option RdmFilter.HbaShared is selected in ESX/ESXi 4.1 or 5.x. To deselect this option, clickConfiguration > Software > Advanced Settings > RDM Filter, deselect the option, then click OK. For more information, see Configuring advanced options for ESX/ESXi (1038578).
  • You are using an external shared SAS storage array like the Dell MD32xx. This requires that the checkboxRdmFilter.HbaShared is deselected in order to use a LUN as RDM. This is expected behavior because the RDM filter only applies to Fiber Channel, FCoE and iSCSI.
Source:-

Disabling or turning Off VMware FT (1008026)

Details


You might need to either disable or turn off the VMware Fault Tolerance (FT) feature. For example, if you are downgrading a license, VMware FT might not be supported by the downgraded license. In such a case, you must first disable or turn off VMware FT for all virtual machines on which VMware FT is currently enabled.

Disabling VMware FT preserves the secondary virtual machines, their configuration, and all history. Use this option if you might re-enable VMware FT in the future. Turning off VMware FT deletes all secondary virtual machines, their configuration, and all history. Use this option if you do not plan to re-enable VMware FT.

Solution

To disable VMware FT on a virtual machine:
  • In the vSphere Client, right-click the virtual machine with Fault Tolerance enabled, click Fault Tolerance, and click Disable Fault Tolerance.
To turn off VMware FT on a virtual machine:
  • In the vSphere Client, right-click the virtual machine with Fault Tolerance enabled, click Fault Tolerance, and click Turn Off Fault Tolerance.
Note: Disabling or turning off VMware FT can be performed whether the virtual machines are powered on or powered off.
Note: If you are downgrading a license and FT is no longer supported by this license, ensure that Fault Tolerance Logging is disabled on the VMkernel Port. For related information, see:
Source:-

Sunday, 21 July 2013

Clone vs. Template

Most of the time frequently asked question is that what is the difference between Clone and Template. So this is the difference between Clone and Template

VM clones are best suited in test and development environments where you want to create, test and work; with exact copies of production servers without disturbing production servers by creating a clone of the production virtual machine.

Templates are best suited for production environments where you want the mass deployment of Virtual Machines along with the installed OS, basic software, and configured settings such as the security policy of your organization, as a base VM. Once a template is deployed, you can install software depending on the role of the server for example IIS or Database.

vCenter Single Sign-On installer reports the error: Error 29155.Identity source discovery error (2034374)

Symptoms

When installing vCenter Server 5.1, you experience these symptoms:
  • During the installation, an attempt is made to automatically discover an Active Directory domain
  • While discovering Identity Sources as part of the vCenter Single Sign-On install, you see the error:

    Error 29155.Identity source discovery error
  • When you click OK in the error dialog, the vCenter Single Sign-On installation continues despite the message
  • Subsequent component installations may fail as the machine is not joined to a domain

Cause

This issue occurs because automatic discovery of an Active Directory domain can sometimes fail, usually due to environmental reasons such as security restrictions.

Resolution

This is a known issue, and is currently being reviewed by VMware. This article will be updated as information becomes available. For related information see the Known issues section in the VMware vCenter Server 5.1.0a release notes.

To work around this issue when you are not able to upgrade, manually add an identity source.

To manually add an identity source:

  1. Skip ahead in installation components and install the vSphere Web Client after the vCenter Single Sign-On installation completes.
  2. Manually add a domain as an identity source using the admin@system-domain account. For more information, seeAdd a vCenter Single Sign-On Identity Source in the vSphere 5.1 Documentation Center.
  3. Resume installing any components that failed to install previously.
Source:-

Thursday, 11 July 2013

Vmware Certification Information

Link For Vmware Certifications:-
http://mylearn.vmware.com/portals/certification/


What is Co-Scheduling?

Proportional Share
ESX uses a proportional share algorithm to schedule virtual machine worlds to run on physical CPUs.  A world is more or less a process.  Thanks to all of the resource management capabilities that ESX provides, it is not always so easy to decide who gets to process first, and for how long.  Typically, if all things are equal, you would just create a list, and have every process execute in turn.  Well, reservations, limits, shares, add an added dimension to that process.  So, ESX factors in that information and creates something called an entitlement.  With that, you now have a world, and a world has an entitlement.  If a world is entitled to a resource, and has not yet consumed it, then it now has priority to be scheduled to run. As and when that world runs, its run time has to be accounted for, so as to keep track of the consumption of the entitlement.  That time is called charging.  In other words, a vm is entitled to resources, and is charged for consumption of those resources.  The vm in essence prepays for “talk time” with its entitlements.  As and when it talks, it is charged for that time, and its balance goes down.  If it hasn’t consumed all of its time, it gets priority when it wants to make a call.  The higher the talk time remaining, the greater its priority.
Simple enough, I suppose, but what happens when a vm has more than a single vCPU to worry about.  This is where co-scheduling comes into play.
Co-Scheduling
Simply put, if you create a virtual machine with more than 1 vCPU, ESX will make every attempt to schedule those worlds to run together.  That is co-scheduling in its simplest terms.  There are additional considerations that have to be made to keep the guest OS happy when you use multiple processors.  The processor access has to be symmetric, hence the Symmetric MultiProcessing in vSMP.  If you have a single vCPU making progress out of a two vCPU configuration, that difference in progress is called skew.  Now, I say progress, instead of simple runtime, because a vCPU can make progress when it uses CPU, or when it halts or idles.
When skew gets beyond a certain threshold, the guest OS will think one of its processors have died.  If you’re lucky, the OS will mark the processor bad, and keep chugging along.  If you’re not lucky, and most of us who have dealt with the physical server world know that when an OS loses a CPU you will not be lucky and the OS will crash and burn.  There’s a reason that most every admin knows the meaning of a BSOD/PSOD or a kernel panic.  How the skew is managed has changed over ESX scheduler iterations, from Strict, to Relaxed, to “even more Relaxed”?
Strict Co-Scheduling
Strict co-scheduling was employed with ESX 2.x.  Under strict co-scheduling, the skew is cumulative per each vCPU of an SMP virtual machine, meaning the skew grows when a vCPU does not make progress relative to any other vCPU in the same vm.  If the skew becomes greater than a set threshold, the entire virtual machine stops processing.  This vm will co-stop and will not be scheduled again, or co-start, until there are enough physical CPUs available to schedule all of the vCPUs simultaneously.  This is an attempt to shrink the skew, and if nothing else, to not allow the skew to grow any larger.  This also ends up causing CPU fragmentation, when a 2 vCPU vm can not run because only 1 pCPU is idle and available to process, causing a scheduling delay until a second physical CPU is ready to go.
This “co-stop penalty” is larger for larger SMP virtual machines, than for smaller, because a greater number of physical CPUs need to be ready to run.  So, a 2 vSMP virtual machine will be scheduled faster than a 4 vSMP virtual machine.  You can see how large this penalty is with esxtop.  The %CSTP counter under CPU represents the % of time the world spent ready to go, but co-descheduled or co-stopped.
Relaxed Co-Scheduling
Then along comes relaxed co-scheduling with ESX 3.x and made things quite a bit better.  Whereas previously, all vCPUs had to be scheduled together, under relaxed co-scheduling, once a skew threshold is reached, the virtual machine stops, but now only has to have enough pCPUs available to allow the vCPUs with high skew to co-start together.  So, in a 4 vCPU virtual machine, if only 2 vCPUs had enough skew, only those are required to co-start together, so only 2 pCPUs need to be available for those vCPU to make progress.  ESX will still make every attempt to co-start all of the vCPUs together, but it is no longer required to do so.  It will take what it can get.
ESX4 Even More Relaxed Co-Scheduling
ESX4 went even further and changed the skew detection to further reduce time spent de-scheduled or in co-stop.  Instead of a cumulative skew per each vCPU, skew is now measured for each vCPU as the difference in progress between each vCPU and the slowest vCPU.  The virtual machine in this case does not have to co-stop all vCPU, and the skewed vCPU co-started together.  Instead, if  any vCPU individually exceeds a threshold, that vCPU will alone be stopped until the other slow vCPUs have caught up.   Now the vCPU can be started by itself.  Again, ESX will attempt to co-schedule all vCPUs together, but it can now individually stop and start vCPUs as needed.
This gives ESX much more opportunities to schedule small and large SMP virtual machines than it could previously, and those virtual machines now perform much better than they had before.
Ultimately, remember that there is a penalty to using vSMP.  Not every application benefits from being given an additional processor to run on and it takes overhead on the part of ESX to track and manage that additional processor.  Balance that cost with the benefit to your application, and use vSMP sparingly.


NAA Id's

After searching around and not finding anything that covers the entire string, I figured I’d throw in what information I have.  I like to label my datastores with my source information, which makes it easy to search and isolate when SAN work has to be performed.  The labels make it easy, but I’m relying on information gathered to create these labels.  So, this is a way, if nothing else, to validate that the information is being applied to the correct identifier.

The identifier comes in the form of naa.aaaaaaaabbbbbbbbbbbbccdddddddddd .  I’ve been able to find a somewhat reliable means to describe a, b, and d, but for some odd reason, c does not quite fit in.  But, for what it’s worth, I’ve been able to gather vendor, device, and lun.
The breakdown is as follows:
  • aaaaaaaa is an 8 digit vendor identifier, and I’ve listed the vendors we use below, as well as others I’ve been able to find online:
    • 60060480 <— EMC
    • 60060e80 <— HDS
    • 60a98000 <— NetApp
    • 60060160 <— DGC (Clarrion?)
    • 6090a038 <— EQL
  • bbbbbbbbbbbb is a 12 digit serial # of the device providing the storage.  This may differ from device to device, but matches up perfectly to the id’s from our Symm.  Our mileage may vary, but it’s held up so far.
  • cc is a 2 digit code for something.  No idea as of yet, and I’ve managed to stump some other smart folks.  If anyone has any ideas on this one, please share.  It’s very frustrating to puzzle out 30 / 32 digits, and leave 2 digits in the wind.
  • dddddddddd is a 10 digit LUN identifier.  This differed based on the device on how the device ID is actually represented.
    • HDS – was the most straightforward.  It represented in the naa id, the actual device ID being used on the array side.
    • EMC – was very confusing.  You will have to take the 10 digits in pairs, that will give you the ASCII code in hex, for the pair, which after being concatenated give  you the device id.  Very straightforward, I know.  Here’s an example:
      • 60060480bbbbbbbbbbbb533031464446
      • 60060480 makes this EMC
      • bbbbbbbbbbbb serial number which I’ll keep to myself.
      • 53 which will drive me crazy
      • 3031464446 –> which will break down to 30  31  46  44  46 –> which gives us a device id of 01FDF
        • 30 –> converted to decimal from hex= 48 –> which in ASCII = 0
        • 31 –> converted to decimal from hex= 49 –> which in ASCII = 1
        • 46 –> converted to decimal from hex= 70 –> which in ASCII = F
        • 44 –> converted to decimal from hex= 68 –> which in ASCII = D
        • 46 –> converted to decimal from hex= 70 –> which in ASCII = F

Tuesday, 25 June 2013

Thin Provisioned Disk and Microsoft Operating System

When using thin provisioned disks with Microsoft operating systems such as Windows 2008 or Windows 7, if you perform a Full Format of the disk, this will inflate the thin provisioned disk to the full size. To avoid this situation, select the option to perform a Quick Format. For more information, see the Microsoft article 941961.

Sample Configuration - Network Load Balancing (NLB) Multicast Mode Configuration (1006558)

Purpose

Setting up NLB Multicast Mode

Multicast mode does not have the problem that unicast operation does since the servers can communicate with each other via the original addresses of their NLB network cards.
Each server's NLB network card operating in multicast mode has two MAC addresses (the original one and the virtual one for the cluster), which causes some problems. Most routers reject the ARP replies sent by hosts in the cluster, since the router sees the response to the ARP request that contains a unicast IP address with a multicast MAC address. The router considers this to be invalid and rejects the update to the ARP table. In this case, you need to manually Configure Static ARP Resolution at the switch or router for each port connecting to ESX's NICs. For related information, see Sample Configuration - Network Load Balancing (NLB) Multicast mode over routed subnet - Cisco Switch Static ARP Configuration (1006525).

Resolution

These versions of Windows are recommended:
  • Microsoft Windows 2008 Server
  • Microsoft Windows 2008 R2
  • Microsoft Windows 2003 Server and later
  • Microsoft Windows 2000 Server with Load Balancing
Note: To troubleshoot issues related NLB, contact Microsoft Support.
To configure NLB in Windows Server 2003:
Note: Each NLB cluster node is required to have NLB enabled and configured with the same cluster IP address and FQDN.
  1. Go to Local Area Connection Properties > General tab > Check Network Load Balancing.
  2. Click Properties.
  3. Click the Cluster Parameters tab.
  4. Enter the Cluster IP address.
  5. Select the Multicast option.



    Note
    : Click to enlarge image.
  6. Click the Host Parameters tab
  7. Set the Priority (unique host identifier).
  8. Enter the dedicated host IP. This is the same as the NIC IP. (From the example above this would be 192.168.1.10 for the first host)
  9. Click OK.

     

    Note
    : Click to enlarge image.
  10. Select Networking Protocols TCP/IP
  11. Enter the dedicated host IP specified in Step 8.
  12. Click Advanced.
  13. Click Add.
  14. Enter the Cluster IP.
  15. Click OK.



    Note
    : Click to enlarge image.
For more information on weak and strong host behavior in Windows, see the Microsoft Technet articlehttp://technet.microsoft.com/en-us/magazine/2007.09.cableguy.aspx.
For more information on configuring Network Load Balancing (NLB) on Windows Server 2008, see the Microsoft Technet article http://technet.microsoft.com/en-us/library/cc771300(WS.10).aspx.
 
Note: The preceding links were correct as of December 16, 2011. If you find a link is broken, provide feedback and a VMware employee will update the link.

Source:-

Sample Configuration - Network Load Balancing (NLB) unicast mode configuration (1006778)

Purpose

Requirements and notes for setting up NLB unicast mode:
  • Two machines running Windows Server 2003 or later
  • Each machine should have at least two network cards and at least one fixed IP address
  • VMware recommends two adapters in each machine for best performance
  • One adapter mapped to the real IP address (Microsoft calls this the Dedicated IP), and one mapped to the virtual IP address (Microsoft calls this the Cluster IP)
  • A second network card is required for communication between the servers
Notes:
  • A benefit of unicast mode is that it works out of the box with all routers and switches (since each network card only has one MAC address)
  • In unicast mode, since all hosts in the cluster have the same MAC and IP address, they do not have the ability to communicate with each other via their NLB network card

Resolution

To configure NLB unicast mode:

  1. NLB unicast mode requires two NICs.
  2. Add two virtual NICs to NLB-configured virtual machines.
  3. Use the Add New Hardware wizard to add new hardware to the virtual machine. The virtual hardware that you add appears in the hardware list displayed in the Virtual Machine Properties wizard. The selected guest operating system determines the devices that are available to be added to a given virtual machine.
  4. Add an Ethernet adapter (NIC):

    1. Start the Add Hardware wizard.
    2. Click Ethernet Adapter, and click Next.
    3. In the Network connection panel, choose either a named network with a specified label or a legacy network.
    4. To connect the virtual NIC when the virtual machine is powered on, select Connect at power on.
    5. To complete the wizard, click Finish.
Notes:
  • ESXi/ESX vSwitch properties Notify Switches = NO
  • Unicast mode reassigns the station (MAC) address of the network adapter for which it is enabled and all cluster hosts are assigned the same MAC (media access control) address, you cannot have ESXi/ESX send ARP or RARP to update the physical switch port with the actual MAC address of the NICs as this break the the unicast NLB communication
  • ESXi/ESX vSwitch security properties must be set to default, Forged Transmits = Accept.
  • VMware recommends configuring the cluster to use NLB multicast mode even though NLB unicast mode should function correctly if you complete these steps. This recommendation is based on the possibility that the settings described in these steps might affect vMotion operations on virtual machines. Also, unicast mode forces the physical switches on the LAN to broadcast all NLB cluster traffic to every machine on the LAN. For more information on the differences, seeMicrosoft Network Load Balancing Multicast and Unicast operation modes (1006580). If you plan to use NLB unicast mode, note that:

    • All members of the NLB cluster must be running on the same ESXi/ESX host.
    • All members of the NLB cluster must be connected to the single portgroup on the virtual switch
    • vMotion for unicast NLB virtual machines is not supported (unless you want to migrate all NLB members to a different ESXi/ESX host)
  • For troubleshooting information see: Microsoft NLB not working properly in Unicast Mode (1556).
  • Unicast NLB is not supported on the Cisco Nexus 1000V Switches, except version 4.2(1) SV1(5.1) and later.

    Note: The preceding link was correct as of December 4, 2012. If you find the link is broken, provide feedback and a VMware employee will update the link.

Example screen shots:



Additional Information

Weak and strong host behavior in Windows

Windows XP and Windows Server 2003 use the weak host model for sends and receives for all IPv4 interfaces, and the strong host model for sends and receives for all IPv6 interfaces. You cannot configure this behavior.

The Next Generation TCP/IP stack in Windows Vista and Windows Server 2008 supports strong host sends and receives for both IPv4 and IPv6 by default on all interfaces, except the Teredo tunneling interface for a Teredo host-specific relay. For more information, see Strong and Weak Host Models on the Microsoft TechNet site.

Note: The preceding link was correct as of December 4, 2012. If you find the link is broken, provide feedback and a VMware employee will update the link.

To change this behavior and revert to the weak host model (which was used in Server 2003), open a Windows command prompt and run these commands:

netsh interface ipv4 set interface "Local Area Connection" weakhostreceive=enable
netsh interface ipv4 set interface "Local Area Connection" weakhostsend=enable


To verify that the changes are in effect, run this command:

netsh interface ipv4 show interface "Local Area Connection"

Where Local Area Connection is the name of the network interface obtained from running ipconfig /all from a Windows command prompt.
Source:-

Configuring CHAP Parameters for iSCSI Adapters

CHAP uses a three-way handshake algorithm to verify the identity of your host and, if applicable, of the iSCSI target when the host and target establish a connection. The verification is based on a predefined private value, or CHAP secret, that the initiator and target share.
ESXi supports CHAP authentication at the adapter level. In this case, all targets receive the same CHAP name and secret from the iSCSI initiator. For software and dependent hardware iSCSI adapters, ESXi also supports per-target CHAP authentication, which allows you to configure different credentials for each target to achieve greater level of security.
ESXi supports one-way CHAP for all types of iSCSI initiators, and mutual CHAP for software and dependent hardware iSCSI.
Before configuring CHAP, check whether CHAP is enabled at the iSCSI storage system and check the CHAP authentication method the system supports. If CHAP is enabled, enable it for your initiators, making sure that the CHAP authentication credentials match the credentials on the iSCSI storage.
ESXi supports the following CHAP authentication methods:
One-way CHAP
In one-way CHAP authentication, also called unidirectional, the target authenticates the initiator, but the initiator does not authenticate the target.
Mutual CHAP
In mutual CHAP authentication, also called bidirectional, an additional level of security enables the initiator to authenticate the target. VMware supports this method for software and dependent hardware iSCSI adapters only.
For software and dependent hardware iSCSI adapters, you can set one-way CHAP and mutual CHAP for each initiator or at the target level. Independent hardware iSCSI supports CHAP only at the initiator level.
When you set the CHAP parameters, specify a security level for CHAP.
Note
When you specify the CHAP security level, how the storage array responds depends on the array’s CHAP implementation and is vendor specific. For example, when you select Use CHAP unless prohibited by target, some storage arrays use CHAP in response, while others do not. For information on CHAP authentication behavior in different initiator and target configurations, consult the array documentation.
CHAP Security Level
CHAP Security Level
Description
Supported
Do not use CHAP
The host does not use CHAP authentication. Select this option to disable authentication if it is currently enabled.
Software iSCSI
Dependent hardware iSCSI
Independent hardware iSCSI
Do not use CHAP unless required by target
The host prefers a non-CHAP connection, but can use a CHAP connection if required by the target.
Software iSCSI
Dependent hardware iSCSI
Use CHAP unless prohibited by target
The host prefers CHAP, but can use non-CHAP connections if the target does not support CHAP.
Software iSCSI
Dependent hardware iSCSI
Independent hardware iSCSI
Use CHAP
The host requires successful CHAP authentication. The connection fails if CHAP negotiation fails.
Software iSCSI
Dependent hardware iSCSI
You can set up all targets to receive the same CHAP name and secret from the iSCSI initiator at the initiator level. By default, all discovery addresses or static targets inherit CHAP parameters that you set up at the initiator level.
The CHAP name should not exceed 511 alphanumeric characters and the CHAP secret should not exceed 255 alphanumeric characters. Some adapters, for example the QLogic adapter, might have lower limits, 255 for the CHAP name and 100 for the CHAP secret.
■
Before setting up CHAP parameters for software or dependent hardware iSCSI, determine whether to configure one-way or mutual CHAP. Independent hardware iSCSI adapters do not support mutual CHAP.
■
In one-way CHAP, the target authenticates the initiator.
■
In mutual CHAP, both the target and the initiator authenticate each other. Use different secrets for CHAP and mutual CHAP.
When you configure CHAP parameters, verify that they match the parameters on the storage side.
■
Required privilege: Host.Configuration.Storage Partition Configuration
1
Access the iSCSI Initiator Properties dialog box.
2
On the General tab, click CHAP.
3
To configure one-way CHAP, under CHAP specify the following:
a
Select the CHAP security level.
■
Do not use CHAP unless required by target (software and dependent hardware iSCSI only)
■
Use CHAP unless prohibited by target
■
Use CHAP (software and dependent hardware iSCSI only). To configure mutual CHAP, you must select this option.
b
Specify the CHAP name.
Make sure that the name you specify matches the name configured on the storage side.
■
To set the CHAP name to the iSCSI initiator name, select Use initiator name.
■
To set the CHAP name to anything other than the iSCSI initiator name, deselect Use initiator name and type a name in the Name text box.
c
Enter a one-way CHAP secret to be used as part of authentication. Use the same secret that you enter on the storage side.
4
To configure mutual CHAP, first configure one-way CHAP by following the directions in Step 3.
Make sure to select Use CHAP as an option for one-way CHAP. Then, specify the following under Mutual CHAP:
a
Select Use CHAP.
b
Specify the mutual CHAP name.
c
Enter the mutual CHAP secret. Make sure to use different secrets for the one-way CHAP and mutual CHAP.
5
Click OK.
6
Rescan the initiator.
If you change the CHAP or mutual CHAP parameters, they are used for new iSCSI sessions. For existing sessions, new settings are not used until you log out and log in again.
For software and dependent hardware iSCSI adapters, you can configure different CHAP credentials for each discovery address or static target.
When configuring CHAP parameters, make sure that they match the parameters on the storage side. The CHAP name should not exceed 511 and the CHAP secret 255 alphanumeric characters.
Required privilege: Host.Configuration.Storage Partition Configuration
Before setting up CHAP parameters for software and dependent hardware iSCSI, determine whether to configure one-way or mutual CHAP.
■
In one-way CHAP, the target authenticates the initiator.
■
In mutual CHAP, both the target and initiator authenticate each other. Make sure to use different secrets for CHAP and mutual CHAP.
1
Access the iSCSI Initiator Properties dialog box.
2
Select either Dynamic Discovery tab or Static Discovery tab.
3
From the list of available targets, select a target you want to configure and click Settings > CHAP.
4
Configure one-way CHAP in the CHAP area.
a
Deselect Inherit from parent.
b
Select one of the following options:
■
Do not use CHAP unless required by target
■
Use CHAP unless prohibited by target
■
Use CHAP. To be able to configure mutual CHAP, you must select this option.
c
Specify the CHAP name.
Make sure that the name you specify matches the name configured on the storage side.
■
To set the CHAP name to the iSCSI initiator name, select Use initiator name.
■
To set the CHAP name to anything other than the iSCSI initiator name, deselect Use initiator name and enter a name in the Name field.
d
Enter a one-way CHAP secret to be used as part of authentication. Make sure to use the same secret that you enter on the storage side.
5
To configure mutual CHAP, first configure one-way CHAP by following directions in Step 4.
Make sure to select Use CHAP as an option for one-way CHAP. Then, specify the following in the Mutual CHAP area:
a
Deselect Inherit from parent.
b
Select Use CHAP.
c
Specify the mutual CHAP name.
d
Enter the mutual CHAP secret. Make sure to use different secrets for the one-way CHAP and mutual CHAP.
6
Click OK.
7
Rescan the initiator.
If you change the CHAP or mutual CHAP parameters, they are used for new iSCSI sessions. For existing sessions, new settings are not used until you log out and login again.
You can disable CHAP if your storage system does not require it.
If you disable CHAP on a system that requires CHAP authentication, existing iSCSI sessions remain active until you reboot your host, end the session through the command line, or the storage system forces a logout. After the session ends, you can no longer connect to targets that require CHAP.
Required privilege: Host.Configuration.Storage Partition Configuration
1
Open the CHAP Credentials dialog box.
2
For software and dependent hardware iSCSI adapters, to disable just the mutual CHAP and leave the one-way CHAP, select Do not use CHAP in the Mutual CHAP area.
3
To disable one-way CHAP, select Do not use CHAP in the CHAP area.
The mutual CHAP, if set up, automatically turns to Do not use CHAP when you disable the one-way CHAP.
4
Click OK.

Thanks to Vmware Documentation