<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:48:06" />
    <title>Enforcing Access Control  </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1926;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1076790"> </a><h1 class="pTitle">
Enforcing Access Control 

</h1>
<a name="wp1076793"> </a><p class="pBody">
IPS modules and MPS-14/2 modules use both iSCSI and Fibre Channel zoning-based access control lists 
to enforce access control. Access control is enforced both during the iSCSI discovery phase and the 
iSCSI session creation phase. Access control enforcement is not required during the I/O phase because 
the IPS module or MPS-14/2 module is responsible for the routing of iSCSI traffic to Fibre Channel.

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1076796"> </a><li class="pSmartList1">iSCSI discovery phase&#8212;When an iSCSI host creates an iSCSI discovery session and queries for all 
iSCSI targets, the IPS module or MPS-14/2 module returns only the list of iSCSI targets this iSCSI 
host is allowed to access based on the access control policies discussed in the previous section. The 
IPS module or MPS-14/2 module does this by querying the Fibre Channel name server for all the 
devices in the same zone as the initiator in all VSANs. It then filters out the devices that are initiators 
by looking at the FC4-feature field of the FCNS entry. (If a device does not register as either initiator 
or target in the FC4-feature field, the IPS module or MPS-14/2 module will advertise it). It then 
responds to the iSCSI host with the list of targets. Each will have either a static iSCSI target name 
that you configure or a dynamic iSCSI target name that the IPS module or MPS-14/2 module creates 
for it (see the <a href="ciscsi005.html">&quot;Dynamic Mapping&quot; topic</a>).
</li>
<a name="wp1076802"> </a><li class="pSmartList1">iSCSI session creation&#8212;When an IP host initiates an iSCSI session, the IPS module or MPS-14/2 
module verifies if the specified iSCSI target (in the session login request) is allowed by both the 
access control mechanisms described in the <a href="ciscsi018.html">&quot;iSCSI-Based Access Control&quot; topic</a>. 
</li>
<a name="wp1076807"> </a><p class="pListBodyLevel1">
If the iSCSI target is a static mapped target, the IPS module or MPS-14/2 module verifies if the 
iSCSI host is allowed within the access list of the iSCSI target. If the IP host does not have access, 
its login is rejected. If the iSCSI host is allowed, it validates if the virtual Fibre Channel N port used 
by the iSCSI host and the Fibre Channel target mapped to the static iSCSI virtual target are in the 
same Fibre Channel zone. 

</p>
<a name="wp1076809"> </a><p class="pListBodyLevel1">
If the iSCSI target is an autogenerated iSCSI target, then the IPS module or MPS-14/2 module 
extracts the WWN of the Fibre Channel target from the iSCSI target name and verifies if the initiator 
and the Fibre Channel target  is in the same Fibre Channel zone or not. If they are, then access is 
allowed.

</p>
</ul></div>
<a name="wp1076810"> </a><p class="pBody">
The IPS module or MPS-14/2 module uses the Fibre Channel virtual N port of the iSCSI host and does 
a zone-enforced name server query for the Fibre Channel target WWN. If the FC ID is returned by the 
name server, then the iSCSI session is accepted. Otherwise, the login request is rejected.

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
