> # Configuring CHAP with External RADIUS Server

> ## Detailed Steps

> To configure authentication using the CHAP option with an external RADIUS server, follow these steps:

> 1. Configure the password for the Cisco MDS switch as RADIUS client to the RADIUS server:
> 1. In Cisco DCNM-SAN, choose Switches > Security > AAA > RADIUS in the Physical Attributes pane.
> 2. Click the Default tab in the Information pane.
> 3. Set the AuthKey field to the default password and click the Apply Changes icon.
> 2. Configure the RADIUS server IP address:
> 1. In Cisco DCNM-SAN, choose Switches > Security > AAA > RADIUS in the Physical Attributes pane.
> 2. Click the Server tab in the Information pane and click Create Row.
> 3. Set the Index field to a unique number.
> 4. Set the IP Type radio button to ipv4 or ipv6.
> 5. Set the Name or IP Address field to the IP address of the RADIUS server and click Create.
> 3. Create a RADIUS server group and add the RADIUS server to the group:
> 1. In Cisco DCNM-SAN, choose Switches > Security > AAA in the Physical Attributes pane.
> 2. Select the Server Groups tab in the Information pane and click Create Row.
> 3. Set the Index field to a unique number.
> 4. Set the Protocol radio button to radius.
> 5. Set the Name field to the server group name.
> 6. Set the ServerIDList to the index value of the RADIUS server (as created in Step 2 c.) and click Create.
> 4. Set up the authentication verification for the iSCSI protocol to go to the RADIUS server.
> 1. In Cisco DCNM-SAN, choose Switches > Security > AAA in the Physical Attributes pane.
> 2. Click the Applications tab in the Information pane.
> 3. Right-click on the iSCSI row in the Type, SubType, Function column.
> 4. Set the ServerGroup IDList to the index value of the Server Group (as created in Step 3 c) and click Create.
> 5. Set up the iSCSI authentication method to require CHAP for all iSCSI clients.
> 1. In Cisco DCNM-SAN, choose End Devices > iSCSI in the Physical Attributes pane.
> 2. Select chap from the AuthMethod drop-down menu.
> 3. Click the Apply Changes icon.
> 6. In Cisco DCNM-SAN, choose End Devices > iSCSI in the Physical Attributes pane.
> 7. Click the Globals tab in the Information pane to verify that the global iSCSI authentication setup is for CHAP.
> 8. In Cisco DCNM-SAN, choose Switches > Security > AAA in the Physical Attributes pane.
> 9. Click the Applications tab in the Information pane to verify the AAA authentication information for iSCSI.

> To configure an iSCSI RADIUS server, follow these steps:

> 1. Configure the RADIUS server to allow access from the Cisco MDS switch's management Ethernet IP address.
> 2. Configure the shared secret for the RADIUS server to authenticate the Cisco MDS switch.
> 3. Configure the iSCSI users and passwords on the RADIUS server.

> Copyright 2010-2015, Cisco Systems, Inc. All rights reserved.