Nimble iSCSI CHAP and VMware VVols

[spjon1]

I have a Nimble HF40 running NOS 6.1.1.100 connected via iSCSI to two HP DL580 G10s running ESXi 7.0.3 update i. As of NOS 6.1 there is support for setting up CHAP security for iSCSI when using VVols. I've setup CHAP according to the HPE VMware Integration gude for NOS 6.1., but I can't seem to get the connection to use CHAP. How can I get the VVol connections to autheticate using CHAP?

[Vipin_S]

Hello,
Please refer the below article from Vmware Docs which talks about CHAP Authentication and setup. Make sure you validate the same with your configuration.

Set Up CHAP for Target
If you use software and dependent hardware iSCSI adapters, or an iSER storage adapter, you can
configure different CHAP credentials for each discovery address or static target.
The CHAP name cannot exceed 511 and the CHAP secret 255 alphanumeric characters.
Prerequisites
n Before setting up CHAP parameters, determine whether to configure unidirectional or
bidirectional CHAP.
n Verify CHAP parameters configured on the storage side. Parameters that you configure must
match the ones on the storage side.
n Required privilege: Host.Configuration.Storage Partition Configuration
Procedure
1 Navigate to the iSCSI or iSER storage adapter.
a In the vSphere Client, navigate to the ESXi host.
b Click the Configure tab.
c Under Storage, click Storage Adapters, and select the adapter (vmhba#) to configure.
2 Click either Dynamic Discovery or Static Discovery.
3 From the list of available targets, select a target to configure and click Authentication.
4 Deselect Inherit settings from parent and specify authentication method.
n None
n Use unidirectional CHAP if required by target
n Use unidirectional CHAP unless prohibited by target
n Use unidirectional CHAP
n Use bidirectional CHAP. To configure bidirectional CHAP, you must select this option.
5 Specify the outgoing CHAP name.
Make sure that the name you specify matches the name configured on the storage side.
n To set the CHAP name to the iSCSI adapter name, select Use initiator name.
n To set the CHAP name to anything other than the iSCSI initiator name, deselect Use
initiator name and enter a name in the Name text box.
6 Enter an outgoing CHAP secret to be used as part of authentication. Use the same secret that
you enter on the storage side.

7 If configuring bidirectional CHAP, specify incoming CHAP credentials.
Make sure to use different secrets for the outgoing and incoming CHAP.
8 Click OK.
9 Rescan the storage adapter.
Results
If you change the CHAP parameters, they are used for new iSCSI sessions. For existing sessions,
new settings are not used until you log out and login again

https://docs.vmware.com/en/VMware-vSphere/7.0/vsphere-esxi-vcenter-server-701-storage-guide.pdf?hWord=N4IghgNiBcIG5wPYQM4AIwDsAmaDGAFmAA4gC+QA

If you still experiance issue - Please contact the support team @supportcase@nimblestorage.com
Tel (US): +1-877-364-6253 | Tel (UK): +44-808-134-9962 | Tel (AU): 1-800-751-916 |Tel (IN): 000-800-100-7390 | Tel (SG): +65-800-852-3823 

List of support contact number for other countries: https://h20195.www2.hpe.com/v2/Getdocument.aspx?docname=a00050207enw

[Mahesh202]

Hi spjon

If you have configured CHAP according to the HPE VMware Integration guide for NOS 6.1 and are still unable to get the VVol connections to authenticate using CHAP, there are a few things you can check:

1. Verify that the CHAP settings on the Nimble array and the ESXi hosts match. Make sure that the CHAP usernames and passwords are identical on both sides.

2. Ensure that the iSCSI initiator on the ESXi hosts is configured to use CHAP authentication. You can do this by going to the iSCSI Initiator Properties in the vSphere Client, selecting the Dynamic Discovery tab, selecting the Nimble array, and clicking on the CHAP button. Here you can enter the CHAP credentials for the Nimble array.

3. Verify that the VVol datastore is configured to use the correct CHAP credentials. You can do this by going to the Storage Providers tab in the vSphere Client, selecting the Nimble storage provider, and clicking on the Configure tab. Here you can enter the CHAP credentials for the Nimble array.

4. Check the Nimble array logs to see if there are any error messages related to CHAP authentication. You can access the logs from the Nimble array web interface.

If you have verified all of the above and are still unable to get the VVol connections to authenticate using CHAP, you may want to contact HPE Nimble support for further assistance.

Hope this helps.!!

Regards
Mahesh