VMware ESXi and vSphere Cluster Management

Configure Unidirectional iSCSI CHAP Authentication on VMware ESXi

Learn how to configure, coordinate, and verify unidirectional iSCSI CHAP authentication for an ESXi software iSCSI adapter in the vSphere Web Client.

Challenge-Handshake Authentication Protocol (CHAP) authenticates an iSCSI session when an ESXi host connects to storage. This lesson shows how to configure unidirectional CHAP for the ESXi software iSCSI adapter, configure the matching storage-side policy, and verify that targets, LUNs, paths, and datastores remain available.

What CHAP Does for iSCSI

iSCSI is a storage protocol that transports SCSI block-storage commands over an IP network. ESXi is VMware's bare-metal hypervisor. In this scenario, the ESXi software iSCSI adapter acts as the initiator, meaning it starts the iSCSI session. The storage array, NAS, SAN appliance, or iSCSI server acts as the target, meaning it presents block devices or LUNs.

CHAP validates the initiator's identity during iSCSI login. The target challenges the initiator, and the initiator proves knowledge of a shared secret without sending that secret as ordinary cleartext in the login exchange. The username and secret are configured on both sides.

CHAP is an authentication mechanism, not an encryption mechanism. It does not encrypt iSCSI commands or block-storage data after the session is established. Use a suitably isolated storage network and additional encryption controls where your security requirements demand them.

Unidirectional and Mutual CHAP

Mode	Who Authenticates	Typical Use	Configuration Requirement
No authentication	Neither endpoint authenticates with CHAP.	Environments that rely on other access controls and do not require CHAP.	Target access controls and network security still need to be configured.
Unidirectional CHAP	The ESXi initiator authenticates to the storage target.	Common iSCSI access control where the target must verify each ESXi host.	Matching CHAP username and secret must be configured for the initiator's target access.
Mutual CHAP	The initiator authenticates to the target, and the target also authenticates to the initiator.	Environments that require two-way endpoint authentication.	Both directions require compatible identities and secrets.

This procedure focuses on unidirectional CHAP: the ESXi initiator proves its identity to the storage target.

Prerequisites and Planning

Confirm that the ESXi software iSCSI adapter is enabled and is the adapter used for the intended targets.
Confirm that one or more iSCSI VMkernel adapters provide the required storage network path. A VMkernel adapter is an ESXi network interface used for host services such as iSCSI traffic.
Verify IP addressing, VLANs, routing or directly connected storage networks, and target reachability according to your storage design.
Collect the target discovery address or addresses and any existing static target information. Discovery may use addresses supplied by the storage administrator.
Obtain the exact CHAP username and shared secret defined, or to be defined, on the storage system.
Ensure CHAP is enabled for the relevant storage initiator, target, LUN, or access policy. The location depends on the array, NAS, SAN, or iSCSI server platform.
Confirm that the storage target's access control list or initiator policy permits the ESXi initiator and the intended LUNs.

Locate the Software iSCSI Adapter in vSphere

The vSphere Web Client is the graphical vSphere management interface used to administer ESXi hosts and storage settings. Use the inventory and storage views to reach the host's software iSCSI adapter.

Select the intended ESXi host in the vSphere inventory.
Open the host's storage management area and display its storage adapters.
Identify the adapter labeled as the software iSCSI adapter. Do not change authentication on an unrelated Fibre Channel, SAS, NVMe, or other storage adapter.
Open the adapter properties, edit action, or authentication settings for that software iSCSI adapter.

Before changing a production adapter, record the adapter identity, configured discovery addresses, current target access arrangement, and the planned rollback procedure. Avoid recording the CHAP secret itself.

Configure Unidirectional CHAP on ESXi

In the software iSCSI adapter's properties or authentication settings, select unidirectional CHAP.
Enter the CHAP name or username approved by the storage administrator.
Enter the corresponding CHAP secret. Confirm the value carefully, but do not expose it in a screenshot or copied text.
Save, apply, or otherwise commit the adapter authentication configuration.
If the interface indicates that existing sessions must reconnect, schedule or perform that action according to the storage change plan.
Rescan the iSCSI host bus adapter after the credentials are configured.

vSphere Web Client workflow:
Select ESXi host
  -> Storage management
  -> Storage adapters
  -> Software iSCSI adapter
  -> Adapter properties or authentication
  -> Unidirectional CHAP
  -> CHAP name and secret
  -> Save or apply
  -> Rescan adapter

The names of buttons such as Edit, Properties, Authentication, Apply, and Rescan can differ by vSphere version. Select the equivalent controls for the software iSCSI adapter.

Configure the Corresponding Storage-Side Authentication

Changing ESXi alone does not create a successful authenticated session. The storage system must also accept the same identity and secret for the relevant access relationship.

Open the storage platform's iSCSI target, initiator access, or authentication configuration.
Enable unidirectional CHAP for the applicable target or initiator access rule.
Assign the same CHAP username and shared secret used on the ESXi software iSCSI adapter.
Associate the ESXi initiator with the intended target and permit access to the required LUNs.
Apply the storage configuration according to the platform's change process.

Storage workflows vary between arrays, NAS devices, SAN systems, and general-purpose iSCSI servers. The important result is that the target's authentication policy, CHAP identity, initiator permission, and LUN mapping all agree with the ESXi configuration.

Setting	ESXi Location	Storage-System Location	Validation Notes
Authentication mode	Software iSCSI adapter authentication settings.	Target or initiator access policy.	Both sides must use compatible unidirectional CHAP settings.
CHAP username	CHAP name or username field on the adapter.	CHAP identity associated with the target access rule.	Compare spelling, capitalization, and any permitted character restrictions.
CHAP secret	CHAP secret field on the adapter.	Shared secret stored by the target policy.	Re-enter it securely if uncertain; never disclose it while troubleshooting.
Target and initiator access association	Configured discovery and target relationship.	Initiator ACL, target access rule, and LUN mapping.	The correct ESXi initiator must be allowed to use the intended LUNs.

Rescan and Validate Storage Connectivity

A HBA rescan is a storage adapter scan that rediscovers targets, paths, and devices. Rescan the software iSCSI adapter after changing authentication. If an existing session remains active, a reconnect may be needed before the new credentials take effect.

Initiate a rescan for the software iSCSI adapter from the host's storage management view.
Verify that the expected iSCSI targets are discovered or reconnected.
Verify that the expected devices and LUNs appear. A LUN is a logical unit of block storage presented by a target.
Check that expected paths are present and have a healthy status.
Confirm that existing datastores remain mounted and accessible.
For a newly added datastore, confirm that the presented LUN can be selected for VMFS datastore creation or mounting according to your change plan.

Check	Expected Result	Where to Verify
iSCSI session	The software initiator has an authenticated session to the intended target.	Host storage adapter and target/session details.
Target discovery	Expected target addresses and target identifiers are visible.	Dynamic or static discovery and discovered-target views.
Device or LUN visibility	Expected block devices are present with the correct capacity and identifiers.	Storage devices view.
Path status	Expected paths are active or otherwise healthy according to the multipathing design.	Device path details.
Datastore availability	Existing datastores remain mounted and usable; a new datastore can use the intended LUN.	Datastores and datastore summary views.

Practical Configuration Examples

Enable CHAP for a New iSCSI Datastore

Create or identify a dedicated iSCSI VMkernel network path and verify its connectivity to the storage network.
Enable the ESXi software iSCSI adapter and add the target discovery information.
On the storage system, configure the target, initiator access rule, CHAP identity, secret, and LUN mapping.
On ESXi, select the software iSCSI adapter, choose unidirectional CHAP, and enter the matching identity and secret.
Save the adapter settings, reconnect sessions if required, and rescan the adapter.
Confirm the target, presented LUN, paths, and datastore workflow before making the datastore available to workloads.

Use One CHAP Identity Across Multiple ESXi Hosts

When a shared target is accessed by multiple hosts, configure the intended authentication settings consistently on every host. Each host still needs valid iSCSI VMkernel networking, target discovery, and storage-side initiator permission. Validate each host independently and confirm that all hosts discover the same shared datastore and expected paths.

Some organizations use a shared identity for a host group, while others assign a distinct identity per host. Follow the storage platform's access-control model and your organization's security policy; do not assume that a username that works on one host is automatically authorized for another.

Rotate a CHAP Secret with Minimal Disruption

Plan a maintenance window and inventory every ESXi host, software iSCSI adapter, target, and datastore using the credential.
Determine the storage platform's supported order for changing the target policy and reconnecting initiators.
Update credentials in a coordinated sequence, avoiding a period in which active production sessions cannot authenticate.
Rescan or reconnect sessions and validate device visibility after each host or host group is changed.
Retain rollback information according to credential-handling policy, without placing the secret in general-purpose notes or logs.

Operational and Security Considerations

Use unique, sufficiently strong CHAP secrets and protect them like other infrastructure credentials.
Coordinate secret rotation on ESXi and the storage target. An unmatched rotation can interrupt storage access.
Document which hosts, software iSCSI adapters, targets, LUNs, and CHAP identities are associated. Store documentation in an access-controlled system.
Use dedicated or appropriately isolated storage networking, including suitable VLAN and routing controls.
Remember that CHAP authenticates the session but does not encrypt iSCSI traffic. Apply suitable encryption controls when required by policy or threat model.
Do not place real secrets in screenshots, support bundles intended for broad distribution, command history, configuration examples, or troubleshooting messages.

Troubleshooting

Target or LUN Is Not Discovered After Enabling CHAP

Likely causes: The CHAP name or secret differs, CHAP is enabled on only one side, the wrong adapter was configured, or target discovery and network connectivity are incomplete.
Actions: Compare the authentication mode and username on both endpoints. Re-enter the secret carefully without disclosing it. Confirm that the selected adapter is the software iSCSI adapter used for the target. Validate VMkernel reachability, discovery addresses, target configuration, initiator permissions, and LUN mapping. Rescan after corrections.

Authentication Fails Immediately After Credential Rotation

Likely causes: Hosts and storage targets were updated in different sequences, one host still has the previous secret, or an active session has not reauthenticated.
Actions: Inventory every host using the target and compare its current setting. Verify the storage-side credential associated with each initiator. Perform a controlled rescan or session reconnect during the planned change window.

One ESXi Host Cannot See a Datastore That Other Hosts Can See

Likely causes: Incorrect CHAP credentials, missing iSCSI VMkernel networking, missing target discovery, a storage ACL that excludes the host initiator, or absent LUN mapping.
Actions: Compare the affected host's adapter, discovery, and network configuration with a working host. Confirm that the storage target permits the affected initiator and maps the LUN to it. Review rescan results and path status.

Datastore Becomes Inaccessible After Enabling CHAP

Likely causes: ESXi authentication was enabled before matching storage-side credentials were active, or existing adapter authentication settings were unintentionally replaced.
Actions: Use documented prior settings to restore connectivity if necessary. Confirm that the target accepts the configured credentials before retrying. Review session, path, device, and datastore status after the change.

Exam-Relevant Notes

In this scenario, the ESXi software iSCSI adapter is the initiator and the storage array or iSCSI server is the target.
Unidirectional CHAP authenticates the initiator to the target; mutual CHAP authenticates both directions.
CHAP settings must match on the ESXi adapter and the relevant storage-side access policy.
CHAP authenticates iSCSI login but does not encrypt storage traffic.
After changing credentials, a session reconnect and HBA rescan may be required before targets, LUNs, and datastores show the expected state.

For this lesson's focused workflow, see Configure iSCSI CHAP.