VMware ESXi and vSphere Cluster Management

Configure Unidirectional iSCSI CHAP Authentication on VMware ESXi

Learn how to configure unidirectional iSCSI CHAP authentication for an ESXi software iSCSI adapter, match storage credentials, rescan, and validate paths and datastores.

Challenge-Handshake Authentication Protocol (CHAP) adds identity verification to an iSCSI session. This lesson shows how to configure unidirectional CHAP for an ESXi host through the vSphere Web Client and then verify access to a CHAP-protected storage target.

In a typical iSCSI design, the ESXi host is the initiator: the system that starts the connection. The storage array or NAS is the target: the endpoint that presents logical storage units called LUNs. With unidirectional CHAP, the target requires the ESXi initiator to prove its identity using a CHAP name and shared secret.

How iSCSI CHAP Authentication Works

iSCSI transports SCSI storage commands over an IP network. Before allowing a session, the target can issue a challenge. The initiator uses the configured shared secret to produce a response. The target checks that response without requiring the secret to be sent as ordinary text across the network.

The ESXi host and storage system must agree on the CHAP identity and secret. Configuring credentials only on ESXi is not sufficient; the storage-side target policy must also permit the ESXi initiator.

Important iSCSI terms

• iSCSI: A storage protocol that transports SCSI commands over IP networks.
• Initiator: The system that starts an iSCSI connection. In this procedure, it is the ESXi host.
• Target: The iSCSI storage endpoint that presents LUNs.
• IQN: An iSCSI Qualified Name that identifies an initiator or target.
• Portal: An IP address and port through which an iSCSI target is reached.
• VMkernel adapter: An ESXi network interface used for host services such as iSCSI traffic.
• HBA rescan: A storage adapter scan that refreshes target, device, and path discovery.
• LUN: A logical storage unit presented by a target to an initiator.

iSCSI CHAP Authentication Modes

This procedure focuses on unidirectional CHAP. Mutual CHAP additionally authenticates the target to the initiator and requires separate reverse-authentication settings. Do not select mutual CHAP unless the storage design and ESXi configuration have been planned for it.

Prerequisites and Planning

Complete the following checks before changing authentication:

1. Confirm that the ESXi host has a configured iSCSI Software Adapter.
2. Verify the iSCSI VMkernel networking, including the correct VMkernel interface, VLAN, IP address, subnet, routing, and any required port binding.
3. Confirm that the target portal is online and reachable from the intended storage network.
4. Record the ESXi initiator IQN and the target portal information.
5. Obtain a CHAP name and strong shared secret approved by the storage administrator. Do not place the actual secret in screenshots, general documentation, tickets, or logs.
6. Confirm that the storage platform supports CHAP and that CHAP is enabled for the intended target, initiator, host object, host group, or access-control policy.
7. Plan a maintenance window if the adapter already serves active datastores. Changing authentication can cause sessions to reconnect, and a mismatch can interrupt storage access.

For background on ESXi administration, see the VMware ESXi online course.

Locate the ESXi iSCSI Software Adapter

In the vSphere Web Client, use this general path:

Host inventory object > Manage > Storage > Storage Adapters

1. Select the applicable ESXi host from the inventory.
2. Open Manage and select Storage.
3. Open Storage Adapters.
4. Find and select the adapter identified as the iSCSI Software Adapter.
5. Open the adapter's Properties area and locate Authentication.

Exact labels and navigation can vary between vSphere Client and ESXi releases. Use the selected adapter's authentication or security settings if the wording differs.

Configure Unidirectional CHAP on ESXi

1. With the iSCSI Software Adapter selected, open its Properties or configuration view.
2. Locate the Authentication section and choose Edit.
3. Select the authentication method equivalent to Use Unidirectional CHAP.
4. In the Name field, enter the CHAP identity exactly as configured on the storage system.
5. Enter the corresponding shared secret. Use the approved credential, and avoid exposing it while screen sharing or capturing evidence.
6. Save or apply the authentication configuration.

The relevant values are:

Authentication method: Use Unidirectional CHAP
Name:              <storage-approved CHAP identity>
Secret:            <matching shared secret>

Configure the Matching Storage-Side CHAP Policy

ESXi-side credentials alone cannot authorize a session. On the storage system:

1. Enable or assign CHAP authentication for the applicable iSCSI target or access policy.
2. Authorize the ESXi initiator IQN, host object, host group, or access-control entry.
3. Configure the identical CHAP name and shared secret.
4. Associate the credentials with the correct target and initiator mapping. Do not accidentally assign them to another host or target.
5. Confirm that the target permits the ESXi host to discover and log in.
6. Present the required LUNs to the authorized host or host group.

In a one-host example, the storage administrator creates an initiator access entry for the ESXi IQN, assigns a CHAP identity and secret, and maps a LUN to that entry. The VMware administrator enters the same identity and secret on the iSCSI Software Adapter. After a successful rescan, the LUN can become available for a VMFS datastore.

Rescan and Validate Connectivity

1. After saving the ESXi credentials and completing the storage-side policy, rescan the iSCSI host bus adapter.
2. Rescan storage devices as well if the client presents separate adapter and device scan actions.
3. Check that the expected target portal and target are discovered.
4. Verify that the expected devices and LUNs appear.
5. Confirm that an existing datastore remains accessible, or create and mount a VMFS datastore only after device visibility is confirmed.
6. Review task results and iSCSI or storage events for successful login and discovery.
7. If multiple iSCSI paths are designed, validate each path and confirm the expected multipath state.

For an existing protected target, identify every ESXi host using the shared datastore before the change. Apply consistent matching credentials to each authorized host, rescan each host, and verify that every host regains its expected paths before closing the change.

Security and Operational Considerations

• Use unique, strong CHAP secrets and store them in an approved credential-management process.
• Use dedicated iSCSI networking where possible, with suitable VLAN segmentation, firewalling, and storage-side initiator authorization.
• Avoid sharing one CHAP credential across unrelated hosts when host-level accountability is required.
• Document credential ownership, the authorized targets and hosts, and the rotation or change procedure without recording the secret in unsecured documentation.
• Coordinate changes across all ESXi hosts that access a shared datastore.
• Do not change CHAP settings casually on a host with production datastore dependencies.
• Remember that CHAP is authentication, not encryption. Protect the storage network separately if confidentiality of storage traffic is required.

Troubleshooting Common CHAP Login Failures

Target is not discovered

First verify IP connectivity through the intended VMkernel adapter and confirm the target portal and discovery configuration. Then check that the target is online, that network firewalls permit the required traffic, and that the storage access policy allows the ESXi initiator IQN. Authentication settings cannot correct a basic network or discovery failure.

Target is reachable but authentication fails

Compare the CHAP name character-for-character on both systems. Re-enter the shared secret carefully using the approved value, and confirm that the target expects unidirectional CHAP rather than mutual CHAP. Review whether the credentials were assigned to the correct target, initiator, host object, or host group.

Authentication succeeds but no datastore appears

Successful login does not guarantee LUN presentation. Verify that the LUN is mapped to the ESXi host, rescan the adapter and storage devices, and inspect device and path visibility. A visible device may still require an appropriate datastore mount or creation operation.

Access is interrupted after a CHAP change

Check whether credentials changed on only one side or whether another ESXi host using the shared datastore was missed. Restore matching known-good settings where necessary, apply the approved configuration consistently to all authorized hosts, and validate datastore access and paths host by host.

Exam-Relevant Notes

• In the normal ESXi-to-array model, ESXi is the initiator and the array or NAS is the target.
• Unidirectional CHAP means the target authenticates the initiator.
• Mutual CHAP adds authentication of the target by the initiator and requires additional reverse-authentication settings.
• CHAP does not encrypt iSCSI traffic.
• The CHAP name and secret must match on ESXi and the storage system.
• An HBA rescan refreshes target, device, and path discovery after the configuration change.
• Authentication success and LUN presentation are separate checks.

Summary

To configure unidirectional iSCSI CHAP, verify the ESXi iSCSI Software Adapter and storage network, identify the initiator IQN and target portal, obtain approved credentials, select the adapter's authentication settings, and choose unidirectional CHAP. Enter the exact CHAP name and secret, configure the matching storage-side policy, rescan the adapter, and verify targets, LUNs, paths, and datastores. Treat the change as an operational storage change whenever active production sessions are involved.