VMware ESXi and vSphere Cluster Management

iSCSI CHAP Authentication Overview for VMware ESXi

Learn how CHAP authenticates ESXi iSCSI initiators and targets, including one-way, mutual, adapter-level, and per-target authentication.

Challenge Handshake Authentication Protocol, or CHAP, is an authentication method used when an ESXi host connects to storage through iSCSI. It helps the storage target verify the identity of the ESXi iSCSI initiator before or during iSCSI session establishment.

CHAP authenticates endpoints; it does not encrypt iSCSI traffic. If confidentiality is required, address it with additional network and storage security controls.

What iSCSI CHAP Protects

iSCSI is a storage networking protocol that transports SCSI commands over IP networks. The endpoint that starts the connection is the iSCSI initiator. In this context, the initiator is the ESXi host or one of its iSCSI adapters. The storage endpoint that provides iSCSI-accessible resources is the iSCSI target.

CHAP allows one endpoint to verify that the other endpoint knows a preconfigured shared secret. A shared secret is a password known by both sides and used to calculate an authentication response.

  • CHAP verifies endpoint identity during the login exchange.
  • The secret itself is not transmitted across the network.
  • The response is based on a hash value derived from the secret and the challenge.
  • CHAP is authentication, not encryption. It does not make the iSCSI payload confidential.

How the CHAP Challenge-Response Exchange Works

CHAP uses a three-way challenge-response handshake. A simplified exchange looks like this:

  1. The authenticating endpoint sends a challenge containing a generated value.
  2. The other endpoint combines the challenge with its shared secret and calculates a hash-based response.
  3. The authenticating endpoint calculates the expected response and compares it with the received response. The login proceeds only if the values match.
1. Target sends:       challenge value
2. Initiator returns:  hash(challenge value + shared secret)
3. Target checks:      received response == expected response

The exact protocol exchange contains additional login information, but the important security principle is that the password or secret is not sent as the response. Both endpoints must know the correct secret to produce the same derived value.

CHAP Roles in an ESXi iSCSI Connection

In an ESXi storage connection, the ESXi iSCSI initiator acts as the client-side endpoint. The iSCSI target is the storage-side endpoint. Which side validates which endpoint depends on the selected CHAP mode.

  • In one-way CHAP, the target validates the ESXi initiator.
  • In mutual CHAP, the target validates the ESXi initiator and the ESXi initiator validates the target.

One-Way CHAP

One-way CHAP, also called unidirectional CHAP, authenticates the initiator to the target. The storage target challenges the ESXi initiator, and the initiator proves that it knows the configured secret.

The ESXi initiator does not authenticate the target in this mode. Therefore, one-way CHAP establishes that the connecting initiator has the expected credentials, but it does not provide reciprocal target identity verification.

For one-way CHAP to work, the initiator-side credentials and the target-side authorization record must match. This normally includes the configured CHAP name and shared secret, as well as the correct initiator identity and target access record.

One-Way CHAP Example

  1. An ESXi host connects to an iSCSI storage array.
  2. The array is configured to authenticate the ESXi initiator.
  3. The corresponding initiator CHAP name and secret are configured on ESXi and in the target's access settings.
  4. The target permits the iSCSI login only after the initiator produces a valid response.

Mutual CHAP

Mutual CHAP, also called bidirectional CHAP, authenticates both endpoints. The target authenticates the ESXi initiator, and the ESXi initiator authenticates the target.

Mutual authentication requires separate credential pairs or secrets for the two directions:

  • The target uses initiator-authentication credentials to verify the ESXi initiator.
  • The ESXi initiator uses target-authentication credentials to verify the storage target.

Both sides must be configured consistently for both exchanges. Avoid using the same secret for the initiator and target directions. Separate secrets make the direction of each credential clear and reduce the impact if one secret is exposed.

Mutual CHAP Example

  1. The target is configured with credentials used to authenticate the ESXi initiator.
  2. ESXi is configured with the matching initiator name and secret.
  3. ESXi is additionally configured with a target-authentication name and a separate target secret.
  4. The target and initiator each validate the other during session establishment.

One-Way CHAP Versus Mutual CHAP

Authentication mode: One-way CHAP

Alternative name: Unidirectional CHAP

Who authenticates the ESXi initiator: The iSCSI target

Who authenticates the iSCSI target: No endpoint authentication by CHAP

Secrets required: One initiator-authentication credential pair

Typical use case: The storage system must verify ESXi, but target verification is not required

Authentication mode: Mutual CHAP

Alternative name: Bidirectional CHAP

Who authenticates the ESXi initiator: The iSCSI target

Who authenticates the iSCSI target: The ESXi iSCSI initiator

Secrets required: Separate initiator and target credential pairs

Typical use case: Both endpoints must verify each other's identity

CHAP Configuration Scope in ESXi

ESXi can apply CHAP settings at different scopes. The correct choice depends on whether all targets reached through an adapter share the same authentication requirements.

Adapter-Level CHAP

Adapter-level CHAP applies authentication settings to an ESXi iSCSI adapter. The ESXi initiator presents the same configured authentication information to all targets connected through that adapter.

This scope is appropriate when several targets share the same initiator authentication policy and credentials. It simplifies administration, but it may not work when different storage systems require different credentials.

Per-Target CHAP

Per-target CHAP assigns CHAP settings individually to specific iSCSI targets. This allows one ESXi adapter to use different credentials for different storage systems.

Per-target CHAP is supported for software iSCSI initiators and dependent hardware iSCSI initiators. A software iSCSI initiator is an ESXi-provided software adapter. A dependent hardware iSCSI initiator is a hardware-assisted implementation that depends on the ESXi networking stack.

Configuration scope: Adapter-level CHAP

Applicable initiator type: An iSCSI adapter using the applicable ESXi authentication capabilities

Credential reuse behavior: The same adapter authentication information is presented to all connected targets

Best-fit scenario: Multiple targets share one authentication policy and credential set

Configuration scope: Per-target CHAP

Applicable initiator type: Software iSCSI initiators and dependent hardware iSCSI initiators

Credential reuse behavior: Credentials are assigned separately to individual targets

Best-fit scenario: Targets require distinct usernames, secrets, or authentication policies

Default ESXi CHAP Behavior

CHAP authentication is disabled by default on ESXi hosts. It must be explicitly enabled and configured when the storage target requires it or when the security policy specifies it.

Enabling CHAP on only one endpoint is not sufficient. The ESXi authentication mode, names, secrets, target association, and storage-side access settings must agree.

Configuration Planning

Plan the authentication relationship before changing an active iSCSI connection. Coordinate usernames and secrets with the storage administrator so that both the ESXi host and target use the intended values.

  • Choose one-way CHAP when only initiator authentication is required.
  • Choose mutual CHAP when both the initiator and target must be verified.
  • Choose adapter-level credentials when all targets behind the adapter share the same authentication requirements.
  • Choose per-target credentials when different targets require distinct access credentials.
  • Use separate secrets for initiator authentication and target authentication in mutual CHAP.
  • Record which credential belongs to each direction and target, preferably in an approved secrets-management system.

Credential Planning Table

Mode: One-way CHAP

Initiator username and secret: Configured on ESXi and matched by the target

Target username and secret: Not used for target authentication

Number of distinct secrets: At least one

Configuration consistency requirement: ESXi and the target must use the same initiator-authentication settings

Mode: Mutual CHAP

Initiator username and secret: Used by the target to authenticate ESXi

Target username and secret: Used by ESXi to authenticate the target

Number of distinct secrets: At least two; use separate secrets for each direction

Configuration consistency requirement: Both authentication exchanges, names, secrets, mode, adapter, and target association must match

ESXi and Storage Configuration Checklist

Use the following as a planning checklist rather than as a version-specific command sequence, because management interfaces vary by ESXi release and adapter type.

ESXi iSCSI initiator:
- Enable CHAP
- Select one-way or mutual CHAP
- Set the initiator CHAP name and secret
- For mutual CHAP, set a separate target CHAP name and secret
- Apply settings at adapter level or to the supported individual target

Storage target:
- Create or update the ESXi initiator authorization entry
- Configure matching initiator-authentication credentials
- For mutual CHAP, configure the target-authentication credentials expected by ESXi
- Select the same CHAP mode as ESXi
- Verify that the credentials apply to the intended target and initiator

Troubleshooting CHAP Authentication

iSCSI Session Fails After CHAP Is Enabled

Likely causes include an authentication mode mismatch, an incorrect username or secret, an incorrect initiator or target access record, or settings applied to the wrong adapter or target.

  • Compare the CHAP mode configured on ESXi with the mode configured on the storage target.
  • Verify the initiator name and secret on both sides.
  • Check that the target access record identifies the correct ESXi initiator.
  • Confirm that the settings were applied to the intended adapter or target.
  • Check whether the target expects mutual CHAP while ESXi is using one-way CHAP, or the reverse.

Mutual CHAP Fails but One-Way CHAP Works

This usually indicates a problem with the second authentication direction. The target may not have the credentials that ESXi uses to authenticate it, or the same credentials may have been incorrectly reused for both directions.

  • Review the initiator-authentication credential pair separately from the target-authentication pair.
  • Confirm that ESXi has the target name and secret required for target verification.
  • Confirm that distinct initiator and target secrets are configured.

One Target Connects but Another Does Not

If one target connects successfully while another fails, adapter-level credentials may be unsuitable for the failed target. The targets may require different usernames, secrets, or CHAP modes.

  • Determine whether all targets share the same authentication policy.
  • Inspect whether adapter-level settings are being reused for every target.
  • When supported, assign per-target CHAP settings to the target with different credentials.

Exam-Relevant Notes

  • CHAP is a challenge-response authentication mechanism based on a shared secret.
  • The CHAP secret is not transmitted directly during authentication.
  • CHAP authenticates; it does not encrypt iSCSI traffic.
  • One-way or unidirectional CHAP means the target authenticates the initiator only.
  • Mutual or bidirectional CHAP means both the target and initiator authenticate each other.
  • ESXi CHAP is disabled by default.
  • Adapter-level CHAP reuses the adapter's authentication information for connected targets.
  • Per-target CHAP allows target-specific settings for supported software and dependent hardware initiators.

Summary

CHAP gives an ESXi iSCSI initiator and storage target a way to verify knowledge of shared secrets during session establishment without sending those secrets across the network. One-way CHAP verifies the initiator to the target. Mutual CHAP verifies both endpoints and requires separate credentials for the two directions. ESXi can use adapter-level settings when targets share credentials or per-target settings when each storage system needs its own authentication configuration.

CHAP is one part of iSCSI security and should be coordinated with target access control and storage network design. For adjacent storage administration topics, review adding a raw LUN and the broader VMware ESXi administration material.