VMware ESXi and vSphere Cluster Management

iSCSI SAN Components in VMware ESXi

Learn how iSCSI initiators, targets, portals, IQNs, LUNs, and VMkernel networking work together to provide shared block storage to VMware ESXi.

iSCSI is a common way to provide shared block storage to VMware ESXi hosts over an Ethernet network. This lesson explains the components involved, how they are addressed and discovered, and how an ESXi host turns a presented LUN into a VMFS datastore or an approved Raw Device Mapping (RDM).

Prerequisites

You should understand basic TCP/IP networking, VLANs, routing, TCP ports, Ethernet, block storage versus file storage, ESXi VMkernel networking, and basic storage terms such as disks, volumes, RAID groups, and storage pools.

What iSCSI Is

iSCSI, or Internet Small Computer System Interface, is a block-storage protocol. It transports SCSI commands and storage data across a TCP/IP network.

SCSI provides the command model used to communicate with block devices. iSCSI encapsulates those commands and their data in TCP packets. The network can use ordinary Ethernet infrastructure, although storage networks are commonly designed with dedicated VLANs, adapters, switches, or physical paths.

Unlike direct-attached SCSI, where a server connects directly to storage using a local SCSI connection, iSCSI separates the host and storage with an IP network. An ESXi host can therefore access shared block devices from a storage array located elsewhere in the data center.

Shared iSCSI storage is useful for vSphere because multiple ESXi hosts can access the same datastore LUN when the storage array presents it to the hosts correctly. This supports clustered workloads, VM mobility, centralized storage management, and multipathing.

High-Level iSCSI SAN Architecture

An iSCSI SAN is a storage area network that provides hosts with network-accessible block storage. Its architecture has three broad parts:

Host side: an ESXi iSCSI initiator, an ESXi storage adapter, and one or more VMkernel adapters that carry storage traffic.
Network transport: Ethernet, IP addressing, switches, VLANs, routing where required, and TCP. iSCSI normally uses TCP port 3260.
Storage-array side: physical disks or flash, storage pools or RAID groups, logical volumes, iSCSI targets, portals, access controls, and LUN mappings.

The command and data path is conceptually:

VM or VMFS request → ESXi storage stack → iSCSI initiator → VMkernel network path → TCP/IP and Ethernet → target portal → iSCSI target → mapped LUN → storage volume and backend media

iSCSI presents block devices. It does not directly provide a file share such as an NFS export or SMB share. ESXi can format a presented block device with VMFS, or an approved virtual machine workflow can use a raw LUN through RDM.

iSCSI Storage System

The iSCSI storage system is the physical array or storage server that provides backend capacity. It may contain hard disks, solid-state drives, controllers, cache, and software that manages data protection and presentation.

Storage administrators usually build several layers:

Physical disks or flash: the actual media storing data.
Storage pool or RAID group: a collection of media managed for capacity, performance, and resilience.
Logical volume: a portion of the pool allocated for a workload.
LUN presentation: the logical block device made available through an iSCSI target.

Terminology varies by vendor. A vendor may call a logical volume a volume, virtual disk, dataset, or logical device. The important distinction is that the backend volume is an array object, while the LUN is the host-visible logical block unit associated with that presentation.

LUNs

A Logical Unit Number (LUN) is a logical block-storage device presented by a target to an authorized host. ESXi detects it as a storage device after the host discovers the target, logs in, and rescans its storage adapters.

A LUN identifier is not necessarily the same thing as the name of the underlying array volume. The target uses a LUN number within a target's namespace to identify the logical unit. The storage array may also expose persistent identifiers, such as NAA-style identifiers, for device recognition.

Common ESXi uses include:

Creating a VMFS datastore on the presented LUN.
Using the LUN in an approved Raw Device Mapping workflow.
Presenting the same datastore LUN to every intended ESXi host in a cluster.

LUN visibility must be controlled by target presentation, host groups, initiator access policies, and LUN masking. A host that can reach a target portal should not automatically receive access to every LUN on that target.

iSCSI Targets

An iSCSI target is the storage-side logical endpoint that receives SCSI requests from initiators. A target normally exposes one or more LUNs.

The storage array associates LUNs with targets and controls which initiators may log in or see particular LUNs. This process may be called target-to-LUN mapping, masking, host mapping, or presentation, depending on the vendor.

A target is commonly hosted by a storage array, but software-based targets can run on a general-purpose server or storage operating system. Regardless of implementation, the target provides the endpoint through which the host accesses block devices.

iSCSI Initiators in ESXi

An iSCSI initiator is the host-side endpoint that sends SCSI commands to targets. Every ESXi host using iSCSI has an initiator supplied by either software or hardware.

Software iSCSI initiator: ESXi performs iSCSI processing in software and uses an ESXi network path to send traffic through a physical NIC or uplink.
Hardware-assisted iSCSI adapter: a network or storage adapter performs some or all iSCSI processing. The exact capabilities depend on the adapter and ESXi support.

The ESXi storage adapter represents the iSCSI initiator from the storage configuration perspective. VMkernel adapters provide the IP interfaces and network paths used for iSCSI traffic. After discovery and login, the adapter maintains sessions to target portals, and ESXi reports the LUNs made visible through those sessions.

iSCSI Network Portals

An iSCSI portal is a network endpoint used by an initiator or target. It is normally represented by an IP address and a TCP listening port.

A target portal is the IP address and port through which a storage target accepts iSCSI connections. The standard iSCSI TCP port is 3260. For example, a target portal could be represented as 192.0.2.20:3260.

On ESXi, initiator connectivity is supplied by VMkernel adapters configured for iSCSI traffic. The VMkernel adapter must have appropriate IP connectivity to the target portal. In a redundant design, multiple VMkernel paths can reach multiple target portals.

Multiple portals and paths can provide high availability and multipathing. A failed cable, NIC, switch path, or storage interface can be isolated while another path remains available, provided the paths are configured independently and ESXi multipathing is correctly configured.

iSCSI Addressing and Names

iSCSI uses both network addresses and persistent names. These serve different purposes:

An IP address and TCP port locate a network endpoint. They are routable addresses.
An IQN identifies an iSCSI entity persistently. It is a name, not a network route.
A LUN identifier identifies a logical unit under a particular target presentation.
A persistent device identifier, such as an NAA identifier, helps identify a storage device independently of transient discovery details.

An iSCSI Qualified Name (IQN) is a globally unique naming format for iSCSI entities. An ESXi initiator has an initiator IQN, and a storage endpoint has a target IQN. Storage access-control lists commonly authorize an ESXi host by matching its initiator IQN.

An IQN is not normally the unique identifier for every LUN. A LUN is ordinarily addressed through a target and its LUN mapping. The target IQN identifies the target endpoint; the LUN identifier identifies a logical unit exposed beneath that target.

Other persistent naming formats include EUI-style identifiers and NAA-style identifiers. These can help ESXi and administrators recognize a device consistently even when its path, portal, or discovery order changes.

Item	Example format	Purpose	Whether it is routable
Target portal IP address	`192.0.2.20`	Locates the target network endpoint	Yes
TCP port 3260	`3260`	Identifies the standard iSCSI service port	Used with an IP address
Initiator IQN	`iqn.2026-01.example:esxi01`	Identifies the ESXi initiator for authorization	No
Target IQN	`iqn.2026-01.example:array.target1`	Identifies the storage target	No
LUN identifier	`0` or another target-relative value	Identifies a logical unit exposed by a target	No
Persistent device identifier such as NAA	`naa...`	Identifies a storage device persistently	No

Discovery and iSNS

iSCSI discovery is the process of finding available targets and their portals so an initiator can establish sessions.

Method	Information supplied to ESXi	How targets are found	Typical usage
Static discovery	A known target portal and usually the target IQN	The administrator enters the specific target information	Small, controlled, or highly explicit configurations
Dynamic discovery	One or more discovery portal addresses	ESXi contacts the portal and receives available target information	Arrays that provide target discovery through a portal
iSNS-assisted discovery	Information for an iSNS server	The iSNS service registers devices and supplies discovery information	Environments that centrally manage iSCSI discovery

iSNS, or iSCSI Name Service, is a service for registering, discovering, and managing iSCSI devices. It can provide centralized information about initiators, targets, and portals. iSNS remains a valid automated discovery and management mechanism, although it is uncommon in many current iSCSI deployments.

How the Components Work Together

An administrator configures an ESXi VMkernel adapter for iSCSI traffic.
The ESXi software initiator or hardware-assisted adapter supplies the host-side iSCSI endpoint and its initiator IQN.
The administrator configures a storage target, target IQN, target portal addresses, and backend LUNs.
The storage system authorizes the ESXi initiator IQN through an ACL, host group, or equivalent access policy.
The storage system maps selected LUNs to the target and applies LUN masking.
ESXi uses a VMkernel network path to contact a target portal on TCP port 3260.
The initiator performs discovery and establishes an iSCSI session with the target.
The target presents the mapped LUNs permitted for that initiator.
ESXi rescans its storage adapters and detects the resulting block devices.
An administrator formats a device as VMFS or uses it in an approved RDM workflow.

The array enforces which initiators can see which LUNs. Network reachability alone is not sufficient for storage access. Authentication, network segmentation, and LUN masking are separate controls:

Network segmentation limits which systems can communicate on the storage network.
Authentication, such as CHAP, verifies credentials during iSCSI login.
LUN masking limits which logical devices are presented to an authorized initiator.

Practical Example: One ESXi Host

Suppose an ESXi host has a VMkernel adapter on a dedicated storage VLAN. Its software iSCSI initiator has a known IQN. A storage array provides target IQN iqn.2026-01.example:array.target1 through portal 192.0.2.20:3260.

The storage administrator creates a logical volume from a storage pool.
The array exposes the volume as LUN 0 through the target.
The array permits the ESXi initiator IQN and maps LUN 0 to the target.
The ESXi administrator adds the target portal through static or dynamic discovery.
ESXi logs in, rescans storage, and detects the LUN.
The administrator creates a VMFS datastore on the detected device.

Practical Example: Two-Path Redundant Design

In a redundant design, the ESXi host uses separate storage network paths, such as different VMkernel paths and physical uplinks. The array provides two target portals, for example 192.0.2.20:3260 and 192.0.2.21:3260. Both paths lead to the same presented LUN.

ESXi sees multiple paths to one device and uses multipathing. If one NIC, cable, switch path, or target portal fails, the remaining path can keep the LUN reachable. Redundancy is meaningful only when the paths are independent and each path is tested.

Practical Example: LUN Masking for Multiple Hosts

A storage administrator may create separate production and test LUNs. The production ESXi cluster's initiator IQNs receive access to production datastore LUNs. A test host may be able to reach the target network address but is not mapped to those LUNs. Consequently, the test host does not see the unauthorized devices.

Conceptual ESXi Configuration Workflow

Create or select a VMkernel adapter for iSCSI traffic.
Enable and identify the software iSCSI initiator, or select the applicable hardware iSCSI adapter.
Record the initiator IQN for storage-side authorization.
Configure storage volumes, targets, target portals, LUN mappings, and access policies.
Add target portals through static discovery, dynamic discovery, or an iSNS-based method.
Rescan the ESXi storage adapters.
Confirm that the expected device and paths are visible.
Create a VMFS datastore or use the detected LUN for an approved RDM workflow.

When command-line validation is appropriate, these ESXi commands can help inspect adapters, portals, and devices:

esxcli iscsi adapter list
esxcli iscsi adapter get -A <adapter>
esxcli iscsi adapter target portal list -A <adapter>
esxcli storage core adapter rescan --all
esxcli storage core device list

Replace <adapter> with the actual adapter identifier. Use the vSphere Client or your organization's supported configuration process for changes, and treat command output as validation rather than a substitute for correct array configuration.

iSCSI SAN Component Reference

Component	Location or role	Primary function	Example in an ESXi environment
iSCSI storage system	Storage-array side	Provides backend capacity and manages volumes, targets, and access	Array with a storage pool and controller interfaces
LUN	Logical device under a target	Provides host-visible block storage	LUN formatted as a VMFS datastore
iSCSI target	Storage-side endpoint	Receives SCSI requests and exposes mapped LUNs	Target with production LUNs assigned to an ESXi host group
iSCSI initiator	ESXi host side	Sends SCSI commands to targets	ESXi software iSCSI initiator
iSCSI portal	Network endpoint	Provides an IP address and TCP port for an iSCSI connection	`192.0.2.20:3260`
IQN	Persistent iSCSI identity	Names an initiator or target for identification and authorization	Initiator IQN listed in an array ACL
iSNS	Discovery service	Registers devices and supplies discovery information	Central iSCSI discovery service, where deployed

Troubleshooting iSCSI Components

Target Cannot Be Discovered

Possible causes include an incorrect portal address or port, missing IP connectivity, an incorrect VLAN or route, MTU or firewall problems, a physical-switch issue, or an unavailable target service.

Confirm that the VMkernel interface is on the intended iSCSI network.
Validate reachability to the target portal address.
Confirm that the target listens on TCP port 3260.
Verify the discovery portal and target IQN.

Target Is Visible but the Expected LUN Is Missing

The LUN may not be mapped to the target, the ESXi initiator IQN may not be authorized, host-group or masking settings may be wrong, or ESXi may not have been rescanned.

Compare the ESXi initiator IQN with the storage access-control entry.
Confirm target-to-LUN mapping on the array.
Rescan the ESXi storage adapters.
Check whether the LUN is already claimed or intentionally hidden by policy.

A Path Is Down or Storage Is Intermittently Unavailable

Investigate failed NICs, cables, switch ports, target portals, multipathing settings, VLAN configuration, jumbo-frame consistency, and duplicate or unstable IP addresses.

Review the available paths for the device.
Verify each VMkernel-to-target-portal path independently.
Confirm consistent end-to-end MTU settings when jumbo frames are used.
Check physical and switch-level link status.

iSCSI Authentication Fails

CHAP credentials may not match, one-way and mutual CHAP settings may differ, or the target ACL may not permit the initiator IQN.

Verify initiator and target authentication settings on both sides.
Confirm that the correct initiator IQN is authorized.
Do not expose credentials in screenshots, logs, or documentation.

Exam-Relevant Notes

iSCSI transports SCSI commands and data over TCP/IP.
The initiator is on the ESXi host; the target is normally on the storage system.
A portal is an IP address and TCP endpoint, normally using port 3260.
An IQN is a persistent name, not a routable address.
A LUN is a logical block device presented through a target.
LUN masking controls which authorized initiators can see particular LUNs.
VMkernel adapters provide ESXi network connectivity for iSCSI traffic.
Multiple portals and independent paths support multipathing and availability.
After presentation changes, ESXi commonly requires a storage rescan.

Summary

An iSCSI SAN combines an ESXi initiator, VMkernel network paths, TCP/IP portals, storage targets, and mapped LUNs. The storage array supplies capacity and applies authorization and masking. ESXi discovers the target, establishes sessions, detects permitted LUNs, and can use those block devices for VMFS or an approved RDM workflow. Multiple independent portals and paths add resilience through multipathing.

For broader ESXi fundamentals, see the VMware ESXi online course and the VMware ESXi topic index.