What does the CHAP secret accomplish for an E-Series system?

The Challenge-Handshake Authentication Protocol (CHAP) is an authentication scheme used by iSCSI initiators and targets to verify each other's identity. On a NetApp E-Series system, configuring a CHAP secret enables authentication for iSCSI sessions. This ensures that only authorized hosts (initiators) with the correct secret can establish a connection and access the storage resources (targets) presented over the iSCSI protocol. E-Series supports both one-way CHAP, where the target authenticates the initiator, and mutual CHAP, where the initiator also authenticates the target.

B. Ethernet management authentication: Management access to the E-Series controller (e.g., SANtricity System Manager) is secured using role-based access control (RBAC) with local user accounts or directory services like LDAP, not CHAP.

C. FC authentication: Fibre Channel (FC) SANs primarily use World Wide Name (WWN) zoning and LUN masking for access control and security, not the CHAP protocol.

D. SAS authentication: Serial Attached SCSI (SAS) is a point-to-point protocol where security is typically managed at the physical layer or through zoning in a SAS fabric, not with CHAP.

1. NetApp E-Series SANtricity 11.70 iSCSI Configuration Guide: In the section "Authentication

" it states

"You can use the Challenge-Handshake Authentication Protocol (CHAP) to authenticate the connection between a host and a target. The storage array supports one-way CHAP and mutual CHAP." (Page 11)

2. NetApp E-Series SANtricity System Manager Online Help: The help topic for configuring iSCSI settings details the CHAP authentication procedure. It describes setting a CHAP secret to "authenticate iSCSI initiators that attempt to connect to this storage system." This confirms its exclusive use for iSCSI. (Accessed via SANtricity System Manager GUI: Settings -> iSCSI -> Modify CHAP settings)