VMware Cross-Cloud Architecture

Securing iSCSI storage connectivity

If iSCSI storage is configured on a host, measures can be taken to minimize its security risks. Consider the following:

• Require that the host or initiator be authenticated by the iSCSI device or target whenever the host attempts to access data on the target logical unit number (LUN). ESXi supports only CHAP key authentication for iSCSI.
• Verify that each iSCSI name is unique, and traffic is only allowed for expected initiators.
• Use segregated vLANs or dedicated storage-only switches for the iSCSI traffic, to prevent unauthorized snooping on that network.