draft-ietf-ips-iscsi-slp-06.txt   draft-ietf-ips-iscsi-slp-07.txt 
Internet Draft Mark Bakke Internet Draft Mark Bakke
<draft-ietf-ips-iscsi-slp-06.txt> Cisco <draft-ietf-ips-iscsi-slp-07.txt> Cisco
Expires September 2003 Expires October 2004
John Hufferd John Hufferd
Kaladhar Voruganti Kaladhar Voruganti
IBM IBM
Marjorie Krueger Marjorie Krueger
HP HP
Todd Sperry Todd Sperry
Adaptec Adaptec
March 2003 April 2004
Finding iSCSI Targets and Name Servers Using SLP Finding iSCSI Targets and Name Servers Using SLP
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026. all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
skipping to change at page 1, line 43 skipping to change at page 1, line 43
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2001). All Rights Reserved. Copyright (C) The Internet Society (2004). All Rights Reserved.
Abstract Abstract
The iSCSI protocol provides a way for hosts to access SCSI devices The iSCSI protocol provides a way for hosts to access SCSI devices
over an IP network. This document defines the use of the Service over an IP network. This document defines the use of the Service
Location Protocol (SLP) by iSCSI hosts, devices, and management Location Protocol (SLP) by iSCSI hosts, devices, and management
services, along with the SLP service type templates that describe the services, along with the SLP service type templates that describe the
services they provide. services they provide.
Acknowledgements Acknowledgements
skipping to change at page 2, line 30 skipping to change at page 2, line 30
(IBM) for suggesting the use of SLP for iSCSI discovery, and to Matt (IBM) for suggesting the use of SLP for iSCSI discovery, and to Matt
Peterson (Caldera) and James Kempf (Sun) for reviewing the document Peterson (Caldera) and James Kempf (Sun) for reviewing the document
from an SLP perspective. from an SLP perspective.
Table of Contents Table of Contents
1. Introduction.................................................2 1. Introduction.................................................2
2. Notation Conventions.........................................3 2. Notation Conventions.........................................3
3. Terminology..................................................3 3. Terminology..................................................3
4. Using SLP for iSCSI Service Discovery........................4 4. Using SLP for iSCSI Service Discovery........................4
5. iSCSI SLP Templates.........................................14 5. iSCSI SLP Templates.........................................13
6. Security Considerations.....................................19 6. Security Considerations.....................................19
7. IANA Considerations.........................................20 7. IANA Considerations.........................................20
8. Summary.....................................................20 8. Summary.....................................................20
9. Normative References........................................20 9. Normative References........................................20
10. Informative References......................................21 10. Informative References......................................21
11. Authors' Addresses..........................................22 11. Authors' Addresses..........................................22
12. Full Copyright Notice.......................................22 12. Full Copyright Notice.......................................22
1. Introduction 1. Introduction
iSCSI [iSCSI] is a protocol used to transport SCSI [SAM2] commands, iSCSI [RFC3720] is a protocol used to transport SCSI [SAM2] commands,
data, and status across an IP network. This protocol is connection- data, and status across an IP network. This protocol is connection-
oriented, and is currently defined over TCP. iSCSI uses a client- oriented, and is currently defined over TCP. iSCSI uses a client-
server relationship. The client end of the connection is an server relationship. The client end of the connection is an
initiator, and sends SCSI commands; the server end of the connection initiator, and sends SCSI commands; the server end of the connection
is called a target, and receives and executes the commands. is called a target, and receives and executes the commands.
There are several methods an iSCSI initiator can use to find the There are several methods an iSCSI initiator can use to find the
targets to which it should connect. Two of these methods can be targets to which it should connect. Two of these methods can be
accomplished without the use of SLP: accomplished without the use of SLP:
- Each target and its address can be statically configured on the - Each target and its address can be statically configured on the
initiator. initiator.
- Each address providing targets can be configured on the initiator; - Each address providing targets can be configured on the initiator;
iSCSI provides a mechanism by which the initiator can query the iSCSI provides a mechanism by which the initiator can query the
address for a list of targets. address for a list of targets.
The above methods are further defined in "iSCSI Naming and Discovery The above methods are further defined in "iSCSI Naming and Discovery
Requirements" [NDT]. Requirements" [RFC3721].
Each of the above methods requires a small amount of configuration to Each of the above methods requires a small amount of configuration to
be done on each initiator. The ability to discover targets and name be done on each initiator. The ability to discover targets and name
services without having to configure initiators is a desirable services without having to configure initiators is a desirable
feature. The Service Location Protocol (SLP) [RFC2608] is an IETF feature. The Service Location Protocol (SLP) [RFC2608] is an IETF
standards track protocol that provides several features that will standards track protocol that provides several features that will
simplify locating iSCSI services. This document describes how SLP simplify locating iSCSI services. This document describes how SLP
can be used in iSCSI environments to discover targets, addresses can be used in iSCSI environments to discover targets, addresses
providing targets, and storage management servers. providing targets, and storage management servers.
skipping to change at page 4, line 29 skipping to change at page 4, line 29
Target A logical entity, typically within a Target A logical entity, typically within a
storage controller or gateway, that storage controller or gateway, that
receives SCSI commands from an initiator receives SCSI commands from an initiator
and executes them. A target includes one and executes them. A target includes one
or more Logical Units (LUs); each LU is a or more Logical Units (LUs); each LU is a
SCSI device, such as a disk or tape drive. SCSI device, such as a disk or tape drive.
iSCSI Name A UTF-8 character string which serves as a iSCSI Name A UTF-8 character string which serves as a
unique identifier for iSCSI initiators and unique identifier for iSCSI initiators and
targets. Its format and usage is further targets. Its format and usage is further
defined in [NDT]. defined in [RFC3721].
iSCSI Client A logical entity, typically a host, which iSCSI Client A logical entity, typically a host, which
includes at least one iSCSI Initiator. includes at least one iSCSI Initiator.
iSCSI Server A logical entity, typically a storage iSCSI Server A logical entity, typically a storage
controller or gateway, which includes at controller or gateway, which includes at
least one iSCSI Target. least one iSCSI Target.
Storage Management Server An addressable entity that provides Storage Management Server An addressable entity that provides
management services that benefit an iSCSI management services that benefit an iSCSI
skipping to change at page 8, line 32 skipping to change at page 8, line 32
As information contained in the iSCSI target template may exceed As information contained in the iSCSI target template may exceed
common network datagram sizes, the SLP implementation for both UAs common network datagram sizes, the SLP implementation for both UAs
and SAs supporting this template MUST implement SLP over TCP. and SAs supporting this template MUST implement SLP over TCP.
4.1.1. Finding Targets Based on Initiator Credentials 4.1.1. Finding Targets Based on Initiator Credentials
To be allowed access to an iSCSI target, an initiator must be To be allowed access to an iSCSI target, an initiator must be
authenticated. The initiator may be required by the target to authenticated. The initiator may be required by the target to
produce one or more of the following credentials: produce one or more of the following credentials:
- - An iSCSI Initiator Name - An iSCSI Initiator Name
- - An IP address - An IP address
- - A CHAP, SRP, or Kerberos credential - A CHAP, SRP, or Kerberos credential
- - Any combination of the above - Any combination of the above
Most iSCSI targets allow access to only one or two initiators. In Most iSCSI targets allow access to only one or two initiators. In
the ideal discovery scenario, an initiator would send an SLP request, the ideal discovery scenario, an initiator would send an SLP request,
and receive responses ONLY for those targets to which the initiator and receive responses ONLY for those targets to which the initiator
is guaranteed a successful login. To achieve this goal, the iSCSI is guaranteed a successful login. To achieve this goal, the iSCSI
target template contains the following attributes, each of which target template contains the following attributes, each of which
allows a list of values: allows a list of values:
1. auth-name - This attribute contains the list of initiator names 1. auth-name - This attribute contains the list of initiator names
allowed to access this target, or the value "any", indicating allowed to access this target, or the value "any", indicating
skipping to change at page 9, line 23 skipping to change at page 9, line 23
credentials that will be allowed access to the target, provided credentials that will be allowed access to the target, provided
they can produce the correct password or other verifier during they can produce the correct password or other verifier during
the login process. If no specific credentials are required, the the login process. If no specific credentials are required, the
value "any" is used. value "any" is used.
The above identifiers follow the semantics described in the IP The above identifiers follow the semantics described in the IP
Storage Authentication MIB [AUTH-MIB]. Examples showing initiator Storage Authentication MIB [AUTH-MIB]. Examples showing initiator
searches based on auth-xxxx attributes are shown in the target- searches based on auth-xxxx attributes are shown in the target-
specific template section below. specific template section below.
Also note that the auth-xxxx attributes are considered to be security
policy information. If these attributes are distributed, IPsec MUST
be implemented as specified in the Security Implementation section
below.
4.1.2. Supporting Access by Multiple Identities to the Same Target 4.1.2. Supporting Access by Multiple Identities to the Same Target
If a target is to allow access to multiple host identities, more than If a target is to allow access to multiple host identities, more than
one combination of auth-xxxx attributes will need to be present. one combination of auth-xxxx attributes will need to be present.
Since service URLs must be unique, each of these must be registered Since service URLs must be unique, each of these must be registered
under its own service URL. under its own service URL.
For systems that support the configuration of multiple identities to For systems that support the configuration of multiple identities to
access a target, the service URL must contain an additional, opaque access a target, the service URL must contain an additional, opaque
string defining the identity. This appears after the iSCSI name in string defining the identity. This appears after the iSCSI name in
skipping to change at page 12, line 46 skipping to change at page 11, line 46
+---------------------------+ +---------------------------+
Note the difference between the storage management server model and Note the difference between the storage management server model and
the previously-defined target discovery model. When target discovery the previously-defined target discovery model. When target discovery
was used, the iSCSI Server implemented an SA, to be discovered by the was used, the iSCSI Server implemented an SA, to be discovered by the
initiator's UA. In the storage management server model, the iSCSI initiator's UA. In the storage management server model, the iSCSI
clients and servers both implement UAs, and the management server clients and servers both implement UAs, and the management server
implements the SA. implements the SA.
A storage management server's URL contains the domain name or IP A storage management server's URL contains the domain name or IP
address and TCP port. No other information is required. address and TCP or UDP port number. No other information is
required.
The storage management server constructs a service advertisement of The storage management server constructs a service advertisement of
the type "service:iscsi:sms" for each of the addresses at which it the type "service:iscsi:sms" for each of the addresses at which it
appears. The advertisement contains the URL, a lifetime, along with appears. The advertisement contains the URL, a lifetime, along with
other attributes which are defined in the service template. other attributes which are defined in the service template.
The remainder of the discovery procedure is identical to that used to The remainder of the discovery procedure is identical to that used to
discover iSCSI targets, except that both initiators and targets would discover iSCSI targets, except that both initiators and targets would
normally be "clients" of the storage management service. normally be "clients" of the storage management service.
skipping to change at page 13, line 29 skipping to change at page 12, line 29
or whether one is used at all, or whether the target registrations or whether one is used at all, or whether the target registrations
are provided directly by the target or by the management service. are provided directly by the target or by the management service.
4.3. NAT and NAPT Considerations 4.3. NAT and NAPT Considerations
Since SLP provides IP address and TCP port information within its Since SLP provides IP address and TCP port information within its
payload, the addresses an SA or DA advertise may not be the same as payload, the addresses an SA or DA advertise may not be the same as
those a UA must use if a Network Address(/Port) Translation those a UA must use if a Network Address(/Port) Translation
(NAT/NAPT) device is present between the UA and the SA. This may (NAT/NAPT) device is present between the UA and the SA. This may
result in the UA discovering address information that is unusable. result in the UA discovering address information that is unusable.
Here are a few recommendations to handle this: Also note that SLP advertisements that occur inside a private address
realm may be unreachable outside that realm. Below are some
recommendations for dealing with SLPv2 and NAT/NAPT devices:
- A fully-qualified domain name (i.e. not an IP address) SHOULD be - A fully-qualified domain name (i.e. not an IP address) SHOULD be
used in service URLs, the mgmt-entity attribute, and the auth-addr used in service URLs, the mgmt-entity attribute, and the auth-addr
attribute. attribute [RFC1900].
- The default, IANA-assigned iSCSI TCP port number SHOULD be used in
service URLs, wherever possible.
- If advertising service URLs through a translating device (e.g. a - Configure the NAPT device to provide default mapping(s) for the
NAT/NAPT device), and the FQDN, IP address, or TCP port will be well-known port(s) and use the default IANA-assigned iSCSI TCP port
translated, the translating device can provide an SLPv2 proxy number in service URLs, when possible.
capability to do the translation.
4.4. Internationalization Considerations 4.4. Internationalization Considerations
SLP allows internationalized strings to be registered and retrieved. SLP allows internationalized strings to be registered and retrieved.
Attributes in the template that are not marked with an 'L' (literal) Attributes in the template that are not marked with an 'L' (literal)
will be registered in a localized manner. An "en" (English) will be registered in a localized manner. An "en" (English)
localization MUST be registered, and others MAY be registered. localization MUST be registered, and others MAY be registered.
Attributes that include non-ASCII characters will be encoded using Attributes that include non-ASCII characters will be encoded using
UTF-8, as discussed in [STRINGPREP] and [NAMEPREP]. UTF-8, as discussed in [RFC3722] and [RFC3491].
5. iSCSI SLP Templates 5. iSCSI SLP Templates
Three templates are provided: an iSCSI target template, a management Three templates are provided: an iSCSI target template, a management
service template, and an abstract template to encapsulate the two. service template, and an abstract template to encapsulate the two.
5.1. The iSCSI Abstract Service Type Template 5.1. The iSCSI Abstract Service Type Template
This template defines the abstract service "service:iscsi". It is This template defines the abstract service "service:iscsi". It is
used as a top-level service to encapsulate all other iSCSI-related used as a top-level service to encapsulate all other iSCSI-related
services. services.
Name of submitter: Mark Bakke Name of submitter: Mark Bakke
Language of service template: en Language of service template: en
Security Considerations: Security Considerations: see section 6.
See the security considerations of the concrete service types.
Template Text: Template Text:
-------------------------template begins here----------------------- -------------------------template begins here-----------------------
template-type=iscsi template-type=iscsi
template-version=0.1 template-version=0.1
template-description= template-description=
This is an abstract service type. The purpose of the iscsi This is an abstract service type. The purpose of the iscsi
service type is to encompass all of the services used to support service type is to encompass all of the services used to support
skipping to change at page 16, line 20 skipping to change at page 15, line 14
targets: targets:
Service: service:iscsi:target Service: service:iscsi:target
Scope: management-server-scope-list Scope: management-server-scope-list
Query: <empty-string> Query: <empty-string>
More details on booting from an iSCSI target are defined in [BOOT]. More details on booting from an iSCSI target are defined in [BOOT].
Name of submitter: Mark Bakke Name of submitter: Mark Bakke
Language of service template: en Language of service template: en
Security Considerations: Security Considerations: see section 6.
See later section.
Template Text: Template Text:
-------------------------template begins here----------------------- -------------------------template begins here-----------------------
template-type=iscsi:target template-type=iscsi:target
template-version=0.1 template-version=0.1
template-description= template-description=
This is a concrete service type. The iscsi:target service type is This is a concrete service type. The iscsi:target service type is
used to register individual target addresses to be discovered by used to register individual target addresses to be discovered by
skipping to change at page 17, line 5 skipping to change at page 15, line 47
alphanum = ALPHA / DIGIT alphanum = ALPHA / DIGIT
domainlabel = alphanum / alphanum *[alphanum / "-"] alphanum domainlabel = alphanum / alphanum *[alphanum / "-"] alphanum
toplabel = ALPHA / ALPHA *[ alphanum / "-" ] alphanum toplabel = ALPHA / ALPHA *[ alphanum / "-" ] alphanum
hostnumber = ipv4-number hostnumber = ipv4-number
ipv4-number = 1*3DIGIT 3("." 1*3DIGIT) ipv4-number = 1*3DIGIT 3("." 1*3DIGIT)
port = 1*DIGIT port = 1*DIGIT
iscsi-name = iscsi-char ; iSCSI target name iscsi-name = iscsi-char ; iSCSI target name
identity = iscsi-char ; optional identity string identity = iscsi-char ; optional identity string
iscsi-char = ALPHA / DIGIT / escaped / ":" / "-" / "." iscsi-char = ALPHA / DIGIT / escaped / ":" / "-" / "."
; Intended to allow UTF-8 encoded strings ; Intended to allow UTF-8 encoded strings
escaped = 1*(` HEXDIG HEXDIG) escaped = 1*(`' HEXDIG HEXDIG)
; ;
; The iscsi-name part of the URL is required and must be the iSCSI ; The iscsi-name part of the URL is required and must be the iSCSI
; name of the target being registered. ; name of the target being registered.
; A device representing multiple targets must individually ; A device representing multiple targets must individually
; register each target/address combination with SLP. ; register each target/address combination with SLP.
; The identity part of the URL is optional, and is used to ; The identity part of the URL is optional, and is used to
; indicate an identity that is allowed to access this target. ; indicate an identity that is allowed to access this target.
; ;
; Example (split into two lines for clarity): ; Example (split into two lines for clarity):
; service:iscsi:target://192.0.2.3:3260/ ; service:iscsi:target://192.0.2.3:3260/
; iqn.2001-04.com.example.sn.45678 ; iqn.2001-04.com.example.sn.45678
iscsi-name = string iscsi-name = string
# The iSCSI Name of this target. # The iSCSI Name of this target.
# This must match the iscsi-name in the url-path. # This must match the iscsi-name in the url-path.
portal-group = integer portal-group = integer
# The iSCSI portal group tag for this address. Addresses sharing # The iSCSI portal group tag for this address. Addresses sharing
# the same iscsi-name and portal-group tag can be used within the # the same iscsi-name and portal-group tag can be used within the
# same iSCSI session. Portal groups are described in [iSCSI]. # same iSCSI session. Portal groups are described in [RFC3720].
transports = string M L transports = string M L
tcp tcp
# This is a list of transport protocols that the registered # This is a list of transport protocols that the registered
# entity supports. iSCSI is currently supported over TCP, # entity supports. iSCSI is currently supported over TCP,
# but it is anticipated that it could be supported over other # but it is anticipated that it could be supported over other
# transports, such as SCTP, in the future. # transports, such as SCTP, in the future.
tcp tcp
mgmt-entity = string O mgmt-entity = string O
skipping to change at page 18, line 6 skipping to change at page 16, line 48
auth-name = string M X auth-name = string M X
# A list of iSCSI Initiator Names that can access this target. # A list of iSCSI Initiator Names that can access this target.
# Normal iSCSI names will be 80 characters or less; max length # Normal iSCSI names will be 80 characters or less; max length
# is 255. # is 255.
# Normally, only one or a few values will be in the list. # Normally, only one or a few values will be in the list.
# Using the equivalence search on this will evaluate to "true" # Using the equivalence search on this will evaluate to "true"
# if any one of the items in this list matches the query. # if any one of the items in this list matches the query.
# If this list contains the default name "any", any initiator # If this list contains the default name "any", any initiator
# is allowed to access this target, provided it matches the # is allowed to access this target, provided it matches the
# other auth-xxx attributes. # other auth-xxx attributes.
#
# This attribute contains security policy information. If this
# attribute is distributed via an Attribute Reply message,
# IPsec MUST be used.
auth-addr = string M X auth-addr = string M X
# A list of initiator IP addresses (or host names) which will # A list of initiator IP addresses (or host names) which will
# be allowed access to this target. If this list contains the # be allowed access to this target. If this list contains the
# default name "any", any IP address is allowed access to this # default name "any", any IP address is allowed access to this
# target, provided it matches the other auth-xxx attributes. # target, provided it matches the other auth-xxx attributes.
#
# This attribute contains security policy information. If this
# attribute is distributed via an Attribute Reply message,
# IPsec MUST be used.
auth-cred = string M X auth-cred = string M X
# A list of credentials which will be allowed access to the target # A list of credentials which will be allowed access to the target
# (provided they can provide the correct password or other # (provided they can provide the correct password or other
# authenticator). Entries in this list are of the form # authenticator). Entries in this list are of the form
# "method/identifier", where the currently defined methods are # "method/identifier", where the currently defined methods are
# "chap" and "srp", both of which take usernames as their # "chap" and "srp", both of which take usernames as their
# identifiers. # identifiers.
#
# This attribute contains security policy information. If this
# attribute is distributed via an Attribute Reply message,
# IPsec MUST be used.
boot-list = string M O boot-list = string M O
# A list of iSCSI Initiator Names that can boot from this target. # A list of iSCSI Initiator Names that can boot from this target.
# This list works precisely like the auth-name attribute. A name # This list works precisely like the auth-name attribute. A name
# appearing in this list must either appear in the access-list, # appearing in this list must either appear in the access-list,
# or the access-list must contain the initiator name "iscsi". # or the access-list must contain the initiator name "iscsi".
# Otherwise, an initiator will be unable to find its boot target. # Otherwise, an initiator will be unable to find its boot target.
# If boot-list contains the name "iscsi", any host can boot from it, # If boot-list contains the name "iscsi", any host can boot from it,
# but I am not sure if this is useful to anyone. # but I am not sure if this is useful to anyone.
# If this attribute is not registered, this target is not "bootable". # If this attribute is not registered, this target is not "bootable".
# #
# Note that the LUN the host boots from is not specified here; a # Note that the LUN the host boots from is not specified here; a
# host will generally attempt to boot from LUN 0. # host will generally attempt to boot from LUN 0.
# #
# It is quite possible that other attributes will need to be defined # It is quite possible that other attributes will need to be defined
# here for booting as well. # here for booting as well.
#
# This attribute contains security policy information. If this
# attribute is distributed via an Attribute Reply message,
# IPsec MUST be used.
--------------------------template ends here------------------------ --------------------------template ends here------------------------
5.3. iSCSI Storage Management Service Templates 5.3. iSCSI Storage Management Service Templates
This template defines the service "service:iscsi:sms". An entity This template defines the service "service:iscsi:sms". An entity
supporting one or more iSCSI management service protocols may supporting one or more iSCSI management service protocols may
register itself with SLP as this service type. register itself with SLP as this service type.
iSCSI clients and servers wishing to discover storage management iSCSI clients and servers wishing to discover storage management
services using SLP will usually search for them by the protocol(s) services using SLP will usually search for them by the protocol(s)
they support: they support:
Service: service:iscsi:sms Service: service:iscsi:sms
Scope: initiator-scope-list Scope: initiator-scope-list
Query: (protocols=isns) Query: (protocols=isns)
Name of submitter: Mark Bakke Name of submitter: Mark Bakke
Language of service template: en Language of service template: en
Security Considerations: Security Considerations: see section 6.
See later section.
Template Text: Template Text:
-------------------------template begins here----------------------- -------------------------template begins here-----------------------
template-type=iscsi:sms template-type=iscsi:sms
template-version=0.1 template-version=0.1
template-description= template-description=
This is a concrete service type. The iscsi:sms service type This is a concrete service type. The iscsi:sms service type
provides the capability for entities supporting iSCSI to discover provides the capability for entities supporting iSCSI to discover
skipping to change at page 19, line 35 skipping to change at page 18, line 47
protocols = string M protocols = string M
# The list of protocols supported by this name service. This # The list of protocols supported by this name service. This
# list may be expanded in the future. There is no default. # list may be expanded in the future. There is no default.
# #
# "isns" - This management service supports the use of the iSNS # "isns" - This management service supports the use of the iSNS
# protocol for access management, health monitoring, and # protocol for access management, health monitoring, and
# discovery management services. This protocol is defined # discovery management services. This protocol is defined
# in [ISNS]. # in [ISNS].
isns isns
transports = string M L
tcp
# This is a list of transport protocols that the registered
# entity supports.
tcp, udp
--------------------------template ends here------------------------ --------------------------template ends here------------------------
6. Security Considerations 6. Security Considerations
The SLPv2 security model does not provide confidentiality, but does The SLPv2 security model as specified in [RFC2608] does not provide
provide an authentication mechanism for UAs to assure that service confidentiality, but does provide an authentication mechanism for UAs
advertisements only come from trusted SAs [RFC2608]. to assure that service advertisements only come from trusted SAs with
the exception that it does not provide a mechanism to authenticate
"zero-result responses". See [RFC3723] for a discussion of the SLPv2
[RFC2608] security model.
Once a target or management server is discovered, authentication and Once a target or management server is discovered, authentication and
authorization are handled by the iSCSI protocol, or by the management authorization are handled by the iSCSI protocol, or by the management
server's protocol. It is the responsibility of the providers of server's protocol. It is the responsibility of the providers of
these services to ensure that an inappropriately advertised or these services to ensure that an inappropriately advertised or
discovered service does not compromise their security. discovered service does not compromise their security.
When no security is used for SLPv2, there is a risk of distribution
of false discovery information. The primary countermeasure for this
risk is authentication. When this risk is a significant concern,
IPsec SAs and iSCSI in-band authentication SHOULD be used for iSCSI
traffic subject to this risk to ensure that iSCSI traffic only flows
between endpoints that have participated in IKE authentication and
iSCSI in-band authentication. For example, if an attacker
distributes discovery information falsely claiming that it is an
iSCSI target, it will lack the secret information necessary to
successfully complete IKE authentication or iSCSI in-band
authentication, and hence will be prevented from falsely sending or
receiving iSCSI traffic.
There remains a risk of a denial of service attack based on repeated
use of false discovery information that will cause initiation of IKE
negotiation. The countermeasures for this are administrative
configuration of each iSCSI Target to limit the peers that it is
willing to communicate with (i.e., by IP address range and/or DNS
domain), and maintenance of a negative authentication cache to avoid
repeatedly contacting an iSCSI Target that fails to authenticate.
These three measures (i.e., IP address range limits, DNS domain
limits, negative authentication cache) MUST be implemented.
The auth-name, auth-addr, auth-cred, and boot-list attributes
comprise security policy information. When these are distributed,
IPsec MUST be implemented.
6.1. Security Implementation 6.1. Security Implementation
For all implementations, IPsec SHOULD be implemented. When security Security for SLPv2 in an IP storage environment is specified in
policy information distribution using SLPv2 is supported, IPsec MUST [RFC3723].
be implemented.
To provide confidentiality, IPsec with ESP and a non-null transform IPsec SHOULD be implemented for SLPv2 as specified in [RFC3723]; this
SHOULD be implemented. When security policy information distribution includes ESP with a non-null transform to provide both authentication
via SLPv2 is used, IPsec with ESP and a non-null transform MUST be and confidentiality.
used.
When SLPv2 can be used to distribute auth-name, auth-addr, auth-cred,
boot-list information (see Section 5.2 above), IPsec MUST be
implemented, as these items are considered to be sensitive security
policy information. If IPsec is not implemented, auth-name, auth-
addr, auth-cred, and boot-list information MUST NOT be distributed
via SLPv2, and MUST NOT be used if discovered via SLPv2.
SLPv2 authentication is OPTIONAL to implement and use, and SLPv2 SLPv2 authentication is OPTIONAL to implement and use, and SLPv2
authentication SHOULD be implemented when IPsec is not supported. authentication SHOULD be implemented when IPsec is not supported.
The use of IPsec and IKE for SLPv2 in an IP storage environment is
described in [IPS-SEC].
7. IANA Considerations 7. IANA Considerations
This document describes three SLP Templates. When they have been This document describes three SLP Templates. When they have been
reviewed and approved by the IESG, they should be registered in the reviewed and approved by the IESG, they should be registered in the
IANA "SVRLOC Templates" registry. This process is described in the IANA "SVRLOC Templates" registry. This process is described in the
IANA Considerations section of [RFC2609]. IANA Considerations section of [RFC2609].
8. Summary 8. Summary
This document describes how SLP can be used by iSCSI initiators to This document describes how SLP can be used by iSCSI initiators to
find iSCSI targets and storage management servers. Service type find iSCSI targets and storage management servers. Service type
templates for iSCSI targets and storage management servers are templates for iSCSI targets and storage management servers are
presented. presented.
9. Normative References 9. Normative References
[RFC2608] E. Guttman, C. Perkins, J. Veizades, M. Day. "Service [RFC2608] Guttman, E., Perkins, C., Veizades, J. and M. Day, "Service
Location Protocol, version 2", RFC 2608, July 1999. Location Protocol, version 2", RFC 2608, June 1999.
[RFC2609] E. Guttman, C. Perkins, J. Kempf. "Service Templates and [RFC2609] Guttman, E., Perkins, C. and J. Kempf, "Service Templates
service: Schemes", RFC 2609, July 1999. and service: Schemes", RFC 2609, June 1999.
[RFC2119] S. Bradner. "Key Words for Use in RFCs to Indicate [RFC2119] Bradner, S., "Key Words for Use in RFCs to Indicate
Requirement Levels", RFC 2119, March 1997. Requirement Levels", RFC 2119, March 1997.
[iSCSI] J. Satran, et. al. "iSCSI", Work in Progress, draft-ietf- [RFC3720] Satran, J., Meth, K., Sapuntzakis, C., Chadalapaka, M. and
ips-iscsi-20.txt, January 2003. E. Zeidner, "Internet Small Computer Systems Interface
(iSCSI)", RFC 3720, March 2004.
[IPS-SEC] B. Aboba, et. al., "Securing Block Storage Protocols over [RFC3723] Aboba, B., Tseng, J., Walker, J., Rangan, V. and F.
IP", Work in Progress, draft-ietf-ips-security-19.txt, Travostino, "Securing Block Storage Protocols over IP", RFC
January 2003. 3723, March 2004.
10. Informative References 10. Informative References
[RFC2614] J. Kempf, E. Guttman. "An API for Service Location", RFC [RFC2614] Kempf, J. and E. Guttman, "An API for Service Location",
2614, June 1999. RFC 2614, June 1999.
[2614BIS] J. Kempf, E. Guttman. "An API for Service Location", draft- [2614BIS] Kempf, J. and E. Guttman, "An API for Service Location",
kempf-svrloc-rfc2614bis-00.txt, February 2002. draft-kempf-svrloc-rfc2614bis-00.txt, February 2002.
[SAM2] ANSI T10. "SCSI Architectural Model 2", March 2000. [SAM2] ANSI T10. "SCSI Architectural Model 2", March 2000.
[NDT] M. Bakke et. al. "iSCSI Naming and Discovery", Work in [RFC3721] Bakke, M., Hafner, J., Hufferd, J., Voruganti, K., and M.
Progress, draft-ietf-ips-iscsi-name-disc-09.txt, March 2003. Krueger, "Internet Small Computer Systems Interface (iSCSI)
Naming and Discovery", RFC 3721, March 2004.
[AUTH-MIB] M. Bakke, J. Muchow, "Definitions of Managed Objects for [AUTH-MIB] Bakke, M. and J. Muchow, "Definitions of Managed Objects for
User Identity Authentication", Work in Progress, draft-ietf- User Identity Authentication", Work in Progress, draft-ietf-
ips-auth-mib-04.txt, March 2003. ips-auth-mib-04.txt, March 2003.
[ISNS] J. Tseng, et. al. "Internet Storage Name Service", Work in [ISNS] Tseng, J., Gibbons, K., Travostino, F., Du Laney, C. and J.
Progress, draft-ietf-ips-isns-17.txt, January 2003. Souza, "Internet Storage Name Service", Work in Progress,
draft-ietf-ips-isns-22.txt, February 2004.
[BOOT] P. Sarkar, D. Missimer, C. Sapuntzakis. "A Standard for [BOOT] Sarkar, P., Missimer, D. and C. Sapuntzakis, "A Standard
Bootstrapping Clients using the iSCSI Protocol", Work in for Bootstrapping Clients using the iSCSI Protocol", Work in
Progress, draft-ietf-ips-iscsi-boot-07.txt, October 2002. Progress, draft-ietf-ips-iscsi-boot-12.txt, March 2004.
[RFC3082] J. Kempf, J Goldschmidt. "Notification and Subscription for [RFC1900] Carpenter, B. and Y. Rekhter, "Renumbering Needs Work", RFC
SLP", RFC 3082, March 2001. 1900, February 1996.
[RFC3105] Kempf, J., Montenegro, G. "Finding an RSIP Server with SLP", [RFC3105] Kempf, J. and G. Montenegro, "Finding an RSIP Server with
RFC 3105, October 2001. SLP", RFC 3105, October 2001.
[STRINGPREP] [RFC3722] Bakke, M., "String Profile for iSCSI Names", RFC 3722,
Bakke, M. "String Profile for iSCSI Names", Work in March 2004.
Progress, draft-ietf-ips-iscsi-string-prep-04.txt, March
2003.
[NAMEPREP] Hoffman, P., Blanchet, M. "Nameprep: A Stringprep Profile [RFC3491] Hoffman, P. and M. Blanchet, "Nameprep: A Stringprep Profile
for Internationalized Domain Names", Work in Progress, for Internationalized Domain Names", RFC 3491, March 2003.
draft-ietf-idn-nameprep-11.txt, June 2002.
11. Authors' Addresses 11. Authors' Addresses
Mark Bakke Mark Bakke
Cisco Systems, Inc. Cisco Systems, Inc.
6450 Wedgwood Road 6450 Wedgwood Road
Maple Grove, MN 55311 Maple Grove, MN 55311
Voice: +1 763-398-1000 Voice: +1 763-398-1000
EMail: mbakke@cisco.com EMail: mbakke@cisco.com
skipping to change at page 22, line 43 skipping to change at page 22, line 43
Todd Sperry Todd Sperry
Adaptec, Inc. Adaptec, Inc.
691 South Milpitas Boulevard 691 South Milpitas Boulevard
Milpitas, Ca. 95035 Milpitas, Ca. 95035
Voice: +1 408 957-4980 Voice: +1 408 957-4980
Email: todd_sperry@adaptec.com Email: todd_sperry@adaptec.com
12. Full Copyright Notice 12. Full Copyright Notice
Copyright (C) The Internet Society (2001). All Rights Reserved. Copyright (C) The Internet Society (2004). All Rights Reserved.
This document and translations of it may be copied and furnished to This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of Internet organizations, except as needed for the purpose of
 End of changes. 

This html diff was produced by rfcdiff 1.23, available from http://www.levkowetz.com/ietf/tools/rfcdiff/