draft-ietf-ips-iscsi-slp-09.txt   rfc4018.txt 
Internet Draft Mark Bakke Network Working Group M. Bakke
<draft-ietf-ips-iscsi-slp-09.txt> Cisco Request for Comments: 4018 Cisco
Expires February 2005 Category: Standards Track J. Hufferd
John Hufferd K. Voruganti
Kaladhar Voruganti
IBM IBM
M. Krueger
Marjorie Krueger
HP HP
T. Sperry
Todd Sperry
Adaptec Adaptec
April 2005
August 2004
Finding Internet Small Computer Systems Interface (iSCSI) Targets Finding Internet Small Computer Systems Interface (iSCSI) Targets
and Name Servers using Service Location Protocol version 2 (SLPv2) and Name Servers by Using Service Location Protocol version 2 (SLPv2)
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet- Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at Status of This Memo
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at This document specifies an Internet standards track protocol for the
http://www.ietf.org/shadow.html. Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2004). All Rights Reserved. Copyright (C) The Internet Society (2005).
Abstract Abstract
The iSCSI protocol provides a way for hosts to access SCSI devices The iSCSI protocol provides a way for hosts to access SCSI devices
over an IP network. This document defines the use of the Service over an IP network. This document defines the use of the Service
Location Protocol (SLP) by iSCSI hosts, devices, and management Location Protocol (SLP) by iSCSI hosts, devices, and management
services, along with the SLP service type templates that describe the services, along with the SLP service type templates that describe the
services they provide. services they provide.
Acknowledgements
This draft was produced by the iSCSI Naming and Discovery team,
including Joe Czap, Jim Hafner, John Hufferd, and Kaladhar Voruganti
(IBM), Howard Hall (Pirus), Jack Harwood (EMC), Yaron Klein (Sanrad),
Marjorie Krueger (HP), Lawrence Lamers (San Valley), Todd Sperry
(Adaptec), and Joshua Tseng (Nishan). Thanks also to Julian Satran
(IBM) for suggesting the use of SLP for iSCSI discovery, and to Matt
Peterson (Caldera) and James Kempf (Sun) for reviewing the document
from an SLP perspective.
Table of Contents Table of Contents
1. Introduction.................................................2 1. Introduction................................................ 2
2. Notation Conventions.........................................3 2. Notation Conventions........................................ 2
3. Terminology..................................................3 3. Terminology................................................. 3
4. Using SLP for iSCSI Service Discovery........................4 4. Using SLP for iSCSI Service Discovery....................... 4
5. iSCSI SLP Templates.........................................12 5. iSCSI SLP Templates......................................... 11
6. Security Considerations.....................................18 6. Security Considerations..................................... 18
7. IANA Considerations.........................................20 7. IANA Considerations......................................... 19
8. Summary.....................................................20 8. Summary..................................................... 19
9. Normative References........................................20 9. Normative References........................................ 19
10. Informative References......................................21 10. Informative References...................................... 20
11. Authors' Addresses..........................................21 11. Acknowledgements............................................ 21
12. Full Copyright Notice.......................................22
1. Introduction 1. Introduction
iSCSI [RFC3720] is a protocol used to transport SCSI [SAM2] commands, iSCSI [RFC3720] is a protocol used to transport SCSI [SAM2] commands,
data, and status across an IP network. This protocol is connection- data, and status across an IP network. This protocol is connection-
oriented, and is currently defined over TCP. iSCSI uses a client- oriented and is currently defined over TCP. iSCSI uses a client-
server relationship. The client end of the connection is an server relationship. The client end of the connection is an
initiator, and sends SCSI commands; the server end of the connection initiator, and it sends SCSI commands; the server end of the
is called a target, and receives and executes the commands. connection is called a target, and it receives and executes the
commands.
There are several methods an iSCSI initiator can use to find the There are several methods an iSCSI initiator can use to find the
targets to which it should connect. Two of these methods can be targets to which it should connect. Two of these methods can be
accomplished without the use of SLP: accomplished without the use of SLP:
- Each target and its address can be statically configured on the - Each target and its address can be statically configured on the
initiator. initiator.
- Each address providing targets can be configured on the initiator; - Each address providing targets can be configured on the initiator;
iSCSI provides a mechanism by which the initiator can query the iSCSI provides a mechanism by which the initiator can query the
address for a list of targets. address for a list of targets.
The above methods are further defined in "iSCSI Naming and Discovery The above methods are further defined in "iSCSI Naming and Discovery
Requirements" [RFC3721]. Requirements" [RFC3721].
Each of the above methods requires a small amount of configuration to Each of the above methods requires a small amount of configuration to
be done on each initiator. The ability to discover targets and name be done on each initiator. The ability to discover targets and name
services without having to configure initiators is a desirable services without having to configure initiators is a desirable
feature. The Service Location Protocol (SLP) [RFC2608] is an IETF feature. The Service Location Protocol (SLP) [RFC2608] is an IETF
standards track protocol that provides several features that will standards track protocol providing several features that will
simplify locating iSCSI services. This document describes how SLP simplify locating iSCSI services. This document describes how SLP
can be used in iSCSI environments to discover targets, addresses can be used in iSCSI environments to discover targets, addresses
providing targets, and storage management servers. providing targets, and storage management servers.
2. Notation Conventions 2. Notation Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", In this document, the key words "MUST", "MUST NOT", "REQUIRED",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY",
document are to be interpreted as described in [RFC2119]. and "OPTIONAL" are to be interpreted as described in [RFC2119].
3. Terminology 3. Terminology
Here are some definitions that may aid readers that are unfamiliar Here are some definitions that may aid readers who are unfamiliar
with either SLP, SCSI, or iSCSI. Some of these definitions have been with SLP, SCSI, or iSCSI. Some of these definitions have been
reproduced from [RFC2608] and "Finding an RSIP Server with SLP" reproduced from [RFC2608] and "Finding an RSIP Server with SLP"
[RFC3105]. [RFC3105].
User Agent (UA) A process working on the client's behalf User Agent (UA) A process working on the client's behalf
to establish contact with some service. to establish contact with some service.
The UA retrieves service information from The UA retrieves service information from
the Service Agents or Directory Agents. the Service Agents or Directory Agents.
Service Agent (SA) A process working on behalf of one or more Service Agent (SA) A process working on behalf of one or more
services to advertise the services and services to advertise the services and
their capabilities. their capabilities.
Directory Agent (DA) A process which collects service Directory Agent (DA) A process that collects service
advertisements. There can only be one DA advertisements. There can only be one DA
present per given host. present per given host.
Scope A named set of services, typically making Scope A named set of services, typically making
up a logical administrative group. up a logical administrative group.
Service Advertisement A URL, attributes, and a lifetime Service Advertisement A URL, attributes, and a lifetime
(indicating how long the advertisement is (indicating how long the advertisement is
valid), providing service access valid) providing service access
information and capabilities description information and capabilities description
for a particular service. for a particular service.
Initiator A logical entity, typically within a host, Initiator A logical entity, typically within a host,
that sends SCSI commands to targets to be that sends SCSI commands to targets to be
executed. An initiator is usually present executed. An initiator is usually present
in the form of a device driver. in the form of a device driver.
Target A logical entity, typically within a Target A logical entity, typically within a
storage controller or gateway, that storage controller or gateway that
receives SCSI commands from an initiator receives SCSI commands from an initiator
and executes them. A target includes one and executes them. A target includes one
or more Logical Units (LUs); each LU is a or more Logical Units (LUs); each LU is a
SCSI device, such as a disk or tape drive. SCSI device, such as a disk or tape drive.
iSCSI Name A UTF-8 character string which serves as a iSCSI Name A UTF-8 character string that serves as a
unique identifier for iSCSI initiators and unique identifier for iSCSI initiators and
targets. Its format and usage is further targets. Its format and usage is further
defined in [RFC3721]. defined in [RFC3721].
iSCSI Client A logical entity, typically a host, which iSCSI Client A logical entity, typically a host that
includes at least one iSCSI Initiator. includes at least one iSCSI Initiator.
iSCSI Server A logical entity, typically a storage iSCSI Server A logical entity, typically a storage
controller or gateway, which includes at controller or gateway that includes at
least one iSCSI Target. least one iSCSI Target.
Storage Management Server An addressable entity that provides Storage Management Server An addressable entity that provides
management services that benefit an iSCSI management services that benefit an iSCSI
environment. "Storage management server" environment. "Storage management server"
is used as a generic term, rather than a is used as a generic term and does not
specific protocol or service. indicate a specific protocol or service.
4. Using SLP for iSCSI Service Discovery 4. Using SLP for iSCSI Service Discovery
Two entities are involved in iSCSI discovery. The end result is that Two entities are involved in iSCSI discovery. The end result is that
an iSCSI initiator (e.g. a host) discovers iSCSI targets, usually an iSCSI initiator (e.g., a host) discovers iSCSI targets, usually
provided by storage controllers or gateways. provided by storage controllers or gateways.
iSCSI targets are registered with SLP as a set of service URLs, one iSCSI targets are registered with SLP as a set of service URLs, one
for each address on which the target may be accessed. Initiators for each address on which the target may be accessed. Initiators
discover these targets using SLP service requests. Targets that do discover these targets by using SLP service requests. Targets that
not directly support SLP, or are under the control of a management do not directly support SLP or that are under the control of a
service, may be registered by a proxy service agent as part of the management service may be registered by a proxy service agent as part
software providing this service. of the software providing this service.
iSCSI entities may also use SLP to discover higher-level management iSCSI entities may also use SLP to discover higher-level management
services where needed. services when these are needed.
This section first describes the use of SLP for discovery of targets This section first describes the use of SLP for discovery of targets
by iSCSI initiators, and then describes the use of SLP to discover by iSCSI initiators, it then describes the use of SLP to discover
storage management servers. storage management servers.
This document assumes that SLPv2 will be used when discovering iSCSI- This document assumes that SLPv2 will be used for discovering iSCSI-
related services; no attempt is made to include support for SLPv1. related services; no attempt is made to include support for SLPv1.
4.1. Discovering iSCSI Targets using SLP 4.1. Discovering iSCSI Targets with SLP
The following diagram shows the relationship between iSCSI clients, The following diagram shows the relationship among iSCSI clients,
servers, initiators, and targets. An iSCSI client includes at least servers, initiators, and targets. An iSCSI client includes at least
one iSCSI initiator, and an SLP user agent (UA). An iSCSI server one iSCSI initiator, and an SLP user agent (UA). An iSCSI server
includes at least one iSCSI target, and an SLP service agent (SA). includes at least one iSCSI target an SLP service agent (SA). Some
Some entities, such as extended copy engines, include both initiators entities, such as extended copy engines, include both initiators and
and targets. These include both an SA, for its targets to be targets. These include both an SA, for its targets to be discovered,
discovered, and a UA, for its initiator(s) to discover other targets. and a UA, for its initiator(s) to discover other targets.
+---------------------------------+ +---------------------------------+
| iSCSI Client | | iSCSI Client |
| +-----------+ | | +-----------+ |
| | iSCSI | | | | iSCSI | |
| | initiator | | | | initiator | |
| | "myhost" | | | | "myhost" | |
| +-----------+ | | +-----------+ |
| | | |
+--------------------------+------+ +--------------------------+------+
skipping to change at page 7, line 14 skipping to change at page 5, line 52
In the above drawing, the iSCSI server has three iSCSI targets that In the above drawing, the iSCSI server has three iSCSI targets that
the client could discover, named "one", "two" and "three". The iSCSI the client could discover, named "one", "two" and "three". The iSCSI
client has an iSCSI initiator with the name "myhost". The iSCSI client has an iSCSI initiator with the name "myhost". The iSCSI
client may use the initiator name in its SLP Service Requests as a client may use the initiator name in its SLP Service Requests as a
filter to discover only targets that are configured to accept iSCSI filter to discover only targets that are configured to accept iSCSI
connections from "myhost". connections from "myhost".
Each iSCSI target and initiator has a unique name, called an iSCSI Each iSCSI target and initiator has a unique name, called an iSCSI
Name. This identifier is the same regardless of the network path Name. This identifier is the same regardless of the network path
(through adapter cards, networks, interfaces on the storage device) (through adapter cards, networks, and interfaces on the storage
over which the target is discovered and accessed. For this example, device) over which the target is discovered and accessed. For this
the iSCSI names "one" and "two", and "three" are used for the example, the iSCSI names "one", "two", and "three" are used for the
targets; the initiator uses the name "myhost". An actual iSCSI name targets; the initiator uses the name "myhost". An actual iSCSI name
would incorporate more structure, including a naming authority, and would incorporate more structure, including a naming authority, and
is not described here. is not described here.
Each of the iSCSI targets in the drawing can appear at two addresses, Each of the iSCSI targets in the drawing can appear at two addresses,
since two network interfaces are present. Each target would have two since two network interfaces are present. Each target would have two
service URLs, unless a single service URL included a DNS host name service URLs, unless a single service URL included a DNS host name
mapping to both addresses. mapping to both addresses.
An iSCSI target URL consists of its fully qualified host name or IP An iSCSI target URL consists of its fully qualified host name or IP
address, the TCP port on which it is listening, and its iSCSI name. address, the TCP port on which it is listening, and its iSCSI name.
An iSCSI server must register each of its individual targets at each An iSCSI server must register each of its individual targets at each
of its network addresses. of its network addresses.
The iSCSI server constructs a service advertisement of the type The iSCSI server constructs a service advertisement of the type
"service:iscsi:target" for each of the service URLs it wishes to "service:iscsi:target" for each of the service URLs it wishes to
register. The advertisement contains a lifetime, along with other register. The advertisement contains a lifetime, along with other
attributes which are defined in the service template. attributes that are defined in the service template.
If the server in the above drawing is listening at TCP port 3260 for If the server in the above drawing is listening at TCP port 3260 for
both network addresses, the service URLs registered would be: both network addresses, the service URLs registered would be
- 192.0.2.131:3260/one - 192.0.2.131:3260/one
- 192.0.2.131:3260/two - 192.0.2.131:3260/two
- 192.0.2.131:3260/three - 192.0.2.131:3260/three
- 192.0.2.3:3260/one - 192.0.2.3:3260/one
- 192.0.2.3:3260/two - 192.0.2.3:3260/two
- 192.0.2.3:3260/three - 192.0.2.3:3260/three
The remainder of the discovery procedure is identical to that used by The remainder of the discovery procedure is identical to that used by
any client/server pair implementing SLP: any client/server pair implementing SLP:
1. If an SLP DA is found, the SA contacts the DA and registers 1. If an SLP DA is found, the SA contacts the DA and registers the
the service advertisement. Whether or not one or more SLPv2 service advertisement. Whether or not one or more SLPv2 DAs are
DAs are discovered, the SA maintains the advertisement itself discovered, the SA maintains the advertisement itself and answers
and answers multicast UA queries directly. multicast UA queries directly.
2. When the iSCSI initiator requires contact information for an 2. When the iSCSI initiator requires contact information for an
iSCSI target, the UA either contacts the DA using unicast or iSCSI target, the UA either contacts the DA by using unicast or
the SA using multicast. If a UA is configured with the address the SA by using multicast. If a UA is configured with the
of the SA, it may avoid multicast and contact an SA using address of the SA, it may avoid multicast and may contact an SA
unicast. The UA includes a query based on by using unicast. The UA includes a query based on the
the attributes to indicate the characteristics of the attributes to indicate the characteristics of the target(s) it
target(s) it requires. requires.
3. Once the UA has the host name or address of the iSCSI server 3. Once the UA has the host name or address of the iSCSI server, as
as well as the port number and iSCSI Target Name, it can begin the well as the port number and iSCSI Target Name, it can begin the
normal iSCSI login to the target. normal iSCSI login to the target.
As information contained in the iSCSI target template may exceed As information contained in the iSCSI target template may exceed
common network datagram sizes, the SLP implementation for both UAs common network datagram sizes, the SLP implementation for both UAs
and SAs supporting this template MUST implement SLP over TCP. and SAs supporting this template MUST implement SLP over TCP.
4.1.1. Finding Targets Based on Initiator Credentials 4.1.1. Finding Targets Based on Initiator Credentials
To be allowed access to an iSCSI target, an initiator must be To be allowed access to an iSCSI target, an initiator must be
authenticated. The initiator may be required by the target to authenticated. The initiator may be required by the target to
produce one or more of the following credentials: produce one or more of the following credentials:
- An iSCSI Initiator Name - An iSCSI Initiator Name
- An IP address - An IP address
- A CHAP, SRP, or Kerberos credential - A CHAP, SRP, or Kerberos credential
- Any combination of the above - Any combination of the above
Most iSCSI targets allow access to only one or two initiators. In Most iSCSI targets allow access to only one or two initiators. In
the ideal discovery scenario, an initiator would send an SLP request, the ideal discovery scenario, an initiator would send an SLP request
and receive responses ONLY for those targets to which the initiator and receive responses ONLY for targets to which the initiator is
is guaranteed a successful login. To achieve this goal, the iSCSI guaranteed a successful login. To achieve this goal, the iSCSI
target template contains the following attributes, each of which target template contains the following attributes, each of which
allows a list of values: allows a list of values:
1. auth-name - This attribute contains the list of initiator names 1. auth-name: This attribute contains the list of initiator names
allowed to access this target, or the value "any", indicating allowed to access this target, or the value "any", indicating
that no specific initiator name is required. that no specific initiator name is required.
2. auth-addr - This attribute contains the list of host names 2. auth-addr: This attribute contains the list of host names
and/or IP addresses which will be allowed access to this target, and/or IP addresses that will be allowed access to this target,
or the value "any", indicating that no specific address or or the value "any", indicating that no specific address or
host name is required. If a large number of addresses is to host name is required. If a large number of addresses is to
be allowed (perhaps a subnet), this attribute may contain the be allowed (perhaps a subnet), this attribute may contain the
value "any". value "any".
3. auth-cred - This attribute contains a list of "method/identifier" 3. auth-cred: This attribute contains a list of "method/identifier"
credentials that will be allowed access to the target, provided credentials that will be allowed access to the target, provided
they can produce the correct password or other verifier during they can produce the correct password or other verifier during
the login process. If no specific credentials are required, the the login process. If no specific credentials are required, the
value "any" is used. value "any" is used.
The list of valid method strings for auth-cred are defined in The list of valid method strings for auth-cred are defined in
[RFC3720], section 11.1 "AuthMethod". The identifier used after the [RFC3720], section 11.1, "AuthMethod". The identifier used after the
"/" is defined by the specific AuthMethod, also in [RFC3720]. "/" is defined by the specific AuthMethod, also in [RFC3720].
Examples showing initiator searches based on auth-xxxx attributes are Examples showing initiator searches based on auth-xxxx attributes are
shown in the target-specific template section below. shown in the target-specific template section below.
Also note that the auth-xxxx attributes are considered to be security Also note that the auth-xxxx attributes are considered security
policy information. If these attributes are distributed, IPsec MUST policy information. If these attributes are distributed, IPsec MUST
be implemented as specified in the Security Implementation section be implemented as specified in the Security Implementation section
below. below.
4.1.2. Supporting Access by Multiple Identities to the Same Target 4.1.2. Supporting Access by Multiple Identities to the Same Target
If a target is to allow access to multiple host identities, more than If a target is to allow access to multiple host identities, more than
one combination of auth-xxxx attributes will need to be allowed. In one combination of auth-xxxx attributes will have to be allowed. In
some of these cases, it is not possible to express the entire set of some of these cases, it is not possible to express the entire set of
valid combinations of auth-xxxx attributes within a single registered valid combinations of auth-xxxx attributes within a single registered
service URL. For example, if a target can be addressed by: service URL. For example, if a target can be addressed by
auth-name=myhost1 AND auth-cred=CHAP/user1 (identity1) auth-name=myhost1 AND auth-cred=CHAP/user1 (identity1)
OR OR
auth-name-myhost2 AND auth-cred=CHAP/user2 (identity2) auth-name-myhost2 AND auth-cred=CHAP/user2 (identity2)
the above cannot be specified in a single registered service URL, the above cannot be specified in a single registered service URL,
since (auth-name=myhost1, auth-name=myhost2, auth-cred=CHAP/user1, since (auth-name=myhost1, auth-name=myhost2, auth-cred=CHAP/user1,
auth-cred=CHAP/user2) would allow either auth-name to be used with auth-cred=CHAP/user2) would allow either auth-name to be used with
either auth-cred. This necessitates the ability to register a target either auth-cred. This necessitates the ability to register a target
and address under more than one service URL; one for (identity1) and and address under more than one service URL; one for (identity1) and
one for (identity2). one for (identity2).
Since service URLs must be unique, (identity1) and (identity2) must Because service URLs must be unique, (identity1) and (identity2) must
each be registered under its own unique service URL. each be registered under a unique service URL. For systems that
support the configuration of multiple identities to access a target,
For systems that support the configuration of multiple identities to the service URL must contain an additional, opaque string defining
access a target, the service URL must contain an additional, opaque the identity. This appears after the iSCSI name in the URL string
string defining the identity. This appears after the iSCSI name in and is separated by a "/". Each registered (target-address, target-
the URL string, and is separated by a "/". Each registered (target- name, initiator-identity) tuple can then register a set of auth-xxxx
address, target-name, initiator-identity) tuple can then register its attributes.
own set of auth-xxxx attributes.
4.1.3. Using SLP in a Non-Multicast Environment 4.1.3. Using SLP in a Non-multicast Environment
In some networks, the use of multicast for discovery purposes is In some networks, the use of multicast for discovery purposes is
either unavailable or not allowed. Such networks include public or either unavailable or not allowed. These include public or service-
service-provider networks that are placed in between an iSCSI client provider networks that are placed between an iSCSI client and a
and server; these are probably most common between two iSCSI server. These are probably most common between two iSCSI gateways,
gateways, one at a storage service provider site, and one at a one at a storage service provider site, and one at a customer site.
customer site.
In these networks, an initiator may, instead or in addition to its DA In these networks, an initiator may allow the addresses of one or
configuration, allow the addresses of one or more SAs to be more SAs to be configured instead of or in addition to its DA
configured. The initiator would then make unicast SLP service configuration. The initiator would then make unicast SLP service
requests directly to these SAs, without the use of multicast to first requests directly to these SAs, without the use of multicast to
discover them. discover them first.
This functionality is well within the scope of the current SLP This functionality is well within the scope of the current SLP
protocol. The main consequence for implementors is that an initiator protocol. The main consequence for implementors is that an initiator
configured to make direct, unicast requests to an SA will have to add configured to make direct unicast requests to an SA will have to add
this to the SLP API, if it is following the service location API this to the SLP API, if it is following the service location API
defined in [RFC2614]. This capability is being added to the next defined in [RFC2614].
revision of the API, in [2614BIS].
4.2. Discovering Storage Management Services using SLP 4.2. Discovering Storage Management Services with SLP
Storage management servers can be built to manage and control access Storage management servers can be built to manage and control access
to targets in a variety of ways. They can also provide extended to targets in a variety of ways. They can provide extended services
services beyond discovery, which could include storage allocation and beyond discovery, which could include storage allocation and
management. None of these services are defined here; the intent of management. None of these services are defined here; the intent of
this document is to allow these services to be discovered by both this document is to allow these services to be discovered by both
clients and servers, in addition to the target discovery already clients and servers, in addition to the target discovery already
being performed. being performed.
The following drawing shows an iSCSI client, an iSCSI server, and a The following drawing shows an iSCSI client, an iSCSI server, and a
storage management server. To simplify the drawing, the second IP storage management server. To simplify the drawing, the second IP
network is not shown, but is assumed to exist. The storage network is not shown but is assumed to exist. The storage management
management server would use its own protocol (smsp) to provide server would use its own protocol (smsp) to provide capabilities to
capabilities to iSCSI clients and servers; these clients and servers iSCSI clients and servers; these clients and servers can both use SLP
can both use SLP to discover the storage management server. to discover the storage management server.
+---------------------------+ +---------------------------+
| iSCSI Client | | iSCSI Client |
| | | |
| +-----------+ | | +-----------+ |
| | iSCSI | | | | iSCSI | |
| | initiator | | | | initiator | |
| +-----------+ | | +-----------+ |
| | | |
+---------------+------+----+ +------------+ +---------------+------+----+ +------------+
skipping to change at page 11, line 39 skipping to change at page 10, line 39
| +--------+ +--------+ | | storage mgmt server | | +--------+ +--------+ | | storage mgmt server |
| | iSCSI | | iSCSI | | | | | | iSCSI | | iSCSI | | | |
| | target | | target | | +---------------------+ | | target | | target | | +---------------------+
| | 1 | | 2 | | | | 1 | | 2 | |
| +--------+ +--------+ | | +--------+ +--------+ |
| | | |
| iSCSI Server | | iSCSI Server |
+---------------------------+ +---------------------------+
Note the difference between the storage management server model and Note the difference between the storage management server model and
the previously-defined target discovery model. When target discovery the previously defined target discovery model. When target discovery
was used, the iSCSI Server implemented an SA, to be discovered by the was used, the iSCSI Server implemented an SA, to be discovered by the
initiator's UA. In the storage management server model, the iSCSI initiator's UA. In the storage management server model, the iSCSI
clients and servers both implement UAs, and the management server clients and servers both implement UAs, and the management server
implements the SA. implements the SA.
A storage management server's URL contains the domain name or IP A storage management server's URL contains the domain name or IP
address and TCP or UDP port number. No other information is address and TCP or UDP port number. No other information is
required. required.
The storage management server constructs a service advertisement of The storage management server constructs a service advertisement of
the type "service:iscsi:sms" for each of the addresses at which it the type "service:iscsi:sms" for each of the addresses at which it
appears. The advertisement contains the URL, a lifetime, along with appears. The advertisement contains the URL and a lifetime, along
other attributes which are defined in the service template. with other attributes that are defined in the service template.
The remainder of the discovery procedure is identical to that used to The remainder of the discovery procedure is identical to that used to
discover iSCSI targets, except that both initiators and targets would discover iSCSI targets, except that both initiators and targets would
normally be "clients" of the storage management service. normally be "clients" of the storage management service.
Targets that support a storage management service implement a UA in Targets that support a storage management service implement a UA in
addition to the SA. A target may alternatively just implement the addition to the SA. A target may alternatively just implement the UA
UA, and allow the storage management service to advertise its targets and allow the storage management service to advertise its targets
appropriately by providing an SA and registering the appropriate appropriately by providing an SA and registering the appropriate
service:iscsi:target registrations on the target's behalf; the target service:iscsi:target registrations on the target's behalf: The target
device would not have to advertise its own targets. This has no device would not have to advertise its own targets. This has no
impact on the initiator. impact on the initiator.
This allows the initiators' discovery of targets to be completely This allows the initiators' discovery of targets to be completely
interoperable regardless of which storage management service is used, interoperable regardless of which storage management service is used,
or whether one is used at all, or whether the target registrations or whether one is used at all, or whether the target registrations
are provided directly by the target or by the management service. are provided directly by the target or by the management service.
4.3. Internationalization Considerations 4.3. Internationalization Considerations
SLP allows internationalized strings to be registered and retrieved. SLP allows internationalized strings to be registered and retrieved.
Attributes in the template that are not marked with an 'L' (literal) Attributes in the template that are not marked with an 'L' (literal)
will be registered in a localized manner. An "en" (English) will be registered in a localized manner. An "en" (English)
localization MUST be registered, and others MAY be registered. localization MUST be registered, and others MAY be registered.
Attributes that include non-ASCII characters will be encoded using Attributes that include non-ASCII characters will be encoded by using
UTF-8, as discussed in [RFC3722] and [RFC3491]. UTF-8, as discussed in [RFC3722] and [RFC3491].
5. iSCSI SLP Templates 5. iSCSI SLP Templates
Three templates are provided: an iSCSI target template, a management Three templates are provided: an iSCSI target template, a management
service template, and an abstract template to encapsulate the two. service template, and an abstract template to encapsulate the two.
5.1. The iSCSI Abstract Service Type Template 5.1. The iSCSI Abstract Service Type Template
This template defines the abstract service "service:iscsi". It is This template defines the abstract service "service:iscsi". It is
used as a top-level service to encapsulate all other iSCSI-related used as a top-level service to encapsulate all other iSCSI-related
services. services.
Name of submitter: Mark Bakke Name of submitter: Mark Bakke
Language of service template: en Language of service template: en
Security Considerations: see section 6. Security Considerations: See section 6.
Template Text: Template Text:
-------------------------template begins here----------------------- -------------------------template begins here-----------------------
template-type=iscsi template-type=iscsi
template-version=0.1 template-version=1.0
template-description= template-description=
This is an abstract service type. The purpose of the iscsi This is an abstract service type. The purpose of the iscsi
service type is to encompass all of the services used to support service type is to encompass all of the services used to support
the iSCSI protocol. the iSCSI protocol.
template-url-syntax= template-url-syntax=
url-path= ; Depends on the concrete service type. url-path= ; Depends on the concrete service type.
--------------------------template ends here------------------------ --------------------------template ends here------------------------
skipping to change at page 13, line 30 skipping to change at page 12, line 27
register each of them, with each of their addresses, as this service register each of them, with each of their addresses, as this service
type. type.
Initiators (and perhaps management services) wishing to discover Initiators (and perhaps management services) wishing to discover
targets in this way will generally use one of the following queries: targets in this way will generally use one of the following queries:
1. Find a specific target, given its iSCSI Target Name: 1. Find a specific target, given its iSCSI Target Name:
Service: service:iscsi:target Service: service:iscsi:target
Scope: initiator-scope-list Scope: initiator-scope-list
Query: (iscsi-name=iqn.2001-04.com.example.sn.456) Query: (iscsi-name=iqn.2001-04.com.example:sn.456)
2. Find all of the iSCSI Target Names that may allow access to a 2. Find all of the iSCSI Target Names that may allow access to a
given initiator: given initiator:
Service: service:iscsi:target Service: service:iscsi:target
Scope: initiator-scope-list Scope: initiator-scope-list
Query: (auth-name=iqn.1998-03.com.example.hostid.045A7B) Query: (auth-name=iqn.1998-03.com.example:hostid.045A7B)
3. Find all of the iSCSI Target Names that may allow access to 3. Find all of the iSCSI Target Names that may allow access to
any initiator: any initiator:
Service: service:iscsi:target Service: service:iscsi:target
Scope: initiator-scope-list Scope: initiator-scope-list
Query: (auth-name=any) Query: (auth-name=any)
4. Find all of the iSCSI Target Names that may allow access to 4. Find all of the iSCSI Target Names that may allow access to
this initiator, or that will allow access to any initiator: this initiator, or that will allow access to any initiator:
Service: service:iscsi:target Service: service:iscsi:target
Scope: initiator-scope-list Scope: initiator-scope-list
Query: &(auth-name=iqn.1998-03.com.example.hostid.045A7B) Query: &(auth-name=iqn.1998-03.com.example:hostid.045A7B)
(auth-name=any) (auth-name=any)
5. Find all of the iSCSI Target Names that may allow access to 5. Find all of the iSCSI Target Names that may allow access to
a given CHAP user name: a given CHAP user name:
Service: service:iscsi:target Service: service:iscsi:target
Scope: initiator-scope-list Scope: initiator-scope-list
Query: (auth-cred=chap/my-user-name) Query: (auth-cred=chap/my-user-name)
6. Find all of the iSCSI Target Names that may allow access to 6. Find all of the iSCSI Target Names that may allow access to a
a given initiator that supports two IP addresses, a CHAP given initiator that supports two IP addresses, a CHAP credential
credential and an SRP credential, and an initiator name: and SRP credential, and an initiator name:
Service: service:iscsi:target Service: service:iscsi:target
Scope: initiator-scope-list Scope: initiator-scope-list
Query: &(|(auth-name=iqn.com.example:host47)(auth-name=any) Query: &(|(auth-name=iqn.com.example:host47)(auth-name=any)
|(auth-addr=192.0.2.3)(auth-addr=192.0.2.131)(auth-addr=any) |(auth-addr=192.0.2.3)(auth-addr=192.0.2.131)(auth-addr=any)
|(auth-cred=chap/foo)(auth-cred=srp/my-user-name) |(auth-cred=chap/foo)(auth-cred=srp/my-user-name)
(auth-cred=any)) (auth-cred=any))
7. Find the iSCSI Target Names from which the given initiator is 7. Find the iSCSI Target Names from which the given initiator is
allowed to boot: allowed to boot:
Service: service:iscsi:target Service: service:iscsi:target
Scope: initiator-scope-list Scope: initiator-scope-list
Query: (boot-list=iqn.1998-03.com.example.hostid.045A7B) Query: (boot-list=iqn.1998-03.com.example:hostid.045A7B)
8. In addition, a management service may wish to discover all 8. In addition, a management service may wish to discover all
targets: targets:
Service: service:iscsi:target Service: service:iscsi:target
Scope: management-server-scope-list Scope: management-server-scope-list
Query: <empty-string> Query: <empty-string>
More details on booting from an iSCSI target are defined in [BOOT]. More details on booting from an iSCSI target are defined in [BOOT].
Name of submitter: Mark Bakke Name of submitter: Mark Bakke
Language of service template: en Language of service template: en
Security Considerations: see section 6. Security Considerations: see section 6.
Template Text: Template Text:
-------------------------template begins here----------------------- -------------------------template begins here-----------------------
template-type=iscsi:target template-type=iscsi:target
template-version=1.0
template-version=0.1
template-description= template-description=
This is a concrete service type. The iscsi:target service type is This is a concrete service type. The iscsi:target service type is
used to register individual target addresses to be discovered by used to register individual target addresses to be discovered
others. UAs will generally search for these by including one of by others. UAs will generally search for these by including one of
the following: the following:
- the iSCSI target name - the iSCSI target name
- iSCSI initiator identifiers (iSCSI name, credential, IP address) - iSCSI initiator identifiers (iSCSI name, credential, IP address)
- the service URL - the service URL
template-url-syntax= template-url-syntax=
url-path = hostport "/" iscsi-name [ "/" identity ] url-path = hostport "/" iscsi-name [ "/" identity ]
hostport = host [ ":" port ] hostport = host [ ":" port ]
host = hostname / hostnumber ; DNS name or IP address host = hostname / hostnumber ; DNS name or IP address
skipping to change at page 15, line 41 skipping to change at page 14, line 38
/ [ *5( h16 ":" ) h16 ] "::" h16 / [ *5( h16 ":" ) h16 ] "::" h16
/ [ *6( h16 ":" ) h16 ] "::" / [ *6( h16 ":" ) h16 ] "::"
ls32 = ( h16 ":" h16 ) / ipv4-number ls32 = ( h16 ":" h16 ) / ipv4-number
; least-significant 32 bits of ipv6 address ; least-significant 32 bits of ipv6 address
h16 = 1*4HEXDIG h16 = 1*4HEXDIG
port = 1*DIGIT port = 1*DIGIT
iscsi-name = iscsi-char ; iSCSI target name iscsi-name = iscsi-char ; iSCSI target name
identity = iscsi-char ; optional identity string identity = iscsi-char ; optional identity string
iscsi-char = ALPHA / DIGIT / escaped / ":" / "-" / "." iscsi-char = ALPHA / DIGIT / escaped / ":" / "-" / "."
; Intended to allow UTF-8 encoded strings ; Intended to allow UTF-8 encoded strings
escaped = 1*(`' HEXDIG HEXDIG) escaped = 1*("\" HEXDIG HEXDIG)
; ;
; The iscsi-name part of the URL is required and must be the iSCSI ; The iscsi-name part of the URL is required and must be the iSCSI
; name of the target being registered. ; name of the target being registered.
; A device representing multiple targets must individually ; A device representing multiple targets must individually
; register each target/address combination with SLP. ; register each target/address combination with SLP.
; The identity part of the URL is optional, and is used to ; The identity part of the URL is optional, and is used to
; indicate an identity that is allowed to access this target. ; indicate an identity that is allowed to access this target.
; ;
; Example (split into two lines for clarity): ; Example (split into two lines for clarity):
; service:iscsi:target://192.0.2.3:3260/ ; service:iscsi:target://192.0.2.3:3260/
; iqn.2001-04.com.example.sn.45678 ; iqn.2001-04.com.example:sn.45678
; ;
; IPv6 addresses are also supported; they use the notation specified ; IPv6 addresses are also supported; they use the notation
; above and in [RFC3513], section 2.2 ; specified above and in [RFC3513], section 2.2
iscsi-name = string iscsi-name = string
# The iSCSI Name of this target. # The iSCSI Name of this target.
# This must match the iscsi-name in the url-path. # This must match the iscsi-name in the url-path.
portal-group = integer portal-group = integer
# The iSCSI portal group tag for this address. Addresses sharing # The iSCSI portal group tag for this address. Addresses sharing
# the same iscsi-name and portal-group tag can be used within the # the same iscsi-name and portal-group tag can be used within the
# same iSCSI session. Portal groups are described in [RFC3720]. # same iSCSI session. Portal groups are described in [RFC3720].
skipping to change at page 16, line 43 skipping to change at page 15, line 40
# The alias string contains a descriptive name of the target. # The alias string contains a descriptive name of the target.
auth-name = string M X auth-name = string M X
# A list of iSCSI Initiator Names that can access this target. # A list of iSCSI Initiator Names that can access this target.
# Normal iSCSI names will be 80 characters or less; max length # Normal iSCSI names will be 80 characters or less; max length
# is 255. # is 255.
# Normally, only one or a few values will be in the list. # Normally, only one or a few values will be in the list.
# Using the equivalence search on this will evaluate to "true" # Using the equivalence search on this will evaluate to "true"
# if any one of the items in this list matches the query. # if any one of the items in this list matches the query.
# If this list contains the default name "any", any initiator # If this list contains the default name "any", any initiator
# is allowed to access this target, provided it matches the # is allowed to access this target, provided it matches
# other auth-xxx attributes. # the other auth-xxx attributes.
# #
# This attribute contains security policy information. If this # This attribute contains security policy information. If this
# attribute is distributed via an Attribute Reply message, # attribute is distributed via an Attribute Reply message,
# IPsec MUST be implemented. # IPsec MUST be implemented.
auth-addr = string M X auth-addr = string M X
# A list of initiator IP addresses (or host names) which will # A list of initiator IP addresses (or host names) which will
# be allowed access to this target. If this list contains the # be allowed access to this target. If this list contains the
# default name "any", any IP address is allowed access to this # default name "any", any IP address is allowed access to this
# target, provided it matches the other auth-xxx attributes. # target, provided it matches the other auth-xxx attributes.
skipping to change at page 17, line 29 skipping to change at page 16, line 27
# #
# This attribute contains security policy information. If this # This attribute contains security policy information. If this
# attribute is distributed via an Attribute Reply message, # attribute is distributed via an Attribute Reply message,
# IPsec MUST be implemented. # IPsec MUST be implemented.
boot-list = string M O boot-list = string M O
# A list of iSCSI Initiator Names that can boot from this target. # A list of iSCSI Initiator Names that can boot from this target.
# This list works precisely like the auth-name attribute. A name # This list works precisely like the auth-name attribute. A name
# appearing in this list must either appear in the access-list, # appearing in this list must either appear in the access-list,
# or the access-list must contain the initiator name "iscsi". # or the access-list must contain the initiator name "iscsi".
# Otherwise, an initiator will be unable to find its boot target. # Otherwise, an initiator will be unable to find its boot
# If boot-list contains the name "iscsi", any host can boot from it, # target. If boot-list contains the name "iscsi", any host can boot
# but I am not sure if this is useful to anyone. # from it, but I am not sure if this is useful to anyone. If this
# If this attribute is not registered, this target is not "bootable". # attribute is not registered, this target is not "bootable".
# #
# Note that the LUN the host boots from is not specified here; a # Note that the LUN the host boots from is not specified here; a
# host will generally attempt to boot from LUN 0. # host will generally attempt to boot from LUN 0.
# #
# It is quite possible that other attributes will need to be defined # It is quite possible that other attributes will need to be defined
# here for booting as well. # here for booting as well.
# #
# This attribute contains security policy information. If this # This attribute contains security policy information. If this
# attribute is distributed via an Attribute Reply message, # attribute is distributed via an Attribute Reply message,
# IPsec MUST be implemented. # IPsec MUST be implemented.
--------------------------template ends here------------------------ --------------------------template ends here------------------------
5.3. iSCSI Storage Management Service Templates 5.3. iSCSI Storage Management Service Templates
This template defines the service "service:iscsi:sms". An entity This template defines the service "service:iscsi:sms". An entity
supporting one or more iSCSI management service protocols may supporting one or more iSCSI management service protocols may
register itself with SLP as this service type. register itself with SLP as this service type. iSCSI clients and
servers wishing to discover storage management services using SLP
iSCSI clients and servers wishing to discover storage management will usually search for them by the protocol(s) they support:
services using SLP will usually search for them by the protocol(s)
they support:
Service: service:iscsi:sms Service: service:iscsi:sms
Scope: initiator-scope-list Scope: initiator-scope-list
Query: (protocols=isns) Query: (protocols=isns)
Name of submitter: Mark Bakke Name of submitter: Mark Bakke
Language of service template: en Language of service template: en
Security Considerations: see section 6. Security Considerations: see section 6.
Template Text: Template Text:
-------------------------template begins here----------------------- -------------------------template begins here-----------------------
template-type=iscsi:sms template-type=iscsi:sms
template-version=1.0
template-version=0.1
template-description= template-description=
This is a concrete service type. The iscsi:sms service type This is a concrete service type. The iscsi:sms service type
provides the capability for entities supporting iSCSI to discover provides the capability for entities supporting iSCSI to discover
appropriate management services. appropriate management services.
template-url-syntax= template-url-syntax=
url-path = ; The URL of the management service [RFC2608]. url-path = ; The URL of the management service [RFC2608].
protocols = string M protocols = string M
skipping to change at page 19, line 13 skipping to change at page 18, line 12
# precedence is protocol-specific; for some protocols, the primary # precedence is protocol-specific; for some protocols, the primary
# server may have the highest server-priority value, while for # server may have the highest server-priority value, while for
# others it may have the lowest. For example, with iSNS, the primary # others it may have the lowest. For example, with iSNS, the primary
# server has the lowest value (value 0). # server has the lowest value (value 0).
--------------------------template ends here------------------------ --------------------------template ends here------------------------
6. Security Considerations 6. Security Considerations
The SLPv2 security model as specified in [RFC2608] does not provide The SLPv2 security model as specified in [RFC2608] does not provide
confidentiality, but does provide an authentication mechanism for UAs confidentiality but does provide an authentication mechanism for UAs
to assure that service advertisements only come from trusted SAs with to ensure that service advertisements only come from trusted SAs,
the exception that it does not provide a mechanism to authenticate with the exception that it does not provide a mechanism to
"zero-result responses". See [RFC3723] for a discussion of the SLPv2 authenticate "zero-result responses". See [RFC3723] for a discussion
[RFC2608] security model. of the SLPv2 [RFC2608] security model.
Once a target or management server is discovered, authentication and Once a target or management server is discovered, authentication and
authorization are handled by the iSCSI protocol, or by the management authorization are handled by the iSCSI protocol, or by the management
server's protocol. It is the responsibility of the providers of server's protocol. It is the responsibility of the providers of
these services to ensure that an inappropriately advertised or these services to ensure that an inappropriately advertised or
discovered service does not compromise their security. discovered service does not compromise their security.
When no security is used for SLPv2, there is a risk of distribution When no security is used for SLPv2, there is a risk of distribution
of false discovery information. The primary countermeasure for this of false discovery information. The primary countermeasure for this
risk is authentication. When this risk is a significant concern, risk is authentication. When this risk is a significant concern,
IPsec SAs and iSCSI in-band authentication SHOULD be used for iSCSI IPsec SAs and iSCSI in-band authentication SHOULD be used for iSCSI
traffic subject to this risk to ensure that iSCSI traffic only flows traffic subject to this risk to ensure that iSCSI traffic only flows
between endpoints that have participated in IKE authentication and between endpoints that have participated in IKE authentication and
iSCSI in-band authentication. For example, if an attacker iSCSI in-band authentication. For example, if an attacker
distributes discovery information falsely claiming that it is an distributes discovery information falsely claiming that it is an
iSCSI target, it will lack the secret information necessary to iSCSI target, it will lack the secret information necessary to
successfully complete IKE authentication or iSCSI in-band complete IKE authentication or iSCSI in-band authentication
authentication, and hence will be prevented from falsely sending or successfully and therefore will be prevented from falsely sending or
receiving iSCSI traffic. receiving iSCSI traffic.
There remains a risk of a denial of service attack based on repeated A risk remains of a denial of service attack based on repeated use of
use of false discovery information that will cause initiation of IKE false discovery information that will cause initiation of IKE
negotiation. The countermeasures for this are administrative negotiation. The countermeasures for this are administrative
configuration of each iSCSI Target to limit the peers that it is configuration of each iSCSI Target to limit the peers it is willing
willing to communicate with (i.e., by IP address range and/or DNS to communicate with (i.e., by IP address range and/or DNS domain),
domain), and maintenance of a negative authentication cache to avoid and maintenance of a negative authentication cache to avoid
repeatedly contacting an iSCSI Target that fails to authenticate. repeatedly contacting an iSCSI Target that fails to authenticate.
These three measures (i.e., IP address range limits, DNS domain These three measures (i.e., IP address range limits, DNS domain
limits, negative authentication cache) MUST be implemented. limits, negative authentication cache) MUST be implemented.
The auth-name, auth-addr, auth-cred, and boot-list attributes The auth-name, auth-addr, auth-cred, and boot-list attributes
comprise security policy information. When these are distributed, comprise security policy information. When these are distributed,
IPsec MUST be implemented. IPsec MUST be implemented.
6.1. Security Implementation 6.1. Security Implementation
Security for SLPv2 in an IP storage environment is specified in Security for SLPv2 in an IP storage environment is specified in
[RFC3723]. [RFC3723]. IPsec is mandatory-to-implement for IPS clients and
servers. Thus, all IP storage clients, including those invoking SLP,
can be assumed to support IPsec. SLP servers, however, cannot be
assumed to implement IPsec, since there is no such requirement in
standard SLP. In particular, SLP Directory Agents (DA) may be
running on machines other than those running the IPS protocols.
IPsec SHOULD be implemented for SLPv2 as specified in [RFC3723]; this IPsec SHOULD be implemented for SLPv2 as specified in [RFC3723]; this
includes ESP with a non-null transform to provide both authentication includes ESP with a non-null transform to provide both authentication
and confidentiality. and confidentiality.
When SLPv2 can be used to distribute auth-name, auth-addr, auth-cred, When SLPv2 can be used to distribute auth-name, auth-addr, auth-cred,
boot-list information (see Section 5.2 above), IPsec MUST be and boot-list information (see section 5.2 above), IPsec MUST be
implemented, as these items are considered to be sensitive security implemented, as these items are considered sensitive security policy
policy information. If IPsec is not implemented, auth-name, auth- information. If IPsec is not implemented, auth-name, auth-addr,
addr, auth-cred, and boot-list information MUST NOT be distributed auth-cred, and boot-list information MUST NOT be distributed via
via SLPv2, and MUST NOT be used if discovered via SLPv2. SLPv2 and MUST NOT be used if discovered via SLPv2.
SLPv2 authentication is OPTIONAL to implement and use, and SLPv2 Because the IP storage services have their own authentication
authentication SHOULD be implemented when IPsec is not supported. capabilities when located, SLPv2 authentication is OPTIONAL to
implement and use (as discussed in more detail in [RFC3723]).
7. IANA Considerations 7. IANA Considerations
This document describes three SLP Templates. When they have been This document describes three SLP Templates. They have been reviewed
reviewed and approved by the IESG, they should be registered in the and approved by the IESG and registered in the IANA's "SVRLOC
IANA "SVRLOC Templates" registry. This process is described in the Templates" registry. This process is described in the IANA
IANA Considerations section of [RFC2609]. Considerations section of [RFC2609].
8. Summary 8. Summary
This document describes how SLP can be used by iSCSI initiators to This document describes how SLP can be used by iSCSI initiators to
find iSCSI targets and storage management servers. Service type find iSCSI targets and storage management servers. Service type
templates for iSCSI targets and storage management servers are templates for iSCSI targets and storage management servers are
presented. presented.
9. Normative References 9. Normative References
[RFC2608] Guttman, E., Perkins, C., Veizades, J. and M. Day, "Service [RFC2608] Guttman, E., Perkins, C., Veizades, J., and M. Day,
Location Protocol, version 2", RFC 2608, June 1999. "Service Location Protocol, Version 2", RFC 2608, June
1999.
[RFC2609] Guttman, E., Perkins, C. and J. Kempf, "Service Templates [RFC2609] Guttman, E., Perkins, C., and J. Kempf, "Service
and service: Schemes", RFC 2609, June 1999. Templates and Service: Schemes", RFC 2609, June 1999.
[RFC2119] Bradner, S., "Key Words for Use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3491] Hoffman, P. and M. Blanchet, "Nameprep: A Stringprep Profile [RFC3491] Hoffman, P. and M. Blanchet, "Nameprep: A Stringprep
for Internationalized Domain Names", RFC 3491, March 2003. Profile for Internationalized Domain Names (IDN)", RFC
3491, March 2003.
[RFC3513] Hinden, R. and S. Deering, "Internet Protocol Version 6 [RFC3513] Hinden, R. and S. Deering, "Internet Protocol Version 6
(IPv6) Addressing Architecture", RFC 3513, April 2003. (IPv6) Addressing Architecture", RFC 3513, April 2003.
[RFC3720] Satran, J., Meth, K., Sapuntzakis, C., Chadalapaka, M. and [RFC3720] Satran, J., Meth, K., Sapuntzakis, C., Chadalapaka, M.,
E. Zeidner, "Internet Small Computer Systems Interface and E. Zeidner, "Internet Small Computer Systems
(iSCSI)", RFC 3720, March 2004. Interface (iSCSI)", RFC 3720, April 2004.
[RFC3722] Bakke, M., "String Profile for iSCSI Names", RFC 3722, [RFC3722] Bakke, M., "String Profile for Internet Small Computer
March 2004. Systems Interface (iSCSI) Names", RFC 3722, April 2004.
[RFC3723] Aboba, B., Tseng, J., Walker, J., Rangan, V. and F. [RFC3723] Aboba, B., Tseng, J., Walker, J., Rangan, V., and F.
Travostino, "Securing Block Storage Protocols over IP", RFC Travostino, "Securing Block Storage Protocols over IP",
3723, March 2004. RFC 3723, April 2004.
10. Informative References 10. Informative References
[RFC2614] Kempf, J. and E. Guttman, "An API for Service Location", [RFC2614] Kempf, J. and E. Guttman, "An API for Service Location",
RFC 2614, June 1999. RFC 2614, June 1999.
[2614BIS] Kempf, J. and E. Guttman, "An API for Service Location", [SAM2] ANSI T10. "SCSI Architectural Model 2", March 2000.
draft-kempf-svrloc-rfc2614bis-00.txt, February 2002.
[SAM2] ANSI T10. "SCSI Architectural Model 2", March 2000. [RFC3721] Bakke, M., Hafner, J., Hufferd, J., Voruganti, K., and M.
Krueger, "Internet Small Computer Systems Interface
(iSCSI) Naming and Discovery", RFC 3721, April 2004.
[RFC3721] Bakke, M., Hafner, J., Hufferd, J., Voruganti, K., and M. [ISNS] Tseng, J., Gibbons, K., Travostino, F., Du Laney, C. and
Krueger, "Internet Small Computer Systems Interface (iSCSI) J. Souza, "Internet Storage Name Service", Work in
Naming and Discovery", RFC 3721, March 2004. Progress, February 2004.
[ISNS] Tseng, J., Gibbons, K., Travostino, F., Du Laney, C. and J. [BOOT] Sarkar, P., Missimer, D. and C. Sapuntzakis, "A Standard
Souza, "Internet Storage Name Service", Work in Progress, for Bootstrapping Clients using the iSCSI Protocol", Work
draft-ietf-ips-isns-22.txt, February 2004. in Progress, March 2004.
[BOOT] Sarkar, P., Missimer, D. and C. Sapuntzakis, "A Standard [RFC3105] Kempf, J. and G. Montenegro, "Finding an RSIP Server with
for Bootstrapping Clients using the iSCSI Protocol", Work in SLP", RFC 3105, October 2001.
Progress, draft-ietf-ips-iscsi-boot-12.txt, March 2004.
[RFC3105] Kempf, J. and G. Montenegro, "Finding an RSIP Server with 11. Acknowledgements
SLP", RFC 3105, October 2001.
11. Authors' Addresses This document was produced by the iSCSI Naming and Discovery team,
including Joe Czap, Jim Hafner, John Hufferd, and Kaladhar Voruganti
(IBM), Howard Hall (Pirus), Jack Harwood (EMC), Yaron Klein (Sanrad),
Marjorie Krueger (HP), Lawrence Lamers (San Valley), Todd Sperry
(Adaptec), and Joshua Tseng (Nishan). Thanks also to Julian Satran
(IBM) for suggesting the use of SLP for iSCSI discovery, and to Matt
Peterson (Caldera) and James Kempf (Sun) for reviewing the document
from an SLP perspective.
Mark Bakke Authors' Addresses
Cisco Systems, Inc.
6450 Wedgwood Road
Maple Grove, MN 55311
Voice: +1 763-398-1000
EMail: mbakke@cisco.com
Kaladhar Voruganti Mark Bakke
IBM Almaden Research Center Cisco Systems, Inc.
650 Harry Road 7900 International Drive, Suite 400
San Jose, CA 95120 Bloomington, MN
Email: kaladhar@us.ibm.com USA 55425
John L. Hufferd EMail: mbakke@cisco.com
IBM Storage Systems Group
5600 Cottle Road
San Jose, CA 95193
Voice: +1 408 256-0403
Email: hufferd@us.ibm.com
Marjorie Krueger Kaladhar Voruganti
Hewlett-Packard Corporation IBM Almaden Research Center
8000 Foothills Blvd 650 Harry Road
Roseville, CA 95747-5668, USA San Jose, CA 95120
Voice: +1 916 785-2656
Email: marjorie_krueger@hp.com
Todd Sperry EMail: kaladhar@us.ibm.com
Adaptec, Inc.
691 South Milpitas Boulevard
Milpitas, Ca. 95035
Voice: +1 408 957-4980
Email: todd_sperry@adaptec.com
12. Full Copyright Notice John L. Hufferd
IBM Storage Systems Group
5600 Cottle Road
San Jose, CA 95193
Copyright (C) The Internet Society (2004). All Rights Reserved. Phone: +1 408 997-6136
EMail: jlhufferd@comcast.net
This document and translations of it may be copied and furnished to Marjorie Krueger
others, and derivative works that comment on or otherwise explain it Hewlett-Packard Corporation
or assist in its implementation may be prepared, copied, published 8000 Foothills Blvd
and distributed, in whole or in part, without restriction of any Roseville, CA 95747-5668, USA
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be Phone: +1 916 785-2656
revoked by the Internet Society or its successors or assigns. EMail: marjorie_krueger@hp.com
This document and the information contained herein is provided on an Todd Sperry
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING Adaptec, Inc.
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 691 South Milpitas Boulevard
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION Milpitas, Ca. 95035
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Phone: +1 408 957-4980
EMail: todd_sperry@adaptec.com
Full Copyright Statement
Copyright (C) The Internet Society (2005).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at ietf-
ipr@ietf.org.
Acknowledgement Acknowledgement
Funding for the RFC Editor function is currently provided by the Funding for the RFC Editor function is currently provided by the
Internet Society. Internet Society.
 End of changes. 110 change blocks. 
308 lines changed or deleted 307 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/