RE: Selectively exposing Porgal Groups to Initiators

["KRUEGER,MARJORIE (HP-Roseville,ex1)" <marjorie_krueger@hp.com>]

> 1. Is it required that TargetAddresses of an iSCSI target advertised to a
>    directory service include portal group tag ?

Yes, information is necessary to communicate to the initiator which target
addresses can be used to form a multi-connection session.

> 2. Is it mandatory for an Initiator to use "SendTargets" to discover
>    TargetAddress for an iSCSI target (even if if has a set of addresses
>    either statically configured or found through a directory service)?

To my knowledge no iSCSI document has declared it mandatory, but it's
recommended to ensure the initiator has current addressing information for
this target.

> 3. Is it okay to restrict access to an Initiator (based on it's iSCSI
name)
>    to only a subset of total Target Portal Groups supported by the iSCSI
>    target?

Yes

> 
> In this scenario, an Initiator may find out the TargetAddresses for an
iSCSI
> target using a directory service, and try to connect a normal operational
> session to any of these addresses without using SendTargets. The 
> iSCSI target can return an error code for login as "Initiator not
Authorized" 
> which in fact is not
> completely true. Initiator is authorized to only use a subset 
> of portal groups.

Correct, although "not completely true" is subjective.  Another perspective
is that this initiator is not authorized to use this *target port*, which is
completely true.

Marjorie