iSCSI Storage Configuration on Linux and Windows

3 Nov 2026, 17:5315 min readby ITYantra Admin

Complete guide to iSCSI storage configuration on Linux and Windows including initiator setup, target configuration, CHAP authentication, and multipathing.

# iSCSI Storage Configuration on Linux and Windows

Introduction

iSCSI (Internet Small Computer Systems Interface) encapsulates SCSI commands over IP networks, allowing block-level storage access over standard Ethernet. Unlike Fibre Channel, iSCSI uses existing network infrastructure, making it cost-effective for small to medium deployments while still providing block-level access for databases, virtualization, and file servers.

This guide covers complete iSCSI configuration on both Linux and Windows, including initiator setup, target configuration, authentication, and multipathing.

You will learn:

  • iSCSI architecture and components
  • iSCSI initiator configuration on Linux
  • iSCSI initiator configuration on Windows Server
  • iSCSI target configuration
  • CHAP authentication
  • Multipathing (MPIO, DM-Multipath)
  • Performance tuning
  • Troubleshooting common issues

Technical Background

iSCSI Architecture

**iSCSI Components:**

  • **Initiator:** Client (server) that initiates iSCSI connections
  • **Target:** Storage device that provides iSCSI LUNs
  • **TPG (Target Portal Group):** Group of network interfaces on target
  • **LUN:** Logical Unit Number, identifier for a logical disk on target
  • **IQN (iSCSI Qualified Name):** Unique identifier for initiators and targets

**iSCSI Data Path:**

Initiator (Server) → TCP/IP → Ethernet → Target (Storage Array)

**iSCSI Names:**

  • **Initiator IQN:** `iqn.1993-08.org.debian:01:7f2a3b4c`
  • **Target IQN:** `iqn.2024-01.com.example:storage.target1`

iSCSI vs Fibre Channel

| Feature | iSCSI | Fibre Channel | |---------|-------|---------------| | Network | Standard Ethernet | Dedicated FC fabric | | Hardware | Standard NIC | FC HBA required | | Cost | Lower | Higher | | Distance | Limited by TCP/IP (routing) | Limited by fiber (10km+) | | Performance | Good (with tuning) | Excellent | | Complexity | Lower | Higher | | Jumbo frames | Recommended | Required for best performance |

iSCSI Authentication

**CHAP (Challenge-Handshake Authentication Protocol):**

  • **One-way CHAP:** Target authenticates initiator
  • **Mutual CHAP:** Both authenticate each other
  • **Credentials:** Username and password per target or globally

Multipathing for iSCSI

Multiple network paths between initiator and target provide redundancy and load balancing.

**Linux:** DM-Multipath **Windows:** MPIO (Multi-Path I/O)

Prerequisites

Hardware Requirements

  • Servers with network interfaces (1GbE minimum, 10GbE+ recommended)
  • Storage array or server acting as iSCSI target
  • Network switches (Jumbo frames support recommended)
  • Cables (Cat6a/Cat7)

Software Requirements

**Linux:**

  • `open-iscsi` package
  • `device-mapper-multipath` (for multipathing)

**Windows Server:**

  • iSCSI Initiator (built-in)
  • MPIO feature (for multipathing)

Network Requirements

  • Dedicated iSCSI storage VLAN (recommended)
  • Jumbo frames (MTU 9000) for performance
  • IP addresses for initiator and target ports
  • CHAP credentials

Step-by-Step Implementation

Step 1: Network Configuration

**Linux (Netplan - Ubuntu):**

# /etc/netplan/01-iscsi.yaml
network:
  version: 2
  ethernets:
    eth1:
      addresses:
        - 10.0.2.10/24
      mtu: 9000

**Apply:**

netplan apply

**Linux (NetworkManager - RHEL/CentOS):**

nmcli con mod eth1 ipv4.addresses 10.0.2.10/24
nmcli con mod eth1 ipv4.method manual
nmcli con mod eth1 802-3-ethernet.mtu 9000
nmcli con up eth1

**Windows Server:**

New-NetIPAddress -InterfaceAlias "iSCSI" -IPAddress 10.0.2.10 -PrefixLength 24
Set-NetIPInterface -InterfaceAlias "iSCSI" -Dhcp Disabled -NlMtuBytes 9000
Set-DnsClientServerAddress -InterfaceAlias "iSCSI" -ServerAddresses ("10.0.1.10")

**Verification:** Can ping target IP from initiator.

Step 2: iSCSI Initiator Configuration (Linux)

**Install open-iscsi:**

# Debian/Ubuntu
apt install open-iscsi

# RHEL/CentOS
yum install iscsi-initiator-utils

**Configure Initiator Name:**

# View current IQN
cat /etc/iscsi/initiatorname.iscsi

# Edit if needed
nano /etc/iscsi/initiatorname.iscsi
# InitiatorName=iqn.1993-08.org.debian:01:myserver

**Discover Targets:**

# Discovery
iscsiadm -m discovery -t st -p 10.0.2.100

# Expected output:
# 10.0.2.100:3260,1 iqn.2024-01.com.example:storage.target1

**Login to Target:**

# Login to specific target
iscsiadm -m node -T iqn.2024-01.com.example:storage.target1 -p 10.0.2.100 -l

# Enable automatic startup
iscsiadm -m node -T iqn.2024-01.com.example:storage.target1 -p 10.0.2.100 --op=update -n node.startup -v automatic

# Verify session
iscsiadm -m session

# Check new block device
lsblk

**Configure CHAP (if required):**

# Edit /etc/iscsi/iscsid.conf
nano /etc/iscsi/iscsid.conf

# Uncomment and set:
node.session.auth.authmethod = CHAP
node.session.auth.username = iscsi-user
node.session.auth.password = iscsi-password

# Restart iscsid
systemctl restart iscsid
iscsiadm -m node -T iqn.2024-01.com.example:storage.target1 -p 10.0.2.100 --login

**Verification:** New block device visible in `lsblk`.

Step 3: iSCSI Initiator Configuration (Windows Server)

**Using GUI:** 1. Open Server Manager → Tools → iSCSI Initiator 2. Click "Configuration" tab, note Initiator Name 3. Click "Discovery" tab → "Discover Portal" 4. Enter target IP address 5. Click "Targets" tab 6. Select target, click "Connect" 7. Check "Enable multi-path" and "Enable CHAP" if needed 8. Click "OK"

**Using PowerShell:**

# Discover target
New-IscsiTargetPortal -TargetPortalAddress 10.0.2.100

# Connect to target
$target = Get-IscsiTarget | Where-Object {$_.IsConnected -eq $false}
$target | Connect-IscsiTarget -IsMultipathEnabled:$true -ChapType CHAP -ChapUsername iscsi-user -ChapPassword iscsi-password

# Verify connection
Get-IscsiConnection
Get-IscsiSession

# Check disk
Get-Disk

**Configure CHAP:**

# Set CHAP credentials for target
Set-IscsiTargetPortal -TargetPortalAddress 10.0.2.100 -ChapUsername iscsi-user -ChapPassword iscsi-password

**Verification:** New disk visible in Disk Management or `Get-Disk`.

Step 4: Format and Mount

**Linux:**

# Create filesystem
mkfs.ext4 /dev/sdb

# Mount
mkdir /mnt/iscsi
mount /dev/sdb /mnt/iscsi

# Add to fstab
echo "/dev/sdb /mnt/iscsi ext4 defaults,_netdev 0 0" >> /etc/fstab

**Windows:**

# Initialize disk
Initialize-Disk -Number 1 -PartitionStyle GPT

# Create partition and format
New-Partition -DiskNumber 1 -UseMaximumSize | Format-Volume -FileSystem NTFS -NewFileSystemLabel "iSCSI_Storage" -DriveLetter E

**Verification:** Storage accessible and writable.

Step 5: Configure Multipathing

**Linux DM-Multipath:**

# Install
apt install multipath-tools  # Debian/Ubuntu
yum install device-mapper-multipath  # RHEL/CentOS

# Enable
mpathconf --enable --with_multipathd y
systemctl enable multipathd
systemctl start multipathd

# Configure for iSCSI
# Edit /etc/multipath.conf
# Add device section for your storage array

# View multipath devices
multipath -ll

# Example:
# mpath0 (36001438...) dm-0 IET,VDISK
# size=100G features='0' hwhandler='0' wp=rw
# `-+- policy='service-time 0' prio=1 status=active
#   `- 1:0:0:1 sdb 8:16 active ready running
# `-+- policy='service-time 0' prio=1 status=enabled
#   `- 2:0:0:1 sdc 8:32 active ready running

**Windows MPIO:**

# Install MPIO feature
Install-WindowsFeature -Name Multipath-IO -IncludeManagementTools

# Restart server

# Enable MPIO for iSCSI
Enable-MSDSM -BusType iSCSI

# Verify MPIO
Get-MSDSMDevice

**Verification:** Multiple paths visible, failover tested.

Step 6: Performance Tuning

**Linux iSCSI Tuning:**

# Increase read ahead
blockdev --setra 4096 /dev/sdb

# Adjust queue depth
echo 128 > /sys/block/sdb/queue/nr_requests

# Set scheduler
echo deadline > /sys/block/sdb/queue/scheduler
# Or for SSDs:
echo mq-deadline > /sys/block/sdb/queue/scheduler

**Windows iSCSI Tuning:**

# Enable jumbo frames on NIC
Set-NetIPInterface -InterfaceAlias "iSCSI" -NlMtuBytes 9000

# Adjust iSCSI timeout
Set-IscsiServerConnection -Timeout 30

**Benchmark:**

# Linux
fio --name=iscsi-test --rw=readwrite --bs=4K --size=50G --numjobs=4 --iodepth=32 --runtime=60

# Windows
# Use DiskSpd
diskspd -b4K -t4 -o32 -d60 -W -C -S -L -c10G E:\test.dat

Configuration Examples

Complete iSCSI Target Setup (Linux with targetcli)

# Install targetcli
apt install targetcli-fb  # Debian/Ubuntu
yum install targetcli  # RHEL/CentOS

# Create backstore (file-based LUN)
targetcli
/> /backstores/fileio create name=disk1 dev=/dev/sdb1 size=500G

# Create iSCSI target
/iscsi create iqn.2024-01.com.example:storage.target1

# Create LUN
/iscsi/iqn.2024-01.com.example:storage.target1/tpg1/luns create /backstores/fileio/disk1

# Create ACL for initiator
/iscsi/iqn.2024-01.com.example:storage.target1/tpg1/acls create iqn.1993-08.org.debian:01:myserver

# Set CHAP authentication
/iscsi/iqn.2024-01.com.example:storage.target1/tpg1 set attribute authentication=1
/iscsi/iqn.2024-01.com.example:storage.target1/tpg1 set attribute demo_mode_authentication=0

# Create CHAP user
/iscsi/iqn.2024-01.com.example:storage.target1/tpg1/acls/iqn.1993-08.org.debian:01:myserver set chapuser=iscsi-user
/iscsi/iqn.2024-01.com.example:storage.target1/tpg1/acls/iqn.1993-08.org.debian:01:myserver set chappassword=iscsi-password

# Save configuration
/saveconfig
exit

CHAP Authentication Setup

**One-way CHAP (Target authenticates Initiator):**

Linux (`/etc/iscsi/iscsid.conf`):

node.session.auth.authmethod = CHAP
node.session.auth.username = iscsi-user
node.session.auth.password = iscsi-password

Windows PowerShell:

Set-IscsiTargetPortal -TargetPortalAddress 10.0.2.100 -ChapUsername iscsi-user -ChapPassword iscsi-password -ChapType CHAP

**Mutual CHAP (Both authenticate):**

Linux:

node.session.auth.authmethod = CHAP
node.session.auth.username = iscsi-user
node.session.auth.password = iscsi-password
node.session.auth.username_in = target-user
node.session.auth.password_in = target-password

iSCSI Over Multiple Networks (Multipath)

**Configuration with two network paths:**

Initiator IPs: 10.0.2.10, 10.0.3.10 Target IPs: 10.0.2.100, 10.0.3.100

# Discover both portals
iscsiadm -m discovery -t st -p 10.0.2.100
iscsiadm -m discovery -t st -p 10.0.3.100

# Login to both portals
iscsiadm -m node -T iqn.2024-01.com.example:storage.target1 -p 10.0.2.100 -l
iscsiadm -m node -T iqn.2024-01.com.example:storage.target1 -p 10.0.3.100 -l

# Verify multipath
multipath -ll
# Should show 2 paths

Verification

Initiator-Target Connectivity

# Linux - Check session
iscsiadm -m session
# Expected: Session with target, logged in

# Linux - Check block device
lsblk | grep -E "(sd|dm-)"

# Windows - Check connection
Get-IscsiSession
# Expected: Connected sessions

# Windows - Check disk
Get-Disk | Where-Object {$_.BusType -eq "iSCSI"}

Multipath Verification

# Linux
multipath -ll
# Expected: Multiple paths, status active

# Windows
Get-MSDSMDevice
# Expected: Multiple paths with status Active

Failover Test

# Disable one network path
# Verify I/O continues via remaining path
# Re-enable path
# Verify failback

Performance Benchmark

# Linux
fio --name=iscsi-benchmark --rw=readwrite --bs=4K --size=50G --numjobs=4 --iodepth=32 --runtime=60 --group_reporting

# Record IOPS, bandwidth, latency

Troubleshooting

| Scenario | Symptom | Possible Cause | Diagnostic | Corrective Action | Verification | |----------|---------|----------------|------------|-------------------|--------------| | Cannot discover target | Discovery fails | Wrong IP, target not listening, firewall | `ping`, `iscsiadm -m discovery`, check firewall | Fix IP, start target, open port 3260 | Discovery succeeds | | Cannot login to target | Login failed | CHAP auth failure, wrong IQN, target full | `iscsiadm -m node --login`, check logs | Fix credentials, verify IQN | Session established | | Disk not visible after login | No new block device | Target not exporting LUN, ACL missing | `iscsiadm -m session`, target LUN config | Export LUN, add ACL for initiator | Block device visible | | CHAP authentication fails | Login rejected | Wrong credentials, one-way vs mutual CHAP | Check `/etc/iscsi/iscsid.conf`, event logs | Fix credentials, match CHAP type | Authentication succeeds | | Slow iSCSI performance | Below expected throughput | No jumbo frames, single path, congestion | `fio`, `ethtool`, check MTU | Enable jumbo frames, add paths, check network | Performance improved | | Multipath not working | Single path only | MPIO not enabled, target not configured for multi-session | `multipath -ll`, `Get-MSDSMDevice` | Enable MPIO, configure target for multi-session | Multiple paths active | | Connection drops | Intermittent iSCSI disconnects | Network instability, timeout too low | `dmesg`, event logs, network counters | Increase timeout, fix network, check cables | Stable connection | | Target portal unreachable | Cannot ping target IP | Wrong VLAN, wrong IP, switch issue | `ping`, `traceroute`, switch port | Fix network config, verify VLAN | Ping succeeds | | iSCSI service not starting | Service fails at boot | Network not ready, dependency issue | `systemctl status iscsid`, journal | Add network dependency, adjust startup order | Service starts at boot | | Write cache issues | Poor write performance | Target cache disabled, battery failed | Target cache status | Enable write cache, replace battery | Write performance improved |

Best Practices

1. **Use dedicated storage VLAN** — Isolate iSCSI traffic from production traffic 2. **Enable jumbo frames** — MTU 9000 on all iSCSI interfaces 3. **Use CHAP authentication** — Never use iSCSI without authentication in production 4. **Implement multipathing** — Multiple network paths for redundancy 5. **Use separate NICs for iSCSI** — Don't share with production traffic 6. **Monitor iSCSI sessions** — Alert on session drops 7. **Test failover regularly** — Verify path failover works 8. **Keep firmware updated** — NIC and storage controller firmware 9. **Document IQNs** — Critical for ACL and CHAP configuration 10. **Use `_netdev` in fstab** — Linux: mount after network is up

Conclusion

iSCSI provides block-level storage over standard Ethernet, making it an affordable alternative to Fibre Channel for many workloads. Success with iSCSI depends on proper network configuration (dedicated VLAN, jumbo frames), authentication (CHAP), multipathing, and monitoring.

While not as performant as Fibre Channel for extreme workloads, iSCSI is suitable for virtualization, databases, and general-purpose storage in small to medium environments.

References

  • iSCSI Specification (RFC 3720): https://tools.ietf.org/html/rfc3720
  • Linux open-iscsi: https://www.open-iscsi.com/
  • Linux DM-Multipath: https://www.kernel.org/doc/html/latest/multipathing.html
  • Windows iSCSI Initiator: https://docs.microsoft.com/en-us/windows-server/storage/
  • Windows MPIO: https://docs.microsoft.com/en-us/windows-server/storage/storage-spaces/
  • targetcli (Linux iSCSI target): https://github.com/agrover/targetcli-fb
#iscsi#storage#linux#windows-server#storage-configuration#infrastructure