On Windows Server 2012 R2, I have setup an iSCSI target and have allowed the following list of Initiators to connect:
IPAddress: 192.168.0.102 (iSCSI Initiator)
IPAddress: 192.168.0.109 (iSCSI Target)
No IQN has been listed, only IPAddress.
On the initiator, I make a quick connect to 192.168.0.109 (the target) but while I get a response right away, I get nothing to connect to. The Quick Connect windows says: "No Targets available for Login using Quick Connect."
If I telnet to 192.168.0.109 port 3260, I get through right away so I know the target is reachable.
Then I try to connect from the target (from 192.168.0.109 to 192.168.0.109) itself and I get a connection right away. Everything works.
So, why can't the iSCSI Initiator from 192.168.0.102 get a connection?
I have tried to add the IQN from the initiator to the target and retried the connect and now the initiator can connect. Something is weird here. Why is IPAddress not enough to connect remotely when it is enough to connect locally?
Then I thought perhaps the listed IQN is allowed from the listed IPAddress'es so I connected from a third pc (192.168.0.101) and it connected just fine (assuming the same IQN as 192.168.0.102 used).
What purpose does IPAdress have? It only seems to work locally.
One specific detail. There are 2 netcards in all pc's, one for 192.168.0.x and one for 192.168.34.x. Perhaps this is the issue so I specicied 192.168.0.102 as source IP on the Discover Portal setup for the initiator, but that changed nothing. Either that source IP isn't passed along correctly or the target throws the source IP away and uses the target IP instead. Bug?
At any rate, specifying IPAddress has no value whatsoever.
It seems the only way to secure the iscsi target is to use the firewall for port 3260.