ESXi Host with inaccessible iSCSI datastore

Products

• VMware vSphere ESXi

Issue/Introduction

Symptoms

• Multiple ESXi hosts are configured to access the same iSCSI targets from a NAS device. 

• Several datastores are hosted on the NAS, and all are accessible.

• After upgrading one of the ESXi hosts, it lost access to a specific iSCSI target.

• The remaining ESXi host continues to have access to all iSCSI targets without any issues.

• On the impacted ESXi host, the LUN corresponding to the missing datastore is not visible under storage devices. However, other LUNs from the same NAS device is accessible

• No changes have been done on the storage array and the LUNs are mapped to all the hosts

Validation Steps

• Compare iSCSI Configuration on the working and non working hosts. Navigate to Host > Configure > Storage > Storage Adapters. Select the iSCSI Software Adapter, then go to the Static Discovery tab.
  
  Ensure that all iSCSI targets are listed under Static Discovery on both hosts.
  
  Note: In this case, the static discovery entries will be consistent across all the hosts. If any iSCSI targets are missing on the non-working host, manually add them using the same configuration as the working host.

Environment

VMware vSphere ESXi 7.x

VMware vSphere ESXi 8.x

Cause

The issue is caused by a misconfiguration in the authentication method for the iSCSI target on the upgraded ESXi host. While the working host was configured with bidirectional CHAP authentication, the impacted host had no authentication method set, leading to a failure in establishing a session with the iSCSI target.

Cause Validation

Upon reviewing the /var/log/vobd.log file on the impacted ESXi host, it is observed that the iSCSI initiator failed to authenticate with the target, returning login status 0201, which indicates authentication failure:

2025-04-09T04:21:44.941Z: [iscsiCorrelator] 112832219083us: [vob.iscsi.target.login.error] vmhba65 failed to login to iqn.2004-04.com.xxxxxxxxxxxxxx because the target returned a login status of 0201
2025-04-09T04:21:44.941Z: [iscsiCorrelator] 112832219538us: [esx.problem.storage.iscsi.target.login.error] Login to iscsI target iqn.2004-04.com.xxxxxxxxxxxxxx on vmhba65 failed. Target returned login error of: 0201.

The error code 0201 indicates that the initiator could not be successfully authenticated. The CHAP and mutual CHAP credentials configured on the ESXi initiator and on the iSCSI array do not match. Error 0201 indicates that the iSCSI initiator could not be successfully authenticated due to mismatched or missing CHAP/mutual CHAP credentials.

Further validation of the static target settings on the impacted ESXi host revealed that authentication was set to “None” on the non working ESXi host

In contrast, the working ESXi host iscsi target was configured with bidirectional CHAP authentication.

To validate the authentication settings follow the below steps:

• In the vSphere Client, navigate to the ESXi host.
• Click the Configure tab.
• Under Storage, click Storage Adapters, and select the adapter (vmhba#) to configure.
• Click on Static Discovery.
• From the list of available targets, select a target to configure and click Authentication.

Resolution

To resolve the issue, the CHAP authentication settings on the impacted ESXi host must be updated to match those configured on the storage target and the working ESXi host. 

For detailed guidance on updating the CHAP credentials, refer to the Broadcom documentation Set Up CHAP for Target

Additional Information

Missing expected iSCSI path due to CHAP authentication failure