HP A7533A - Brocade 4Gb SAN Switch Base - Backing up FICON files; Uploading the configuration files; Downloading configuration files with Active=Saved mode enabled; Downloading configuration files with Active=Saved mode disabled

HP A7533A - Brocade 4Gb SAN Switch Base

576 pages

To Next Page

To Next Page

To Previous Page

To Previous Page

Loading...

116 Configuring standard security features

Table of Contents

Default Chapter3
- Table of Contents3
About this Guide25
- Supported Fabric os 6.2.X HP Storageworks Hardware25
- Fabric os 6.2 Administrator Guide25
- Intended Audience26
- Related Documentation26
- Document Conventions and Symbols26
- Document Conventions26
- Rack Stability27
- HP Technical Support27
- Customer Self Repair27
- Product Warranties27
- Subscription Service28
  - HP Websites28
- Documentation Feedback28
- Fabric os Overview29
- Fabric os Command Line Interface29
  - Getting Help on a Command29
  - Telnet or SSH Sessions30
    - Connecting to Fabric os Using Telnet30
    - Rules for Telnet Connections30
  - Console Sessions Using the Serial Port31
    - Connecting to Fabric os through the Serial Port31
- Password Modification31
  - Default Account Passwords32
    - Changing the Default Account Passwords at Login32
- Default Administrative Account Names and Passwords32
- The Ethernet Interface on Your Switch33
  - Virtual Fabrics and the Ethernet Interface33
  - Displaying the Network Interface Settings34
  - Static Ethernet Addresses35
    - Setting the Static Addresses for the Ethernet Network Interface35
  - DHCP Activation35
    - Activating DHCP36
    - Deactivating DHCP36
  - Ipv6 Autoconfiguration37
    - Setting Ipv6 Autoconfiguration37
- Date and Time Settings37
  - Setting the Date and Time37
  - Time Zone Settings38
    - Setting the Time Zone38
    - Setting the Time Zone Interactively39
  - Network Time Protocol39
    - Synchronizing the Local Time with an External Source40
- Switch Names40
  - Customizing the Switch Name40
- Chassis Names40
  - Customizing Chassis Names41
- Domain Ids41
  - Displaying the Domain Ids41
  - Setting the Domain ID42
- Licensed Features43
  - ICL Licensing45
  - 8G Licensing45
  - Time-Based Licenses46
  - Viewing Installed Licenses46
  - Activating a License46
  - Adding a Licensed Feature47
  - Removing a Licensed Feature48
  - Ports on Demand49
- List of Available Ports When Implementing Pods49
  - Activating Ports on Demand50
  - Dynamic Ports on Demand50
  - Displaying the Port License Assignments50
  - Enabling Dynamic Ports on Demand51
  - Disabling Dynamic Ports on Demand52
  - POD License Management52
  - Reserving a Port License52
  - Releasing a Port from a POD Set53
- Switch Activation and Deactivation54
  - Disabling a Switch54
  - Enabling a Switch54
- Port Activation and Deactivation54
  - Disabling a Port55
  - Enabling a Port55
- Basic Connections55
  - Device Connection56
  - Switch Connection56
- Gateway Links56
  - Configuring a Link through a Gateway56
- Equipment Status57
  - Checking Switch Operation57
  - Verifying High Availability Features (Directors and Enterprise-Class Platforms Only)57
  - Verifying Fabric Connectivity58
  - Verifying Device Connectivity59
  - Displaying Switches in Access Gateway Mode60
- Track and Control Switch Changes60
  - Enabling the Track Changes Feature60
  - Displaying the Status of the Track Changes Feature60
  - Viewing the Switch Status Policy Threshold Values61
  - Setting the Switch Status Policy Threshold Values61
- Audit Log Configuration62
  - Auditable Event Classes63
- Auditcfg Event Class Operands63
  - Verifying Host Syslog Prior to Configuring the Audit Log64
  - Configuring an Audit Log for Specific Event Classes64
- Switch and Enterprise-Class Platform Shutdown65
  - Powering off a Switch65
  - Powering off an Enterprise-Class Platform65
- High Availability of Daemon Processes66
- Daemons that Are Automatically Restarted66
Managing User Accounts67
- User Accounts Overview67
  - Role-Based Access Control (RBAC)67
    - Role Permissions68
- Fabric os Roles68
- Permission Types68
- RBAC Permissions Matrix69
  - The Management Channel70
- Maximum Number of Simultaneous Sessions70
  - Local Database User Accounts71
- Default Local User Accounts71
- Authentication Configuration Options84
  - Fabric os User Accounts85
- Syntax for VSA-Based Account Roles85
  - Fabric os Users on the RADIUS Server86
    - Linux Freeradius Server86
    - Windows 2000 IAS86
- Dictionary.brocade File Entries86
  - RADIUS Configuration with Admin Domains or Virtual Fabrics87
Configuring Standard Security Features101
- Security Protocols101
- Secure Protocol Support101
  - Secure File Copy102
    - Setting up SCP for Configuploads and Downloads102
- Items Needed to Deploy Secure Protocols102
- Main Security Scenarios102
- SSL Certificate Files110
  - Certificate Authorities111
  - Telnet Protocol114
    - Blocking Telnet114
- Commands for Displaying and Deleting SSL Certificates114
  - Unblocking Telnet115
  - Listener Applications115
- Blocked Listener Applications115
  - Ports and Applications Used by Switches116
- Access Defaults116
  - Port Configuration117
- Port Information117
Configuring Advanced Security Features119
- ACL Policies Overview119
  - How the ACL Policies Are Stored119
- Security Database Size Restrictions119
  - Policy Members120
  - ACL Policy Management120
- Valid Methods for Specifying Policy Members120
  - Displaying ACL Policies121
  - FCS Policies121
- FCS Policy States121
  - FCS Policy Restrictions122
  - Overview of FCS Policy Management122
- Switch Operations122
  - Creating an FCS Policy123
  - Modifying the Order of FCS Switches123
  - FCS Policy Distribution124
  - DCC Policies125
- Distribution Policy States125
- DCC Policy States125
  - DCC Policy Restrictions126
  - Creating a DCC Policy126
  - Deleting a DCC Policy127
  - SCC Policies127
- SCC Policy States127
  - Creating an SCC Policy128
  - ACL Policy Modifications128
  - Authentication Policy for Fabric Elements129
  - IP Filter Policy137
- Supported Services139
- Implicit IP Filter Rules139
  - IP Filter Policy Enforcement140
  - Adding a Rule to an IP Filter Policy140
- Default IP Policy Rules140
  - Deleting a Rule to an IP Filter Policy141
  - Aborting a Transaction Associated with IP Filter141
  - IP Filter Policy Distributions141
  - IP Filter Policy Restrictions141
  - Policy Database Distribution141
    - Database Distribution Settings142
- Interaction between Fabric-Wide Consistency Policy and Distribution Settings142
  - Displaying the Database Distribution Settings143
  - Enabling Local Switch Protection143
  - Disabling Local Switch Protection143
- Supported Policy Databases143
  - ACL Policy Distribution to Other Switches144
    - Distributing the Local ACL Policies144
    - Fabric-Wide Enforcement144
- ACL Policy Database Distribution Behavior144
  - Displaying the Fabric-Wide Consistency Policy145
  - Setting the Fabric-Wide Consistency Policy145
- Fabric-Wide Consistency Policy Settings145
  - Notes on Joining a Switch to the Fabric146
    - Matching Fabric-Wide Consistency Policies146
    - Non-Matching Fabric-Wide Consistency Policies147
- Merging Fabrics with Matching Fabric-Wide Consistency Policies147
- Examples of Strict Fabric Merges147
  - Securing the Management Interface148
    - Configuration Examples148
    - Endpoint-To-Endpoint Transport or Tunnel148
- Fabric Merges with Tolerant/Absent Combinations148
  - Gateway-To-Gateway Tunnel149
  - Endpoint-To-Gateway Tunnel149
  - Roadwarrior Configuration149
  - Protected Endpoints Configuration149
  - Gateway Tunnel Configuration149
  - Endpoint to Gateway Tunnel Configuration149
- Algorithms and Associated Authentication Policies150
  - Block Ciphers151
  - Hmac151
  - 3Des151
  - Blowfish151
  - Aes151
  - Null Encryption152
  - Ipsec Policies152
  - FIPS Support156
    - Zeroization Functions156
- Zeroization Behavior156
  - Power-On Self Tests157
  - Conditional Tests157
  - FIPS Mode Configuration157
    - LDAP in FIPS Mode158
- FIPS Mode Restrictions158
- FIPS and Non-FIPS Modes of Operation158
  - Setting up LDAP for FIPS Mode159
  - LDAP Certificates for FIPS Mode160
    - Exporting an LDAP Switch Certificate160
    - Importing an LDAP Switch Certificate160
- Active Directory Keys to Modify160
  - Deleting an LDAP Switch Certificate161
  - Preparing the Switch for FIPS161
Maintaining the Switch Configuration File165
- Configuration Settings165
  - Configuration File Format165
    - Chassis Section166
    - Switch Section167
- Configuration File Backup167
  - Uploading a Configuration File in Interactive Mode167
- Configuration File Restoration168
  - Restrictions169
  - Configuration Download Without Disabling a Switch170
    - Restoring a Configuration170
- CLI Commands to Display or Modify Switch Configuration Information170
  - Configurations Across a Fabric172
- Backup and Restore in a FICON CUP Environment173
  - B-Series Configuration Form174
- B-Series Configuration and Connection174
Managing Virtual Fabrics175
- Virtual Fabrics Overview175
- Logical Switch175
- Logical Fabric179
- Management Model for Logical Switches182
  - Logical Fabric Using Isls and Xisls182
- Account Management and Virtual Fabrics183
- Supported Platforms for Virtual Fabrics183
- Virtual Fabrics Interaction with Fabric os Features184
  - Limitations and Restrictions of Virtual Fabrics185
- Maximum Number of Logical Switches Per Chassis185
Managing Administrative Domains193
- Administrative Domains Overview193
- AD User Types196
- Ports and Devices in CLI Output209
- Admin Domain Interaction with Fabric os Features211
- Configuration Upload and Download Scenarios in an AD Context214
Installing and Maintaining Firmware215
- Firmware Download Process Overview215
- Preparing for a Firmware Download217
- Enterprise-Class Platform HA Sync States217
Administering Advanced Zoning235
- Zoning Overview235
  - Zoning Example235
  - Zone Types236
- Types of Zoning236
  - Zone Objects237
- Approaches to Fabric-Based Zoning237
- Enforcing Hardware Zoning241
- Zoning Database Limitations254
- Resulting Database Size: 0 to 96K254
- Resulting Database Size: 96K to 128K255
- Resulting Database Size: 128K to 256K255
  - Zoning Configurations256
- Resulting Database Size: 256K to 1M256
10Configuring Enterprise-Class Platforms269
- Ports269
- Power Conservation274
  - Powering off a Port Blade275
  - Powering on a Port Blade275
- Disabling and Enabling Port Blades275
- HP Storageworks Enterprise-Class Platform Terminology and Abbreviations277
- Port Blades Supported by each Platform280
  - Displaying Slot Information281
  - Inter-Chassis Links282
- LED Behavior283
11Routing Traffic285
- Routing Overview285
- Path Versus Route Selection285
- Fspf285
- Routing Policies286
- Displaying the Current Routing Policy287
- Exchange-Based Routing287
- Port-Based Routing287
- AP Route Policy288
- Routing in Virtual Fabrics288
  - Setting the Routing Policy288
  - Setting up the AP Route Policy288
- Route Selection288
- Dynamic Load Sharing289
  - Setting DLS289
- Static Route Assignment289
  - Assigning a Static Route290
  - Removing a Static Route290
- Frame Order Delivery290
- Forcing In-Order Frame Delivery Across Topology Changes291
- Restoring Out-Of-Order Frame Delivery Across Topology Changes291
Interoperability for Merged Sans293
13Configuring the Distributed Management Server295
- Distributed Management Server Overview295
- Management Server Database296
- Topology Discovery300
14Iscsi Gateway Service303
- Iscsi Gateway Service Overview303
- Iscsi Target Gateway Configuration Steps309
15Administering NPIV335
- NPIV Overview335
  - Fixed Addressing Mode335
  - 10-Bit Addressing Mode335
- Enabling and Disabling NPIV335
- Configuring NPIV336
  - Configuration Scenarios337
- Viewing NPIV Port Configuration Information337
  - Viewing Virtual PID Login Information338
Optimizing Fabric Behavior341
- Adaptive Networking Overview341
- Traffic Isolation Routing341
  - TI Zone Failover342
  - Traffic Isolation Zone Creating a Dedicated Path through the Fabric342
- Comparison of Traffic Behavior When Failover Is Enabled or Disabled in TI Zones342
- Virtual Channels Assigned to Qos Priority363
Using the FC-FC Routing Service369
- FC-FC Routing Service Overview369
  - Supported Platforms for Fibre Channel Routing369
  - Supported Configurations369
- Integrated Routing370
- Fibre Channel Routing Concepts370
- A Metasan with Interfabric Links371
- A Metasan with Edge-To-Edge and Backbone Fabrics and LSAN Zones372
  - Proxy Devices373
  - Phantom Domains373
- Metasan with Imported Devices374
- Sample Topology (Physical Topology)375
  - Fibre Channel Network Address Translation376
- Ex_Port Phantom Switch Topology376
- Setting up the FC-FC Routing Service377
  - Verifying the Setup for FC-FC Routing377
- Backbone Fids379
  - Assigning Backbone Fids380
- FCIP Tunnel Configuration380
- Interfabric Link Configuration380
  - Configuring an IFL for both Edge and Backbone Connections381
- FC Router Port Cost Configuration385
- Ex_Port Frame Trunking Configuration386
- LSAN Zone Configuration388
- Example of Setting up Speed LSAN Tag394
- LSAN Information Stored in each FC Router with and Without LSAN Zone Binding397
Administering Advanced Performance Monitoring409
- Advanced Performance Monitoring Overview409
- Types of Monitors Supported on HP Storageworks Switch Models409
  - End-To-End Performance Monitoring410
- Number of Logical Switches that Support Performance Monitors410
- Predefined Values at Offset 0417
Administering Extended Fabrics427
- Licensing for Extended Fabrics427
- Extended Fibre Channel over Distance427
  - Distance Levels for Extended Inter-Switch Links427
  - Buffer-To-Buffer Credits427
- Fibre Channel Data Frames428
  - FC Switch Port Buffer Credit Requirements for Long-Distance Calculations429
  - Determining How Many Ports Can be Used for Long Distance429
- Buffer Credits429
  - Example: Consider the HP Storageworks 8/8 and 8/24 SAN Switches, Which Have a Single 24-Port Port Group and a Total of 676 Buffer Credits for that Port Group430
  - Displaying the Remaining Buffers in a Port Group430
- Supported Distances432
Administering ISL Trunking436
- ISL Trunking Overview439
- Distribution of Traffic over ISL Trunking Groups439
- Standard Trunking Criteria440
- Fabric Considerations for ISL Trunking440
- Initializing Trunking on Ports441
  - Disabling and Re-Enabling Ports441
- Lossless Dynamic Load Sharing on Trunk Ports441
  - Configuring Lossless Dynamic Load Sharing on Trunk Ports442
  - Lossless Dynamic Load Sharing in Virtual Fabrics442
    - Example: How DLS Affects Other Logical Switches in the Fabric442
- Performance Monitoring442
  - Adding a Monitor to an F_Port Master Port443
  - Displaying Port Throughput Performance Information for All Ports on the Switch443
- ISL Trunking444
  - Enabling or Disabling ISL Trunking on a Port444
  - Enabling or Disabling ISL Trunking for All Ports on a Switch444
- Setting Port Speeds444
- Long-Distance Mode Definitions445
- Trunking over Distance for the HP Storageworks 4/256 SAN Director with Supported Blades448
- F_Port Masterless Trunking Considerations450
  - Setting up F_Port Trunking452
- PWWN Format for F_Port and N_Port Trunk Ports452
Configuring and Monitoring FCIP Extension Services461
- FCIP Concepts461
  - Virtual Ports and FCIP Tunnels461
  - Virtual Port Types461
- Tunnel and Virtual Port Numbering461
FICON Fabrics499
- Fabric os Support for FICON499
- Switch Configuration503
- Preparing a Switch for FICON504
  - Single Switch Configuration504
  - Configuring a High-Integrity Fabric504
- Setting Unique Domain Ids505
- Cascaded Configuration, Two Switches505
- Cascaded Configuration, Three Switches505
- FICON Information506
- Port Swapping507
  - Example: Port Swapping507
- Clearing the FICON Management Database507
- Ficon Cup507
- FICON CUP Mode Register Bits510
- FICON Configuration Worksheet513
  - Sample IOCP Configuration File514
Configuring and Monitoring FICON Extension Services517
- FICON Extension Products Licensing517
- Platforms that Support FICON Extension over IP517
- FCIP Configuration Requirements for FICON Extension517
- Configuration Requirements for Switches and Directors517
- FICON Emulation Concepts and Features518
- Allow/Prohibit Example518
- FICON Emulation Configuration519
  - FICON Emulation Configuration Values521
- FICON Emulation Modification521
- FICON Performance Statistics522
  - FICON Emulation Monitoring523
A Configuring the PID Format527
- Pids and PID Binding Overview527
- PID Formats528
- Impact of Changing the Fabric PID Format528
- PID Format Selection529
- Evaluating the Fabric530
- PID Format Recommendations for Adding New Switches530
- Physical Port Numbers and Logical Area Ids for Swapped Ports539
B Understanding Legacy Password Behavior541
- Password Management Information541
- Password Prompting Behaviors542
- Password Migration During Firmware Changes543
- Password Recovery Options543
- Password Migration Behavior During Firmware Upgrade/Downgrade543
C Mixed Fabric Configurations for Non-Merge Sans545
D Migrating from an MP Router to a 400 MP Router547
- Introduction to MP Router Upgrades547
  - Non-Redundant Configuration547
- Non-Redundant Router Configuration547
- Configuration During the Upgrade547
E Inband Management551
- Inband Management Overview551
- Internal Ethernet Devices551
- IP Address and Routing Management552
- Inband Management Process552
- Examples of Supported Configurations555
  - Configuring a Management Station on the same Subnet555
- Management Station on same Subnet555
  - Configuring a Management Station on Different Subnets556
- Management Station on a Different Subnet556
F Using Remote Switch559
- About Remote Switch559
- Remote Switch Capabilities559
- Using Remote Switch with a Gateway559
Index561
- Figures573
- Isolated Subfabrics573
- Logical Switches Connected to Form Logical Fabrics573
- Windows 2000 VSA Configuration573
- 80 Multiple Tunnels to Multiple Ports, Fastwrite and Tape Pipelining Enabled on a Per-Tunnel/Per-Port Basis574
- Dual Backbone Fabric Configuration574
- Edge Sans Connected through a Backbone Fabric574
- Mask Positions for End-To-End Monitors574
- Redundant Router Configuration574
- Single Tunnel, Fastwrite and Tape Pipelining Enabled574
Tables575
- License Requirements575
- Port Numbering Schemes for the HP Storageworks 4/256 SAN Director, HP Storageworks DC SAN Back- Bone Director and HP Storageworks DC04 SAN Director Switch Enterprise-Class Platforms268576
- Default Index/Area_Id Core PID Assignment with no Port Swap576
- 69 Default Index/Area_Id Core PID Assignment with no Port Swap for the HP Storageworks DC04 SAN Director576
  - Switch271576
- Trunking Support for HP Storageworks SAN Switch 4/32 and HP Storageworks 4/64 SAN Switch576
  - Asic)444576
- Address Identifier576
- Default Mapping of DSCP Priorities to L2Cos Priorities576
- Ipsec Terminology576
- Fixed Policy Parameters576

Other manuals for HP A7533A - Brocade 4Gb SAN Switch Base

User Guide248 pages

Hardware Reference Guide256 pages

Release Note76 pages

Related product manuals

Preview: HP AF618A

Preview: HP aruba 6300M

Preview: HP Aruba JL253A

HP Aruba JL253A

Preview: HP A5120 Series

HP A5120 Series

Preview: HP A5120 EI Series

HP A5120 EI Series

Preview: HP A5500 HI Series

HP A5500 HI Series