Brocade Communications Systems A7990A - StorageWorks SAN Director 4/16 Blade... Service manual

Publication Number: 53-1000244-01
Publication Date: 09/29/2006
Secure Fabric OS
Administrator’s Guide
Supporting Fabric OS v3.2.0, v4.4.0, v5.0.1, v5.1.0, 5.2.0

Copyright © 2003-2006 Brocade Communications Systems, Incorporated.
ALL RIGHTS RESERVED.
Brocade, the Brocade B weave logo, Fabric OS, File Lifecycle Manager, MyView, Secure Fabric OS, SilkWorm, and
StorageX are registered trademarks and Tapestry is a trademark of Brocade Communications Systems, Inc., in the
United States and/or in other countries. FICON is a registered trademarks of IBM Corporation in the U.S. and other
countries. All other brands, products, or service names are or may be trademarks or service marks of, and are used to
identify, products or services of their respective owners.
Notice: The information in this document is provided “AS IS,” without warranty of any kind, including, without
limitation, any implied warranty of merchantability, noninfringement or fitness for a particular purpose. Disclosure of
information in this material in no way grants a recipient any rights under Brocade's patents, copyrights, trade secrets or
other intellectual property rights. Brocade reserves the right to make changes to this document at any time, without
notice, and assumes no responsibility for its use.
The authors and Brocade Communications Systems, Inc. shall have no liability or responsibility to any person or entity
with respect to any loss, cost, liability, or damages arising from the information contained in this book or the computer
programs that accompany it.
The product described by this document may contain “open source” software covered by the GNU General Public
License or other open source license agreements. To find-out which open source software is included in Brocade
products, view the licensing terms applicable to the open source software, and obtain a copy of the programming source
code, please visit http://www.brocade.com/support/oscd.
Export of technical data contained in this document may require an export license from the United States Government.
SECURITY NOTICE: Secure Fabric OS includes security features that you can use, along with other security tools, to
design and implement a more secure storage area network ("SAN"), as part of your overall network and information
security infrastructure. However, simply installing Secure Fabric OS does not guarantee the security of your SAN or
your overall network. There are numerous factors that affect the security of a SAN, including, without limitation, proper
security policies and procedures, hardware and software selection (including network security tools), proper installation,
configuration, and maintenance of the hardware and software, the interoperability of the various components of your
SAN and your network, and a proper, secure operating environment. In addition, Secure Fabric OS utilizes digital
certificates in connection with its access control features. Although digital certificates are a useful authentication
security measure that improves overall security, they do not guarantee authenticity or security. To help you evaluate the
digital certificate functionality of Secure Fabric OS, you can obtain details in the Certificate Practices Statement, which
is included with the documentation you received with this product. In designing the security of your SAN, it is your
responsibility to evaluate all of these factors to ensure your SAN will meet your security needs. Your experience may
vary based on these and other factors. Your use of Secure Fabric OS, including the digital certificates, is subject to and
governed by the terms of the applicable license agreement and to your compliance with the policies and procedures for
the use of Secure Fabric OS and digital certificates made available to you by Brocade from time to time. If Brocade
becomes aware of a breach of the security of its digital certificate infrastructure, Brocade reserves the right to re-issue
digital certificates. In that event, you will be required to submit new certificate signing requests and install reissued
certificates across your SAN. You should plan for any network disruption that this may cause.
YOU ACKNOWLEDGE THAT YOU HAVE ACCESS TO SUFFICIENT INFORMATION TO ENSURE THAT YOU
CAN MAKE AN INFORMED DECISION AS TO THE EXTENT TO WHICH YOU CHOOSE TO RELY ON
DIGITAL CERTIFICATES AND OTHER SECURITY FEATURES IN SECURE FABRIC OS ("SECURITY"). THE
SECURITY IS PROVIDED "AS IS," WITHOUT WARRANTIES OF ANY KIND, INCLUDING, WITHOUT
LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE OR NONINFRINGEMENT. BROCADE SHALL HAVE NO LIABILITY WITH RESPECT TO YOUR
USE OF AND RELIANCE ON THE SECURITY.

Brocade Communications Systems, Incorporated
Corporate Headquarters
Brocade Communications Systems, Inc.
1745 Technology Drive
San Jose, CA 95110
Tel: [phone]
Fax: [phone]
Email: [e-mail]
Asia-Pacific Headquarters
Brocade Communications Singapore Pte. Ltd.
9 Raffles Place
#59-02 Republic Plaza 1
Singapore 048619
Tel: [phone]
Fax: [phone]
Email: [e-mail]
European and Latin American Headquarters
Brocade Communications Switzerland Sàrl
Centre Swissair
Tour A - 2ème étage
29, Route de l'Aéroport
Case Postale 105
CH-1215 Genève 15
Switzerland
Tel: [phone]
Fax: [phone]
Email: [e-mail]

Document History
The following table lists all versions of the Secure Fabric OS Administrator’s Guide.
Document Title Publication
Number Summary of Changes Publication Date
Secure Fabric OS User’s
Guide v2.6 53-0000195-02 First release. January 2001
Secure Fabric OS User’s
Guide v3.1.0/4.1.0 53-0000526-02 Examples, information about new features, and new procedures were
added. The book was reorganized for
greater ease of use. Glossary was
removed; detailed procedure for
downloading from Web site was
removed.
April 2003
Secure Fabric OS User’s
Guide v2.6.2/3.1.2/4.2.0 53-0000526-03 “Security Notice” to the back of title page. Updated references to v2.6.1,
v3.1, and v4.1 to v2.6.2, v3.1.2, and
v4.2, as appropriate. Added
references to SilkWorm 3250, 3850,
and 24000, as appropriate. Some
minor edits. Rewording of core PID
passages to reflect new PID mode.
Wording of caution against running
two halves of a 12000 differently
under Secure OS clarified. There was
some rewording of compatibility
requirements.
December 2003
Secure Fabric OS User’s
Guide 53-0000526-04 Add SilkWorm 3016, SilkWorm 4100, and Fabric OS v4.4.0
references, new and revised content
from defects, and minor edits.
September 2004
Secure Fabric OS
Administrator’s Guide 53-0000526-05 Add SilkWorm 48000 and Fabric OS v5.0.1 support information,
secModeEnablecommandandfabric
merging changes for various Fabric
OS versions, especially in
relationship to multiple users
accounts.
March 2005
Secure Fabric OS
Administrator’s Guide 53-0000526-07 Revise with release note content. July 2005
Secure Fabric OS
Administrator’s Guide 53-10000048-01 Add Silkworm 4900 and 7500 and Fabric OS v5.1.0 support
information, fiber channel router and
password management policy support
information.
November 2005
Secure Fabric OS
Administrator’s Guide 53-10000048-02 Minor updates. April 2006
Secure Fabric OS
Administrator’s Guide 53-1000244-01 Revised for Secure Fabric OS v5.2.0 Sept 2006

Secure Fabric OS Administrator’s Guide v
Publication Number: 53-1000244-01
Contents
About This Document
How This Document Is Organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
Supported Hardware and Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x
What’s New in This Document. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x
Document Conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
Text Formatting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
Notes, Cautions, and Warnings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii
Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii
Brocade Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii
Other Industry Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
Getting Technical Help. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Document Feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
Chapter 1 Introducing Secure Fabric OS
Management Channel Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Switch-to-Switch Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
Using PKI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
Using DH-CHAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
Fabric Configuration Server Switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
Fabric Management Policy Set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Chapter 2 Preparing the Fabric for Secure Fabric OS
Prerequisites for a Secure Fabric Environment . . . . . . . . . . . . . . . . . . . . . . . 2-1
Verifying Compatible Fabric OS Version. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
Verifying or Activating Secure Fabric OS and Advanced Zoning Licenses . 2-3

vi Secure Fabric OS Administrator’s Guide
Publication Number: 53-1000244-01
Verifying the Digital Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Displaying the Digital Certificate Status . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Creating PKI Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5
Removing PKI Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6
Obtaining the Digital Certificate File . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7
Configuring Switch-to-Switch Authentication. . . . . . . . . . . . . . . . . . . . . . . . 2-22
Selecting Authentication Protocols. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-23
Managing Shared Secrets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-24
Preparing SilkWorm 24000 for Secure Fabric OS . . . . . . . . . . . . . . . . . . . . . 2-26
Installing a Supported CLI Client on a Workstation. . . . . . . . . . . . . . . . . . . . 2-28
Chapter 3 Enabling Secure Fabric OS and Creating Policies
Prerequisites to Enabling Secure Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
Default Fabric and Switch Accessibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2
Enabling Secure Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2
Modifying the FCS Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-8
Changing the Position of a Switch Within the FCS Policy. . . . . . . . . . . . 3-9
Failing Over the Primary FCS Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-10
Creating Secure Fabric OS Policies Other Than the FCS Policy . . . . . . . . . . 3-11
Creating a MAC Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-12
Creating an Options Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-20
Creating a DCC Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-21
Creating an SCC Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-24
Managing Secure Fabric OS Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-25
Saving Changes to Secure Fabric OS Policies . . . . . . . . . . . . . . . . . . . . . 3-26
Activating Changes to Secure Fabric OS Policies . . . . . . . . . . . . . . . . . . 3-27
Adding a Member to an Existing Policy. . . . . . . . . . . . . . . . . . . . . . . . . . 3-27
Removing a Member from a Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-28
Deleting a Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-28
Aborting All Uncommitted Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-29
Aborting a Secure Fabric OS Transaction . . . . . . . . . . . . . . . . . . . . . . . . 3-29

Secure Fabric OS Administrator’s Guide vii
Publication Number: 53-1000244-01
Chapter 4 Managing Secure Fabric OS
Viewing Secure Fabric OS Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1
Displaying General Secure Fabric OS Information . . . . . . . . . . . . . . . . . 4-2
Viewing the Secure Fabric OS Policy Database. . . . . . . . . . . . . . . . . . . . 4-2
Displaying Individual Secure Fabric OS Policies. . . . . . . . . . . . . . . . . . . 4-3
Displaying Status of Secure Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4
Displaying and Resetting Secure Fabric OS Statistics . . . . . . . . . . . . . . . . . . 4-5
Displaying Secure Fabric OS Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . 4-6
Resetting Secure Fabric OS Statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-7
Managing Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8
Modifying Passwords in Secure Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . 4-10
Using Temporary Passwords. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-11
Resetting the Version Number and Time Stamp. . . . . . . . . . . . . . . . . . . . . . . 4-12
Adding Switches and Merging Fabrics with Secure Mode Enabled . . . . . . . 4-13
Preventing a LUN Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-17
Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-17
Appendix A Removing Secure Fabric OS Capability
Preparing the Fabric for Removal of Secure Fabric OS Policies . . . . . . . . . . 5-1
Disabling Secure Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-2
Deactivating the Secure Fabric OS License on Each Switch . . . . . . . . . . . . . 5-3
Uninstalling Related Items from the Host . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-3
Appendix B Secure Fabric OS Commands and Secure Mode
Restrictions
Secure Fabric OS Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1
Command Restrictions in Secure Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-6
Zoning Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-6
Miscellaneous Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-7
Index

viii Secure Fabric OS Administrator’s Guide
Publication Number: 53-1000244-01

Secure Fabric OS Administrator’s Guide ix
Publication Number: 53-1000244-01
About This Document
This document is a procedural guide written to help SAN administrators set up and manage a Brocade
Secure Fabric OS SAN. This document is specific to Brocade Secure Fabric OS v5.2.0 and all switches
running Fabric OS versions v3.2.x, v4.4.x, v5.0.l, v5.1.0, or v5.2.0.
“About This Document” contains the following sections:
•“How This Document Is Organized,” next
•“Supported Hardware and Software” on page x
•“What’s New in This Document” on page x
•“Document Conventions” on page xi
•“Additional Information” on page xii
•“Getting Technical Help” on page xv
•“Document Feedback” on page xvi
How This Document Is Organized
This document is organized to help you find the particular information that you want as quickly and
easily as possible.
This document contains both information and procedures organized in roughly chronological order.
Starting from an introduction to Secure Fabric OS, it continues with system requirements, initial
implementation, adjusting to your own environment, and continued operation; also included is a
summary of the Secure Fabric OS commands, as well as the steps necessary to remove Secure Fabric
OS.
The document contains the following components:
•Chapter 1, “Introducing Secure Fabric OS” provides basic information about Secure Fabric OS.
•Chapter 2, “Preparing the Fabric for Secure Fabric OS” allows you to set up and get started using
Secure Fabric OS.
•Chapter 3, “Enabling Secure Fabric OS and Creating Policies” helps you create the security
policies needed for your SAN.
•Chapter 4, “Managing Secure Fabric OS” provides information for routine administration of your
Secure Fabric OS.
•Appendix B, “Secure Fabric OS Commands and Secure Mode Restrictions” summarizes Secure
Fabric OS commands.
•Appendix A, “Removing Secure Fabric OS Capability” provides information and procedures for
removing Secure Fabric OS from your SAN.

xSecure Fabric OS Administrator’s Guide
Publication Number: 53-1000244-01
Supported Hardware and Software
In those instances in which procedures or parts of procedures documented here apply to some switches
but not to others, this guide identifies exactly which switches are supported and which are not.
Although many different software and hardware configurations are tested and supported by Brocade
Communications Systems, Inc. for v3.2.x, v4.4.x, v5.0.1, v5.1.0, and v5.2.0 documenting all possible
configurations and scenarios is beyond the scope of this document.
This document does not support all versions. This document is specific to v5.2.0 To obtain information
about an OS version other than refer to the documentation specific to that OS version.
What’s New in This Document
The following changes have been made since this document was last released:
•Information that was added:
-Administrative Domain required settings and restrictions
-iSCSI Gateway considerations
-Support for new administrator roles
-Restrictions related to switch-local DCC and SCC policy database and Fabric-wide
Consistency policy
•Information that was changed:
•Information that was deleted:
-Support for the Silkworm embedded switches
For further information, see the release notes.

Secure Fabric OS Administrator’s Guide xi
Publication Number: 53-1000244-01
Document Conventions
This section describes text formatting conventions and important notices formats.
Text Formatting
The narrative-text formatting conventions that are used in this document are as follows:
bold text Identifies command names
Identifies the names of user-manipulated GUI elements
Identifies keywords and operands
Identifies text to enter at the GUI or CLI
italic text Provides emphasis
Identifies variables
Identifies paths and Internet addresses
Identifies document titles
code text Identifies CLI output
Identifies syntax examples
For readability, command names in the narrative portions of this guide are presented in mixed
lettercase: for example, switchShow. In actual examples, command lettercase is often all lowercase.
Otherwise, this manual specifically notes those cases in which a command is case sensitive.
Notes, Cautions, and Warnings
The following notices appear in this document.
N
ote
A note provides a tip, emphasizes important information, or provides a reference to related information.
C
aution
A caution alerts you to potential damage to hardware, firmware, software, or data.
W
arning
A warning alerts you to potential danger to personnel.

xii Secure Fabric OS Administrator’s Guide
Publication Number: 53-1000244-01
Key Terms
For definitions specific to Brocade and Fibre Channel, see the Brocade Glossary.
For definitions of SAN-specific terms, visit the Storage Networking Industry Association online
dictionary at http://www.snia.org/education/dictionary.
Additional Information
This section lists additional Brocade and industry-specific documentation that you might find helpful.
Brocade Resources
The following related documentation is provided on the Brocade Documentation CD-ROM and on the
Brocade Web site, through Brocade Connect.
Fabric OS
•Fabric OS Administrator’s Guide
•Fabric OS Command Reference
•Fabric OS MIB Reference
•Fabric OS Message Reference
•Brocade Glossary
XPath OS
•XPath OS Administrator’s Guide
•XPath OS Command Reference
•XPath OS MIB Reference
•XPath OS System Error Message Reference
•Web Tools—AP Edition Administrator’s Guide
Fabric OS Optional Features
•Web Tools Administrator’s Guide
•Fabric Watch Administrator’s Guide
•Fabric Manager Administrator’s Guide
•Secure Fabric OS Administrator’s Guide
N
ote
Go to http://www.brocade.com and click Brocade Connect to register at no cost for a user ID and
password.

Secure Fabric OS Administrator’s Guide xiii
Publication Number: 53-1000244-01
SilkWorm 48000
•SilkWorm 48000 Hardware Reference Manual
•SilkWorm 48000 QuickStart Guide
•FR4-18i Hardware Reference Manual
•FC4-16IP Hardware Reference Manual
SilkWorm 24000
•SilkWorm 24000 Hardware Reference Manual
•SilkWorm 24000 QuickStart Guide
SilkWorm 24000/48000
•Port Blade and Filler Panel Replacement Procedure
•Control Processor Blade Replacement Procedure
•Blower Assembly Replacement Procedure
•Cable Management Tray and Guide Replacement Procedure
•Chassis Door Replacement Procedure
•WWN Bezel and Card Replacement Procedure
•Power Supply and Filler Panel Replacement Procedure
•14U Rack Mount Kit Installation Procedure
•Mid-Mount Rack Kit Installation Procedure
SilkWorm 7500
•SilkWorm 7500 Hardware Reference Manual
•SilkWorm 7500 QuickStart Guide
•SilkWorm 7500 Fan Assembly Replacement Procedure
•SilkWorm 7500 Power Supply Replacement Procedure
SilkWorm 4900
•SilkWorm 4900 Hardware Reference Manual
•SilkWorm 4900 QuickStart Guide
•SilkWorm 4900 Fan Assembly Replacement Procedure
•SilkWorm 4900 Power Supply Replacement Procedure
SilkWorm 4100
•SilkWorm 4100 Hardware Reference Manual
•SilkWorm 4100 QuickStart Guide
SilkWorm 3900
•SilkWorm 3900 Hardware Reference Manual (for v4.x software)
•SilkWorm 3900 QuickStart Guide (for v4.x software)
•SilkWorm 3900 Fan Assembly Replacement Procedure

xiv Secure Fabric OS Administrator’s Guide
Publication Number: 53-1000244-01
•SilkWorm 3900 Motherboard Assembly Replacement Procedure
•SilkWorm 3900 Power Supply Replacement Procedure
SilkWorm 3250/3850
•SilkWorm 3250/3850 Hardware Reference Manual (for v4.x software)
•SilkWorm 3250/3850 QuickStart Guide (for v4.x software)
SilkWorm 200E
•SilkWorm 200E Hardware Reference Manual (for v5.x software)
SilkWorm Multiprotocol Router Model AP7420
•SilkWorm Multiprotocol Router Model AP7420 Hardware Reference Manual
•SilkWorm Multiprotocol Router Model AP7420 QuickStart Guide
•SilkWorm Multiprotocol Router Model AP7420 Power Supply Replacement Procedure
•SilkWorm Multiprotocol Router Model AP7420 Fan Assembly Replacement Procedure
For practical discussions about SAN design, implementation, and maintenance, you can obtain Building
SANs with Brocade Fabric Switches through:
http://www.amazon.com
For additional Brocade documentation, visit the Brocade SAN Info Center and click the Resource
Library location:
http://www.brocade.com
Release notes are available on the Brocade Connect Web site and are also bundled with the Fabric OS
firmware.
Other Industry Resources
In addition to this manual, the following information about fabric security and the Secure Fabric OS
product is available:
•Secure Fabric OS Courses (SFO 101 and SFO 200), offered by Brocade.
The class schedule is provided at http://www.brocade.com/education_services/index.jhtml.
•White papers, online demos, and data sheets are available through the Brocade Web site at http://
www.brocade.com/products/software.jhtml.
•Best practice guides, including the SAN Security Best Practice Guide, white papers, online demos,
data sheets, and other documentation is available through the Brocade Partner Web site.
•The CERT®Coordination Center of Carnegie Mellon University provides industry-level
information about certification at http://www.cert.org.
For additional resource information, visit the Technical Committee T11 Web site. This Web site
provides interface standards for high-performance and mass storage applications for Fibre Channel,
storage management, and other applications:
http://www.t11.org

Secure Fabric OS Administrator’s Guide xv
Publication Number: 53-1000244-01
For information about the Fibre Channel industry, visit the Fibre Channel Industry Association Web
site:
http://www.fibrechannel.org
Getting Technical Help
Contact your switch support supplier for hardware, firmware, and software support, including product
repairs and part ordering. To expedite your call, have the following information available:
1. General Information
•Technical Support contract number, if applicable
•Switch model
•Switch operating system version
•Error numbers and messages received
•supportSave command output
•Detailed description of the problem and specific questions
•Description of any troubleshooting steps already performed and results
•Serial console and telnet session logs
•syslog message logs
2. Switch Serial Number
The switch serial number and corresponding bar code are provided on the serial number label, as
shown here:
:
The serial number label is located as follows:
•SilkWorm 3014 switches: Top of chassis, under the insertion arm.
•SilkWorm 3016 switches: Side of switch module.
•SilkWorm 200E, 3200, and 3800 switches: nonport side of chassis.
•SilkWorm 3250, 3850, 3900, 4100, 4900, and 7500 switches: Bottom of chassis.
•SilkWorm 24000, and 48000 directors: Inside the front of the chassis, on the wall to the left of
the ports.
•SilkWorm Multiprotocol Router Model AP7420: On the bottom of the chassis and on the back
of the chassis.
*FT00X0054E9
FT00X0054E9

xvi Secure Fabric OS Administrator’s Guide
Publication Number: 53-1000244-01
3. World Wide Name (WWN)
•SilkWorm 200E, 3014, 3016, 3250, 3600, 3850, 3900, 4100, 4900, 7500 switches and
SilkWorm 24000, and 48000 directors: Provide the license ID. Use the licenseIdShow
command to display the license ID.
•SilkWorm Multiprotocol Router Model AP7420: Provide the switch WWN. Use the
switchShow command to display the switch WWN.
•All other SilkWorm switches: Provide the switch WWN. Use the wwn command to display the
switch WWN.
Document Feedback
Because quality is our first concern at Brocade, we have made every effort to ensure the accuracy and
completeness of this document. However, if you find an error or an omission, or you think that a topic
needs further development, we want to hear from you. Forward your feedback to:
[e-mail]
Provide the title and version number and as much detail as possible about your comment, including the
topic heading and page number and your suggestions for improvement.

Secure Fabric OS Administrator’s Guide 1-1
Publication Number 53-1000244-01
Chapter
1
Introducing Secure Fabric OS
Brocade Secure Fabric OS is an optionally licensed product that provides customizable security
restrictions through local and remote management channels on a SilkWorm fabric. Secure Fabric OS
provides the ability to:
•Create policies to customize fabric management access
•Specify which switches and devices can join the fabric
•View statistics related to attempted policy violations
•Manage the fabric-wide Secure Fabric OS parameters through a single switch
•Create temporary passwords specific to a login account and switch
•Enable and disable Secure Fabric OS as desired
Secure Fabric OS uses digital certificates based on PKI or Diffie-Hellman with Challenge-Handshake
Authentication Protocol (DH-CHAP) shared secrets to provide switch-to-switch authentication.
Table 1-1 lists which switches and fabrics support Secure Fabric OS.
This chapter includes the following sections:
•“Management Channel Security,” next
•“Switch-to-Switch Authentication” on page 1-3
•“Fabric Configuration Server Switches” on page 1-4
•“Fabric Management Policy Set” on page 1-5
Table 1-1 Secure Fabric OS-Supported Switches and Fabrics
Fabric OS Versions Supported SilkWorm Platforms
v2.6.2 SilkWorm 2000-series switches
v3.2.0 SilkWorm 3200 and 3800 switches
v4.4.0 SilkWorm 3016, 3250, 3850, 3900, 4100, and 6400 switches
SilkWorm 12000 and 24000 directors
v5.0.1 SilkWorm 3014, 3250, 3850, 3900, 4100, and 6400 switches
SilkWorm 12000, 24000, and 48000 directors
v5.1.0 SilkWorm 3014, 3250, 3850, 3900, 4100, 4900, 6400, and 7500 switches
SilkWorm 24000 and 48000 directors
v5.2.0 SilkWorm 3250, 3850, 3900, 4100, 4900, 6400, and 7500 switches
SilkWorm 24000 and 48000 directors

1-2 Secure Fabric OS Administrator’s Guide
Publication Number 53-1000244-01
1
Management Channel Security
Secure Fabric OS can be used to provide policy-based access control of local and remote management
channels, including Fabric Manager, Web Tools, standard SNMP applications, and management server.
Access through a channel can be restricted by customizing the Secure Fabric OS policy for that channel.
Secure Fabric OS policies are available for telnet (includes sectelnet and SSH), SNMP, management
server, HTTP, and API.
Fabric Manager, Web Tools, and API all use both HTTP and API to access the switch. To use any of
these management tools to access a fabric that has secure mode enabled, ensure that the workstation
computers can access the fabric by both API and HTTP. If an API or HTTP policy has been created, it
must include the IP addresses of all the workstation computers.
After a digital certificate has been installed on the switch, Fabric OS v3.2.0, v4.4.0, v5.0.1, v5.1.0, and
v5.2.0 encrypt sectelnet, API, and HTTP passwords automatically, regardless of whether Secure Fabric
OS is enabled.
On two-domain directors, messages (such as notifications of password changes) that are sent to the
whole secure fabric are seen on both domains, even if the other domain is not part of the secure fabric.
Secure Shell (SSH)
Fabric OS v4.4.0, v5.0.1, v5.1.0, and v5.2.0 support SSH, enabling fully encrypted telnet sessions. Use
of SSH requires installation of a SSH client on the host computer; use of SSH does not require a digital
certificate on the switch.
SSH access is configurable by the Telnet Policy that is available through Secure Fabric OS. However,
Fabric OS v4.4.0, v5.0.1, v5.1.0, and v5.2.0 support SSH whether or not Secure Fabric OS is licensed.
To restrict CLI access to SSH over the network, disable telnet as described in “Telnet” on page 1-3 later
in this section.
SSH clients are available in the public domain and can be located by searching the Internet. Use clients
that support version 2 of the protocol, such as OpenSSH or F-Secure.
Fabric OS v4.4.0, v5.0.1, v5.1.0, and v5.2.0 also support the following ciphers for session encryption
and HMACs (hash function-based message authentication codes):
•ciphers: AES128-CBC, 3DES-CBC, Blowfish-CBC, Cast128-CBC, and RC4
•HMACs: HMAC-MD5, HMAC-SHA1, HMAC-SHA1-96, and HMACMD5-96
For more information about SSH, see the Fabric OS Administrator’s Guide.
N
ote
The Telnet button in Web Tools can be used to launch telnet only (not sectelnet or SSH); it is disabled
when secure mode is enabled.
N
ote
The first time a SSH client is launched, a message is displayed, indicating that the server’s host key is
not cached in the registry. You will also see this message the first time a SSH client is launched after you
upgrade switch firmware.

Secure Fabric OS Administrator’s Guide 1-3
Publication Number 53-1000244-01
1
sectelnet
The sectelnet client is a secure form of telnet that encrypts passwords only. It is available from your
switch supplier. Fabric OS v4.4.0, v5.0.1, v5.1.0, and v5.2.0 include the sectelnet server; the sectelnet
client must be installed on the workstation computer.
The sectelnet client can be used as soon as a digital certificate is installed on the switch. sectelnet access
is configurable by the Telnet policy.
Telnet
Standard telnet is not available when secure mode is enabled.
To remove all telnet access to the fabric, disable telnet through the telnetd option of the configure
command. This configure option does not require disabling the switch. For more information about the
configure command, see the Fabric OS Command Reference Manual.
Switch-to-Switch Authentication
Switch-to-switch authentication supports the following:
•“Using PKI” on page 1-3
•“Using DH-CHAP” on page 1-4
Using PKI
Secure Fabric OS can use digital certificates based on public key infrastructure (PKI) and switch
WWNs and the SLAP or FCAP protocols to identify the authorized switches and prevent the addition of
unauthorized switches to the fabric. A PKI certificate installation utility (PKICert) is provided for
generating certificate signing requests (CSRs) and installing digital certificates on switches. For
information about how to use the PKICert utility, see “Using the PKICert Utility to Obtain CSR” on
page 2-8.
Support for FCAP is provided in Secure Fabric OS v3.2.0, v4.4.0, v5.0.1, v5.1.0, and v5.2.0 and is used
instead of SLAP when both switches support it. PKI authentication automatically uses SLAP when a
switch does not support FCAP.
on
N
ote
A secure edge fabric that is connected to a Fibre Channel router (such as the SilkWorm 7500) can use
only DH-CHAP authentication.
N
ote
Fabric OS v4.4.0, v5.0.1, v5.1.0, and v5.2.0 also use PKI digital certificates. Secure Fabric OS and
secure sockets layer (SSL) use different digital certificates and different methods of obtaining and
installing the certificates. PKI digital certificates are used for the secure fabric, and SSL digital
certificates are not. The methods described in this manual are specific to Secure Fabric OS. See the
Fabric OS Administrator’s Guide for information about SSL and digital certificates.

1-4 Secure Fabric OS Administrator’s Guide
Publication Number 53-1000244-01
1
Using DH-CHAP
Secure Fabric OS v3.2.0, v4.4.0, v5.0.1, v5.1.0, and v5.2.0 use Diffie-Hellman with Challenge-
Handshake Authentication Protocol (DH-CHAP) shared secrets to provide switch-to-switch
authentication and prevent the addition of unauthorized switches to the fabric. (DH-CHAP is not
available with Fabric OS v2.6.x.) The default is to use FCAP or SLAP (see “Using PKI”). It should be
explicitly enabled to authenticate using DH-CHAP.
Using the authUtil command, you can control which authentication protocols. You can specify that
FCAP only, DH-CHAP only, or either be used. If either is permitted, the default order (FCAP, DH-
CHAP) is used. The actual protocol is selected during dynamic negotiation.
DH-CHAP requires a pair of shared secret keys—shared secrets—between each pair of switches
authenticating with DH-CHAP. Use the secAuthSecret command to manage shared secrets. See the
Fabric OS Command Reference Manual for details of the authUtil and secAuthSecret commands and
see “Configuring Switch-to-Switch Authentication” on page 2-22 for a basic procedure for configuring
DH-CHAP.
Fabric Configuration Server Switches
Fabric configuration server (FCS) switches are one or more switches that are specified as “trusted”
switches for managing Secure Fabric OS. These switches should be both electronically and physically
secure. At least one FCS switch must be specified to act as the primary FCS switch, and one or more
backup FCS switches are recommended to provide failover ability in case the primary FCS switch fails.
If your primary FCS switch runs Fabric OS v3.2.0, v4.4.0, v5.0.1, v5.1.0, or v5.2.0 you should not use a
Fabric OS v2.6.2 switch (or a switch running older versions of Fabric OS v3.x.x or v4.x.x) as a backup
FCS switch. Fabric OS v3.2.0, v4.4.0, v5.0.1, v5.1.0, and v5.2.0 introduce features, such as a larger
secure database (128K in v3.2.0 and 256K in v4.4.0, v5.0.1, v5.1.0, and v5.2.0), multiple user account
(MUA), RADIUS, password policies, and an SSL certificate, all of which are not supported by older
releases.
FCS switches are specified by listing their WWNs in a specific policy called the FCS policy. The first
switch that is listed in this policy and participating in the fabric acts as the primary FCS switch; it
distributes the following information to the other switches in the fabric:
•Zoning configuration
•Secure Fabric OS policies
•Fabric password database
•SNMP community strings
•System date and time
When secure mode is enabled, only the primary FCS switch can propagate management changes to the
fabric. When a new switch joins the fabric, the primary FCS switch verifies the digital certificate; then it
provides the current configuration, overwriting the existing configuration of the new switch.
N
ote
The role of the FCS switch is separate from the role of the principal switch, which assigns domain IDs.
The role of the principle switch is not affected by whether secure mode is enabled.