HP SN3000B Service manual

53-1002446-01
15 December 2011
®
Fabric OS
Administrator’s Guide
Supporting Fabric OS v7.0.1

Copyright © 2011 Brocade Communications Systems, Inc. All Rights Reserved.
Brocade, the B-wing symbol, BigIron, DCX, Fabric OS, FastIron, NetIron, SAN Health, ServerIron, and TurboIron are registered
trademarks, and Brocade Assurance, Brocade NET Health, Brocade One, CloudPlex, MLX, VCS, VDX, and When the Mission Is
Critical, the Network Is Brocade are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other
countries. Other brands, products, or service names mentioned are or may be trademarks or service marks of their respective
owners.
Notice: This document is for informational purposes only and does not set forth any warranty, expressed or implied, concerning
any equipment, equipment feature, or service offered or to be offered by Brocade. Brocade reserves the right to make changes to
this document at any time, without notice, and assumes no responsibility for its use. This informational document describes
features that may not be currently available. Contact a Brocade sales office for information on feature and product availability.
Export of technical data contained in this document may require an export license from the United States government.
The authors and Brocade Communications Systems, Inc. shall have no liability or responsibility to any person or entity with
respect to any loss, cost, liability, or damages arising from the information contained in this book or the computer programs that
accompany it.
The product described by this document may contain “open source” software covered by the GNU General Public License or other
open source license agreements. To find out which open source software is included in Brocade products, view the licensing
terms applicable to the open source software, and obtain a copy of the programming source code, please visit
http://www.brocade.com/support/oscd.
Brocade Communications Systems, Incorporated
Document History
Corporate and Latin American Headquarters
Brocade Communications Systems, Inc.
130 Holger Way
San Jose, CA 95134
Tel: [phone]
Fax: [phone]
E-mail: [e-mail]
Asia-Pacific Headquarters
Brocade Communications Systems China HK, Ltd.
No. 1 Guanghua Road
Chao Yang District
Units 2718 and 2818
Beijing 100020, China
Tel: [phone]
Fax: [phone]
E-mail: [email protected]
European Headquarters
Brocade Communications Switzerland Sàrl
Centre Swissair
Tour B - 4ème étage
29, Route de l'Aéroport
Case Postale 105
CH-1215 Genève 15
Switzerland
Tel: [phone]
Fax: [phone]
E-mail: [e-mail]
Asia-Pacific Headquarters
Brocade Communications Systems Co., Ltd. (Shenzhen WFOE)
Citic Plaza
No. 233 Tian He Road North
Unit 1308 – 13th Floor
Guangzhou, China
Tel: [phone]
Fax: [phone]
E-mail: [email protected]
Title Publication number Summary of changes Date
Fabric OS Administrator’s Guide 53-1001763-01 Added enhancements and new features for
Fabric OS v6.4.0. Added support for the
Brocade VA-40FC hardware.
March 2010
Fabric OS Administrator’s Guide 53-1001763-02 Corrected minor errors. Added additional
clarification in some places.
September 2010
Fabric OS Administrator’s Guide 53-1002148-01 Added Fabric OS v7.0.0 software features and
support for new hardware platforms:
Brocade 6510, DCX 8510-4, and DCX 8510-8.
April 2011
Fabric OS Administrator’s Guide 53-1002148-02 Corrected errors and added additional
explanations for some features.
June 2011
Fabric OS Administrator’s Guide 53-1002148-03 Updated the ICL section and licensing table. July 2011
Fabric OS Administrator’s Guide 53-1002446-01 Added Fabric OS v7.0.1 software features and
support for new hardware platforms:
Brocade 6505, FC8-32E, and FC8-48E.
December 2011

Fabric OS Administrator’s Guide iii
53-1002446-01
Contents
About This Document
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxiii
How this document is organized . . . . . . . . . . . . . . . . . . . . . . . . . . xxxiii
Supported hardware and software . . . . . . . . . . . . . . . . . . . . . . . . xxxiv
What’s new in this document. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxv
Document conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxvi
Notice to the reader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxvii
Additional information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxviii
Getting technical help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxviii
Document feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxix
Section I Standard Features
Chapter 1 Understanding Fibre Channel Services
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Fibre Channel services overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Management server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Platform services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Platform services and Virtual Fabrics. . . . . . . . . . . . . . . . . . . . . . 5
Enabling platform services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Disabling platform services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Management server database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Displaying the management server ACL. . . . . . . . . . . . . . . . . . . . 6
Adding a member to the ACL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Deleting a member from the ACL . . . . . . . . . . . . . . . . . . . . . . . . . 7
Viewing the contents of the management server database . . . . 8
Clearing the management server database . . . . . . . . . . . . . . . . 9
Topology discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Displaying topology discovery status . . . . . . . . . . . . . . . . . . . . . . 9
Enabling topology discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Disabling topology discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

iv Fabric OS Administrator’s Guide
53-1002446-01
Device login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Principal switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
E_Port login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Fabric login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Port login process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
RSCNs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Duplicate Port World Wide Name . . . . . . . . . . . . . . . . . . . . . . . . 13
High availability of daemon processes . . . . . . . . . . . . . . . . . . . . . . . 13
Chapter 2 Performing Basic Configuration Tasks
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Fabric OS overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Fabric OS command line interface. . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Console sessions using the serial port. . . . . . . . . . . . . . . . . . . . 16
Telnet or SSH sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Getting help on a command . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Password modification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Default account passwords. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
The Ethernet interface on your switch. . . . . . . . . . . . . . . . . . . . . . . . 20
Virtual Fabrics and the Ethernet interface . . . . . . . . . . . . . . . . .20
Displaying the network interface settings . . . . . . . . . . . . . . . . . 21
Static Ethernet addresses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22
DHCP activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
IPv6 autoconfiguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Date and time settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Setting the date and time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Time zone settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
Network time protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Domain IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28
Displaying the domain IDs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Setting the domain ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Switch names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
Customizing the switch name . . . . . . . . . . . . . . . . . . . . . . . . . . .30
Chassis names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
Customizing chassis names . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
Fabric name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Configuring the fabric name . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
High availability considerations for fabric names . . . . . . . . . . . 31
Upgrade and downgrade considerations for fabric names. . . . 31
Config file upload and download considerations for
fabric names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Switch activation and deactivation . . . . . . . . . . . . . . . . . . . . . . . . . .32
Disabling a switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
Enabling a switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32

Fabric OS Administrator’s Guide v
53-1002446-01
Switch and Backbone shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Powering off a Brocade switch . . . . . . . . . . . . . . . . . . . . . . . . . .32
Powering off a Brocade Backbone . . . . . . . . . . . . . . . . . . . . . . .33
Basic connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Device connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
Switch connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
Chapter 3 Performing Advanced Configuration Tasks
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
PIDs and PID binding overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Core PID addressing mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Fixed addressing mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
10-bit addressing mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36
256-area addressing mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
WWN-based PID assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Ports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Setting port names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Port identification by slot and port number . . . . . . . . . . . . . . . . 40
Port identification by port area ID. . . . . . . . . . . . . . . . . . . . . . . .40
Port identification by index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Swapping port area IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Port activation and deactivation. . . . . . . . . . . . . . . . . . . . . . . . . 42
Port decommissioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Setting port speeds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43
Setting the same speed for all ports on the switch. . . . . . . . . . 43
Setting port speed for a port octet . . . . . . . . . . . . . . . . . . . . . . . 44
Blade terminology and compatibility . . . . . . . . . . . . . . . . . . . . . . . . .44
CP blades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Core blades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Port and application blade compatibility . . . . . . . . . . . . . . . . . . 47
FX8-24 compatibility notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48
Enabling and disabling blades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Enabling blades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Disabling blades. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Blade swapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50
How blades are swapped . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Swapping blades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Power management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Powering off a port blade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
Powering on a port blade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
Equipment status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Checking switch operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . .54
Verifying High Availability features (Backbones only) . . . . . . . . 54
Verifying fabric connectivity. . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
Verifying device connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

vi Fabric OS Administrator’s Guide
53-1002446-01
Track and control switch changes . . . . . . . . . . . . . . . . . . . . . . . . . . .55
Enabling the track changes feature . . . . . . . . . . . . . . . . . . . . . .56
Displaying the status of the track changes feature. . . . . . . . . .56
Viewing the switch status policy threshold values. . . . . . . . . . .56
Setting the switch status policy threshold values . . . . . . . . . . . 57
Audit log configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58
Verifying host syslog prior to configuring the audit log . . . . . . .59
Configuring an audit log for specific event classes . . . . . . . . . . 59
Configuring FLOGI-time handling of duplicate PWWN . . . . . . . . . . .60
Setting the behavior for handling duplicate PWWNs. . . . . . . . . 61
Chapter 4 Routing Traffic
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Routing overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63
Paths and route selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64
FSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64
Fibre Channel NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Inter-switch links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Buffer credits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Virtual channels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Gateway links. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Configuring a link through a gateway . . . . . . . . . . . . . . . . . . . . .69
Routing policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Displaying the current routing policy . . . . . . . . . . . . . . . . . . . . .70
Exchange-based routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Port-based routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
AP route policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Route selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Dynamic Load Sharing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73
Frame order delivery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Forcing in-order frame delivery across topology changes. . . . . 74
Restoring out-of-order frame delivery across topology changes74
Lossless Dynamic Load Sharing on ports . . . . . . . . . . . . . . . . . . . . . 75
Lossless core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Configuring Lossless Dynamic Load Sharing. . . . . . . . . . . . . . . 77
Lossless Dynamic Load Sharing in Virtual Fabrics . . . . . . . . . . 77
Enabling forward error correction . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Frame Redirection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78
Creating a frame redirect zone . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Deleting a frame redirect zone . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Viewing redirect zones. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Chapter 5 Managing User Accounts
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Fabric OS Administrator’s Guide vi i
53-1002446-01
User accounts overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Role-Based Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
The management channel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Managing user-defined roles . . . . . . . . . . . . . . . . . . . . . . . . . . .84
Local database user accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .85
Default accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Local account passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Local account database distribution . . . . . . . . . . . . . . . . . . . . . . . . .88
Distributing the local user database . . . . . . . . . . . . . . . . . . . . .88
Accepting distributed user databases on the local switch . . . .88
Rejecting distributed user databases on the local switch . . . .89
Password policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89
Password strength policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89
Password history policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Password expiration policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Account lockout policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
The boot PROM password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Setting the boot PROM password for a switch with a
recovery string . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .93
Setting the boot PROM password for a Backbone with a
recovery string . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Setting the boot PROM password for a switch without a
recovery string . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95
Setting the boot PROM password for a Backbone without a
recovery string . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96
The authentication model using RADIUS and LDAP . . . . . . . . . . . . . 97
Setting the switch authentication mode . . . . . . . . . . . . . . . . . . 99
Fabric OS user accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Fabric OS users on the RADIUS server. . . . . . . . . . . . . . . . . . .100
The RADIUS server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .103
LDAP configuration and Microsoft Active Directory . . . . . . . . .109
Authentication servers on the switch . . . . . . . . . . . . . . . . . . . .112
Configuring local authentication as backup. . . . . . . . . . . . . . .113
Chapter 6 Configuring Protocols
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Security protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Secure Copy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
Setting up SCP for configuration uploads and downloads . . .116
Secure Shell protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
SSH public key authentication . . . . . . . . . . . . . . . . . . . . . . . . . 117
Secure Sockets Layer protocol. . . . . . . . . . . . . . . . . . . . . . . . . . . . .120
Browser and Java support . . . . . . . . . . . . . . . . . . . . . . . . . . . . .120
SSL configuration overview . . . . . . . . . . . . . . . . . . . . . . . . . . . .120
Certificate authorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .121
The browser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .123
Root certificates for the Java Plug-in . . . . . . . . . . . . . . . . . . . .124

viii Fabric OS Administrator’s Guide
53-1002446-01
Simple Network Management Protocol . . . . . . . . . . . . . . . . . . . . . .125
SNMP and Virtual Fabrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . .126
The security level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .127
The snmpConfig command . . . . . . . . . . . . . . . . . . . . . . . . . . . .127
Telnet protocol. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .127
Blocking Telnet. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .127
Unblocking Telnet. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129
Listener applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129
Ports and applications used by switches . . . . . . . . . . . . . . . . . . . .129
Port configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130
Chapter 7 Configuring Security Policies
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131
ACL policies overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131
How the ACL policies are stored . . . . . . . . . . . . . . . . . . . . . . . .131
Policy members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .132
ACL policy management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .132
Displaying ACL policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133
Saving changes without activating the policies . . . . . . . . . . . .133
Activating policy changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133
Deleting an ACL policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133
Adding a member to an existing ACL policy . . . . . . . . . . . . . . .134
Removing a member from an ACL policy . . . . . . . . . . . . . . . . .134
Aborting unsaved policy changes . . . . . . . . . . . . . . . . . . . . . . .134
FCS policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .135
FCS policy restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .135
Ensuring fabric domains share policies . . . . . . . . . . . . . . . . . .136
Creating an FCS policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136
Modifying the order of FCS switches . . . . . . . . . . . . . . . . . . . .137
FCS policy distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137
DCC policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138
DCC policy restrictions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .139
Creating a DCC policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .139
Deleting a DCC policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .140
DCC policy behavior with Fabric-Assigned PWWNs . . . . . . . . . 141
SCC Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .142
Creating an SCC policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .143
Authentication policy for fabric elements . . . . . . . . . . . . . . . . . . . .143
E_Port authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .144
Device authentication policy . . . . . . . . . . . . . . . . . . . . . . . . . . .146
AUTH policy restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Authentication protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148
Secret key pairs for DH-CHAP . . . . . . . . . . . . . . . . . . . . . . . . . .149
FCAP configuration overview. . . . . . . . . . . . . . . . . . . . . . . . . . .150
Fabric-wide distribution of the Auth policy . . . . . . . . . . . . . . . .153

Fabric OS Administrator’s Guide ix
53-1002446-01
IP Filter policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .153
Creating an IP Filter policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . .153
Cloning an IP Filter policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154
Displaying an IP Filter policy . . . . . . . . . . . . . . . . . . . . . . . . . . .154
Saving an IP Filter policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154
Activating an IP Filter policy. . . . . . . . . . . . . . . . . . . . . . . . . . . .154
Deleting an IP Filter policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . .155
IP Filter policy rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .155
IP Filter policy enforcement. . . . . . . . . . . . . . . . . . . . . . . . . . . .158
Adding a rule to an IP Filter policy. . . . . . . . . . . . . . . . . . . . . . .159
Deleting a rule to an IP Filter policy . . . . . . . . . . . . . . . . . . . . .159
Aborting an IP Filter transaction . . . . . . . . . . . . . . . . . . . . . . . .159
IP Filter policy distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . .159
Managing filter thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . .160
Policy database distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .160
Database distribution settings . . . . . . . . . . . . . . . . . . . . . . . . .161
ACL policy distribution to other switches . . . . . . . . . . . . . . . . .162
Fabric-wide enforcement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .163
Notes on joining a switch to the fabric . . . . . . . . . . . . . . . . . . .164
Management interface security . . . . . . . . . . . . . . . . . . . . . . . . . . . .166
Configuration examples. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .167
IPsec protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .168
Security associations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .169
Authentication and encryption algorithms . . . . . . . . . . . . . . . .169
IPsec policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170
IKE policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170
Creating the tunnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172
Example of an End-to-end transport tunnel mode . . . . . . . . . 174
Chapter 8 Maintaining the Switch Configuration File
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Configuration settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Configuration file format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .178
Configuration file backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .180
Uploading a configuration file in interactive mode . . . . . . . . .181
Configuration file restoration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .181
Restrictions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .182
Configuration download without disabling a switch . . . . . . . .184
Configurations across a fabric . . . . . . . . . . . . . . . . . . . . . . . . . . . . .185
Downloading a configuration file from one switch to
another same model switch . . . . . . . . . . . . . . . . . . . . . . . . . . .186
Security considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .186
Configuration management for Virtual Fabrics. . . . . . . . . . . . . . . .186
Uploading a configuration file from a switch with
Virtual Fabrics enabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .186
Restoring logical switch configuration using configDownload 187
Restrictions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .188
Brocade configuration form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189

xFabric OS Administrator’s Guide
53-1002446-01
Chapter 9 Installing and Maintaining Firmware
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
Firmware download process overview . . . . . . . . . . . . . . . . . . . . . . .191
Upgrading and downgrading firmware . . . . . . . . . . . . . . . . . . .192
Considerations for FICON CUP environments . . . . . . . . . . . . .193
HA sync state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193
Preparing for a firmware download . . . . . . . . . . . . . . . . . . . . . . . . .194
Connected switches. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
Finding the switch firmware version . . . . . . . . . . . . . . . . . . . . .195
Obtain and decompress firmware . . . . . . . . . . . . . . . . . . . . . .195
Firmware download on switches . . . . . . . . . . . . . . . . . . . . . . . . . . .196
Switch firmware download process overview. . . . . . . . . . . . . .196
Firmware download on a Backbone. . . . . . . . . . . . . . . . . . . . . . . . .197
Backbone firmware download process overview. . . . . . . . . . .198
Firmware download from a USB device. . . . . . . . . . . . . . . . . . . . . .201
Enabling USB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .201
Viewing the USB file system . . . . . . . . . . . . . . . . . . . . . . . . . . .201
Downloading from USB using the relative path . . . . . . . . . . . .202
Downloading from USB using the absolute path . . . . . . . . . . .202
FIPS support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .202
Public and private key management . . . . . . . . . . . . . . . . . . . .202
The firmwareDownload command . . . . . . . . . . . . . . . . . . . . . .203
Power-on firmware checksum test . . . . . . . . . . . . . . . . . . . . . .204
Test and restore firmware on switches . . . . . . . . . . . . . . . . . . . . . .204
Testing a different firmware version on a switch . . . . . . . . . . .204
Test and restore firmware on Backbones . . . . . . . . . . . . . . . . . . . .206
Testing different firmware versions on Backbones . . . . . . . . .206
Validating a firmware download. . . . . . . . . . . . . . . . . . . . . . . . . . . .208
Chapter 10 Managing Virtual Fabrics
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .211
Virtual Fabrics overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .211
Logical switch overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .212
Default logical switch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .212
Logical switches and fabric IDs. . . . . . . . . . . . . . . . . . . . . . . . .213
Port assignment in logical switches . . . . . . . . . . . . . . . . . . . . .214
Logical switches and connected devices . . . . . . . . . . . . . . . . .215
Logical fabric overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .216
Logical fabric and ISLs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Base switch and extended ISLs . . . . . . . . . . . . . . . . . . . . . . . .218
Management model for logical switches. . . . . . . . . . . . . . . . . . . . .221
Account management and Virtual Fabrics . . . . . . . . . . . . . . . . . . .221