HP StorageWorks 1606 Brocade Fabric OS Troubleshooting and Diagnostics Guide v - Page 65

Protocol and certificate management issues, Gathering additional information

Get HP StorageWorks 1606 - Extension SAN Switch PDF manuals and user guides View all HP StorageWorks 1606 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 65 highlights

Protocol and certificate management issues 6 Symptom Switch is unable to form an F_Port. Probable cause and recommended action Regardless of the device authentication policy mode on the switch, the F_Port is disabled if the DH-CHAP protocol fails to authenticate. If the HBA sets the FC-SP bit during FLOGI and the switch sends a FLOGI accept with FC-SP bit set, then the switch expects the HBA to start the AUTH_NEGOTIATE. From this point on until the AUTH_NEGOTIATE is completed, all ELS and CT frames, except the AUTH_NEGOTIATE ELS frame, are blocked by the switch. During this time, the Fibre Channel driver rejects all other ELS frames. The F_Port will not form until the AUTH_NEGOTIATE is completed. It is the HBA's responsibility to send an Authentication Negotiation ELS frame after receiving the FLOGI accept frame with the FC-SP bit set. Protocol and certificate management issues This section provides information and procedures for troubleshooting standard Fabric OS security features such as protocol and certificate management. NOTE Secure Fabric OS is not supported in Fabric OS v6.2.0. Symptom Troubleshooting certificates Probable cause and recommended action If you receive messages in the browser or in a pop-up window when logging in to the target switch using HTTPS, refer to Table 11 for recommended actions you can take to correct the problem. TABLE 11 SSL messages and actions Message Action The page cannot be displayed The SSL certificate is not installed correctly or HTTPS is not enabled correctly. Make sure that the certificate has not expired, that HTTPS is enabled, and that certificate file names are configured correctly. The security certificate was issued by a company you have not chosen to trust. The certificate is not installed in the browser. Install it as described in the Fabric OS Administrator's Guide. The security certificate has expired or is not yet valid Either the certificate file is corrupted or it needs to be updated. Click View Certificate to verify the certificate content. If it is corrupted or out of date, obtain and install a new certificate. The name on the security certificate is invalid The certificate is not installed correctly in the Java Plug-in. Install or does not match the name of the site file it as described in the Fabric OS Administrator's Guide. This page contains both secure and nonsecure Click No in this pop-up window. The session opens with a closed items. Do you want to display the nonsecure lock icon on the lower-right corner of the browser, indicating an items? encrypted connection. Gathering additional information For security-related issues, use the following guidelines to gather additional data for your switch support provider. • Perform a supportSave -n command. Fabric OS Troubleshoot and Diagnostics Guide 51 53-1001340-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
Fabric OS Troubleshoot and Diagnostics Guide
51
53-1001340-01
Protocol and certificate management issues
6
Symptom
Switch is unable to form an F_Port.
Probable cause and recommended action
Regardless of the device authentication policy mode on the switch, the F_Port is disabled if the
DH-CHAP protocol fails to authenticate. If the HBA sets the FC-SP bit during FLOGI and the switch
sends a FLOGI accept with FC-SP bit set, then the switch expects the HBA to start the
AUTH_NEGOTIATE. From this point on until the AUTH_NEGOTIATE is completed, all ELS and CT
frames, except the AUTH_NEGOTIATE ELS frame, are blocked by the switch. During this time, the
Fibre Channel driver rejects all other ELS frames. The F_Port will not form until the
AUTH_NEGOTIATE is completed. It is the HBA's responsibility to send an Authentication Negotiation
ELS frame after receiving the FLOGI accept frame with the FC-SP bit set.
Protocol and certificate management issues
This section provides information and procedures for troubleshooting standard Fabric OS security
features such as protocol and certificate management.
NOTE
Secure Fabric OS is not supported in Fabric OS v6.2.0.
Symptom
Troubleshooting certificates
Probable cause and recommended action
If you receive messages in the browser or in a pop-up window when logging in to the target switch
using HTTPS, refer to
Table 11
for recommended actions you can take to correct the problem.
Gathering additional information
For security-related issues, use the following guidelines to gather additional data for your switch
support provider.
•
Perform a
supportSave -n
command.
TABLE 11
SSL messages and actions
Message
Action
The page cannot be displayed
The SSL certificate is not installed correctly or HTTPS is not
enabled correctly. Make sure that the certificate has not expired,
that HTTPS is enabled, and that certificate file names are
configured correctly.
The security certificate was issued by a
company you have not chosen to trust.
The certificate is not installed in the browser. Install it as
described in the
Fabric OS Administrator’s Guide
.
The security certificate has expired or is not
yet valid
Either the certificate file is corrupted or it needs to be updated.
Click
View Certificate
to verify the certificate content. If it is
corrupted or out of date, obtain and install a new certificate.
The name on the security certificate is invalid
or does not match the name of the site file
The certificate is not installed correctly in the Java Plug-in. Install
it as described in the
Fabric OS Administrator’s Guide
.
This page contains both secure and nonsecure
items. Do you want to display the nonsecure
items?
Click
No
in this pop-up window. The session opens with a closed
lock icon on the lower-right corner of the browser, indicating an
encrypted connection.