HP StorageWorks 2/16V Brocade Secure Fabric OS Administrator's Guide (53-10002 - Page 21

Fabric Management Policy Set

Get HP StorageWorks 2/16V - SAN Switch PDF manuals and user guides View all HP StorageWorks 2/16V manuals
Add to My Manuals
Save this manual to your list of manuals

Page 21 highlights

1 Because the primary FCS switch distributes the zoning configuration, zoning databases do not merge when new switches join the fabric. Instead, the zoning information on the new switches is overwritten when the primary FCS switch downloads zoning to these switches, if secure mode is enabled on all of them. For more information about zoning, see the Fabric OS Administrator's Guide. For more information about merging fabrics, see "Adding Switches and Merging Fabrics with Secure Mode Enabled" on page 4-13. The remaining switches listed in the FCS policy act as backup FCS switches. If the primary FCS switch becomes unavailable for any reason, the next switch in the list becomes the primary FCS switch. You should have at least one backup FCS switch, to reduce the possibility of having no primary FCS switch available. You can designate as many backup FCS switches as you like; however, all FCS switches should be physically secure. Any switches not listed in the FCS policy are defined as non-FCS switches. The root and factory accounts are disabled on non-FCS switches. For information about customizing the FCS policy, see "Enabling Secure Mode" on page 3-2. For information about configuration download restrictions while in secure mode, see "Enabling Secure Mode" on page 3-2. Fabric Management Policy Set Using Secure Fabric OS, you can create several types of policies to customize various aspects of the fabric. By default, only the FCS policy exists when secure mode is first enabled. Use the CLI or Fabric Manager to create and manage Secure Fabric OS policies. Note Fibre Channel routers, such as the Silkworm 7500, do not enforce security policies. Secure Fabric OS policies can be created, displayed, modified, and deleted. They can also be created and saved without being activated immediately, to allow future implementation. Saved policies are persistent, meaning that they are saved in flash memory and remain available after switch reboot or power cycle. The group of existing policies is referred to as the "fabric management policy set" or FMPS, which contains an active policy set and a defined policy set. The active policy set contains the policies that are activated and currently in effect. The defined policy set contains all the policies that have been defined, whether activated or not. Both policy sets are distributed to all switches in the fabric by the primary FCS switch. Secure Fabric OS recognizes each type of policy by a predetermined name. Secure Fabric OS Administrator's Guide 1-5 Publication Number 53-1000244-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
Secure Fabric OS Administrator’s Guide
1-5
Publication Number 53-1000244-01
1
Because the primary FCS switch distributes the zoning configuration, zoning databases do not merge
when new switches join the fabric. Instead, the zoning information on the new switches is overwritten
when the primary FCS switch downloads zoning to these switches, if secure mode is enabled on all of
them. For more information about zoning, see the
Fabric OS Administrator’s Guide
. For more
information about merging fabrics, see
“Adding Switches and Merging Fabrics with Secure Mode
Enabled”
on page 4-13.
The remaining switches listed in the FCS policy act as backup FCS switches. If the primary FCS switch
becomes unavailable for any reason, the next switch in the list becomes the primary FCS switch. You
should have at least one backup FCS switch, to reduce the possibility of having no primary FCS switch
available. You can designate as many backup FCS switches as you like; however, all FCS switches
should be physically secure.
Any switches not listed in the FCS policy are defined as non-FCS switches. The root and factory
accounts are disabled on non-FCS switches.
For information about customizing the FCS policy, see
“Enabling Secure Mode”
on page 3-2. For
information about configuration download restrictions while in secure mode, see
“Enabling Secure
Mode”
on page 3-2.
Fabric Management Policy Set
Using Secure Fabric OS, you can create several types of policies to customize various aspects of the
fabric. By default, only the FCS policy exists when secure mode is first enabled. Use the CLI or Fabric
Manager to create and manage Secure Fabric OS policies.
Secure Fabric OS policies can be created, displayed, modified, and deleted. They can also be created
and saved without being activated immediately, to allow future implementation. Saved policies are
persistent, meaning that they are saved in flash memory and remain available after switch reboot or
power cycle.
The group of existing policies is referred to as the “fabric management policy set” or FMPS, which
contains an
active
policy set and a
defined
policy set. The active policy set contains the policies that are
activated and currently in effect. The defined policy set contains all the policies that have been defined,
whether activated or not. Both policy sets are distributed to all switches in the fabric by the primary FCS
switch. Secure Fabric OS recognizes each type of policy by a predetermined name.
Note
Fibre Channel routers, such as the Silkworm 7500, do not enforce security policies.