HP StorageWorks 2/16V Brocade Secure Fabric OS Administrator's Guide (53-10002 - Page 67

API Policy, To create an API policy

Get HP StorageWorks 2/16V - SAN Switch PDF manuals and user guides View all HP StorageWorks 2/16V manuals
Add to My Manuals
Save this manual to your list of manuals

Page 67 highlights

3 API Policy The API policy can be used to specify which workstations can use API to access the fabric and which ones can write to the primary FCS switch. The policy is named API_POLICY and contains a list of the IP addresses that are allowed to establish an API connection to switches in the fabric. Table 3-6 displays the possible API policy states. Table 3-6 API Policy States Policy State Characteristics No policy All workstations can establish an API connection to any switch in the fabric. Policy with no entries No host can establish an API connection to any switch in the fabric. Policy with entries Only specified hosts can establish an API connection to any switch in the fabric, and write operations can only be performed on the primary FCS switch. To create an API policy 1. From a sectelnet or SSH session, log in to the primary FCS switch as admin. 2. Type secPolicyCreate "API_POLICY", "member;...;member". member is one or more IP addresses in dot-decimal notation. "0" can be entered in an octet to indicate that any number can be matched in that octet. 3. To save or activate the new policy, enter either the secPolicySave or the secPolicyActivate command. If neither of these commands is entered, the changes are lost when the session is logged out. For more information about these commands, see "Saving Changes to Secure Fabric OS Policies" on page 3-26 and "Activating Changes to Secure Fabric OS Policies" on page 3-27. For example, to create an API policy to allow anyone on the network with an IP address of 192.168.5.0 (where "0" can be any number) to establish an API connection to any switch in the fabric: primaryfcs:admin> secpolicycreate "API_POLICY", "192.168.5.0" API_POLICY has been created. SES Policy The SES policy can be used to restrict which devices can be managed by SES commands. The policy is named SES_POLICY and contains a list of device port WWNs that are allowed to access SES and from which SES commands are accepted and acted upon. If secure mode is enabled, the SES client must be directly attached to the primary FCS switch. Then the SES client can be used to manage all the switches in the fabric through the SES product for SilkWorm switches. Refer to the SES User's Guide for more information. The current SES implementation does not support the SES commands Read Buffer or Write Buffer for remote switches. To direct these commands to a switch that is not the primary FCS switch, designate that switch as the primary FCS switch and attach the SES client directly to it. Secure Fabric OS Administrator's Guide Publication Number: 53-1000244-01 3-17

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
Secure Fabric OS Administrator’s Guide
3-17
Publication Number: 53-1000244-01
3
API Policy
The API policy can be used to specify which workstations can use API to access the fabric and which
ones can write to the primary FCS switch.
The policy is named API_POLICY and contains a list of the IP addresses that are allowed to establish
an API connection to switches in the fabric.
Table 3-6
displays the possible API policy states.
To create an API policy
1.
From a sectelnet or SSH session, log in to the
primary FCS switch as admin.
2.
Type
secPolicyCreate “API_POLICY”, “
member
;
...
;
member
”
.
member
is one or more IP addresses in dot-decimal notation. “0” can be entered in an octet to
indicate that any number can be matched in that octet.
3.
To save or activate the new policy, enter either the
secPolicySave
or the
secPolicyActivate
command.
If neither of these commands is entered, the changes are lost when the session is logged out. For
more information about these commands, see
“Saving Changes to Secure Fabric OS Policies”
on
page 3-26 and
“Activating Changes to Secure Fabric OS Policies”
on page 3-27.
For example, to create an API policy to allow anyone on the network with an IP address of
192.168.5.0 (where “0” can be any number) to establish an API connection to any switch in the
fabric:
SES Policy
The SES policy can be used to restrict which devices can be managed by SES commands. The policy is
named SES_POLICY and contains a list of device port WWNs that are allowed to access SES and from
which SES commands are accepted and acted upon.
If secure mode is enabled, the SES client must be directly attached to the primary FCS switch. Then the
SES client can be used to manage all the switches in the fabric through the SES product for SilkWorm
switches. Refer to the
SES User’s Guide
for more information.
The current SES implementation does not support the SES commands
Read Buffer
or
Write Buffer
for
remote switches. To direct these commands to a switch that is not the primary FCS switch, designate
that switch as the primary FCS switch and attach the SES client directly to it.
Table 3-6
API Policy States
Policy State
Characteristics
No policy
All workstations can establish an API connection to any switch in the
fabric.
Policy with no entries
No host can establish an API connection to any switch in the fabric.
Policy with entries
Only specified hosts can establish an API connection to any switch in
the fabric, and write operations can only be performed on the primary
FCS switch.
primaryfcs:admin>
secpolicycreate "API_POLICY", "192.168.5.0"
API_POLICY has been created.