HP StorageWorks 2/16V Brocade Secure Fabric OS Administrator's Guide (53-10002 - Page 96

4-16

Secure Fabric OS Administrator’s Guide

Publication Number: 53-1000244-01

4

7.

Install a supported CLI client on the computer workstations that you will be using to manage the

merged fabric.

Supported CLI clients include sectelnet and SSH and are discussed in

“Installing a Supported CLI

Client on a Workstation”

on page 2-28.

8.

Enable secure mode on all switches to be merged by entering the

secModeEnable

command on the

primary FCS switches of any fabrics that do not already have secure mode enabled.

For more information about enabling secure mode, refer to

“Enabling Secure Mode”

on page 3-2.

9.

Determine which switches you want to designate as primary FCS switch and backup FCS switches

for the merged fabric; then, modify the FCS policy for

each

fabric to list these switches as the

primary FCS switch and backup FCS switches.

Ensure that all the FCS policies are an

exact

match; they must list the same switches, with the

switches identified in the same manner and listed in the same order.

If a fabric has become segmented with secure mode enabled but no FCS switches available, enter

the

secModeEnable

command and modify the FCS policy to specify FCS switches. This is the

only instance in which this

command can be entered when secure mode is already enabled.

10.

Modify the SCC policy on the final primary FCS switch (the one that will succeed as the primary

FCS switch in the final merged fabric) to include all switches that are being merged.

11.

Ensure that the final primary FCS switch has the desired Secure Fabric OS policy set, zoning

configuration, password information, MUA information, and SNMP community strings.

The primary FCS switch distributes this information fabric-wide.

For information about managing zoning configurations, refer to the

Fabric OS Administrator’s

Guide

.

12.

Verify that the fabric that contains the final primary FCS switch has a nonzero version stamp by

logging into the fabric and entering the

secModeShow

command.

If this fabric does not show a nonzero version stamp, modify a policy and enter either the

secPolicySave

or

secPolicyActivate

command to create a nonzero version stamp. Set the version

stamp of the other fabrics to 0 by logging in to each fabric and entering the

secVersionReset

command.

13.

If fabrics are to be rejoined after a segmentation, enter the

switchDisable

and

switchEnable

commands on each switch that was segmented from the primary FCS switch. For each ISL

connected to the segmented switch, enter the

portDisable

and

portEnable

commands on both ISL

ports.

14.

Physically connect the fabrics. The fabrics automatically merge and the Secure Fabric OS

configuration associated with the primary FCS switch that has the nonzero version stamp is kept.

Section	Page
About This Document	5
Chapter 1 Introducing Secure Fabric OS	5
Chapter 2 Preparing the Fabric for Secure Fabric OS	5
Chapter 3 Enabling Secure Fabric OS and Creating Policies	6
Chapter 4 Managing Secure Fabric OS	7
Appendix A Removing Secure Fabric OS Capability	7
Appendix B Secure Fabric OS Commands and Secure Mode Restrictions	7
Index	7
About This Document	9
How This Document Is Organized	9
Supported Hardware and Software	10
What’s New in This Document	10
Document Conventions	11
Text Formatting	11
Notes, Cautions, and Warnings	11
Key Terms	12
Additional Information	12
Brocade Resources	12
Other Industry Resources	14
Getting Technical Help	15
Document Feedback	16
Introducing Secure Fabric OS	17
Management Channel Security	18
Switch-to-Switch Authentication	19
Using PKI	19
Using DH-CHAP	20
Fabric Configuration Server Switches	20
Fabric Management Policy Set	21
Preparing the Fabric for Secure Fabric OS	23
Prerequisites for a Secure Fabric Environment	23
Verifying Compatible Fabric OS Version	24
Verifying or Activating Secure Fabric OS and Advanced Zoning Licenses	25
Verifying the Digital Certificate	26
Displaying the Digital Certificate Status	26
Creating PKI Objects	27
Removing PKI Objects	28
Obtaining the Digital Certificate File	29
Configuring Switch-to-Switch Authentication	44
Selecting Authentication Protocols	45
Managing Shared Secrets	46
Preparing SilkWorm 24000 for Secure Fabric OS	48
Installing a Supported CLI Client on a Workstation	50
Enabling Secure Fabric OS and Creating Policies	51
Prerequisites to Enabling Secure Mode	51
Default Fabric and Switch Accessibility	52
Enabling Secure Mode	52
Modifying the FCS Policy	58
Changing the Position of a Switch Within the FCS Policy	59
Failing Over the Primary FCS Switch	60
Creating Secure Fabric OS Policies Other Than the FCS Policy	61
Creating a MAC Policy	62
Creating an Options Policy	70
Creating a DCC Policy	71
Creating an SCC Policy	74
Managing Secure Fabric OS Policies	75
Saving Changes to Secure Fabric OS Policies	76
Activating Changes to Secure Fabric OS Policies	77
Adding a Member to an Existing Policy	77
Removing a Member from a Policy	78
Deleting a Policy	78
Aborting All Uncommitted Changes	79
Aborting a Secure Fabric OS Transaction	79
Managing Secure Fabric OS	81
Viewing Secure Fabric OS Information	81
Displaying General Secure Fabric OS Information	82
Viewing the Secure Fabric OS Policy Database	82
Displaying Individual Secure Fabric OS Policies	83
Displaying Status of Secure Mode	84
Displaying and Resetting Secure Fabric OS Statistics	85
Displaying Secure Fabric OS Statistics	86
Resetting Secure Fabric OS Statistics	87
Managing Passwords	88
Modifying Passwords in Secure Mode	90
Using Temporary Passwords	91
Resetting the Version Number and Time Stamp	92
Adding Switches and Merging Fabrics with Secure Mode Enabled	93
Preventing a LUN Connection	97
Troubleshooting	97
Removing Secure Fabric OS Capability	103
Preparing the Fabric for Removal of Secure Fabric OS Policies	103
Disabling Secure Mode	104
Deactivating the Secure Fabric OS License on Each Switch	105
Uninstalling Related Items from the Host	105
Secure Fabric OS Commands and Secure Mode Restrictions	107
Secure Fabric OS Commands	107
Command Restrictions in Secure Mode	112
Zoning Commands	112
Miscellaneous Commands	113
Index	115
A	115
C	115
D	116
E	116
F	116
H	116
I	116
J	116
L	116
M	116
N	116
O	117
P	117
R	117
S	117
T	118
U	118
V	118
W	118

HP StorageWorks 2/16V Brocade Secure Fabric OS Administrator's Guide (53-10002 - Page 96

Installing a Supported CLI, Client on a Workstation, Enabling Secure Mode, secModeEnable, secModeShow

Page 96 highlights