HP StorageWorks 2/24 FW 07.00.00/HAFM SW 08.06.00 McDATA Products in a SAN Env - Page 151

McDATA Fabric 1.0, Open Fabric 1.0, fabric, Role-Based Flexpars

Page 151 highlights

Implementing SAN Internetworking Solutions 4 Role-Based Flexpars Zone FlexPars implement an RSCN zone isolation feature that prevents fabric-format RSCNs from propagating to devices in zones not impacted by the RSCN. With zone FlexPars enabled, zoning change RSCNs are handled like device availability change RSCNs. Because the feature is device centric, zone FlexPars work in loop environments and with node port ID virtualization (NPIV) enabled. In addition, the feature operates when the director or switch Interop Mode is set to McDATA Fabric 1.0 or Open Fabric 1.0. Zone FlexPars are enabled or disabled on a per-switch basis through the CLI by setting the zoneFlexParstate parameter to fabric (enabled) or none (disabled). When installing a new director or switch with E/OS 7.0 (or upgrading an existing fabric element to E/OS 7.0 or E/OSn 6.0), the feature is enabled by default and operates on a fabric-wide basis. As Fibre Channel fabrics grow in size and complexity, the potential for fabric configuration problems caused by human error increases significantly. Implementation of role-based access control (RBAC) through role-based FlexPars (available for McDATA products by mid-2005) can control and mitigate these problems. Through a SAN management application, users are grouped into roles, and roles are assigned a set of responsibility-based privileges. These privileges include access to specific devices and commands. In addition, roles can own subsets of a fabric. This concept is useful when a fabric includes several applications, each managed by a different administrator. If a user is assigned administrator (role) duties for a set of switches and devices, other administrators cannot configure the user's switch and device subset. Role-based FlexPars ensure accountability for each application, fabric, or network; prevent errors from propagating across applications; and prevent unauthorized users from damaging or shutting down a fabric. Role-based FlexPars can be configured to warn users in addition to preventing actions. Thus if one person administers an entire fabric, roles ensure the administrator is reminded of the cross-application adverse impact that a configuration action may cause. Implementing SAN Internetworking Solutions 4-7

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
  • 286
  • 287
  • 288
  • 289
  • 290
  • 291
  • 292
  • 293
  • 294
  • 295
  • 296
  • 297
  • 298
  • 299
  • 300
  • 301
  • 302
  • 303
  • 304
  • 305
  • 306
  • 307
  • 308
  • 309
  • 310
  • 311
  • 312
  • 313
  • 314
  • 315
  • 316
  • 317
  • 318
  • 319
  • 320
  • 321
  • 322

4
Implementing SAN Internetworking Solutions
4-7
Implementing SAN Internetworking Solutions
Zone FlexPars implement an RSCN zone isolation feature that
prevents fabric-format RSCNs from propagating to devices in zones
not impacted by the RSCN. With zone FlexPars enabled, zoning
change RSCNs are handled like device availability change RSCNs.
Because the feature is device centric, zone FlexPars work in loop
environments and with node port ID virtualization (NPIV) enabled.
In addition, the feature operates when the director or switch
Interop
Mode
is set to
McDATA Fabric 1.0
or
Open Fabric 1.0
.
Zone FlexPars are enabled or disabled on a per-switch basis through
the CLI by setting the
zoneFlexParstate
parameter to
fabric
(enabled)
or
none
(disabled). When installing a new director or switch with
E/OS 7.0 (or upgrading an existing fabric element to E/OS 7.0 or
E/OSn 6.0), the feature is enabled by default and operates on a
fabric-wide basis.
Role-Based Flexpars
As Fibre Channel fabrics grow in size and complexity, the potential
for fabric configuration problems caused by human error increases
significantly. Implementation of role-based access control (RBAC)
through role-based FlexPars (available for McDATA products by
mid-2005) can control and mitigate these problems.
Through a SAN management application, users are grouped into
roles, and roles are assigned a set of responsibility-based privileges.
These privileges include access to specific devices and commands. In
addition, roles can own subsets of a fabric. This concept is useful
when a fabric includes several applications, each managed by a
different administrator.
If a user is assigned administrator (role) duties for a set of switches
and devices, other administrators cannot configure the user’s switch
and device subset. Role-based FlexPars ensure accountability for each
application, fabric, or network; prevent errors from propagating
across applications; and prevent unauthorized users from damaging
or shutting down a fabric.
Role-based FlexPars can be configured to warn users in addition to
preventing actions. Thus if one person administers an entire fabric,
roles ensure the administrator is reminded of the cross-application
adverse impact that a configuration action may cause.