HP StorageWorks 8/80 HP StorageWorks Fabric OS 6.1.x administrator guide (5697 - Page 112
DCC policy restrictions, Creating a DCC policy
View all HP StorageWorks 8/80 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 112 highlights
Table 28 DCC policy states (continued) Policy state Characteristics Policy with no entries Policy with entries Any device can connect to any switch port in the fabric. An empty policy is the same as no policy. If a device WWN is specified in a DCC policy, that device is only allowed access to the switch if connected by a switch port listed in the same policy. If a switch port is specified in a DCC policy, it only permits connections from devices that are listed in the policy. Devices with WWNs that are not specified in a DCC policy are allowed to connect to the switch at any switch ports that are not specified in a DCC policy. Switch ports and device WWNs may exist in multiple DCC policies. Proxy devices are always granted full access and can connect to any switch port in the fabric. DCC policy restrictions The following restrictions apply when using DCC policies: • Some older private-loop HBAs do not respond to port login from the switch and are not enforced by the DCC policy. This does not create a security problem because these HBAs cannot contact any device outside of their immediate loop. • DCC policies cannot manage or restrict iSCSI connections, that is, an FC Initiator connection from an iSCSI gateway. • You cannot manage proxy devices with DCC policies. Proxy devices are always granted full access, even if the DCC policy has an entry that restricts or limits access of a proxy device. Creating a DCC policy DCC policies must follow the naming convention "DCC_POLICY_nnn," where nnn represents a unique string. The maximum length is 30 characters, including the prefix DCC_POLICY_. To save memory and improve performance, one DCC policy per switch or group of switches is recommended. Device ports must be specified by port WWN. Switch ports can be identified by the switch WWN, Domain ID, or switch name followed by the port or area number. To specify an allowed connection, enter the device port WWN, a semicolon, and the switch port identification. The following methods of specifying an allowed connection are possible: • deviceportWWN;switchWWN (port or area number) • deviceportWWN;domainID (port or area number) • deviceportWWN;switchname (port or area number) To create a DCC policy: 1. Connect to the switch and log in using an account assigned to the admin role. 2. Type secPolicyCreate "DCC_POLICY_nnn", "member;...;member". DCC_POLICY_nnn is the name of the DCC policy; nnn is a string consisting of up to 19 alphanumeric or underscore characters to differentiate it from any other DCC policies. The member contains device or switch port information: deviceportWWN;switch(port) where: 112 Configuring advanced security features