Home » HP Manuals » Servers » HP Brocade BladeSystem 4/12 » Manual Viewer

HP Brocade BladeSystem 4/12 HP StorageWorks Fabric OS 5.2.x Administrator Guid - Page 91

Port Configuration, Table 21 Port information, Configuring for the SSL protocol, Common use, Comment

View all HP Brocade BladeSystem 4/12 manuals

Add to My Manuals
Save this manual to your list of manuals

Page 91 highlights

Port Configuration lists the ports used. This table provides the information to make it clearer when configuring the switch, taking into consideration firewalls and other devices that may sit between switches in the fabric or between the managers and the switch. Table 21 Port information Port Type Common use Comment 22 TCP SSH 23 TCP Telnet Use the configure command to disable the telnet service. 123 TCP NTP 80 TCP HTTP Use the configure command to disable the port. 111 TCP sunrpc This port is used by Platform API. Use the configure command to enable or disable daemons. 161 UDP SNMP Disable the SNMP service on the remote host if you do not use it, or filter incoming UDP packets going to this port. 443 TCP HTTP Supported service (Web Tools). Disable this port using the configure command. 512 TCP exec 513 TCP login 514 TCP shell 897 TCP This port is used by the Platform API. Disable this port using the configure command. Configuring for the SSL protocol Fabric OS v4.4.0 and later supports Secure Sockets Layer (SSL) protocol, which provides secure access to a fabric through Web-based management tools like Web Tools. SSL support is a standard Fabric OS feature; it is independent of Secure Fabric OS, which requires a license and separate certification. Switches configured for SSL grant access to management tools through hypertext transfer protocol-secure links (which begin with https://) instead of standard links (which begin with http://). SSL uses Public Key Infrastructure (PKI) encryption to protect data transferred over SSL connections. PKI is based on digital certificates obtained from an Internet Certificate Authority (CA), which acts as the trusted key agent. Certificates are based on the switch IP address or Fully Qualified Domain Name (FQDN), depending on the issuing CA. If you change a switch IP address or FQDN after activating an associated certificate, you might have to obtain and install a new certificate. Check with the CA to verify this possibility, and plan these types of changes accordingly. Fabric OS 5.2.x administrator guide 91

Section	Page
Contents	3
Supported HP StorageWorks hardware	17
Table 1 Switch model naming matrix	17
Intended audience	18
Related documentation	18
Glossary of terms	18
Document conventions and symbols	18
Table 2 Document conventions	18
HP technical support	19
HP-authorized reseller	19
Helpful web sites	19
Introducing Fabric OS CLI procedures	21
About procedural differences	21
Scope and references	21
About the CLI	22
Help information	23
Displaying command Help	23
Displaying additional Help topics	23
Table 3 Help file commands	23
Performing basic configuration tasks	25
Connecting to the CLI	25
Using telnet or SSH session	25
How to connect via telnet	25
Using a console session on the serial port	26
How to connect via the serial port	26
Setting the default account passwords	26
Table 4 Default administrative account names and passwords	27
Changing default passwords summary	27
How to change default passwords at login	28
Configuring the Ethernet interface	28
How to display network interface settings	29
Static Ethernet addressing summary	29
How to set static addresses for the Ethernet network interface	29
Configuring DHCP	30
DHCP summary	30
How to enable DHCP	30
How to disable DHCP	30
Setting the date and time	31
Setting time zones	31
How to set the time zone	32
How to set the time zone interactively	33
Synchronizing local time	34
How to synchronize local time with an external source	34
Maintaining licensed software features	35
How to generate or activate a license key	36
Figure 1 HP StorageWorks license key screen	36
How to remove a licensed feature	37
Customizing a switch name	38
How to customize the switch name	38
Customizing the chassis name	39
How to change the chassis name	39
Working with domain IDs	39
How to display domain IDs	40
How to set the domain ID	40
Ports on Demand license summary for applicable switches	41
Table 5 Ports enabled with Ports on Demand licenses	41
Activating Ports on Demand	41
Configuring Dynamic Ports on Demand	42
How Dynamic Ports are assigned to licenses	42
Displaying the Port license assignment	43
Activating Dynamic Ports on Demand	43
To enable Dynamic Ports on Demand	43
Disabling Dynamic Ports on Demand	44
To disable Dynamic Ports on Demand:	44
Managing licenses	45
Reserving a license	45
Releasing a port	46
Disabling and enabling a switch	47
How to disable a switch	47
How to enable a switch	47
Disabling and enabling a port	47
How to disable a port	47
How to enable a port	47
Making basic connections	48
Connecting to devices	48
Connecting to other switches	48
Linking through a gateway	48
How to configure a link through a gateway	49
Checking status	49
How to verify switch operation	49
How to verify high-availability features	50
How to verify fabric connectivity	50
How to show switches in Access Gateway mode	50
How to verify device connectivity	50
Tracking and controlling switch changes	51
How to enable the track changes feature	51
How to display the status of the track changes feature	52
How to view the switch status policy threshold values	52
How to set the switch status policy threshold values	53
Configuring the audit log	54
Auditable Event Classes	54
Table 6 AuditCfg Event Class Operands	55
How to verify host syslog prior to configuring the audit log	55
How to configure an audit log for specific event classes	56
Shutting down switches and Directors	56
To power off a Director gracefully (Prior to 5.1.0)	56
To power off a switch gracefully (5.1.0 and later)	57
High availability of daemon processes	57
Table 7 List of daemons that are automatically restarted	57
Managing user accounts	59
Overview	59
Accessing the management channel	59
Table 8 Maximum number of simultaneous sessions	59
Using role-based access control (RBAC)	59
Table 9 Fabric OS 5.2.x roles	59
Role Permissions	60
Table 10 Permission types	60
Table 11 RBAC permissions matrix	60
Configuring the authentication model	62
Table 12 Authentication configuration options	62
How to set the switch authentication model	62
Managing the local database user accounts	62
About the default accounts	63
Table 13 Default Local User Accounts	63
Defining local user accounts	63
How to display account information	63
How to create an account	64
How to delete an account	64
How to change account parameters	65
How to add an administrative domain to the account	65
How to remove an administrative domain from the account	65
Recovering accounts	66
How to recover an account	66
Changing local account passwords	66
How to change the password for the current login account	66
How to change the password for a different account	67
Configuring the local user database	67
Distributing the local user database	67
How to distribute the local user database	67
Protecting the local user database from distributions	67
How to accept the user database	68
How to reject distributed user databases	68
Configuring password policies	68
How to set the password strength policy	68
How to set the password history policy	69
How to set the password expiration policy	69
Upgrade and downgrade considerations	70
How to set the account lockout policy	70
Managing Fabric OS users on the RADIUS server	70
Switch to RADIUS server interaction	70
Creating Fabric OS user accounts	71
Table 14 Syntax for VSA-based account roles	71
Windows 2000 IAS	72
Linux FreeRadius server	72
Table 15 dictionary.brocade file entries	72
RADIUS configuration and admin domains	73
Setting up RADIUS AAA service	73
Configuring the RADIUS server	74
Linux	75
How to add the Brocade attribute to the server	75
How to create the user	75
How to enable clients	76
Windows 2000	76
How to enable CHAP	76
How to configure RADIUS users	77
How to configure the RADIUS server	77
Configuring RADIUS servers on the switch	78
How to display the current RADIUS configuration	79
How to add a RADIUS server to the switch configuration	79
How to enable and disable a RADIUS server	80
How to delete a RADIUS server from the configuration	80
How to change a RADIUS server configuration	80
How to change the order in which RADIUS servers are contacted for service	80
Enabling and disabling local authentication as backup	81
Setting the boot PROM password	81
SSSetting the boot PROM password with a recovery String	81
4/8 and 4/16 SAN Switch, SAN Switch 2/8V, SAN Switch 2/16V, SAN Switch 2/32, SAN Switch 4/32, 4/32B SAN Switch, 4/64 SAN Switch, and 400 MP Router	81
How to set the boot PROM password for a switch with a recovery string	81
SAN Director 2/128 and 4/256 SAN Director	82
How to set the boot PROM password for a Director with a recovery string	82
How to set the boot PROM password for a Director without a recovery string	83
4/8 and 4/16 SAN Switch, SAN Switch 2/8V, SAN Switch 2/16V, SAN Switch 2/32, SAN Switch 4/32, 4/32B SAN Switch, 4/64 SAN Switch, and 400 MP Router	83
How to set the boot PROM password for a switch without a recovery string	83
How to set the boot PROM password for a Director without a recovery string	84
Recovering user, admin, and factory passwords	85
How to recover passwords	85
Configuring standard security features	87
Secure protocols	87
Table 16 Secure protocol support	87
Table 17 Items needed to deploy secure protocols	87
Table 18 Main security scenarios	88
Ensuring network security	88
Configuring the telnet interface	89
How to disable telnet	89
How to enable telnet	89
Blocking listeners	90
Table 19 Blocked Listener Applications	90
Accessing switches and fabrics	90
Table 20 Access defaults	90
Port Configuration	91
Table 21 Port information	91
Configuring for the SSL protocol	91
Browser and Java support	92
Summary of SSL procedures	92
Table 22 SSL Certificate Files	92
Choosing a certificate authority	92
Generating a public/private key	93
Generating and storing a CSR	93
Obtaining certificates	94
Installing a switch certificate	94
Activating a switch certificate	95
Configuring the browser	95
To check and install root certificates on Internet Explorer	95
To check and install root certificates on Mozilla	95
Installing a root certificate to the Java Plug-in	96
Displaying and deleting certificates	96
Table 23 Commands for Displaying and Deleting SSL Certificates	96
Troubleshooting certificates	97
Table 24 SSL Messages and Actions	97
Configuring SNMP	97
Setting the security level	98
Using the snmpConfig command	98
Using legacy commands for SNMPv1	101
Configuring secure file copy	105
Configuring advanced security	107
About Access Control List (ACL) policies	107
How the ACL policies are stored	107
Identifying policy members	107
Table 25 Valid methods for specifying policy members	107
Configuring ACL policies	108
Displaying ACL policies	109
Configuring a DCC policy	109
Table 26 DCC policy states	109
DCC policy restrictions	110
Creating a DCC policy	110
Examples of creating DCC policies	111
Creating an SCC policy	111
Table 27 SCC policy states	112
Saving changes to ACL policies	112
Activating changes to ACL policies	112
Adding a member to an existing policy	113
Removing a member from a policy	113
Deleting a policy	113
Aborting all uncommitted changes	114
Distributing the policy database	114
Table 28 Interaction between fabric-wide consistency policy and distribution settings	114
Configuring the database distribution settings	115
Table 29 Supported Databases Starting in Fabric OS 5.2.x	115
Distributing ACL policies to other switches	116
Table 30 ACL policy database distribution behavior	116
Setting the consistency policy fabric-wide	117
Table 31 Fabric-wide consistency policy settings	117
Notes on joining a switch to the fabric	118
Matching fabric-wide consistency policies	119
Table 32 Merging fabrics with matching fabric-wide consistency policies	119
Non-matching fabric-wide consistency policies	120
Table 33 Examples of strict fabric merges	120
Table 34 Fabric merges with tolerant/absent combinations	120
Maintaining configurations	121
Displaying configuration settings	121
Backing up a configuration	121
Troubleshooting configuration upload	123
Restoring switch information	123
Table 35 CLI Commands to display switch configuration information	123
Restoring a configuration	123
Configuration download without disabling a switch	124
Security considerations	125
Troubleshooting configuration download	125
Messages captured in the logs	125
Restoring configurations in a FICON environment	126
Table 36 Backup and restore in a FICON CUP environment	126
Downloading configurations across a fabric	126
4/256 SAN Director configuration form	127
Table 37 Configuration and connection	127
Table 38 FC port configuration setting	128
Table 39 FC port configuration setting	129
Managing administrative domains	131
About administrative domains	131
Figure 2 Fabric with two admin domains	132
Figure 3 Filtered fabric views	132
Admin domain features	132
Requirements for admin domains	133
User-defined Administrative domains	133
System-defined administrative domains	134
AD0	134
AD255	134
Figure 4 Fabric with AD0 and AD255	135
Admin domain access levels	135
Table 40 AD user types	135
Admin domains and login	136
Admin domain member types	136
Device members	136
Switch port members	137
Switch members	137
Admin Domains and switch WWN	137
Figure 5 Fabric showing switch and device WWNs	138
Figure 6 Filtered fabric views showing converted switch WWNs	138
Admin domain compatibility and availability	139
Admin domains and merging	139
Compatibility	139
Figure 7 Isolated subfabrics	139
Firmware upgrade and downgrade scenarios	139
Managing admin domains	140
Understanding the AD transaction model	140
Implementing admin domains	141
Creating an admin domain	141
Assigning a user to an admin domain	142
Activating and deactivating admin domains	143
Adding and removing admin domain members	144
Renaming an Admin Domain	145
Deleting an Admin Domain	145
Deleting all user-defined Admin Domains	146
Validating an Admin Domain member list	146
Using Admin Domains	147
Using CLI commands in an AD context	147
Table 41 Ports and devices in CLI output	147
Executing a command in a different AD context	147
Displaying an Admin Domain configuration	148
Switching to a different Admin Domain context	148
Performing zone validation	149
Admin Domain interactions	149
Table 42 Admin Domain interaction with Fabric OS features	149
Admin Domains, zones, and zone databases	150
Admin Domains and LSAN zones	151
Configuration upload and download in an AD context	152
Table 43 Configuration upload and download scenarios in an AD context	152
Installing and maintaining firmware	153
About the firmware download process	153
Upgrading and downgrading firmware	153
Effects of firmware changes on accounts and passwords	154
Table 44 Effects of firmware changes on accounts and passwords	154
Considerations for FICON CUP environments	154
Preparing for a firmware download	154
Checking connected switches	156
Obtaining and decompressing firmware	156
Performing firmware download on switches	156
Summary of the firmware download process	157
4/16 SAN Switch and 4/8 SAN Switch, Brocade 4Gb SAN Switch for HP p-Class BladeSystem, Brocade 4Gb SAN Switch for HP c-Class Bla...	157
Summary of firmware downloads on Director models	159
Summary of the firmware download process for Directors	159
SAN Director 2/128 and 4/256 SAN Director firmware download procedure	160
Testing and restoring firmware on switches	164
Testing and restoring firmware-on Directors	165
Validating the firmware download	168
Troubleshooting firmware download	169
Downgrading firmware from Fabric OS 5.2.x	169
Pre-installation messages	170
Blade troubleshooting tips	179
Synchronizing firmware versions on partitions	179
FTP server recommendations	179
Configuring Directors	181
Identifying ports	181
By slot and port number	182
By port area ID	182
By index	182
Table 45 Default index/area_ID Core PID assignment with no port swap	183
Table 46 Default index/area extended-edge PID assignment with no port swap	184
Basic blade management	186
Powering port blades off and on	186
Disabling and enabling port blades	186
400 MP Router exceptions	187
B-Series MP Router blade (FR4-18i) exceptions	187
FC4-48 blade exceptions	187
Conserving power	187
Blade terminology and compatibility	188
Table 47 Director terminology and abbreviations	188
CP blades	189
Port blade compatibility	189
Setting chassis configuration options	189
Table 48 Blades Supported by Each Director	189
Table 49 Supported configuration options	190
Table 50 Configuration options and resulting slot configurations	190
Obtaining slot information	191
Configuring a new SAN Director 2/128 with two domains	192
Converting an installed SAN Director 2/128 to support two domains	193
Setting the blade beacon mode	194
Routing traffic	195
About data routing and routing policies	195
Specifying the routing policy	195
Assigning a static route	196
Specifying frame order delivery	196
Using Dynamic Load Sharing	197
Viewing routing path information	198
Viewing routing information along a path	200
Using the FC-FC routing service	203
Supported platforms	203
Fibre Channel routing concepts	203
Figure 8 A metaSAN with edge-to-edge and backbonef fabrics	203
Figure 9 A metaSAN with interfabric links	205
Figure 10 Edge SANs connected through a backbone fabric	206
Front domain consolidation	206
Supported configurations and platforms	206
Upgrade and downgrade considerations	207
Using front domain consolidation	207
Range of output ports	208
Support	208
Proxy devices	208
Figure 11 metaSAN with imported devices	209
Routing types	209
Fibre Channel NAT and phantom domains	210
Setting up the FC-FC routing service	210
Performing verification checks	211
Assigning backbone fabric IDs	212
Configuring FCIP tunnels (optional)	213
Configuring FC-FC routing to work with Secure Fabric OS (optional)	213
Configuring Secure Fabric OS DH-CHAP secret	213
Configuring an interfabric link	215
Configuring LSANs and zoning	220
Use of administrative domains with LSAN Zones and FCR	220
Defining and naming zones	220
LSAN Zones and fabric-to-fabric communications	220
Configuring backbone fabrics for Interconnectivity	223
Optional configuration procedures	223
FC router port cost (optional)	223
Using router port cost	223
Upgrade, downgrade, and HA considerations	224
Port cost considerations	224
Setting a proxy PID	225
Matching fabric parameters	225
EX_Port frame trunking (optional)	226
Supported configurations and platforms	226
High Availability support	226
Backward Compatibility Support	226
Upgrade and Downgrade Considerations	227
Table 51 Trunking upgrade and downgrade considerations	227
Using EX_Port Frame trunking	227
Security considerations	227
Trunking commands	227
Monitoring resources	228
Routing ECHO	230
Upgrade and downgrade considerations	230
Interoperability with legacy FCR switches	231
Backward compatibility	231
Table 52 Hardware and firmware compatibility for nonsecure fabrics	231
Connecting to HP M-Series or McDATA SANs	232
Supported platforms and configurations	232
Configuring the fabrics for interconnectivity	232
Connectivity modes	233
Table 53 portCfgExPort -m values	233
Configuring the FC router	233
Figure 12 EFCM SAN status	236
Configuring M-Series or McDATA for interconnection	236
Figure 13 SAN Pilot and EFCM zone screens	237
Figure 14 Pending Zone Set list in SAN Pilot and EFCM zone screens	238
Figure 15 Adding a zone set name in SAN Pilot	239
LSAN zoning with McDATA	239
Completing the configuration	240
Administering FICON fabrics	243
Overview of Fabric OS support for FICON	243
Supported switches	244
4/256 Director, SAN Switch 4/32 and 4/32B SAN Switch FICON notes	244
Types of FICON configurations	245
Control Unit Port (CUP)	245
FICON commands	246
Table 54 Fabric OS commands related to FICON and FICON CUP	246
Security considerations	247
Configuring switches	247
Preparing a switch	248
Configuring a single switch	248
Configuring a high-integrity fabric	248
Figure 16 Cascaded configuration, two switches	249
Figure 17 Cascaded configuration, three switches	249
Setting a unique domain ID	249
Displaying information	250
Link incidents	250
Registered listeners	250
Node identification data	250
FRU failures	251
Swapping ports	251
Clearing the FICON management database	251
Using FICON CUP	252
Setup summary	252
Enabling and disabling FICON management server mode	253
Setting up CUP when FICON management server mode is enabled	254
Displaying the fmsmode setting	254
Displaying mode register bit settings	255
Table 55 FICON CUP mode register bits	255
Setting mode register bits	256
Persistently enabling/disabling ports	256
Port and switch naming standards	257
Adding and removing FICON CUP licenses	257
Zoning and PDCM considerations	257
Zoning and link incident reporting	257
Backing up and restoring configurations	257
Troubleshooting	258
Identifying ports	258
Backing up FICON files	259
Recording configuration information	259
Table 56 FICON® switch configuration worksheet	260
Sample IOCP configuration file for SAN Switch 2/32, SAN Switch 4/32, 4/32B SAN Switch, SAN Director 2/128, and 4/256 SAN Director switches	261
Sample RMF configuration file for mainframe	262
Configuring the distributed manager server	265
Enabling and disabling the platform services	265
Controlling access	266
Configuring the server database	268
Controlling topology discovery	269
Working with diagnostic features	271
About Fabric OS diagnostics	271
Viewing Power-on Self Tests	271
Viewing switch status	272
Viewing port information	274
Viewing equipment status	277
Viewing the system message log	278
Viewing the port log	279
Configuring for syslogd	280
Configuring the host	280
Table 57 Fabric OS to UNIX message severities	280
Configuring the switch	281
Viewing and saving diagnostic information	282
Setting up automatic trace dump transfers	282

Match case Limit results 1 per page

Fabric OS 5.2.x administrator guide

Port Configuration

lists the ports used. This table provides the information to make it clearer when configuring the switch,

taking into consideration firewalls and other devices that may sit between switches in the fabric or between

the managers and the switch.

Configuring for the SSL protocol

Fabric OS v4.4.0 and later supports Secure Sockets Layer (SSL) protocol, which provides secure access to

a fabric through Web-based management tools like Web Tools. SSL support is a standard Fabric OS

feature; it is independent of Secure Fabric OS, which requires a license and separate certification.

Switches configured for SSL grant access to management tools through hypertext transfer protocol-secure

links (which begin with

https://

) instead of standard links (which begin with

http://

SSL uses Public Key Infrastructure (PKI) encryption to protect data transferred over SSL connections. PKI is

based on digital certificates obtained from an Internet Certificate Authority (CA), which acts as the trusted

key agent.

Certificates are based on the switch IP address or Fully Qualified Domain Name (FQDN), depending on

the issuing CA. If you change a switch IP address or FQDN after activating an associated certificate, you

might have to obtain and install a new certificate. Check with the CA to verify this possibility, and plan

these types of changes accordingly.

Table 21

Port information

Port

Type

Common use

Comment

TCP

SSH

TCP

Telnet

Use the

configure

command to

disable the telnet service.

123

TCP

NTP

TCP

HTTP

Use the

configure

command to

disable the port.

111

TCP

sunrpc

This port is used by Platform API.

Use the

configure

command to

enable or disable daemons.

161

UDP

SNMP

Disable the SNMP service on the

remote host if you do not use it, or

filter incoming UDP packets going to

this port.

443

TCP

HTTP

Supported service (Web Tools).

Disable this port using the

config-

ure

command.

512

TCP

exec

513

TCP

514

TCP

shell

897

TCP

This port is used by the Platform API.

Disable this port using the

configure

command.