HP StorageWorks 2/140 FW 08.01.00 HP StorageWorks Director and Edge Switch Rel - Page 6

Important information, CLI enhancements

Get HP StorageWorks 2/140 - Director Switch PDF manuals and user guides View all HP StorageWorks 2/140 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 6 highlights

• Port Fencing-Building on E_port or ISL Fencing introduced in firmware 07.xx.xx, Port Fencing policies have been enhanced to include F_ports to block malfunctioning devices attached to M-Series Directors and Edge Switches. Users can configure policies to detect ports that are violating security rules, as well as link-level problems, such as a port that repeatedly exits the active-link state. If a user-defined threshold is reached, the port is automatically blocked, and the user is notified. Users can unblock ports manually to allow the ISL or node to recover when the source of the problem is identified. Malfunctions in connected hardware or Denial of Service (DoS) attacks can cause devices to attempt repeated log-ins, which in extreme cases can impact fabric operations adversely. Port Fencing can detect many of these conditions and prevent adverse consequences. Port Fencing is disabled by default. However, when enabled, default threshold values are established for the different types of policies if the user has not configured them manually. In most cases, the default policies provide a reasonable level of protection, but further refinement may be necessary to accommodate specific SAN behavior. During planned maintenance or service operations, HP recommends disabling appropriate policies to prevent fencing of ports from expected behavior. New CLI commands support this enhancement. See the config.fencing.setParams command under CLI enhancements. • Fibre Channel TraceRoute-Provides the ability to send a Fibre Channel frame through the fabric and view its route to the destination and return to the source. TraceRoute aids customers in troubleshooting device connectivity problems by providing a map of routes through the fabric. See the show.fabric.traceRoute command under CLI enhancements. • Embedded Port Log-CLI Enhancements enable users to specify trigger points that will start and stop events from being written to the Embedded Port Log. These triggers consist of a data pattern and offset into the Fibre Channel frame. CLI enhancements The following commands and command parameters have been added to the CLI: • config.fencing.setParams-Supported with new commands. • config.fencing.showTypeTable-Supported with new types. • config.switch-Commands added to the config.switch branch allow you to enable/disable the API Interface, Web Interface, and Safe Zoning, and commands to configure the FSPF cost of ISLs on the switch.config.switch and the state of zoning request state change notifications (RSCNs). • show.switch-Command added shows the IP address of the application that is managing the switch/director and the method for computing the FSPF cost for ISLs. • config.snmp-Commands added to the config.snmp branch allow you to configure a USM user entry in the User table, configure an entry in the Security-to-Group table, configure v1 through v3 community strings, associate 4

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
•
Port Fencing
—Building on E_port or ISL Fencing introduced in
fi
rmware
07.xx.xx, Port Fencing policies have been enhanced to include F_ports to block
malfunctioning devices attached to M-Series Directors and Edge Switches. Users
can con
fi
gure policies to detect ports that are violating security rules, as well as
link-level problems, such as a port that repeatedly exits the active-link state.
If a user-de
fi
ned threshold is reached, the port is automatically blocked, and
the user is noti
fi
ed. Users can unblock ports manually to allow the ISL or
node to recover when the source of the problem is identi
fi
ed. Malfunctions in
connected hardware or Denial of Service (DoS) attacks can cause devices to
attempt repeated log-ins, which in extreme cases can impact fabric operations
adversely. Port Fencing can detect many of these conditions and prevent adverse
consequences.
Port Fencing is disabled by default. However, when enabled, default threshold
values are established for the different types of policies if the user has not
con
fi
gured them manually. In most cases, the default policies provide a
reasonable level of protection, but further re
fi
nement may be necessary to
accommodate speci
fi
c SAN behavior.
During planned maintenance or service operations, HP recommends disabling
appropriate policies to prevent fencing of ports from expected behavior.
New CLI commands support this enhancement. See the
config.fenc-
ing.setParams
command under
CLI enhancements
.
•
Fibre Channel TraceRoute
—Provides the ability to send a Fibre Channel
frame through the fabric and view its route to the destination and return to
the source. TraceRoute aids customers in troubleshooting device connectivity
problems by providing a map of routes through the fabric.
See the
show.fabric.traceRoute
command under
CLI enhancements
.
•
Embedded Port Log
—CLI Enhancements enable users to specify trigger points
that will start and stop events from being written to the Embedded Port Log.
These triggers consist of a data pattern and offset into the Fibre Channel frame.
CLI enhancements
The following commands and command parameters have been added to the CLI:
•
config.fencing.setParams
—Supported with new commands.
•
config.fencing.showTypeTable
—Supported with new types.
•
config.switch
—Commands added to the con
fi
g.switch branch allow you
to enable/disable the API Interface, Web Interface, and Safe Zoning, and
commands to con
fi
gure the FSPF cost of ISLs on the
switch.config.switch
and the state of zoning request state change noti
fi
cations (RSCNs).
•
show.switch
—Command added shows the IP address of the application that
is managing the switch/director and the method for computing the FSPF cost
for ISLs.
•
config.snmp
—Commands added to the con
fi
g.snmp branch allow you
to con
fi
gure a USM user entry in the User table, con
fi
gure an entry in the
Security-to-Group table, con
fi
gure v1 through v3 community strings, associate
4