HP SAN manual Device security

Page 23

Device security

IMPORTANT: Device security is available only with the McDATA SANtegrity™ Enhanced PFE key and can be managed only with the CLI and Element Manager. Element Manager also requires a PFE key. See ”Installing Product Feature Enablement keys” on page 82 for more information about installing a PFE key. To obtain the McDATA 4Gb SAN Switch serial number and PFE key, follow the step-by-step instructions on the firmware feature entitlement request certificate for the PFE key. You can obtain a PFE key from the web at: www.webkey.external.hp.com.

Device security provides for the authorization and authentication of devices that you attach to a switch. You can configure a switch with a group of devices against which the switch authorizes new attachments by devices, other switches, or devices issuing management server commands. Device security is configured through the use of security sets and groups. A group is a list of device worldwide names that are authorized to attach to a switch. There are three types of groups: one for other switches (ISL), another for devices (port), and a third for devices issuing management server commands (MS). A security set is a set of up to three groups with no more than one of each group type. The security configuration is made up of all security sets on the switch.

In addition to authorization, the switch can be configured to require authentication to validate the identity of the connecting switch, device, or host. Authentication can be performed locally using the switch security database, or remotely using a RADIUS server. With a RADIUS server, the security database for the entire fabric resides on the server. In this way, the security database can be managed centrally, rather than on each switch. You can configure up to five RADIUS servers to provide failover.

You can configure the RADIUS server to authenticate just the switch or both the switch and the initiator device if the device supports authentication. When using a RADIUS server, every switch in the fabric must have a network connection. A RADIUS server can also be configured to authenticate user accounts.

Managing device security involves the following tasks:

•Creating security sets, groups, and members

•Editing a security configuration on a switch

•Viewing properties of a security set, group, or member

•Archiving a security configuration on a switch to a file

•Activating and deactivating a security set

The security database is made up of all security sets on the switch. The security database has the following limits:

•Maximum number of security sets is 4.

•Maximum number of security groups is 16.

•Maximum number of members in a group is 1000.

•Maximum total number of group members is 1000.

McDATA® 4Gb SAN Switch for HP p-Class BladeSystem user guide 23

Page 22 Page 24
Image 23
Page 22 Page 24
Contents McDATA 4Gb SAN Switch Page Contents Managing switches Glossary Index Managing portsTables Related documentation Intended audiencePrerequisites Jdom license Document conventions and symbolsHP-authorized reseller HP technical supportHelpful web sites Using McDATA Web Server/Element Manager Starting McDATA Web Server Workstation requirementsExiting McDATA Web Server or Element Manager Starting Element Manager in HafmSetting preferences Enabling e-mail support Using online helpViewing software version and copyright information Enabling call homeMcDATA Web Server interface User interfaceMenu bar Shortcut keys Popup menusGraphic window McDATA Web Server Fabric treeSelecting ports Selecting switchesData windows and tabs Securing a fabric Security consistency checklistUser account security Remote authenticationConnection security Device security Edit Security dialog Create Security Group dialog Create Security Set dialogCreate Security Group Member dialog McDATA 4Gb SAN Switch for HP p-Class BladeSystem user guide Viewing properties of a security set, group, or member Editing the security configuration on a switchActivating a security set Security Config dialogArchiving a security configuration to a file Rediscovering a fabric Fabric servicesEvents browser Displaying the event browserSorting the event browser Saving the event browser to a file Filtering the event browserDevices data window Working with device information and nicknamesManaging device port nicknames Displaying detailed device informationExporting nicknames to a file Creating a nicknameEditing a nickname Deleting a nicknameZones Zoning a fabricZoning concepts Zoning database Zone setsZoning limits and properties Editing the zoning database Managing the zoning databaseMcDATA 4Gb SAN Switch for HP p-Class BladeSystem user guide Restoring the zoning database from a file Configuring the zoning databaseSaving the zoning database to a file Removing all zoning definitions Restoring the default zoning databaseManaging the active zone set Active zone set data window Displaying the configured and active zone setsRemoving a zone set Creating a zone setActivating and deactivating a zone set Removing a zone from a zone setCreating a zone in a zone set Managing zonesRemoving a zone member Adding zone membersRenaming a zone or a zone set Zone merge failure Zone merge failure recoveryMerging fabrics and zoning Managing user accounts Managing switchesCreating user accounts User Account Administration dialog Add Account tabRemoving a user account User Account Administration Dialog Remove Account tabUser Account Administration dialog Change Password tab Changing a user account passwordModifying a user account User Account Administration dialog Modify Account tabConfiguring Radius servers Adding a Radius server Removing a Radius server Editing Radius server information Modifying Radius server authentication order Device and Host Bus Adapter information Displaying switch informationSwitch event log Switch data window Switch status and operational informationMcDATA 4Gb SAN Switch for HP p-Class BladeSystem user guide With a switch Ratov Port status and operational information McDATA Web Server Configured Zonesets data windowPort performance statistics Configuring port threshold alarms Setting the date/time and enabling NTP client Paging a switchResetting a switch Switch properties Configuring a switchDomain ID and domain ID lock Syslog Symbolic nameIn-band management Switch administrative statesBroadcast support Fabric Device Management Interface Advanced switch propertiesInterop mode System servicesTimeout values Page Network properties Snmp properties Snmp trap configuration Snmp configurationSwitch binding Archiving a switchRestoring a switch Restoring the factory default configuration Downloading a support file Installing Product Feature Enablement keys Installing firmware Hardware status LEDs Displaying hardware statusPort information data window Managing portsPersistent and will be lost on a switch reset VIEnable and LCFEnable features based on Port statistics data window LIP ALPD,ALPS Alps Port symbolic name Viewing and configuring portsPort states Port types Device scan Port speedsPort transceiver media status Port binding Resetting a portTesting ports Page Glossary FRU SFP 100 Index 102 System Fault LED 84 system services 104
Top Page Image Contents