Q-Logic 64 manual Device Security, Security Example Switches and HBAs

3 – Planning Fabric Security

D

3.5.2

Device Security

Device security provides for the authorization and authentication of devices that you attach to a switch. You can configure a switch with a group of devices against which the switch authorizes new attachments by devices, other switches, or applications issuing management server commands. In addition to authorization, the switch can be configured to require authentication of the connecting device through the use of a password or secret.

Device security is configured through the use of security sets and groups. A group is a list of device worldwide names that are authorized to attach to a switch. There are three types of groups: one for other switches (ISL), another for N_Port devices (port), and a third for devices or applications issuing management server commands (MS). Device security is not supported for loop devices. A security set is a set of up to three groups with no more than one of each group type. The security database is made up of all security sets on the switch. The security database has the following limits:

„The maximum number of security sets is 4.

„The maximum number of groups is 16.

„The maximum number of members in a group is 1000.

„The maximum total number of group members is 1000.

Consider the devices, switches, and management agents and evaluate the need for authorization and authentication.

The following examples illustrate how to configure a security database.

3.5.2.1

Security Example: Switches and HBAs

Consider the fabric shown in Figure 3-3. In this fabric, Switch_1 and HBA_1 support security while the JBOD, Switch_2 and HBA_2 do not. The objective is to secure F_Ports and E_Ports in the fabric. To do this, configure security on the devices that support security: Switch_1 and HBA_1.

3-12 59043-03 A