Cisco Nexus 7000 Series NX-OS SAN Switching Configuration Guide
Configuring Fabric Binding
Download this chapter
Configuring Fabric BindingConfiguring Fabric Binding
Download the complete book
Cisco Nexus 7000 Series NX-OS SAN Switching Configuration GuideCisco Nexus 7000 Series NX-OS SAN Switching Configuration Guide (PDF - 4 MB)
 Feedback

Configuring Fabric Binding

This chapter contains the following sections:

Configuring Fabric Binding

Information About Fabric Binding

The fabric binding feature ensures that ISLs are only enabled between specified switches in the fabric. Fabric binding is configured on a per-VSAN basis.

This feature helps prevent unauthorized switches from joining the fabric or disrupting current fabric operations. It uses the Exchange Fabric Membership Data (EFMD) protocol to ensure that the list of authorized switches is identical in all switches in the fabric.

Licensing Requirements for Fabric Binding

Fabric Binding requires the Storage Protocol Services license.

Port Security Versus Fabric Binding

Port security and fabric binding are two independent features that can be configured to complement each other. The following table compares the two features.

Table 1 Fabric Binding and Port Security Comparison

Fabric Binding

Port Security

Uses a set of sWWNs and a persistent domain ID.

Uses pWWNs/nWWNs or fWWNs/sWWNs.

Binds the fabric at the switch level.

Binds devices at the interface level.

Authorizes only the configured sWWN stored in the fabric binding database to participate in the fabric.

Allows a preconfigured set of Fibre Channel devices to logically connect to a SAN port. The switch port, identified by a WWN or interface number, connects to a Fibre Channel device (a host or another switch), also identified by a WWN. By binding these two devices, you lock these two ports into a group (or list).

Requires activation on a per VSAN basis.

Requires activation on a per VSAN basis.

Allows specific user-defined switches that are allowed to connect to the fabric, regardless of the physical port to which the peer switch is connected.

Allows specific user-defined physical ports to which another device can connect.

Does not learn about switches that are logging in.

Learns about switches or devices that are logging in if learning mode is enabled.

Cannot be distributed by CFS and must be configured manually on each switch in the fabric.

Can be distributed by CFS.

Port-level checking for xE ports is as follows:

  • The switch login uses both port security binding and fabric binding for a given VSAN.
  • Binding checks are performed on the port VSAN as follows:
    • E port security binding check on port VSAN
    • TE port security binding check on each allowed VSAN

While port security complements fabric binding, they are independent features and can be enabled or disabled separately.

Fabric Binding Enforcement

To enforce fabric binding, configure the switch world wide name (sWWN) to specify the xE port connection for each switch. Enforcement of fabric binding policies are done on every activation and when the port tries to come up. For a Fibre Channel VSAN, the fabric binding feature requires all sWWNs connected to a switch to be part of the fabric binding active database.

Configuring Fabric Binding

The fabric binding feature ensures ISLs are only enabled between specified switches in the fabric binding configuration. Fabric binding is configured on a per-VSAN basis.

Configuring Fabric Binding

To configure fabric binding in each switch in the fabric, perform this task:

SUMMARY STEPS

    1.    Enable the fabric configuration feature.

    2.    Configure a list of sWWNs and their corresponding domain IDs for devices that are allowed to access the fabric.

    3.    Activate the fabric binding database.

    4.    Copy the fabric binding active database to the fabric binding configuration database.

    5.    Save the fabric binding configuration.

    6.    Verify the fabric binding configuration.


DETAILED STEPS
    Step 1   Enable the fabric configuration feature.
    Step 2   Configure a list of sWWNs and their corresponding domain IDs for devices that are allowed to access the fabric.
    Step 3   Activate the fabric binding database.
    Step 4   Copy the fabric binding active database to the fabric binding configuration database.
    Step 5   Save the fabric binding configuration.
    Step 6   Verify the fabric binding configuration.

    Enabling Fabric Binding

    The fabric binding feature must be enabled in each switch in the fabric that participates in the fabric binding. By default, this feature is disabled. The configuration and verification commands for the fabric binding feature are only available when fabric binding is enabled on a switch. When you disable this configuration, all related configurations are automatically discarded.

    To enable fabric binding on any participating switch, perform this task:

    SUMMARY STEPS

      1.    switch# configure terminal

      2.    switch(config)# feature fabric-binding


    DETAILED STEPS
       Command or ActionPurpose
      Step 1switch# configure terminal 

      Enters global configuration mode.

       
      Step 2 switch(config)# feature fabric-binding
       

      Enables fabric binding on that switch.

       

      About Switch WWN Lists

      A user-specified fabric binding list contains a list of switch WWNs (sWWNs) within a fabric. If an sWWN attempts to join the fabric, and that sWWN is not on the list or the sWWN is using a domain ID that differs from the one specified in the allowed list, the ISL between the switch and the fabric is automatically isolated in that VSAN and the switch is denied entry into the fabric.

      Configuring Switch WWN List

      To configure a list of sWWNs and optional domain IDs for a Fibre Channel VSAN, perform this task:

      SUMMARY STEPS

        1.    switch# configure terminal

        2.    switch(config)# fabric-binding database vsan vsan-id

        3.    switch(config)# no fabric-binding database vsan vsan-id

        4.    switch(config-fabric-binding)#swwn swwn-id domain domain-id

        5.    switch(config-fabric-binding)#no swwn swwn-id domain domain-id


      DETAILED STEPS
         Command or ActionPurpose
        Step 1switch# configure terminal 

        Enters global configuration mode.

         
        Step 2 switch(config)# fabric-binding database vsan vsan-id
         

        Enters the fabric binding submode for the specified VSAN.

         
        Step 3 switch(config)# no fabric-binding database vsan vsan-id
         

        Deletes the fabric binding database for the specified VSAN.

         
        Step 4 switch(config-fabric-binding)#swwn swwn-id domain domain-id
         

        Adds the sWWN of another switch for a specific domain ID to the configured database list.

         
        Step 5 switch(config-fabric-binding)#no swwn swwn-id domain domain-id
         

        Deletes the sWWN and domain ID of a switch from the configured database list.

         

        About Fabric Binding Activation and Deactivation

        The fabric binding feature maintains a configuration database (config database) and an active database. The config database is a read-write database that collects the configurations you perform. These configurations are only enforced upon activation. This activation overwrites the active database with the contents of the config database. The active database is read-only and is the database that checks each switch that attempts to log in.

        By default, the fabric binding feature is not activated. You cannot activate the fabric binding database on the switch if entries existing in the config database conflict with the current state of the fabric. For example, one of the already logged in switches may be denied login by the config database. You can choose to forcefully override these situations.


        Note

        After activation, any already logged in switch that violates the current active database will be logged out, and all switches that were previously denied login because of fabric binding restrictions are reinitialized.

        Activating Fabric Binding

        To activate the fabric binding feature, perform this task:

        SUMMARY STEPS

          1.    switch# configure terminal

          2.    switch(config)# fabric-binding activate vsan vsan-id

          3.    switch(config)# no fabric-binding activate vsan vsan-id


        DETAILED STEPS
           Command or ActionPurpose
          Step 1switch# configure terminal 

          Enters global configuration mode.

           
          Step 2 switch(config)# fabric-binding activate vsan vsan-id
           

          Activates the fabric binding database for the specified VSAN.

           
          Step 3 switch(config)# no fabric-binding activate vsan vsan-id
           

          Deactivates the fabric binding database for the specified VSAN.

           

          Forcing Fabric Binding Activation

          If the database activation is rejected due to one or more conflicts listed in the previous section, you may decide to proceed with the activation by using the force option.

          To forcefully activate the fabric binding database, perform this task:

          SUMMARY STEPS

            1.    switch# configure terminal

            2.    switch(config)# fabric-binding activate vsan vsan-id force

            3.    switch(config)# no fabric-binding activate vsan vsan-id force


          DETAILED STEPS
             Command or ActionPurpose
            Step 1switch# configure terminal 

            Enters global configuration mode.

             
            Step 2 switch(config)# fabric-binding activate vsan vsan-id force
             

            Activates the fabric binding database for the specified VSAN forcefully, even if the configuration is not acceptable.

             
            Step 3 switch(config)# no fabric-binding activate vsan vsan-id force
             

            Reverts to the previously configured state or to the factory default (if no state is configured).

             

            Copying Fabric Binding Configurations

            When you copy the fabric binding configuration, the config database is saved to the running configuration.

            You can use the following commands to copy to the config database:

            • Use the fabric-binding database copy vsan command to copy from the active database to the config database. If the configured database is empty, this command is not accepted. 
              switch# fabric-binding database copy vsan 1
            • Use the fabric-binding database diff active vsan command to view the differences between the active database and the config database. This command can be used when resolving conflicts. 
              switch# fabric-binding database diff active vsan 1
            • Use the fabric-binding database diff config vsan command to obtain information on the differences between the config database and the active database. 
              switch# fabric-binding database diff config vsan 1
            • Use the copy running-config startup-config command to save the running configuration to the startup configuration so that the fabric binding config database is available after a reboot. 
              switch# copy running-config startup-config

            Clearing the Fabric Binding Statistics

            Use the clear fabric-binding statistics command to clear all existing statistics from the fabric binding database for a specified VSAN. 

            switch# clear fabric-binding statistics vsan 1

            Deleting the Fabric Binding Database

            Use the no fabric-binding command in configuration mode to delete the configured database for a specified VSAN. 

            switch(config)# no fabric-binding database vsan 10

            Verifying Fabric Binding Information

            To display fabric binding information, perform one of the following tasks

            SUMMARY STEPS

              1.    switch# show fabric-binding database [active]

              2.    switch# show fabric-binding database [active] [vsan vsan-id]

              3.    switch# show fabric-binding statistics

              4.    switch# show fabric-binding status

              5.    switch# show fabric-binding violations

              6.    switch# show fabric-binding efmd [vsan vsan-id]


            DETAILED STEPS
               Command or ActionPurpose
              Step 1 switch# show fabric-binding database [active]
               

              Displays the configured fabric binding database. Include keyword active to display only the active fabric binding database.

               
              Step 2 switch# show fabric-binding database [active] [vsan vsan-id]
               

              Displays the configured fabric binding database for the specified VSAN.

               
              Step 3 switch# show fabric-binding statistics
               

              Displays statistics for the fabric binding database.

               
              Step 4 switch# show fabric-binding status
               

              Displays fabric binding status for all VSANs.

               
              Step 5 switch# show fabric-binding violations
               

              Displays fabric binding violations.

               
              Step 6 switch# show fabric-binding efmd [vsan vsan-id]
               

              Displays the configured fabric binding database for the specified VSAN.

               

              The following example displays the active fabric binding information for VSAN 4:

              switch# show fabric-binding database active vsan 4

              The following example displays fabric binding violations:

              switch# show fabric-binding violations

              ------------------------------------------------------------------------------- 
              VSAN Switch WWN [domain]     Last-Time             [Repeat count] Reason 
              ------------------------------------------------------------------------------- 
              2    20:00:00:05:30:00:4a:1e [0xeb] Nov 25 05:46:14 2003   [2]    Domain mismatch 
              3    20:00:00:05:30:00:4a:1e [*] Nov 25 05:44:58 2003      [2]    sWWN not found 
              4    20:00:00:05:30:00:4a:1e [*] Nov 25 05:46:25 2003      [1]    Database mismatch

              Note

              In VSAN 3, the sWWN was not found in the list. In VSAN 2, the sWWN was found in the list, but has a domain ID mismatch.

              The following example displays EFMD Statistics for VSAN 4:

              switch# show fabric-binding efmd statistics vsan 4

              Default Fabric Binding Settings

              The following table  lists the default settings for the fabric binding feature.

              Table 2  Default Fabric Binding Settings

              Parameters

              Default

              Fabric binding

              Disabled