Cisco MDS 9000 Family 18/4-Port Multiservice Modules
The Cisco® MDS 9000 Family 18/4-Port Multiservice Module is optimized for deployment of high-performance storage area network (SAN) extension solutions, distributed intelligent fabric services, and cost-effective IP storage and mainframe connectivity in enterprise storage networks.
Supported in the Cisco MDS 9200 Series Multilayer Fabric Switches and Cisco MDS 9500 Series Multilayer Directors and offering 18 1-, 2-, and 4-Gbps Fibre Channel ports and 4 1-Gigabit Ethernet IP storage services ports, the Cisco MDS 9000 Family 18/4-Port Multiservice Module provides multiprotocol capabilities integrating, in a single-form-factor Fibre Channel, Fibre Channel over IP (FCIP), Small Computer System Interface over IP (iSCSI), IBM Fiber Connectivity (FICON), FICON Control Unit Port (CUP) management, and switch cascading.
The Cisco MDS 9000 Family 18/4-Port Multiservice Module uses Cisco expertise and knowledge of IP networks to deliver outstanding SAN extension performance, minimizing latency for disk and tape with FCIP acceleration features including FCIP write acceleration and FCIP tape write and read acceleration. Hardware-based encryption helps secure sensitive traffic with IP Security (IPsec), and hardware-based compression dramatically enhances performance for both high- and low-speed links, enabling immediate cost savings in expensive WAN infrastructure.
Natively integrating support for intelligent fabric applications, the Cisco MDS 9000 Family 18/4-Port Multiservice Module provides a platform for distributed fabric services such as Cisco Storage Media Encryption (SME), which encrypts data at rest on heterogeneous tape drives and virtual tape libraries (VTLs), and Cisco Data Mobility Manager (DMM), providing the ability to migrate data between heterogeneous targets. The Cisco MDS 9000 Family 18/4-Port Multiservice Module transparently offers such advanced functions to any device connected to the fabric, facilitating ease of deployment, scalability, and high availability through clustering.
Additionally, the Cisco MDS 9000 Family 18/4-Port Multiservice Federal Information Processing Standards (FIPS) Module, a FIPS 140-2 Level 3-compliant version of the Cisco MDS 9000 Family 18/4-Port Multiservice Module, is offered to provide added security to meet regulatory and industry requirements. FIPS Level 3 certification requires enhanced physical security, including a hard, opaque potting material to deter unauthorized access and tampering.
Figures 1 and 2 show the two modules.
Figure 1. Cisco MDS 9000 Family 18/4-Port Multiservice Module
Figure 2. Cisco MDS 9000 Family 18/4-Port Multiservice FIPS Module
Key Features and Benefits
The Cisco MDS 9000 Family 18/4-Port Multiservice Module is designed for mission-critical enterprise storage networks that require secure, robust, cost-effective business continuance services. Using Fibre Channel and IP in a single module, the Cisco MDS 9000 Family 18/4-Port Multiservice Module offers the following main features:
• Integrated Fibre Channel and IP storage services in an optimized form factor: The module supports 18 4-Gbps Fibre Channel interfaces for high-performance SAN and mainframe connectivity and 4 1-Gigabit Ethernet ports for FCIP and iSCSI storage services. Individual ports can be configured with hot-swappable shortwave, longwave, extended-reach, coarse wavelength-division multiplexing (CWDM), or dense wavelength-division multiplexing (DWDM) Small Form-Factor Pluggables (SFPs) for connectivity up to 200 kilometers or 125 miles.
• Integrated hardware-based virtual SANs (VSANs) and Inter-VSAN Routing (IVR): The module enables deployment of large-scale multisite and heterogeneous SAN topologies. Integration into port-level hardware allows any port within a system or fabric to be partitioned into any VSAN. Integrated hardware-based IVR provides line-rate routing between any ports within a system or fabric without the need for external routing appliances.
• FCIP for remote SAN extension:
– Simplifies data protection and business continuance strategies by enabling backup, remote replication, and other disaster-recovery services over WAN distances using open-standard FCIP tunneling.
– Optimizes utilization of WAN resources for backup and replication by enabling hardware-based compression, hardware-based encryption, FCIP write acceleration, and FCIP tape read and write acceleration; up to 16 virtual Inter-Switch Link (ISL) connections are provided on the 4-Gigabit Ethernet ports through tunneling.
– Preserves Cisco MDS 9000 family enhanced capabilities, including VSANs, advanced traffic management, and security, across remote connections.
• Small Computer System Interface (SCSI) for extension of the SAN to Ethernet attached servers:
– Extends the benefits of Fibre Channel SAN-based storage to Ethernet attached servers at a lower cost than is possible using Fibre Channel interconnect alone.
– Increases storage utilization and availability through consolidation of IP and Fibre Channel block storage.
– Through transparent operation, preserves the capability of existing management storage applications.
• Advanced FICON services: The module supports FICON environments, including cascaded FICON fabrics, VSAN-enabled intermix of mainframe and open systems environments, and N-port ID virtualization for mainframe Linux partitions.
• Integrated Cisco SME: The module protects data at rest on heterogeneous tape drives and VTLs in a SAN environment using secure IEEE-standard Advanced Encryption Standard (AES) algorithms. Supported natively on the Cisco MDS 9000 Family 18/4-Port Multiservice Module, Cisco SME capabilities are provided as a fabric service so that traffic between any host and storage device on the fabric can use the Cisco SME services. Furthermore, these encryption and compression capabilities are transparent to the hosts and storage devices and are available for devices in all VSANs in the fabric without the need for reconfiguration or rewiring, eliminating downtime for deployment. Cisco SME provisioning and key management are both integrated into Cisco Fabric Manager; no additional software is required.
• Intelligent network services: The module uses VSAN technology for hardware-enforced, isolated environments within a single physical fabric, access control lists (ACLs) for hardware-based intelligent frame processing, and advanced traffic management features such as Fibre Channel congestion control and fabricwide quality of service (QoS) to facilitate migration from SAN islands to enterprisewide storage networks.
• High-performance ISLs: The module supports up to 16 Fibre Channel links in a single PortChannel. Links can span any port on any module within the chassis for added scalability and resilience. Up to 4095 buffer-to-buffer credits can be assigned to a single Fibre Channel port to extend storage networks over large distances.
• Sophisticated diagnostics: The module provides intelligent diagnostics, protocol decoding, and network analysis tools as well as integrated Call Home capability for added reliability, faster problem resolution, and reduced service costs.
• Comprehensive network security framework: The module supports RADIUS and TACACS+, Fibre Channel Security Protocol (FC-SP), Secure File Transfer Protocol (SFTP), Secure Shell (SSH) Protocol, and Simple Network Management Protocol Version 3 (SNMPv3) implementing AES, VSANs, hardware-enforced zoning, ACLs, and per-VSAN role-based access control (RBAC). RBAC provides separate control over management functions and access on a per-VSAN basis, enabling separation of duties among administrators on the same physical switch. Gigabit Ethernet ports support IPsec authentication, data integrity, and hardware-assisted data encryption.
• IP Version 6 (IPv6) support: The module supports IPv6 as mandated by the U.S. Department of Defense (DoD), Japan, and China. IPv6 support is provided for FCIP, iSCSI, and management traffic routed in-band and out-of-band.
Integrated FCIP for Remote SAN Extension
Data distribution, data protection, and business continuance services are significant components of today's information-centered businesses. The capability to efficiently replicate critical data on a global scale helps ensure a higher level of data protection for valuable corporate information, and also increases utilization of backup resources and lowers total cost of storage ownership. The Cisco MDS 9000 Family 18/4-Port Multiservice Module uses the open-standard FCIP protocol to extend the distance of current Fibre Channel solutions, enabling interconnection of SAN islands over extended distances.
Advanced SAN Extension Features
The Cisco MDS 9000 Family 18/4-Port Multiservice Module supports hardware-based FCIP compression to maximize the effective WAN bandwidth of SAN extension solutions.
The Cisco MDS 9000 Family 18/4-Port Multiservice Module supports IPsec encryption for secure transmission of sensitive data over extended distances. Hardware enablement of IPsec helps ensure line-rate throughput. Together, hardware-based compression and hardware-based encryption provide a high-performance, highly secure SAN extension capability.
Additionally, the Cisco MDS 9000 Family 18/4-Port Multiservice Module supports FCIP write acceleration, a feature that can significantly improve application performance when storage traffic is extended across long distances. When FCIP write acceleration is enabled, WAN throughput is optimized by reducing the latency of command acknowledgments. Similarly, the module supports FCIP tape acceleration, which significantly improves throughput over WAN links for remote tape backup and restore operations.
Cisco Storage Media Encryption
Cisco SME protects data at rest on heterogeneous tape drives and VTLs in a SAN environment using secure IEEE-standard AES algorithms. Cisco SME has become important with the recent enactment of regulations that require companies to store and protect data at rest for a specified number of years and publicly disclose security breaches. Cisco SME enables data to be compressed, encrypted, and authenticated for centralized security management and data management and recovery. Cisco SME services employ clustering technology to create a highly available solution. The cryptographic cluster formed enhances reliability and availability, enables automated load balancing and failover capabilities, and simplifies provisioning as a single SAN fabric service rather than as individual switches or modules. The Cisco Key Management Center (KMC) provides integrated key management for Cisco SME, with support for single- and multiple-site deployments. Cisco KMC provides essential features such as key archival, secure export and import and translation for distribution, and key shredding.
Cisco Data Mobility Manager
The Cisco Data Mobility Manager (DMM) is a fabric-based data migration solution that transfers block data nondisruptively across heterogeneous storage volumes and across distances, whether the host is online or offline. This data-center class solution helps to minimize the challenges experienced in migrating data, such as downtime, the need to add data migration software to servers, and the potential for data loss and corruption. By simply enabling the DMM feature on the Cisco MDS 9000 Family 18/4-Port Multiservice Module located anywhere in the SAN, data migration can be configured without host agents, without rewiring, with minimal performance impact, and without downtime.
VSANs
Ideal for efficient, secure SAN consolidation, ANSI T11-standard VSANs enable more efficient storage network utilization by creating hardware-based isolated environments with a single physical SAN fabric or switch. Each VSAN can be zoned as a typical SAN and maintained with its own fabric services for added scalability and resilience. VSANs allow the cost of SAN infrastructure to be shared among more users, while helping ensure segregation of traffic and retaining independent control of configuration on a VSAN-by-VSAN basis.
Integrated SAN Routing
In another step toward deployment of efficient, cost-effective, consolidated storage networks, the Cisco MDS 9000 Family 18/4-Port Multiservice Module supports IVR, the industry's first routing function for Fibre Channel. IVR allows selective transfer of data between specific initiators and targets on different VSANs while maintaining isolation of control traffic within each VSAN. With IVR, data can transit VSAN boundaries while maintaining control plane isolation, thereby maintaining fabric stability and availability. IVR eliminates the need for external routing appliances, greatly increasing routing scalability while delivering line-rate routing performance, simplifying management, and eliminating the challenges associated with maintaining separate systems. IVR means lower total cost of SAN ownership.
Integrated Mainframe Support
The Cisco MDS 9000 Family 18/4-Port Multiservice Module is mainframe ready with full support for IBM zSeries FICON and Linux environments. Certified by IBM for attachment to all FICON-enabled devices in an IBM zSeries operating environment, the Cisco MDS 9000 Family 18/4-Port Multiservice Module supports transport of the FICON protocol in both cascaded and noncascaded fabrics, as well as an intermix of FICON and open systems Fibre Channel Protocol traffic on the same switch. Virtual SANs simplify intermixing of SAN resources among IBM z/OS, mainframe Linux, and open systems environments, enabling increased SAN utilization and simplified SAN management. VSAN-based intermix mode eliminates the uncertainty and instability often associated with zoning-based intermixing techniques. The use of VSANs also greatly reduces the probability that misconfiguration or component failure in one VSAN will affect operation in other VSANs. VSAN-based management access control simplifies partitioning of SAN management responsibilities between mainframe and open systems environments, enhancing security. FICON VSANs can be managed using the integrated Cisco Fabric Manager, Cisco command-line interface (CLI), or IBM CUP-enabled management tools including SA/390 Resource Measurement Facility (RMF) and dynamic channel path management (DCM).
Advanced Traffic Management
The advanced traffic management capabilities integrated into the Cisco MDS 9000 Family 18/4-Port Multiservice Module simplify deployment and optimization of large-scale fabrics.
• Virtual output queuing: Helps ensure line-rate performance on each port, independent of traffic pattern, by eliminating head-of-line blocking
• Up to 4095 buffer-to-buffer credits: Can be assigned to an individual port for optimal bandwidth utilization across long distances
• PortChannels: Allow users to aggregate up to 16 physical ISLs into a single logical bundle, providing optimized bandwidth utilization across all links; the bundle can consist of any speed-matched ports from any module in the chassis, helping ensure that the bundle can remain active even in the event of a module failure
• Fabric Shortest Path First (FSPF)-based multipathing: Provides the intelligence to load balance across up to 16 equal-cost paths and, in the event of a switch failure, dynamically reroute traffic
• QoS: Can be used to manage bandwidth and control latency, to prioritize critical traffic
• Fibre Channel congestion control: Provides end-to-end, feedback-based congestion control that augments the Fibre Channel buffer-to-buffer credit mechanism, enabling enhanced traffic management
Advanced Diagnostics and Troubleshooting Tools
Management of large-scale storage networks requires proactive diagnostics, tools to verify connectivity and route latency, and mechanisms for capturing and analyzing traffic. The Cisco MDS 9000 family integrates the industry's most advanced analysis and diagnostic tools. Power-on self test (POST) and online diagnostics provide proactive health monitoring. The Cisco MDS 9000 Family 18/4-Port Multiservice Module implements diagnostic capabilities such as Fibre Channel Traceroute to detail the exact path and timing of flows and Switched Port Analyzer (SPAN) to intelligently capture network traffic. After traffic has been captured, it can be analyzed with the Cisco Fabric Analyzer, an embedded Fibre Channel analyzer. Comprehensive port-based and flow-based statistics facilitate sophisticated performance analysis and service-level agreement (SLA) accounting. With the Cisco MDS 9000 family, Cisco delivers a comprehensive toolset for troubleshooting and analysis of storage networks.
Comprehensive Solution for Robust Network Security
Addressing the need for fail-proof security in storage networks, the Cisco MDS 9000 Family 18/4-Port Multiservice Module offers an extensive security framework to protect highly sensitive data moving in today's enterprise networks. The module employs intelligent frame inspection at the port level, including the application of ACLs for hardware enforcement of zones, VSANs, and advanced port security features.
• Extended zoning capabilities are enabled to help ensure that logical unit numbers (LUNs) can be accessed by only specific hosts (LUN zoning), to limit SCSI read commands for a certain zone (read-only zoning), and to restrict broadcasts to only the selected zones (broadcast zones).
• VSANs are used to achieve higher security and greater stability by providing complete isolation among devices that are connected to the same physical SAN.
• FC-SP provides switch-switch and host-switch Diffie-Hellman Challenge Handshake Authentication Protocol (DH-CHAP) authentication supporting RADIUS and TACACS+, to help ensure that only authorized devices can access protected storage networks.
• For both FCIP and iSCSI deployments, the comprehensive IPsec protocol suite delivers secure authentication, data integrity, and hardware-based encryption.
FIPS 140-2 Level 3 Compliant
The FIPS standard is an information technology security accreditation program for cryptographic modules produced by private-sector vendors who seek to have their products certified for use in government departments and regulated industries (such as financial and health-care institutions) that collect, store, transfer, share, and disseminate sensitive but unclassified (SBU) information. The FIPS Level 3 standard requires that the systems used to store encryption keys be physically secure, use two-part authentication, produce audit logs showing all accesses, and encrypt all communications between systems. The Cisco MDS 9000 Family 18/4-Port Multiservice FIPS Module is identical to the non-FIPS version in form and function, with the exception of an opaque potting material encapsulating the cryptographic boundary of the Cisco MDS 9000 Family 18/4-Port Multiservice FIPS module.
Advanced Software Packages
The Cisco MDS 9000 Family 18/4-Port Multiservice Module can be further enhanced through additional software packages that offer advanced intelligence and functions. Currently available software packages include the following:
• Cisco MDS 9000 Family SME Package: Cisco SME secures data stored on heterogeneous tape drives and VTLs using the Cisco MDS 9000 Family 18/4-Port Multiservice Module.
• Cisco SAN Extension over IP Package: The Cisco SAN Extension over IP Package provides an integrated, cost-effective, and reliable business continuance solution that uses IP infrastructure by offering FCIP for remote SAN extension, along with a variety of advanced features to optimize the performance and manageability of FCIP links.
Product Specifications
Table 1 lists the product specifications for the Cisco MDS 9000 Family 18/4-Port Multiservice Module and 18/4-Port Multiservice FIPS Module.
Table 1. Product Specifications
Feature
Description
Product compatibility
Cisco MDS 9000 family
Software compatibility
Cisco MDS SAN-OS Software Release 3.2.(1) or later
• RFC 2461 and 2462 IPv6 neighbor discovery and stateless autoconfiguration
• RFC 2464 IPv6/Ethernet
• RFC 3270 iSCSI
• RFC 3643 and 3821 FCIP
Protocols (continued)
• Ethernet standards
• IEEE 802.3z Gigabit Ethernet
• IEEE 802.1Q VLAN
• IPsec
• RFC 2401 Security Architecture for IP
• RFC 2403 and 2404 Hash Message Authentication Code (HMAC)
• RFC 2405, 2406, and 2451 IP Encapsulating Security Payload (ESP)
• RFC 2407 and 2408 Internet Security Association and Key Management Protocol (ISAKMP)
• RFC 2412 OAKLEY Key Determination Protocol
• RFC 3566, 3602, and 3686 AES
• Internet Key Exchange (IKE)
• RFC 2409 IKEv1
• IKEv2, draft
Cards, ports, and slots
18 fixed autosensing 1-, 2-, and 4-Gbps Fibre Channel ports and 4 fixed 1-Gbps Ethernet ports
Features and functions
Fabric services
• Name server
• Internet Storage Name Server (iSNS)
• Registered State Change Notification (RSCN)
• Login services
• Fabric Configuration Server (FCS)
• iSCSI Network Boot (iNBP)
• Private loop
• Public loop
• Translative loop
• Broadcast
• In-order delivery
Advanced functions
• VSAN
• IVR
• PortChannel with multipath load balancing
• Flow-based and zone-based QoS
• Fibre Channel congestion control
• Extended buffer-to-buffer credits
• Hardware-based FCIP compression
• Hardware-based encryption
• Hardware-based data integrity
• FCIP disk write acceleration
• FCIP tape read and write acceleration
• Cisco SME
Diagnostics and troubleshooting tools
• POST diagnostics
• Online diagnostics
• Internal port loopbacks
• SPAN and remote SPAN
• Fibre Channel Traceroute
• Fibre Channel Ping
• Fibre Channel Debug
• Cisco Fabric Analyzer
• Syslog
• Online system health
• Port-level statistics
• Real Time Protocol Debug
Network security
• VSANs
• ACLs
• Per-VSAN RBAC
• Fibre Channel zoning
• N-port world-wide name (WWN)
• N-port FC-ID
• Fx-port WWN
• Fx-port WWN and interface index
• Fx-port domain ID and interface index
• Fx-port domain ID and port number
• LUN
• Read-only
• Broadcast
• iSCSI zoning
• iSCSI name
• IP address
• FC-SP
• DH-CHAP switch-switch authentication
• DH-CHAP host-switch authentication
• Port security and fabric binding
• IPsec for FCIP and iSCSI
• IKEv1 and IKEv2
• Management access
• SSH v2 implementing AES
• SNMPv3 implementing AES
• SFTP
FICON
• FC-SB-3 compliant
• Cascaded and noncascaded FICON fabrics
• Intermix of FICON and Fibre Channel FCP traffic
• CUP management interface
Serviceability
• Configuration file management
• Nondisruptive software upgrades for Fibre Channel interfaces
• Call Home
• Power-management LEDs
• Port beaconing
• System LED
• SNMP traps for alerts
• Network boot
Performance
• Port speed: 1-, 2-, and 4-Gbps autosensing, optionally configurable
• Buffer credits: 16 per port on shared-mode ports, up to 250 per port on dedicated-mode ports, and up to 4095 per individual port on dedicated-mode ports with optional Enterprise Package license activated
• PortChannel: Up to 16 physical links
• FCIP tunnels: Up to 3 per port
Supported Cisco optics, media, and transmission distances
Speed
Media
Distance
1 Gbps-SW, LC SFP
1 Gbps-SW, LC SFP
1 Gbps-SW, LC SFP
1 Gbps-LW, LC SFP
2 Gbps-SW, LC SFP
2 Gbps-SW, LC SFP
2 Gbps-SW, LC SFP
2 Gbps-LW, LC SFP
4 Gbps-SW, LC SFP
4 Gbps-SW, LC SFP
4 Gbps-SW, LC SFP
4 Gbps-MR, LC SFP
4 Gbps-LW, LC SFP
4 Gbps-CWDM, LC SFP
1-Gbps-SX, LC SFP
1-Gbps-SX, LC SFP
1-Gbps-LX/LH, LC SFP
1 Gbps-CWDM, LC SFP
2 Gbps-CWDM, LC SFP
1 Gbps-DWDM, LC SFP
2 Gbps-DWDM, LC SFP
50/125-micron multimode (OM3)
50/125-micron multimode
62.5/125-micron multimode
9/125-micron single-mode
50/125-micron multimode (OM3)
50/125-micron multimode
62.5/125-micron multimode
9/125-micron single-mode
50/125-micron multimode (OM3)
50/125-micron multimode
62.5/125-micron multimode
9/125-micron single-mode
9/125-micron single-mode
9/125-micron single-mode
50/125-micron multimode
62.5/125 micron multimode
9/125 or 10/125 micron single-mode
9/125-micron single-mode
9/125-micron single-mode
9/125-micron single-mode
9/125-micron single-mode
860 m
500 m
300 m
10 km
500 m
300 m
150 m
10 km
380 m
150 m
70 m
4 km
10 km
Up to 25 km (40 km in point-to-point application)
550 m
275 m
10 km
Up to 100 km
Up to 100 km
Up to 200 km
Up to 200 km
Reliability and availability
• Hot-swappable module
• Hot-swappable SFP optics
• Online diagnostics
• Stateful process restart
• Nondisruptive supervisor failover
• Any module, any port configuration for PortChannels
• Fabric-based multipathing
• Per-VSAN fabric services
• Port tracking
• VRRP for management and FCIP or iSCSI connections
Network management
• Access methods through Cisco MDS 9500 Series Supervisor Module
• Out-of-band 10/100 Ethernet port (Supervisor-1 Module)
• Out-of-band 10/100/1000 Ethernet port (Supervisor-2 Module)
• RS-232 serial console port
• In-band IP-over-Fibre Channel
• DB-9 COM port
• Access protocols
• CLI through console and Ethernet ports
• SNMPv3 through Ethernet port and in-band IP-over-Fibre Channel access
• Storage Networking Industry Association (SNIA) Storage Management Initiative Specification (SMI-S)
• Distributed Device Alias service
• Network security
• Per-VSAN RBAC using RADIUS and TACACS+ based authentication, authorization, and accounting (AAA) functions
