Creating and Editing SAN Fabrics, Release 4.3.1

 
Updated August 22, 2026
PDF
Is this helpful? Feedback

New and changed information

The following table provides an overview of the significant changes up to this current release. The table does not provide an exhaustive list of all changes or of the new features up to this release.

Release Version Feature Description

Nexus Dashboard 4.3.1

Support for CyberArk credential store for SAN fabrics

Beginning with this release, you can use a configured CyberArk credential store for Cisco MDS Fibre Channel (FC) switch discovery credentials when you add or edit a SAN fabric. You can also use CyberArk credential-store keys for SAN device credentials. For more information, see Add a fabric, Edit a fabric, and Edit device credentials for SAN switches.

View SAN fabrics

To view the SAN fabrics in your Nexus Dashboard:

  1. Navigate to Fabrics:

    Manage > Fabrics

  2. Review the information provided in Fabrics on the SAN fabrics that have been configured in your Nexus Dashboard.

    The following table describes the fields that appear in Fabrics.

    Field Description

    Fabric Name

    Specifies the name of the fabric.

    Seed Switch

    Specifies the seed switch used to discover switches in the fabric.

    State

    Specifies the state of the fabric.

    SNMPv3/SSH

    Specifies if SNMP and SSH access is allowed.

    User/Community

    Specifies the role of the user who created the fabric.

    Auth/Privacy

    Displays the authentication type.

    Licensed

    Specifies if all the switches in the fabric are licensed or not.

    Health

    Displays the health of the fabric.

    Performance Collection

    Specifies if performance collection is enabled or disabled on the fabric.

    Updated Time

    Specifies the time when the fabric was created or updated.

    Incl. VSANS

    Specifies the VSANS included with the fabric.

    Excl. VSANS

    Specifies the excluded VSANS.

    The following table describes the action items in the Actions menu drop-down list that appear in Fabrics.

    Action Item Description

    Add Fabric

    From the Actions drop-down list, select Add Fabric. For more instructions, see Add a fabric.

    Edit Fabrics

    Select a fabric to edit. From the Actions drop-down list, select Edit Fabrics. Make the necessary changes and click Apply. For more instructions, see Edit a fabric.

    Delete Fabrics

    Select one or more fabrics to delete. From the Actions drop-down list, select Delete Fabrics. Click Confirm to delete the fabrics. For more instructions, see Delete a fabric.

    Rediscover Fabrics

    Allows you to rediscover the switches, links, and end devices associated with the fabric. Select one or more fabrics to rediscover. From the Actions drop-down list, select Rediscover Fabrics. A progress bar in the State column displays the rediscovery progress. For more instructions, see Rediscover a fabric.

    Purge Fabrics

    Allows you to purge non-existent switches, links, and end devices of the fabric. Select one or more fabrics to purge. From the Actions drop-down list, select Purge Fabrics. For more instructions, see Purge a fabric.

    Configure Performance

    Allows you to enable performance monitoring on links, switch interfaces, and end devices associated with the fabric. Select one or more fabrics for performance monitoring. From the Actions drop-down list, select Configure Performance. Make the necessary changes and click Apply. For more instructions, see Working with Reports for SAN Fabrics.

    Configure SAN Insights

    Allows you configure SAN Insights on the selected fabric. For more instructions, see SAN Insights.

    Configure Backup

    Allows you to configure and schedule backup for the fabric data. For more instructions, see Backing Up and Restoring Your SAN Fabric.

View SAN fabric summary information

To view SAN fabric summary information:

  1. Navigate to Fabrics:

    Manage > Fabrics

  2. Click on a SAN fabric to open a drawer with information on that SAN fabric.

    The following sections display the summary of the SAN fabric:

    • Health - Shows the health of the SAN fabric.

    • Alarms - Displays the alarms based on the categories.

    • Switch Health: Displays the number of switches in the SAN fabric and the switch health information.

    • Switch Interfaces: Displays the number of switch interfaces in the SAN fabric, along with this information:

      • Oper. Status:

      • Admin Status: Specifies the administration status of an interface, depending on the action taken on an interface. Possible states:

        • Up: Reflects the state of a switch interface where a No Shutdown action was performed (Actions > No Shutdown).

        • Down: Reflects the state of a switch interface where a Shutdown action was performed (Actions > Shutdown)

Click the Launch icon to the right top corner to view the Fabric Overview for a SAN fabric. See Understanding Fabric Overview for SAN Fabrics for more information.

Add a fabric

To add a SAN fabric:

  1. Navigate to Fabrics:

    Manage > Fabrics

  2. Choose Actions > Add Fabrics.

  3. In the Fabric Name field, enter a unique name for the fabric.

  4. Select the Fabric Seed Switch Type.

    Nexus Dashboard allows you to discover Cisco and Non-Cisco switches to SAN Fabrics.

  5. If you chose Cisco in the Fabric Seed Switch Type, complete these steps:

    1. In the Fabric Seed Switch field, enter the IP address of the seed switch.

      Use the IP address of the management interface (mgmt0). You can also enter the DNS name of the seed switch.

    2. Check the SNMPv3/SSH check box to enable access.

    3. From the Authentication / Privacy drop-down list, choose the authentication setting for switch discovery.

    4. Provide the Cisco MDS FC switch discovery credentials by using one of the following methods:

      • To use locally stored credentials, click the Local tab and enter the User Name and Password.

        note.svg

        If you do not use SNMPv3/SSH, enter the community string in the Community String field.

      • To use CyberArk credentials, click the Credential store tab and enter the Credential store key.

        When you use a credential store key and AAA remote authentication passthrough is not enabled, Nexus Dashboard retrieves the credentials from the external credential store during SAN discovery and subsequent fabric operations.

        note.svg

        • The Credential store tab is available only when you configure a system certificate and map it to the CyberArk feature. For CA certificate information, refer to Managing Certificates in your Nexus Dashboard. For credential store information, refer to AAA remote authentication passthrough for SAN fabrics.

        • Credential store support for SAN applies only to Cisco MDS FC switch credentials. It does not apply to UCS fabric interconnect (FI) credentials or other integrations in this workflow.

        The User Name and Password that you enter for the seed switch are the SAN discovery credentials. You can configure one discovery credential for each fabric.

        Beginning with Nexus Dashboard 4.3.1, you can provide SAN discovery credentials as local credentials or as a credential store key. Nexus Dashboard uses the discovery credentials to update switch inventory information every 5 minutes.

    5. To discover switches using VSANs only, check the Limit Discovery by VSAN check box.

      • Choose Included VSAN List to discovery switches included in VSANs.

      • Choose Excluded VSAN List to discovery switches excluded in VSANs.

      • Enter the included or excluded VSANs in the VSAN List field.

    6. To discover UCS fabric interconnects (FIs) using UCS credentials, check the Use UCS Credentials check box.

      • Enter the appropriate UCS CLI Credentials in the UCS User Name and UCS Password fields.

      • To use the same SNMP credentials, check the Use same SNMP Credentials for UCS check box.

        You must provide different SNMP details if you uncheck this check box.

      • To use Simple Network Management Protocol version 3 (SNMPv3) for UCS, check the Use SNMPv3 for UCS check box.

      • From the UCS Authentication / Privacy drop-down list, choose the appropriate authentication with privacy for UCS fabric interconnect discovery.

      note.svg

      Cisco UCS Manager Release 3.2(3) and later releases do not support SNMPv3 users without Advanced Encryption Standard (AES) encryption, and it does not support Message-Digest Algorithm 5 (MD5) authentication if SNMPv3 is in Federal Information Processing Standards (FIPS) mode.

      • In the UCS SNMP User Name and UCS SNMP Password fields, enter the appropriate details to access the UCS FIs if SNMPv3 is used.

        note.svg

        If SNMPv3/SSH is not used, enter the appropriate community string in the UCS SNMP Community String field.

      • Enter the appropriate community string in the UCS SNMP Community String field, if SNMPv3 is not used.

    7. To monitor metrics for the attached UCS FIs in IMM, check the Monitor Intersight checkbox. The Intersight credentials are necessary for obtaining inventory and metrics information. For more information, see Working with Cisco Intersight.

      • Enter the Intersight region in the Intersight Region field.

      • Generate the API key ID in Intersight > API Keys and add it to API Key ID in Nexus Dashboard. Save the secret key for uploading to Nexus Dashboard.

      • Enter the Account ID in Nexus Dashboard that you obtained from Intersight > Account Details.

      • Browse to and upload the saved secret key from Intersight to Intersight Secret Key File in Nexus Dashboard.

      • Once configured and saved, you can view your Intersight integration on the Nexus Dashboard Topology page. You can view the associated blade servers, vNICs, and vHBAs.

  6. If you chose Non-Cisco in the Fabric Seed Switch Type, follow these steps:

    1. In the Fabric Seed Switch field, enter the IP address of the seed switch.

      You can also enter the DNS name of the seed switch.

    2. Check the SNMPv3/SSH check box to enable access.

    3. From the Authentication / Privacy drop-down list, choose the appropriate authentication for switch discovery.

    4. In the User Name and Password fields, enter the appropriate details to access the switches.

    5. In the Non-Cisco Switch CLI Credentials, provide appropriate username and password to access non-Cisco seed switch.

    6. To discover UCS FIs using UCS credentials, check the Use UCS Credentials check box.

      • Enter the appropriate UCS CLI Credentials in the UCS Username and UCS Password fields.

      • To use the same SNMP credentials, check the Use same SNMP Credentials for UCS check box.

        You must provide different SNMP details if you uncheck this check box.

      • To use SNMPv3 for UCS, check the Use SNMPv3 for UCS check box.

        From the UCS Authentication / Privacy drop-down list, choose the appropriate authentication with privacy for discovery of UCS fabric interconnects.

        Enter the UCS SNMP username and password in the appropriate fields.

      • If Use SNMPv3 for UCS is unchecked, enter the appropriate community string in the UCS SNMP Community String field.

  7. Click Add to add a fabric.

    note.svg

    When you start SAN fabric discovery, after 15 minutes of fabric discovery the following process is scheduled on Nexus Dashboard:

    • If the fabric is licensed, Performance Manager (PM) collection is initiated.

    • The congestion analysis job is scheduled to run continuously for a year. This job run will initiate after an hour of the schedule.

ESXi Networking for Promiscuous Mode

You can run Nexus Dashboard on top of virtual Nexus Dashboard (vND) instance with promiscuous mode that is disabled on port groups that are associated with Nexus Dashboard interfaces where External Service IP addresses are specified. vND comprises Nexus Dashboard management interface and data interface. By default, for fabric controller persona, two external service IP addresses are required for the Nexus Dashboard management interface subnet.

Enabling promiscuous mode raises the risk of security issues in Nexus Dashboard, so we recommend that you set the default setting for promiscuous mode.

note.svg

  • You can disable promiscuous mode when Nexus Dashboard nodes are layer-3 adjacent on the Data network, BGP is configured, and fabric switches are reachable through the data interface.

  • You can disable promiscuous mode when Nexus Dashboard interfaces are layer-2 adjacent to switch mgmt0 interface.

If Inband management or EPL is enabled, you must specify External Service IP addresses in the Nexus Dashboard data interface subnet. You can disable promiscuous mode for the Nexus Dashboard data or fabric interface port-group. For more information, refer to the Cisco Nexus Dashboard Deployment Guide.

note.svg

The default option for promiscuous mode is Reject.

  1. Log into your vSphere Client.

  2. Navigate to the ESXi host.

  3. Right-click the host and choose Settings.

    A sub-menu appears.

  4. Choose Networking > Virtual Switches.

    All the virtual switches appear as blocks.

  5. Click Edit Settings of the VM Network.

  6. Navigate to the Security tab.

  7. Update the Promiscuous mode settings as follows:

    • Check the Override check box.

    • Choose Accept from the drop-down list.

  8. Click OK.

Edit a fabric

To edit a SAN fabric:

  1. Choose Manage > Fabrics

  2. Select a SAN fabric to edit.

  3. Choose Actions > Edit Fabrics.

  4. In the Edit Fabric window, you can edit only one fabric at a time.

  5. Check the Use SNMPv3 / SSH check box, if applicable.

    • If you uncheck the Use SNMPv3 / SSH check box, the Community String field appears. Enter the appropriate community string in the Community String field.

    • If you check the Use SNMPv3/SSH check box, these fields appear:

      • Authentication/Privacy: From Authentication/Privacy, choose one of these options for switch discovery:

        • MD5

        • SHA

        • SHA2_224

        • SHA2_256

        • SHA2_384

        • SHA2_512

        • MD5_DES

        • MD5_AES

        • SHA_DES

        • SHA_AES

        • SHA2_224_AES

        • SHA2_256_AES

        • SHA2_384_AES

        • SHA2_512_AES

          note.svg

          The options with _DES or _AES are related to privacy. You need to select one of these options for enforcePriv or globalEnforcePriv. _AES only supports AES-128 encryption.

    • To use locally stored credentials, click the Local tab and enter the appropriate details in the User Name and Password fields.

      note.svg

      The Password should be the same for both authentication and privacy.

    • To use credentials from CyberArk, click the Credential store tab and enter the Credential store key.

      note.svg

  6. Change the status to Managed, Unmanaged, or Managed Continuously, if necessary.

  7. Check the Use UCS Credentials check box if you want to modify UCS credentials.

  8. Check the Monitor Intersight option, if necessary.

  9. Click Apply to save the changes.

Edit device credentials for SAN switches

After you discover a SAN fabric, Nexus Dashboard automatically saves device credentials for the user who performed the discovery. If you did not discover the fabric, configure your credentials in Manage > Device Credentials.

Nexus Dashboard uses device credentials for SAN operations that require switch access, including viewing zoning information and pushing configuration changes to switches. Each user has a separate device credential for a fabric.

Before you begin, if you plan to use CyberArk, ensure that the required SSH or SNMPv3 credential-store keys exist for each device.

Follow these steps to edit device credentials for SAN switches:

  1. Choose Manage > Device Credentials.

  2. Locate the SAN switch to update and choose Actions > Edit.

  3. . Select one of the following options to provide the SAN device credentials:

    • To use locally stored credentials, click the Local tab and enter the required details in the Username and Password/Community fields.

    • To use credentials from CyberArk, click the Credential store tab and enter the Credential store key.

      When you use a credential store key and AAA remote authentication passthrough is not enabled, Nexus Dashboard retrieves the credentials from CyberArk to validate the credentials and push SAN configuration changes.

      note.svg

      The Credential store tab is visible only if you have configured a system certificate and mapped it to the CyberArk feature. For more information about CA certificates and credential store, see Managing Certificates in your Nexus Dashboard and AAA remote authentication passthrough for SAN fabrics.

  4. From the SNMPv3/SSH drop-down list, choose the required option.

  5. From the Auth/Privacy drop-down list, choose the appropriate authentication and privacy option.

  6. Click Save.

Verify CyberArk credential store configuration for SAN fabrics

Follow these steps to verify that the CyberArk credential store is configured correctly for SAN fabrics:

  1. Verify the credential store status as follows:

    1. Choose Admin > Users and Security > Security > Credentials store.

    2. Confirm that the CyberArk store displays as Connected. If needed, click Resync to refresh the status.

  2. Verify fabric discovery as follows:

    1. Choose Manage > Fabrics.

    2. Confirm that the SAN fabric is healthy and all expected switches are discovered.

      If discovery fails, check the store key and the CyberArk account contents and permissions.

  3. Verify device credentials as follows:

    1. Choose Manage > Device Credentials.

    2. Select the required SAN fabric row and click Actions > Validate to validate the saved credentials.

  4. Test a configuration operation by performing a minor configuration change on a SAN switch to confirm credentials are retrieved and applied successfully.

  5. Check for errors. If you see an Invalid credential store key error, do the following:

    1. Verify that the key exists in CyberArk.

    2. Ensure that the system certificate is mapped to the CyberArk feature in Admin > Certificate Management.

    3. Confirm that Nexus Dashboard can reach the CCP URL.

Delete a fabric

When the orchestration feature is enabled on a fabric, the Delete Fabric option remains disabled. To delete a fabric, you must first disable its orchestration feature.

To delete a SAN fabric:

  1. Navigate to Fabrics:

    Manage > Fabrics

  2. Choose the SAN fabric that you want to delete.

  3. Click Actions > Delete Fabrics to remove the fabric from the data source and to discontinue data collection for that fabric.

Rediscover a fabric

To rediscover a SAN fabric:

  1. Navigate to Fabrics:

    Manage > Fabrics

  2. Choose a SAN fabric to rediscover.

  3. Click Actions > Rediscover Fabrics.

  4. Click Yes in the dialog box.

    In a fabric window, State column displays the progress of rediscovery for the selected fabric.

    The SAN fabric is rediscovered.

Purge a fabric

You can clean and update the fabric discovery table through the Purge option.

  1. Navigate to Fabrics:

    Manage > Fabrics

  2. Choose a SAN fabric to purge.

  3. Choose Action > Purge Fabrics.

    The SAN fabric is purged.

You can also purge a fabric from Topology:

  1. Navigate to Topology:

    Home > Topology

  2. Right-click on the SAN fabric that you want to purge, then click Purge Down Fabric.

    The SAN fabric is purged.

Copyright

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

© 2017-2026 Cisco Systems, Inc. All rights reserved.

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
https://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883

Need help?