-
Cisco MDS 9000 Family Fabric Manager Configuration Guide, Release 3.4(1a)
-
Index
-
New and Changed Information
-
Preface
- Getting Started
- Installation and Switch Management
- Switch Configuration
-
Fabric Configuration
-
Configuring and Managing VSANs
-
SAN Device Virtualization
-
Creating Dynamic VSANs
-
Configuring Inter-VSAN Routing
-
Configuring and Managing Zones
-
Distributing Device Alias Services
-
Configuring Fibre Channel Routing Services and Protocols
-
Dense Wavelength Division Multiplexing
-
Managing FLOGI, Name Server, FDMI, and RSCN Databases
-
Discovering SCSI Targets
-
Configuring FICON
-
Advanced Features and Concepts
-
-
Security
-
Configuring FIPS
-
Configuring Users and Common Roles
-
Configuring SNMP
-
Configuring RADIUS and TACACS+
-
Configuring IPv4 Access Control Lists
-
Configuring Certificate Authorities and Digital Certificates
-
Configuring IPsec Network Security
-
Configuring FC-SP and DHCHAP
-
Configuring Port Security
-
Configuring Fabric Binding
-
- IP Services
- Intelligent Storage Services
- Network and Switch Monitoring
- Traffic Management
- Troubleshooting
-
Launching Fabric Manager in Cisco SAN-OS Releases Prior to 3.2(1)
-
Cisco Fabric Manager Unsupported Feature List
-
Interface Nonoperational Reason Codes
-
Managing Cisco FabricWare
-
Configuration Limits for Cisco MDS SAN-OS Release 3.1(x) and 3.2(x)
-
Feedback
Table Of Contents
Port Security Versus Fabric Binding
Forcing Fabric Binding Activation
Saving Fabric Binding Configurations
Clearing the Fabric Binding Statistics
Deleting the Fabric Binding Database
Verifying Fabric Binding Configurations
Configuring Fabric Binding
This chapter describes the fabric binding feature provided in the Cisco MDS 9000 Family of directors and switches. It includes the following sections:
About Fabric Binding
The fabric binding feature ensures ISLs are only enabled between specified switches in the fabric binding configuration. Fabric binding is configured on a per-VSAN basis.
This feature helps prevent unauthorized switches from joining the fabric or disrupting current fabric operations. It uses the Exchange Fabric Membership Data (EFMD) protocol to ensure that the list of authorized switches is identical in all switches in the fabric.
This section has the following topics:
•
Port Security Versus Fabric Binding
Licensing Requirements
Fabric binding requires that you install either the MAINFRAME_PKG license or the ENTERPRISE_PKG license on your switch.
See Chapter 10, "Obtaining and Installing Licenses," for more information on license feature support and installation.
Port Security Versus Fabric Binding
Port security and fabric binding are two independent features that can be configured to complement each other. Table 38-1 compares the two features.
Port-level checking for xE ports is as follows:
•
•
–
–
While port security complements fabric binding, they are independent features and can be enabled or disabled separately.
Fabric Binding Enforcement
To enforce fabric binding, configure the switch world wide name (sWWN) to specify the xE port connection for each switch. Enforcement of fabric binding policies are done on every activation and when the port tries to come up. In a FICON VSAN, the fabric binding feature requires all sWWNs connected to a switch and their persistent domain IDs to be part of the fabric binding active database. In a Fibre Channel VSAN, only the sWWN is required; the domain ID is optional.
Note
Fabric Binding Configuration
To configure fabric binding in each switch in the fabric, follow these steps.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Enabling Fabric Binding
The fabric binding feature must be enabled in each switch in the fabric that participates in the fabric binding. By default, this feature is disabled in all switches in the Cisco MDS 9000 Family. The configuration and verification commands for the fabric binding feature are only available when fabric binding is enabled on a switch. When you disable this configuration, all related configurations are automatically discarded.
To enable fabric binding on any participating switch, follow these steps:
View the status of the fabric binding feature of a fabric binding-enabled switch by issuing the show fabric-binding status command.
switch# show fabric-binding statusVSAN 1:Activated databaseVSAN 4:No Active databaseConfiguring Switch WWN List
A user-specified fabric binding list contains a list of switch WWNs (sWWNs) within a fabric. If an sWWN attempts to join the fabric, and that sWWN is not on the list or the sWWN is using a domain ID that differs from the one specified in the allowed list, the ISL between the switch and the fabric is automatically isolated in that VSAN and the switch is denied entry into the fabric.
The persistent domain ID can be specified along with the sWWN. Domain ID authorization is required in FICON VSANs where the domains are statically configured and the end devices reject a domain ID change in all switches in the fabric. Domain ID authorization is not required in Fibre Channel VSANs.
To configure a list of sWWNs and domain IDs for a FICON VSAN, follow these steps:
To configure a list of sWWNs and optional domain IDs for a Fibre Channel VSAN, follow these steps:
Fabric Binding Activation
The fabric binding feature maintains a configuration database (config-database) and an active database. The config-database is a read-write database that collects the configurations you perform. These configurations are only enforced upon activation. This activation overwrites the active database with the contents of the config- database. The active database is read-only and is the database that checks each switch that attempts to log in.
By default, the fabric binding feature is not activated. You cannot activate the fabric binding database on the switch if entries existing in the configured database conflict with the current state of the fabric. For example, one of the already logged in switches may be denied login by the config-database. You can choose to forcefully override these situations.
Note
To activate the fabric binding feature, follow these steps:
Forcing Fabric Binding Activation
If the database activation is rejected due to one or more conflicts listed in the previous section, you may decide to proceed with the activation by using the force option.
To forcefully activate the fabric binding database, follow these steps:
Saving Fabric Binding Configurations
When you save the fabric binding configuration, the config database is saved to the running configuration.
Caution
•
switch# fabric-binding database copy vsan 1•
switch# fabric-binding database diff active vsan 1•
switch# fabric-binding database diff config vsan 1•
switch# copy running-config startup-configClearing the Fabric Binding Statistics
Use the clear fabric-binding statistics command to clear all existing statistics from the fabric binding database for a specified VSAN.
switch# clear fabric-binding statistics vsan 1Deleting the Fabric Binding Database
Use the no fabric-binding command in configuration mode to delete the configured database for a specified VSAN.
switch(config)# no fabric-binding database vsan 10Verifying Fabric Binding Configurations
Use the show commands to display all fabric binding information configured on this switch (see Examples 38-1 to 38-9).
Example 38-1 Displays Configured Fabric Binding Database Information
switch# show fabric-binding database--------------------------------------------------Vsan Logging-in Switch WWN Domain-id--------------------------------------------------1 21:00:05:30:23:11:11:11 0x66(102)1 21:00:05:30:23:1a:11:03 0x19(25)1 20:00:00:05:30:00:2a:1e 0xea(234) [Local]4 21:00:05:30:23:11:11:11 Any4 21:00:05:30:23:1a:11:03 Any4 20:00:00:05:30:00:2a:1e 0xea(234) [Local]61 21:00:05:30:23:1a:11:03 0x19(25)61 21:00:05:30:23:11:11:11 0x66(102)61 20:00:00:05:30:00:2a:1e 0xea(234) [Local][Total 7 entries]Example 38-2 Displays Active Fabric Binding Information
switch# show fabric-binding database active--------------------------------------------------Vsan Logging-in Switch WWN Domain-id--------------------------------------------------1 21:00:05:30:23:11:11:11 0x66(102)1 21:00:05:30:23:1a:11:03 0x19(25)1 20:00:00:05:30:00:2a:1e 0xea(234) [Local]61 21:00:05:30:23:1a:11:03 0x19(25)61 21:00:05:30:23:11:11:11 0x66(102)61 20:00:00:05:30:00:2a:1e 0xef(239) [Local]Example 38-3 Displays Configured VSAN-Specific Fabric Binding Information
switch# show fabric-binding database vsan 4--------------------------------------------------Vsan Logging-in Switch WWN Domain-id--------------------------------------------------4 21:00:05:30:23:11:11:11 Any4 21:00:05:30:23:1a:11:03 Any4 20:00:00:05:30:00:2a:1e 0xea(234) [Local][Total 2 entries]Example 38-4 Displays Active VSAN-Specific Fabric Binding Information
switch# show fabric-binding database active vsan 61--------------------------------------------------Vsan Logging-in Switch WWN Domain-id--------------------------------------------------61 21:00:05:30:23:1a:11:03 0x19(25)61 21:00:05:30:23:11:11:11 0x66(102)61 20:00:00:05:30:00:2a:1e 0xef(239) [Local][Total 3 entries]Example 38-5 Displays Fabric Binding Statistics
switch# show fabric-binding statisticsStatistics For VSAN: 1------------------------Number of sWWN permit: 0Number of sWWN deny : 0Total Logins permitted : 0Total Logins denied : 0Statistics For VSAN: 4------------------------Number of sWWN permit: 0Number of sWWN deny : 0Total Logins permitted : 0Total Logins denied : 0Statistics For VSAN: 61------------------------Number of sWWN permit: 0Number of sWWN deny : 0Total Logins permitted : 0Total Logins denied : 0Statistics For VSAN: 345------------------------Number of sWWN permit: 0Number of sWWN deny : 0Total Logins permitted : 0Total Logins denied : 0Statistics For VSAN: 346------------------------Number of sWWN permit: 0Number of sWWN deny : 0Total Logins permitted : 0Total Logins denied : 0Statistics For VSAN: 347------------------------Number of sWWN permit: 0Number of sWWN deny : 0Total Logins permitted : 0Total Logins denied : 0Statistics For VSAN: 348------------------------Number of sWWN permit: 0Number of sWWN deny : 0Total Logins permitted : 0Total Logins denied : 0Statistics For VSAN: 789------------------------Number of sWWN permit: 0Number of sWWN deny : 0Total Logins permitted : 0Total Logins denied : 0Statistics For VSAN: 790------------------------Number of sWWN permit: 0Number of sWWN deny : 0Total Logins permitted : 0Total Logins denied : 0Example 38-6 Displays Fabric Binding Status for Each VSAN
switch# show fabric-binding statusVSAN 1 :Activated databaseVSAN 4 :No Active databaseVSAN 61 :Activated databaseVSAN 345 :No Active databaseVSAN 346 :No Active databaseVSAN 347 :No Active databaseVSAN 348 :No Active databaseVSAN 789 :No Active databaseVSAN 790 :No Active databaseExample 38-7 Displays Fabric Binding Violations
switch# show fabric-binding violations-------------------------------------------------------------------------------VSAN Switch WWN [domain] Last-Time [Repeat count] Reason-------------------------------------------------------------------------------2 20:00:00:05:30:00:4a:1e [0xeb] Nov 25 05:46:14 2003 [2] Domain mismatch3 20:00:00:05:30:00:4a:1e [*] Nov 25 05:44:58 2003 [2] sWWN not found4 20:00:00:05:30:00:4a:1e [*] Nov 25 05:46:25 2003 [1] Database mismatch
Note
Example 38-8 Displays EFMD Statistics
switch# show fabric-binding efmd statisticsEFMD Protocol Statistics for VSAN 1----------------------------------------Merge Requests -> Transmitted : 0 , Received : 0Merge Accepts -> Transmitted : 0 , Received : 0Merge Rejects -> Transmitted : 0 , Received : 0Merge Busy -> Transmitted : 0 , Received : 0Merge Errors -> Transmitted : 0 , Received : 0EFMD Protocol Statistics for VSAN 4----------------------------------------Merge Requests -> Transmitted : 0 , Received : 0Merge Accepts -> Transmitted : 0 , Received : 0Merge Rejects -> Transmitted : 0 , Received : 0Merge Busy -> Transmitted : 0 , Received : 0Merge Errors -> Transmitted : 0 , Received : 0EFMD Protocol Statistics for VSAN 61----------------------------------------Merge Requests -> Transmitted : 0 , Received : 0Merge Accepts -> Transmitted : 0 , Received : 0Merge Rejects -> Transmitted : 0 , Received : 0Merge Busy -> Transmitted : 0 , Received : 0Merge Errors -> Transmitted : 0 , Received : 0Example 38-9 Displays EFMD Statistics for a Specified VSAN
switch# show fabric-binding efmd statistics vsan 4EFMD Protocol Statistics for VSAN 4----------------------------------------Merge Requests -> Transmitted : 0 , Received : 0Merge Accepts -> Transmitted : 0 , Received : 0Merge Rejects -> Transmitted : 0 , Received : 0Merge Busy -> Transmitted : 0 , Received : 0Merge Errors -> Transmitted : 0 , Received : 0Default Settings
Table 38-2 lists the default settings for the fabric binding feature.
