HP A7533A - Brocade 4Gb SAN Switch Base, Administrator'S Manual

Page: 126 / 576

124 Configuring advanced security features
stale policies in the current Logical Switch or delete the stale policies after the port movements. Use the
secPolicyDelete
command to delete stale DCC policies.
DCC policy restrictions
The following restrictions apply when using DCC policies:
• Some older private-loop HBAs do not respond to port login from the switch and are not enforced by the
DCC policy. This does not create a security problem because these HBAs cannot contact any device
outside of their immediate loop.
• DCC policies cannot manage or an iSCSI connection; that is, an FC Initiator connection from an iSCSI
gateway.
• You cannot manage proxy devices with DCC policies. Proxy devices are always granted full access,
even if the DCC policy has an entry that restricts or limits access of a proxy device.
Creating a DCC policy
The following standards apply when creating a DCC policy:
• DCC policies must follow the naming convention
DCC_POLICY_ nnn
, where nnn represents a unique
string. The maximum length is 30 characters, including the prefix DCC_POLICY_.
• Device ports must be specified by port WWN. Switch ports can be identified by the switch WWN,
domain ID, or switch name followed by the port or area number. To specify an allowed connection,
enter the device port WWN, a semicolon, and the switch port identification.
The following methods of specifying an allowed connection are possible:
•
deviceportWWN;switchWWN
(port or area number)
•
deviceportWWN;domainID
(port or area number)
•
deviceportWWN; switchname
(port or area number)
To create a DCC policy:
1. Connect to the switch and log in using an account assigned to the admin role.
2. Enter the
secPolicyCreate “DCC_POLICY_ nnn ”, “ member ; ... ; member ”
command.
where:
DCC_POLICY_ nnn
is the name of the DCC policy
nnn
is a string consisting of up to 19 alphanumeric or underscore characters to differentiate it from any
other DCC policies
the
member contains device or switch port information:
deviceportWWN;switch(port)
where:
3. To save or activate the new policy, enter the appropriate command:
• To save the policy, enter the
secPolicySave
command.
deviceportWWN
The WWN of the device port.
switch
The switch WWN, domain ID, or switch name. The port can be
specified by port or area number. Designating ports automatically
includes the devices currently attached to those ports. The ports can
be specified using any of the following syntax methods:
(*) Selects all ports on the switch.
(1-6) Selects ports 1 through 6.
[*] Selects all ports and all devices attached to those ports.
[3, 9] Selects ports 3 and 9 and all devices attached to those ports.
[1-3, 9] Selects ports 1, 2, 3, 9, and all devices attached to those
ports.
“*” This can be used to indicate DCC lockdown. This will create a
unique policy for each port in the fabric, locking it down to the
device connected or creating an empty policy to disallow any
device to be connected to it. This can be done only when there are
no other DCC policies defined on the switch.