HP Fabric OS v7.0.1, Administrator'S Manual

Page: 350 / 584

312 Fabric OS Administrator’s Guide
53-1002446-01
Configuring encryption and compression
14
Virtual Fabrics considerations
The E_Ports in the user-created logical switch, base switch, or default switch can support
encryption and compression. You can configure encryption on XISL ports, but not on LISL ports.
However, frames from the LISL ports are implicitly encrypted or compressed as they pass through
encryption/compression enabled XISL ports.
If an encryption or compression enabled port needs to be moved from one logical switch to another
logical switch, the movement of the port is blocked. You must disable the encryption and
compression configurations before moving the port, and then enable encryption and compression
after the port has moved.
Recommendation for compression
When configuring compression on long distance ports, it is recommended to configure the long
distance ports with double the number of buffers. This can be done by configuring the port with
long distance LS mode and specifying the number of buffers to allocate to the port.
Configuring encryption and compression
On a given ISL between two 16 Gbps E_Ports, you can configure each port for encryption,
compression, or both. Your encryption and compression settings must match at either end of the
ISL. Port segmentation will occur during port initialization if these configurations do not match.
Before configuring a port for encryption, you must configure the port for authentication using the
authUtil and secAuthSecret commands:
•
Use the authUtil command to enable switch authentication, enable the DH-CHAP
authentication protocol for ports that support encryption, and select the appropriate DH
(Diffie-Hellman) group (4 or “*”).
To enable switch authentication, use the authUtil
--
policy command with the -sw option to
select either the on mode or the active mode.
To enable the DH-CHAP authentication protocol, use the authUtil
--
set command with the -a
option and select either dhchap or all. dhchap explicitly specifies the DH-CHAP protocol.
Although all enables both FCAP and DH-CHAP, the active protocol defaults to DH-CHAP for all
ports configured for in-flight encryption.
To select the appropriate DH group, use the authUtil
--
set command with the -g option and
choose either group 4 or “*”. If “*” is entered, then group 4 is selected from a list.
•
Use the secAuthSecret command to configure a pre-shared secret on both sides of the ISL for
all ports configured for in-flight encryption. A secret of at least 32 characters is recommended.
Maximum is 40 characters.
Port segmentation will occur during port initialization if authentication fails.
If you need to disable authentication on a port that has encryption or compression configured, you
must first disable encryption or compression on the port, and then disable authentication.