Lenovo ThinkSystem NE2552E, Application Manual

Page: 253 / 574

© Copyright Lenovo 2018 Chapter 15: Fibre Channel over Ethernet
253
 After successful completion of each FLOGI, ensure that FCoE frames may only
be addressed to the FCFs that accept them.
Initially, a basic set of FCoE ‐ related ACLs will be installed on all ports where FIP
snooping is enabled. As the switch encounters FIP frames and learns about FCFs
and ENodes that are attached or disconnect, ACLs are dynamically installed or
expanded to provide appropriate security.
When an FCoE connection logs out, or times out (if ACL timeout is enabled), the
related ACLs will be automatically removed.
FCoE ‐ related ACLs are independent of manually configured ACLs used for
regular Ethernet purposes. FCoE ACLs generally have a higher priority over
standard ACLs.
FCoE VLANs
Before the switch applies FIP Snooping, all internal switch ports connected to
ENodes and all external ports connected to FCFs should be members of at least one
common VLAN (for example, VLAN 1). This allows the ENode CNA and the FCF
to exchange initial FIP VLAN request and notification packets. Once FIP Snooping
is applied, FCoE packets are exchanged using one configured FCoE VLAN for each
attached FCF.
Each ENode port must have VLAN tagging enabled, and must belong to the same
VLAN as the FCF to which it will connect. In topologies where a single FCF is
connected to the switch, all ENode and FCF ports belong to the same VLAN
(typically VLAN 1002). When multiple FCFs are connected to the switch, each FCF
must be assigned a unique VLAN, and each ENode must be assigned to the VLAN
for only one particular FCF.
The administrator must ensure that the VLAN configured for each FCF and its
ENodes is supported by the participating FCF and ENode CNAs.
Note:
FCoE ports can have any native VLAN. A Fibre Channel VLAN must not be
configured as the native VLAN for FCoE ports.
Viewing FIP Snooping Information
ACLs automatically generated under FIP snooping are independent of regular,
manually configure ACLs, and are not listed with regular ACLs in switch
information and statistics output. Instead, FCoE ACLs are shown using the
following CLI commands:
For example:
NE2552E# show fcoe fips information
(Show all FIP ‐ related information)
NE2552E# show fcoe fips port
<ports>
information
(Show FIP info for a selected port)
NE2552E# show fcoe fips port ext4 information
FIP Snooping on port ext4:
This port has been detected to be an FCF port.
FIPS ACLs configured on this port:
Ethertype 0x8914, action permit.
dmac 00:00:18:01:00:XX, Ethertype 0x8914, action permit.