HP AE370A - Brocade 4Gb SAN Switch 4/12, Руководство администратора

Страница: 104 / 447

104 Configuring advanced security
Configuring ACL policies
All policy modifications are saved in volatile memory until those changes are saved or activated. You can
create multiple sessions to the switch from one or more hosts. However, Fabric OS allows only one ACL
transaction at a time. If a second ACL transaction is started, it fails.
The Secure Fabric OS and Fabric OS SCC and DCC policies are not interchangeable. Uploading and
saving a copy of the Fabric OS configuration after creating policies is strongly recommended. Use the
configUpload
command to upload a copy of the configuration file. For more information about this
command, see the Fabric OS Command Reference .
NOTE: All changes, including the creation of new policies, are saved and activated on the local switch
only—unless the switch is in a fabric that has a strict or tolerant fabric-wide consistency policy for the ACL
policy type (SCC or DCC). See ” Distributing the policy database ” on page 110 for more information on the
database settings and fabric-wide consistency policy.
Use the instructions in the following sections to manage DCC and SCC policies:
• ” Displaying ACL policies ” on page 105
Displays a list of all active and defined ACL policies on the switch.
• ” Configuring a DCC policy ” on page 105
Multiple DCC policies can be created using the naming convention DCC_POLICY_ nnn , with nnn
representing a unique string.
• ” Creating an SCC policy ” on page 107
One SCC policy can be created.
• ” Saving changes to ACL policies ” on page 108
Save changes to memory without actually implementing the changes within the fabric or to the switch.
This saved but inactive information is known as the “defined policy set.”
• ” Activating changes to ACL policies ” on page 108
Simultaneously save and implement all the policy changes made since the last time changes were
activated. The activated policies are known as the “active policy set.”
• ” Adding a member to an existing policy ” on page 109
Add one or more members to a policy. The aspect of the fabric covered by each policy is closed to
access by all devices/switches that are not listed in that policy.
• ” Removing a member from a policy ” on page 109
Remove one or more members from a policy. If all members are removed from a policy, that aspect of
the fabric becomes closed to all access.
• ” Deleting a policy ” on page 109
Delete an entire policy; deleting a policy opens up that aspect of the fabric to all access.