Qlogic SANbox 5800V Series, Руководство по установке

Страница: 58 / 134

2–Planning
Security
2-20 59265-02 B
Connection Security
Connection security provides an encrypted data path for switch management
methods. The switch supports the SSH protocol for the command line interface
and the SSL protocol for management applications such as Enterprise Fabric
Suite and SMI-S.
The SSL handshake process between the workstation and the switch involves the
exchanging of certificates. These certificates contain the public and private keys
that define the encryption. When the SSL service is enabled, a certificate is
automatically created on the switch. The workstation validates the switch
certificate by comparing the workstation date and time to the switch certificate
creation date and time. For this reason, it is important to synchronize the
workstation and switch with the same date, time, and time zone. The switch
certificate is valid 24 hours before its creation date and 365 days after its creation
date. If the certificate becomes invalid, create a new certificate using the Create
Certificate CLI command. For information about the CLI commands, refer to the
QLogic 5800V Series Fibre Channel Switch Command Line Interface Guide .
Consider your connection security requirements: for the command line interface
(SSH), management applications such as Enterprise Fabric Suite (SSL), or both.
Access to the device security menu selections in Enterprise Fabric Suite requires
an SSL connection. If an SSL connection security is required, also consider using
the network time protocol (NTP) to synchronize workstations and switches.
Device Security
Device security provides for authorization and authentication of devices that you
connect to a switch. You can configure a switch with a group of devices against
which the switch authorizes new connections by devices, other switches, or
devices issuing management server commands. Device security is configured
through the use of security sets and groups.
A group is a list of device WWNs that are authorized to connect to a switch. There
are three types of groups: one for other switches (ISL), another for devices (port),
and a third for devices issuing management server commands (MS).
A security set is a set of up to three groups with no more than one of each group
type. The security configuration is made up of all security sets on the switch. The
security database has the following limits:

Maximum number of security sets is 4.

Maximum number of groups is 16.

Maximum number of members in a group is 1,000.

Maximum total number of group members is 1,000.