Port Security Versus Fabric Binding; Enforcing Fabric Binding - Cisco DS-C9216I-K9 Configuration Manual

Configuring Fabric Binding

Port Security versus Fabric Binding

Port security and fabric binding are two independent features that can be configured to complement each
other. (See
Table 23-2
Fabric Binding
Configured using a set of sWWN and a persistent
Domain ID.
Binds the fabric at the switch level.
Only the configured sWWN stored in the fabric
binding database will be authorized to participate
in the fabric.
Activation is required on a per VSAN basis.
User defines specific switches which are allowed
to connect to the fabric, regardless of the physical
port to which the peer switch is connected.
Does not learn logging in switches.
Port-level Checking for xE ports
•
•
While port security complements fabric binding, they are independent features and can be enabled or
disabled separately.

Enforcing Fabric Binding

To enforce fabric binding, configure the switch world wide name (sWWN) to specify the xE port
connection for each switch. Enforcement of fabric binding policies are done on every activation and
when the port tries to come up. However enforcement of fabric binding at the time of activation happens
only if the VSAN is a FICON VSAN.
The fabric binding feature requires all sWWNs connecting to a switch and their persistent domain IDs
to be part of the fabric-binding active database.
To configure fabric binding in each switch in the fabric, follow these steps.
Enable the fabric configuration feature
Step 1
Configure a list of sWWNs and their corresponding domain IDs for devices that are allowed to access
Step 2
the fabric.
Cisco MDS 9000 Fabric Manager Switch Configuration Guide
23-22
Table 23-2,)
Port Security and Fabric Binding Descriptions
Switch login—Uses both Port Binding as well as the Fabric Binding feature for a given VSAN.
Binding checks are done on the port VSAN:
E-port security binding check done on port VSAN.
–
TE-port security bindings check done in each VSAN allowed.
–
Chapter 23
Port Security
Configured using pWWNs/nWWNs or
fWWNs/switch WWNs.
Binds devices at the interface level.
Allows a preconfigured set of Fibre Channel
devices to logically connect to a SAN port(s). The
switchport, identified by a WWN or interface
number, connects to a Fibre Channel device (a
host or another switch), also identified by a WWN.
By Binding these two devices, you lock these two
ports into a group (list).
Activation is required on a per VSAN basis.
User specifies the specific physical port(s) to
which another device can connect
Learns about switches/devices if in learning mode.
Configuring FICON
OL-7753-01