F_Port Authentication; Configuring E_Port Authentication In Virtual Fabrics - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

The following are considerations for F_Port trunking when you enable a Virtual Fabric:
If a port is enabled for F_Port trunking, you must disable the configuration before you can move a port
•
from the Logical Switch.
• If the user bound area for a port is configured using the portAddress command, the port cannot be
configured as an F_Port trunk port. You must explicitly remove the user bound area before enabling
F_Port trunking.
• If you swap a port using the portSwap command, you must undo the port swap before enabling
F_Port trunking.
• The Port WWN format in a Virtual Fabric is 2z:zz:xx:xx:xx:xx:xx:xx. The z:zz is the logical port
number; for example, the logical port 450 will be 1:c2. The xx:xx:xx:xx:xx:xx is based on the Logical
Fabric's WWN, for example, if the Logical Fabric's WWN is 10:00:00:05:1e:39:fa:f3, and logical
port number is 450, the Port WWN of the F_Port trunk will be 21:c2: 00:05:1e:39:fa:f3.
• F_Port trunks are not allowed on the base switch.
NOTE: A base switch is a Logical Switch that is used to communicate among different Logical Switches.
• F_Port trunks enabled on Fabric OS 6.1 are non-disruptive to Fabric 6.2.0.
• If F_Port trunking is enabled on some ports in the default switch, and you disable the Virtual Fabric, all
of the F_Port trunking information is lost.
• The ports in a trunk group can be partitioned into different Logical Switches, therefore all of the ports in
an F_Port trunk must belong to a single trunk group of ports on the platform and must also belong to the
same Logical Switch.

F_Port authentication

You can enable F_Port or node port authentication by configuring the device authentication policies on a
per Logical Switch basis. The device, for example an HBA, must have the capability to perform
authentication with the switch. In Fabric OS 6.2.0, when the device authentication policy is set to ON or
PASSIVE, the switch authentication type cannot be set to FCAP. Also, if the switch authentication type is set
to FCAP, the device authentication policy type cannot be set to ON or PASSIVE. This is because devices
such as HBAs support only DH-CHAP for authentication.
A combination of FCAP and DH-CHAP with device authentication policy set to ON or PASSIVE is still
supported.

Configuring E_Port authentication in Virtual Fabrics

In Virtual Fabrics, you can configure switch authentication on the physical E_Ports. All of the authentication
parameters, such as shared secrets and switch policies, are switch-wide and must be configured
individually on each Logical Switch; otherwise, when you create a Logical Switch, authentication
automatically takes the authentication (AUTH) default values for policies and other parameters.
E_Port authentication polices apply to all of the E_Ports in the Logical Switch, which includes dedicated ISLs
and extended ISLs. Logical ISL authentication is not required because the underlying extended ISLs are
authenticated and logical ISLs do not carry traffic. Authentication is required between two physical entities;
for example the extended ISL, which connects two HP StorageWorks DC SAN Backbone Director
platforms, must be authenticated.
For more information on Virtual Fabrics and how to create a Logical Switch, see Chapter 6,
virtual fabrics" on page 173.
The following example shows how to enable a Virtual Fabric and configure the E_Ports to perform
authentication using the AUTH policies authUtil command.
454 Administering ISL trunking
"Managing