Creating An Scc Policy; Acl Policy Modifications; Activating Changes To Acl Policies; Scc Policy States - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

Creating an SCC policy

The switch connection control (SCC) policy is used to restrict which switches can join the fabric. Switches
are checked against the policy each time an E_Port-to-E_Port connection is made. The policy is named
SCC_POLICY and accepts members listed as WWNs, Domain IDs, or switch names. Only one SCC policy
can be created.
By default, any switch is allowed to join the fabric; the SCC policy does not exist until it is created. When
connecting a Fibre Channel router to a fabric or switch that has an active SCC policy, the front domain of
the Fibre Channel router must be included in the SCC policy.
SCC policy states are shown in
Table 29

SCC policy states

Policy state
No active policy
Active policy that has no members
Active policy that has members
To create an SCC policy:
1. Connect to the switch and log in using an account assigned to the admin role.
2. Issue the command secPolicyCreate "SCC_POLICY", "member;...;member".
where member indicates a switch that is permitted to join the fabric. Specify switches by WWN,
Domain ID, or switch name. Enter an asterisk (*) to indicate all the switches in the fabric.
For example, to create an SCC policy that allows switches that have Domain IDs 2 and 4 to join the
fabric:
switch:admin> secpolicycreate "SCC_POLICY", "2;4"
SCC_POLICY has been created
3. Save or activate the new policy by issuing either the secPolicySave or the secPolicyActivate
command.
If neither of these commands is entered, the changes are lost when the session is logged out. For more
information about these commands, see
changes to ACL

ACL policy modifications

Save changes to the defined ACL policy set without activating them by issuing the secPolicySave
command. You can implement changes to the ACL policies using the secPolicyActivate command.
This saves the changes to the active policy set and activates all policy changes since the last time the
command was issued. You cannot activate policies on an individual basis; all changes to the entire policy
set are activated by the command. Until a secPolicySave or secPolicyActivate command is
issued, all policy changes are in volatile memory only and are lost upon rebooting.
To save changes without activating the policies:
1. Connect to the switch and log in using an account assigned to the admin role.
2. Issue the secPolicySave command.
switch:admin> secpolicysave

Activating changes to ACL policies

To activate changes:
1. Connect to the switch and log in using an account assigned to the admin role.
116 Configuring advanced security features
Table 29.
SCC policy enforcement
All switches can connect to the switch with the specified policy.
All neighboring switches are segmented.
The neighboring switches not specified in the SCC policy are
segmented.
"ACL policy
policies" on page 1 16.
modifications" on page 1 16 and "Activating