Fabric-Wide Distribution Of The Auth Policy; Accept Distributions Configuration Parameter; Ip Filter Policy; Creating An Ip Filter Policy - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

Fabric-wide distribution of the Auth policy

The AUTH policy can be manually distributed to the fabric using the distribute command; there is no
support for automatic distribution.
To distribute the AUTH policy, see

Accept distributions configuration parameter

Local Switch configuration parameters are needed to control whether a switch accepts or rejects
distributions of the AUTH policy using the distribute command and whether the switch may initiate
distribution of the policy. To set the local switch configuration parameter, see
distribution settings" on page 130.

IP Filter policy

The IP Filter policy is a set of rules applied to the IP management interfaces as a packet filtering firewall.
The firewall permits or denies the traffic to go through the IP management interfaces according to the
policy rules.
Fabric OS supports multiple IP Filter policies to be defined at the same time. Each IP Filter policy is
identified by a name and has an associated type. Two IP Filter policy types, IPv4 and IPv6, exist to provide
separate packet filtering for IPv4 and IPv6. It is not allowed to specify an IPv6 address in the IPv4 filter, or
specify an IPv4 address in the IPv6 filter. There can be up to six different IP Filter policies defined. Only one
IP Filter policy, however, for each IP Filter policy type, can be activated on the affected management IP
interfaces.
Audit messages will be generated for any changes to the IP Filter policies.
The rules in the IP Filter policy are examined one at a time until the end of the list of rules. For performance
reasons, the most import rules must be specified at the top.
On a chassis system, changes to persistent IP Filter policies are automatically synchronized to the standby
CP when the changes are saved persistently on the active CP to the standby CP. The standby CP will
enforce the filter policies to its management interface after policies are synchronized with the active CP.

Creating an IP Filter policy

You can create an IP Filter policy specifying any name and using type IPv4 or IPv6. The policy created is
stored in a temporary buffer, and is lost if the current command session logs out. The policy name is a
unique string composed of a maximum of 20 alphabetical, numeric, and underscore characters. The
names default_ipv4 and default_ipv6 are reserved for default IP Filter policies. The policy name is case
insensitive and always stored as lower case. The policy type identifies the policy as an IPv4 or IPv6 filter.
There is a maximum of six IP Filter policies created for both types.
To create an IP Filter policy:
1. Log in to the switch using an account assigned to the admin role.
2. Issue in the following command:
ipfilter --create <policyname> -type < ipv4 | ipv6 >
where
<policyname>

Cloning an IP Filter policy

You can create an IP Filter policy as an exact copy of an existing policy. The policy created is stored in a
temporary buffer and has the same type and rules as the existing defined or active policy.
To clone an IP Filter policy
1. Log in to the switch using an account assigned to the admin role.
2. Issue the following command:
ipfilter --clone <policyname> -from <src_policyname>
where
policyname
<
policy you want to copy.
124 Configuring advanced security features
"To distribute the local ACL
is the name of the new policy and
is the name of the new policy and
>
policies:" on page 132.
"Configuring the database
specifies an IPv4 or IPv6 address.
-type
is the name of the
src_policyname
< >