User Security Considerations; Configuring Switches - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

User security considerations

To administer FICON, you must have one of the following roles:
• Admin
• Operator
• SwitchAdmin
• FabricAdmin
The User and BasicSwitchAdmin roles are view-only. The ZoneAdmin and SecurityAdmin roles have no
access.
In an Admin Domain-aware fabric, if you use the FICON commands (ficonshow, ficonclear,
ficoncupshow, and ficoncupset) for any Admin Domain other than AD0 and AD255, the current
switch must be a member of that Admin Domain. The output is not filtered based on the Admin Domain.

Configuring switches

Use the worksheet on page 430 to record your configuration information.
Following are recommended FICON environment configuration settings:
• Disable dynamic load sharing (dlsReset command).
If DLS is enabled, traffic on existing ISL ports might be affected when one or more new ISLs is added
between the same two switches. Specifically, adding the new ISL might result in dropped frames as
routes are adjusted to take advantage of the bandwidth provided. By disabling DLS, you ensure that
there will be no dropped frames.
A similar situation occurs when an ISL port is taken offline and then brought back online. When the ISL
port goes offline, the traffic on that port is rerouted to another ISL with a common destination. When the
ISL port comes back online and DLS is enabled, the rerouting of traffic back to the ISL port might result
in dropped frames. If DLS is not enabled, traffic is not routed back.
• Configure ports that are connected to 1 Gbps channels for fixed 1-Gbps speed. Otherwise, when using
fixed 1-Gbps channels (both G5 and FICON Express), the FICON host might generate erroneous link
incidents when the channels are coming online. These link incidents will result in a call home. Other
than the generated link incident, the channel will come online and function normally.
• Use the port-based routing policy on any switch that has FICON devices attached. Other switches in
the fabric with Open Systems devices exclusively can still use exchange-based routing.
• Enable in-order delivery (iodSet command).
• If you have any Extended Fabrics links, enable VC translation link initialization to stabilize them. See
"Administering Extended
portCfgLongDistance command.
• Follow standard FCP zoning practices even though there are no specific zoning rules related to FICON
environments. For management purposes, when operating in a mixed environment put FCP devices in
one zone and FICON devices in another zone.
• Configure ports for fixed 1 Gbps speed when there are 1 Gbps devices attached to them and those
devices cannot auto-negotiate speed.
418 FICON fabrics
Fabrics" on page 1 17 for details on this option of the