Access Gateway Policy Enforcement Matrix; Advanced Device Security Policy; How The Ads Policy Works; Table 6 Policy Enforcement Matrix - Brocade Communications Systems AM866A - StorageWorks 8/8 Base SAN Switch Administrator's Manual

3

Advanced Device Security policy

Access Gateway policy enforcement matrix

The following table shows which combinations of policies can co-exist with each other.
TABLE 6
Policies
Auto Port Configuration
N_Port Grouping
N_Port Trunking
ADS Policy

Advanced Device Security policy

The Advanced Device Security (ADS) is disabled by default for Access Gateway. ADS is a security
policy that restricts access to the fabric at the AG level to a set of authorized devices. Unauthorized
access is rejected and the system logs a RASLOG message. You can configure the list of allowed
devices for each F_Port by specifying their Port WWN (PWWN). The ADS policy secures virtual and
physical connections to the SAN.

How the ADS policy works

When you enable this policy, it applies to all F_ports on the AG-enabled module. By default, all
devices have access to the fabric on all ports. You can restrict the fabric connectivity to a particular
set of devices where AG maintains a per-port allow list for the set of devices whose PWWN you
define to log in through an F_Port. You can view the devices with active connections to an F_Port
using the ag --show command.
NOTE
The ag
fabric. The agshow
Alternatively, the security policy can be established in the Enterprise fabric using the DCC policy.
For information on configuring the DCC policy, see
The DCC policy in the Enterprise fabric takes precedence over the ADS policy. It is generally
recommended to implement the security policy in the AG module rather than in the main fabric,
especially if Failover and Failback policies are enabled.
18
Policy enforcement matrix
Auto Port Configuration
N/A
Mutually exclusive
Can co-exist
Can co-exist
show command only displays the Core AGs, such as the AGs that are directly connected to
--
name name command displays the F_Ports of both the Core and Edge AGs.
--
Port Grouping N_Port Trunking
Cannot co-exist Can co-exist
N/A Can co-exist
Can co-exist N/A
Can co-exist Can co-exist
"Enabling the DCC policy on trunk"
Access Gateway Administrator's Guide
ADS Policy
Can co-exist
Can co-exist
Can co-exist
N/A
on page 40.
53-1001345-01