User manual HP STORAGEWORKS 4/32B SAN SWITCH - BROCADE ACCESS GATEWAY ADMIN GUIDE V6.1.0 (53-1000605-02, JUNE 2008)

53-1000605-02 12 Mar 2008 Access Gateway Administrator's Guide Supporting Fabric OS v6.1.0 Copyright © 2007-2008 Brocade Communications Systems, Inc. All Rights Reserved. Brocade, Fabric OS, File Lifecycle Manager, MyView, and StorageX are registered trademarks and the Brocade B-wing symbol, DCX, and SAN Health are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other countries. All other brands, products, or service names are or may be trademarks or service marks of, and are used to identify, products or services of their respective owners. Notice: This document is for informational purposes only and does not set forth any warranty, expressed or implied, concerning any equipment, equipment feature, or service offered or to be offered by Brocade. Brocade reserves the right to make changes to this document at any time, without notice, and assumes no responsibility for its use. This informational document describes features that may not be currently available. Contact a Brocade sales office for information on feature and product availability. Export of technical data contained in this document may require an export license from the United States government. The authors and Brocade Communications Systems, Inc. shall have no liability or responsibility to any person or entity with respect to any loss, cost, liability, or damages arising from the information contained in this book or the computer programs that accompany it. The product described by this document may contain "open source" software covered by the GNU General Public License or other open source license agreements. To find-out which open source software is included in Brocade products, view the licensing terms applicable to the open source software, and obtain a copy of the programming source code, please visit http://www.brocade.com/support/oscd. Brocade Communications Systems, Incorporated Corporate Headquarters Brocade Communications Systems, Inc. 1745 Technology Drive San Jose, CA 95110 Tel: 1-408-333-8000 Fax: 1-408-333-8101 Email: info@brocade.com European and Latin American Headquarters Brocade Communications Switzerland Sàrl Centre Swissair Tour A - 2ème étage 29, Route de l'Aéroport Case Postale 105 CH-1215 Genève 15 Switzerland Tel: +41 22 799 56 40 Fax: +41 22 799 56 41 Email: emea-info@brocade.com Asia-Pacific Headquarters Brocade Communications Singapore Pte. Ltd. 9 Raffles Place #59-02 Republic Plaza 1 Singapore 048619 Tel: +65-6538-4700 Fax: +65-6538-0302 Email: apac-info@brocade.com Document History The following table lists all versions of the Access Gateway Administrator's Guide. Document Title Access Gateway Administrator's Guide Access Gateway Administrator's Guide Access Gateway Administrator's Guide Publication Number 53-1000430-01 53-1000633-01 53-1000605-01 Summary of Changes First version Added support for the 200E Added support for new policies and changes to N_Port mappings. Publication Date January 2007 15 Jun 2007 19 Oct 2007 Access Gateway Administrator's Guide 53-1000605-02 12 Mar 2008 Added support for new platforms: 300 and the 4424. Added support for new features: - Masterless Trunking - Direct Target Connectivity - Advance Device Security policy - 16- bit routing Access Gateway Administrator's Guide 53-1000605-02 iii iv Access Gateway Administrator's Guide 53-1000605-02 Contents About This Document How this document is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii Supported hardware and software . . . . . . . . . . . . . . . . . . . . . . . . . . vii What's new in this document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii Document conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii Text formatting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii Notes, cautions, and warnings . . . . . . . . . . . . . . . . . . . . . . . . . . . ix Key terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix Additional information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x Brocade resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x Other industry resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x Optional Brocade features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Getting technical help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Document feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii Chapter 1 Getting Started In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Brocade Access Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Fabric OS features in Access Gateway mode. . . . . . . . . . . . . . . . 2 Access Gateway port types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Comparison of Access Gateway ports to standard switch ports. 3 How Access Gateway maps ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Upgrade and downgrade considerations. . . . . . . . . . . . . . . . . . . . . . . 5 Considerations with policies enabled. . . . . . . . . . . . . . . . . . . . . . 5 Advance Device Security policy. . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Automatic Port Configuration policy . . . . . . . . . . . . . . . . . . . . . . . 5 Port Grouping policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Chapter 2 Enabling Policies on Switches in Access Gateway Mode In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Access Gateway Administrator's Guide 53-1000605-02 iii Access Gateway policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Showing current policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Advance Device Security policy. . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Enabling the Advance Device Security policy. . . . . . . . . . . . . . . . 9 Disabling the Advance Device Security policy . . . . . . . . . . . . . . . 9 Setting which devices can log in if ADS policy is enabled. . . . . . 9 Setting which devices cannot log in if ADS policy is enabled . . 10 Removing devices from the list of devices allowed at login . . . 10 Adding new devices to the list of devices allowed at login . . . . 10 Displaying the list of devices on the switch . . . . . . . . . . . . . . . . 11 Automatic Port Configuration policy . . . . . . . . . . . . . . . . . . . . . . 11 Enabling the Automatic Port Configuration policy . . . . . . . . . . . 12 Disabling the Automatic Port Configuration policy . . . . . . . . . . 12 Rebalancing F_Ports with APC policy enabled. . . . . . . . . . . . . . 12 Failover Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Enabling the Failover policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Disabling the Failover policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Failback policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Enabling the Failback policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Cold Failover policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Port Grouping policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Creating a port group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Adding an N_Port to a port group . . . . . . . . . . . . . . . . . . . . . . . . 20 Deleting an N_Port from a port group . . . . . . . . . . . . . . . . . . . . 20 Removing a port group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Renaming a port group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Disabling the Port Group policy. . . . . . . . . . . . . . . . . . . . . . . . . . 21 Access Gateway policy enforcement matrix . . . . . . . . . . . . . . . . 21 Access Gateway N_Port trunking . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Access Gateway trunking considerations. . . . . . . . . . . . . . . . . . 23 Trunk group creation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Setting up F_Port trunking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Assigning a Trunk Area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Enabling the DCC policy on trunk . . . . . . . . . . . . . . . . . . . . . . . . 27 Configuration management for trunk areas . . . . . . . . . . . . . . . 28 Enabling Access Gateway trunking . . . . . . . . . . . . . . . . . . . . . . . 28 Disabling F_Port trunking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 F_Port Trunking monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Chapter 3 Connecting Devices Using Access Gateway In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Configuring the fabric and edge switch . . . . . . . . . . . . . . . . . . . . . . . 32 Verifying the switch mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Setting the Fabric OS switch to Native Mode. . . . . . . . . . . . . . . 33 Enabling NPIV on the M-EOS switch . . . . . . . . . . . . . . . . . . . . . . 33 iv Access Gateway Administrator's Guide 53-1000605-02 Connectivity to Cisco Fabrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Access Gateway routing requirements with Cisco fabrics. . . . . 34 Enabling NPIV on a Cisco switch. . . . . . . . . . . . . . . . . . . . . . . . . 34 Workaround for QLogic-based devices . . . . . . . . . . . . . . . . . . . . 35 Editing Company ID List if no FC target devices on switch . . . . 35 Adding or deleting an OUI from the Company ID List . . . . . . . . 36 Enabling Flat FCID mode if no FC target devices on switch . . . 37 Editing Company ID list if target devices on switch . . . . . . . . . . 37 Access Gateway mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Enabling Access Gateway mode . . . . . . . . . . . . . . . . . . . . . . . . . 38 Port States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Disabling Access Gateway mode . . . . . . . . . . . . . . . . . . . . . . . . 40 Re-joining switches to a fabric . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Reverting to a previous configuration. . . . . . . . . . . . . . . . . . . . . 41 Chapter 4 Configuring Ports in Access Gateway mode In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Port Initialization in Access Gateway mode. . . . . . . . . . . . . . . . . . . . 43 N_Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Unlocking N_Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Displaying N_Port configurations . . . . . . . . . . . . . . . . . . . . . . . . 46 Verifying port mapping and status . . . . . . . . . . . . . . . . . . . . . . . 46 Displaying N_Port mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Displaying port status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Port configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Adding F_Ports to an N_Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Removing F_Ports from an N_Port . . . . . . . . . . . . . . . . . . . . . . . 49 Adding a preferred secondary N_Port . . . . . . . . . . . . . . . . . . . . 50 Deleting F_Ports from a preferred secondary N_Port . . . . . . . . 50 Appendix A Index Troubleshooting Access Gateway Administrator's Guide 53-1000605-02 v vi Access Gateway Administrator's Guide 53-1000605-02 About This Document This document is a procedural guide to help SAN administrators configure and manage Brocade Access Gateway. This preface contains the following sections: ·How this document is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii ·Supported hardware and software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii ·What's new in this document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii ·Document conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii ·Key terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix ·Additional information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x ·Getting technical help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi ·Document feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii How this document is organized The document contains the following topics: · Chapter 1, "Getting Started" describes how to use Access Gateway to create seamless connectivity to any Storage Area Network (SAN) fabric. · Chapter 2, "Enabling Policies on Switches in Access Gateway Mode"describes how to enable policies on a switch in Access Gateway mode. · Chapter 3, "Connecting Devices Using Access Gateway" describes how to connect multiple devices using Access Gateway. · Chapter 4, "Configuring Ports in Access Gateway mode" describes how to configure ports in Access Gateway mode. · Appendix A, "Troubleshooting" provides symptoms and troubleshooting tips to resolve issues. Supported hardware and software Although many different software and hardware configurations are tested and supported by Brocade Communications Systems, Inc. For v6.1.0, documenting all possible configurations and scenarios is beyond the scope of this document. All Fabric OS switches must be running v5.1 or later; all M-EOS switches must be running M-EOSc 9.1 or later, M-EOSn must be running 9.6.2 or later, and Cisco switches with SAN OS must be running 3.0 (1) and 3.1 (1) or later. Access Gateway supports 4 and 8 Gbit bladed servers and blades. Access Gateway Administrator's Guide 53-1000605-02 vii What's new in this document The following changes have been made since this document was last released: Information that was added · Platforms · Brocade 300 and 4424 · 16-bit routing (8 Gbps platforms only) · Performance · Access Gateway masterless trunking · Seamless failover · Configuration · Direct Target Attach · Security · Advance Device Security policy · Enhanced routing For further information, refer to the release notes. Document conventions This section describes text formatting conventions and important notices formats. Text formatting The narrative-text formatting conventions that are used in this document are as follows: bold text Identifies command names Identifies the names of user-manipulated GUI elements Identifies keywords and operands Identifies text to enter at the GUI or CLI Provides emphasis Identifies variables Identifies paths and Internet addresses Identifies document titles Identifies CLI output Identifies syntax examples italic text code text For readability, command names in the narrative portions of this guide are presented in mixed lettercase: for example, switchShow. In actual examples, command lettercase is often all lowercase. Otherwise, this manual specifically notes those cases in which a command is case sensitive. The ficonCupSet and ficonCupShow commands are an exception to this convention. viii Access Gateway Administrator's Guide 53-1000605-02 Notes, cautions, and warnings The following notices appear in this document. NOTE A note provides a tip, emphasizes important information, or provides a reference to related information. ATTENTION An Attention statement indicates potential damage to hardware or data. CAUTION A Caution statement alerts you to situations that can be potentially hazardous to you. DANGER A Danger statement indicates conditions or situations that can be potentially lethal or extremely hazardous to you. Safety labels are also attached directly to products to warn of these conditions or situations. Key terms For definitions of SAN-specific terms, visit the Storage Networking Industry Association online dictionary at: http://www.snia.org/education/dictionary. For definitions specific to Brocade and Fibre Channel, see the Brocade Glossary. The following terms are used in this manual to describe Access Gateway mode and its components. Access Gateway (AG) Fabric OS mode for embedded switches that reduces SAN (storage area network) deployment complexity by leveraging NPIV (N_Port ID virtualization). E_Port Edge switch F_Port An ISL (Interswitch link) port. A switch port that connects switches together to form a fabric. A fabric switch that connects host, storage, or other devices, such as Brocade Access Gateway, to the fabric. A fabric port. A switch port that connects a host, HBA (host bus adaptor), or storage device to the SAN. On Brocade Access Gateway, the F_Port connects to a host only and target. On the Brocade Access Gateway, the configuration of F_Port to N_Port routes. A node port. A Fibre Channel host or storage port in a fabric or point-to-point connection. On Brocade Access Gateway, the N_Port connects to the edge switch. Mapping N_Port Access Gateway Administrator's Guide 53-1000605-02 ix NPIV N_Port ID virtualization. Allows a single Fibre Channel port to appear as multiple, distinct ports providing separate port identification and security zoning within the fabric for each operating system image as if each operating system image had its own unique physical port. Preferred Secondary N_Port On the Brocade Access Gateway, the preferred secondary N_Port refers to the secondary path that and F_Port failovers to if the primary N_Port goes offline. Additional information This section lists additional Brocade and industry-specific documentation that you might find helpful. Brocade resources To get up-to-the-minute information, join Brocade Connect. It's free! Go to http://www.brocade.com and click Brocade Connect to register at no cost for a user ID and password. For practical discussions about SAN design, implementation, and maintenance, you can obtain Building SANs with Brocade Fabric Switches through: http://www.amazon.com For additional Brocade documentation, visit the Brocade SAN Info Center and click the Resource Library location: http://www.brocade.com Release notes are available on the Brocade Connect Web site and are also bundled with the Fabric OS firmware. Other industry resources · White papers, online demos, and data sheets are available through the Brocade Web site at http://www.brocade.com/products/software.jhtml. · Best practice guides, white papers, data sheets, and other documentation is available through the Brocade Partner Web site. For additional resource information, visit the Technical Committee T11 Web site. This Web site provides interface standards for high-performance and mass storage applications for Fibre Channel, storage management, and other applications: http://www.t11.org For information about the Fibre Channel industry, visit the Fibre Channel Industry Association Web site: http://www.fibrechannel.org x Access Gateway Administrator's Guide 53-1000605-02 Optional Brocade features For a list of optional Brocade features and descriptions, see the Fabric OS Administrator's Guide. Getting technical help Contact your switch support supplier for hardware, firmware, and software support, including product repairs and part ordering. To expedite your call, have the following information available: 1. General Information · · · · · · Technical Support contract number, if applicable Switch model Switch operating system version Error numbers and messages received supportSave command output Detailed description of the problem, including the switch or fabric behavior immediately following the problem, and specific questions · Description of any troubleshooting steps already performed and the results · Serial console and Telnet session logs · Syslog message logs 2. Switch Serial Number The switch serial number and corresponding bar code are provided on the serial number label, as shown here. : *FT00X0054E9* FT00X0054E9 The serial number label is located as follows: · Brocade 200E--On the nonport side of the chassis · Brocade 300-- On the nonport side of the chassis · Brocade 4100, 4900, and 7500--On the switch ID pull-out tab located inside the chassis on the port side on the left · Brocade 5000--On the switch ID pull-out tab located on the bottom of the port side of the switch · Brocade 7600--On the bottom of the chassis · Brocade 48000--Inside the chassis next to the power supply bays · Brocade DCX--On the bottom right on the port side of the chassis 3. World Wide Name (WWN) · Use the wwn command to display the switch WWN. · If you cannot use the wwn command because the switch is inoperable, you can get the WWN from the same place as the serial number. Access Gateway Administrator's Guide 53-1000605-02 xi Document feedback Quality is our first concern at Brocade and we have made every effort to ensure the accuracy and completeness of this document. However, if you find an error or an omission, or you think that a topic needs further development, we want to hear from you. Forward your feedback to: documentation@brocade.com Provide the title and version number of the document and as much detail as possible about your comment, including the topic heading and page number and your suggestions for improvement. xii Access Gateway Administrator's Guide 53-1000605-02 Chapter Getting Started 1 This chapter describes how to create seamless connectivity to any Storage Area Network (SAN) fabric using Access Gateway (AG). It provides information on how to set the port types, port mappings, and the policies to ensure a stable fabric. AG is compatible with Fabric OS, M-EOS, and Cisco-based fabrics. Enabling and disabling AG mode on a switch can be performed from the command line interface (CLI) or using Web Tools, Fabric Manager (5.3) or EFCM (9.6). This document describes configurations using the CLI commands. In this chapter ·Brocade Access Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Fabric OS features in Access Gateway mode. . . . . . . . . . . . . . . . . . . . . . . . . . ·Comparison of Access Gateway ports to standard switch ports . . . . . . . . . . ·Access Gateway port types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·How Access Gateway maps ports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Upgrade and downgrade considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Considerations with policies enabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Advance Device Security policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Automatic Port Configuration policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Port Grouping policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2 3 3 4 5 5 5 5 5 Brocade Access Gateway Brocade Access Gateway is a Fabric OS feature that lets you configure your Enterprise fabric to handle additional N_Ports instead of domains. You do this by configuring F_Ports to connect to the fabric as N_Ports, which increases the number of device ports you can connect to a single fabric. Multiple Gas can connect to the DCX enterprise-class platform, directors, and switches. After you set a Fabric OS switch to AG mode, the F_ports connect to the Enterprise fabric as N_Ports rather than as E_Ports. They connect as E_Ports if the Fabric OS switch is in Native mode. Figure 1 shows a comparison of a configuration that connects eight hosts to a fabric using AG to the same configuration with Fabric OS switches in Native mode. Switches in AG mode are logically transparent to the host and the fabric. You can increase the number of hosts to have access to the fabric without increasing the number of switches. This simplifies configuration and management in a large fabric by reducing the number of domain IDs and ports. Access Gateway Administrator's Guide 53-1000605-02 1 1 Brocade Access Gateway FIGURE 1 Access Gateway and fabric switch comparison The following points summarize the differences between a Fabric OS switch in Native mode and a Fabric OS switch in AG mode: · The Fabric OS switch in Native mode is a part of the fabric; it requires two to four times as many physical ports, consumes fabric resources, and can connect to a Fabric OS fabric only. · AG is outside the fabric; it reduces the number of switches in the fabric and the number of required physical ports. You can connect AG to either a Fabric OS, M-EOS, or Cisco-based fabric. Fabric OS features in Access Gateway mode When a switch is behaving as an Access Gateway, RBAC features in Fabric OS are available, but Admin Domains, Advanced Performance Monitoring, direct connection to SAN target devices are available, Fibre Channel Arbitrated Loop support, Fabric Manager, FICON, IP over FC, ISL trunking, extended fabrics, management platform services, name services (SNS), port mirroring, SMI-S, and zoning are not available. For more information on AG supported features, see "Access Gateway trunking considerations" on page 23. You must have the role of securityadmin, admin, or user to configure AG. All security enforcement is done in the Enterprise fabric using the Advanced Device Security policy (ADS), which secures virtual connections in the case where the physical connection to the SAN is lost. When you enable the ADS policy, by default, every port is configured to allow all devices to log in or be a part of the Access List. The Allow list restricts the number of devices that can log in to a specified F_Port. Because all WWNs are a part of the Access List, you can identify which devices are allowed to log in on a per F_Port basis by specifying the device's port WWN(PWWN). Using the ag --adsset command, you can set the "Allow List" to All Access or No Access. For example, the Allow List can include the N_Port WWN and the PWWNs of all the HBAs connected to the F_Ports that are mapped an N_Port, which is connected to a switch in AG mode. If there is an ADS policy violation, the AG connection is disabled and all of the N_Ports to which the F_Ports are connected are also disabled. For information on how to specify which devices to include or exclude at login, see "Setting which devices can log in if ADS policy is enabled" on page 9 or "Setting which devices cannot log in if ADS policy is enabled" on page 10. 2 Access Gateway Administrator's Guide 53-1000605-02 Access Gateway port types 1 Access Gateway port types Access Gateway differs from a typical fabric switch because it is not a switch; instead, it is a mode that you enable on a switch using the ag command. After a switch is set in ag mode, it can connect to the fabric using node ports (N_Ports). Typically fabric switches connect to the Enterprise fabric using ISL (InterSwitch Link) ports, such as E_Ports. Following are the Fibre Channel (FC) ports that AG uses: · F_Port - fabric port that connects a host, HBA, or storage device to a switch in AG mode. · N_Port - node port that connects a switch in AG mode to the F_Port of the fabric switch. Comparison of Access Gateway ports to standard switch ports Access Gateway multiplexes host connections to the fabric. It presents an F_Port to the host and an N_Port to an edge fabric switch. Using N_Port ID virtualization (NPIV), AG allows multiple FC initiators to access the SAN on the same physical port. This reduces the hardware requirements and management overhead of hosts to the SAN connections. A fabric switch presents F_Ports (or FL_Ports) and storage devices to the host and presents E_Ports, VE_Ports, or EX_Ports to other switches in the fabric. A fabric switch consumes SAN resources, such as domain IDs, and participates in fabric management and zoning distribution. A fabric switch requires more physical ports than AG to connect the same number of hosts. Figure 2 shows a comparison of the types of ports a switch in AG mode uses to the type of ports that a standard fabric switch uses. Access Gateway Ports Switch in AG mode Hosts N_Port F_Port N_Port N_Port F_Port Edge Switch F_Port NPIV enabled Fabric Fabric Switch Ports Fabric Hosts N_Port Switch in standard default mode F_Port E_Port Fabric Switch E_Port N_Port F_Port E_Port E_Port FIGURE 2 Port usage comparison Access Gateway Administrator's Guide 53-1000605-02 3 1 How Access Gateway maps ports Table 1 shows a comparison of port configurations with AG to a standard fabric switch. TABLE 1 Port Type F_Port N_Port E_Port 1. Port configurations Access Gateway Yes Yes NA Connects hosts and targets to Access Gateway. Connects Access Gateway to a fabric switch. ISL is not supported.1 Fabric switch Yes NA Yes Connects devices, such as hosts, HBAs, and storage to the fabric. N_Ports are not supported. Connects the switch to other switches to form a fabric. The switch is logically transparent to the fabric, therefore it does not participate in the SAN as a fabric switch. How Access Gateway maps ports Access Gateway uses mapping--that is, pre provisioned routes--to direct traffic from the hosts to the fabric. When you first enable a switch to AG mode, by default, the F_Ports are mapped to a set of predefined N_Ports. For the default F_Port-to-N_Port mapping, see Table 9 on page 51. If required, you can manually change the default mapping. Figure 3 shows a mapping with eight F_Ports evenly mapped to four N_Ports on a switch in AG mode. The N_Ports connect to the same fabric through different edge switches. Hosts Host_1 F_1 N_1 Host_2 F_2 N_2 F_3 Access Gateway Edge Switch (Switch_A) F_A1 NPIV enabled Fabric F_A2 Host_3 NPIV enabled Host_4 F_4 N_3 Edge Switch (Switch_B) F_B1 NPIV enabled Host_5 F_5 F_B2 N_4 NPIV enabled Host_6 F_6 Host_7 F_7 Host_8 F_8 FIGURE 3 Example F_Port-to-N_Port mapping 4 Access Gateway Administrator's Guide 53-1000605-02 Upgrade and downgrade considerations 1 TABLE 2 F_Port F_1, F_2 F_3, F_4 F_5, F_6 F_7, F_8 Description of F_Port-to-N_Port mapping Fabric N_Port N_1 N_2 N_3 N_4 Access Gateway Edge switch Switch_A Switch_A Switch_B Switch_B F_Port F_A1 F_A2 F_B1 F_B2 Upgrade and downgrade considerations Downgrading to Fabric OS v6.0.0 or earlier is supported; however, you must first disable the switch from AG mode. Note the following considerations when upgrading and downgrading from Fabric OS v6.1.0 to Fabric OS v6.0.0 and earlier: · Not allowed if any F_Port trunk is active. · Trunking must be disabled before downgrading. · When a switch is set in AG mode, if you downgrade to v6.0.0x, all preferred settings are lost. Considerations with policies enabled Note the following upgrade and downgrade considerations when the Brocade policies are enabled. Advance Device Security policy If ADS is enabled, downgrading to v6.0 is allowed, however the ADS policy is not supported in v6.0.0. Automatic Port Configuration policy If you upgrade from Fabric OS v6.0.x to Fabric OS v6.1.0, by default, the APC policy is disabled. If the APC is enabled, you can downgrade from Fabric OS v6.1.0 to Fabric OS v6.0.0. Port Grouping policy If you upgrade from v6.0.0 to v6.1.0, then the PG policy is enabled with the default port group pg0 containing all the N_Ports. If the PG policy is enabled, you can downgrade from Fabric OS v6.1.0 to Fabric OS v6.0.0. Access Gateway Administrator's Guide 53-1000605-02 5 1 Upgrade and downgrade considerations 6 Access Gateway Administrator's Guide 53-1000605-02 Chapter Enabling Policies on Switches in Access Gateway Mode 2 This chapter provides information and procedures for enabling policies on switches in Access Gateway mode. In this chapter ·Access Gateway policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 ·Showing current policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 ·Advance Device Security policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 ·Enabling the Advance Device Security policy . . . . . . . . . . . . . . . . . . . . . . . . . 9 ·Disabling the Advance Device Security policy . . . . . . . . . . . . . . . . . . . . . . . . . 9 ·Setting which devices can log in if ADS policy is enabled . . . . . . . . . . . . . . . 9 ·Setting which devices cannot log in if ADS policy is enabled . . . . . . . . . . . . 10 ·Removing devices from the list of devices allowed at login . . . . . . . . . . . . . 10 ·Adding new devices to the list of devices allowed at login . . . . . . . . . . . . . . 10 ·Displaying the list of devices on the switch . . . . . . . . . . . . . . . . . . . . . . . . . . 11 ·Automatic Port Configuration policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 ·Enabling the Automatic Port Configuration policy . . . . . . . . . . . . . . . . . . . . . 12 ·Disabling the Automatic Port Configuration policy . . . . . . . . . . . . . . . . . . . . 12 ·Rebalancing F_Ports with APC policy enabled . . . . . . . . . . . . . . . . . . . . . . . 12 ·Enabling the Failover policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 ·Failover Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 ·Enabling the Failover policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 ·Disabling the Failover policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 ·Failback policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 ·Enabling the Failback policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 ·Cold Failover policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 ·Port Grouping policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 ·Creating a port group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 ·Adding an N_Port to a port group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 ·Deleting an N_Port from a port group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 ·Removing a port group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 ·Renaming a port group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 ·Disabling the Port Group policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 ·Access Gateway policy enforcement matrix. . . . . . . . . . . . . . . . . . . . . . . . . . 21 Access Gateway Administrator's Guide 53-1000605-02 7 2 Access Gateway policies ·Access Gateway trunking considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Trunk group creation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Setting up F_Port trunking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Assigning a Trunk Area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Enabling Access Gateway trunking. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Enabling the DCC policy on trunk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·Disabling F_Port trunking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ·F_Port Trunking monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 25 26 26 28 27 29 30 Access Gateway policies Brocade policy-based approach lets you restrict or filter traffic on standard Fabric OS switches and switches in Access Gateway mode. You can enable the following policies on a switch in Access Gateway mode: · Advance Device Security policy (ADS) · Automatic Port Configuration policy (APC) · Port Grouping policy (PG) Showing current policies You can run the following command to see which policies are enabled or disabled on a switch. 1. Connect to the switch and log in as admin. 2. Enter the ag --policyshow command. switch:admin> ag --policyshow Policy_Description Policy_Name State -------------------------------------------------Port Grouping pg Enabled Auto Port Configuration auto Disabled Advanced Device Security ads Enabled Advance Device Security policy The Advance Device Security (ADS) policy is supported on AG F_Ports. Fabric OS v6.1.0 extends the DCC policy to switches in AG mode to provide an additional level of security. It does this by extending the DCC policy to the physical F_Ports and the NPIV logins on F_Ports. As more physical servers become virtual, virtual servers can become vulnerable and security becomes an integral part of server IO virtualization. This security policy is a mechanism that restricts fabric connectivity to a set of devices that you can specify or allow to log in to the fabric connected through a switch in AG mode. By default, the ADS policy is not enabled. After you set a switch in AG mode, you can enable the ADS policy, and then specify which devices to allow at login on a per F_Port basis. Security enforcement can also be done in the enterprise fabric; the DCC policy in the enterprise fabric takes precedence over the ADS policy. When you enable the ADS policy, it applies to all the ports on the switch. By default, all devices have access to the fabric on all ports. 8 Access Gateway Administrator's Guide 53-1000605-02 Access Gateway policies 2 Enabling the Advance Device Security policy 1. Connect to the switch and log in as admin. 2. Enter the ag --policyenable ads command. switch:admin> ag --policyenable ads The policy ADS is enabled Disabling the Advance Device Security policy 1. Connect to the switch and log in as admin. 2. Enter the ag --policydisable ads command. switch:admin> ag --policydisable ads The policy ADS is disabled Setting which devices can log in if ADS policy is enabled You can determine which devices are allowed to log in on a per F_Port basis by specifying the device's port WWN (PWWN). Use the ag --adsset command to determine which devices are allowed to log in to a specified set of F_Ports. Lists must be enclosed in double quotation marks. List members must be separated by semicolons. The maximum number of entries in the allowed device list is twice the per port maximum log in count. Replace the WWN list with an asterisk (*) to indicate all access on the specified F_Port list. Replace the F_Port list with an asterisk (*) to add the specified WWNs to all the F_Ports' allow lists. A blank WWN list ("") indicates no access. The ADS policy must be enabled for this command to succeed. Use an asterisk enclosed in quotation marks,"*", to set the Allow list to "All Access" to all F_Ports; use a pair of double quotation marks ("") to set the Allow list to "No Access". Note the following characteristics of the Allow List: NOTE · · · · The maximum device entries allowed in the Allow List is twice the per port max login count Each port can be configured to "not allow any device" or "to allow all the devices" to log in If the ADS policy is enabled, by default, every port is configured to allow all devices to log in The same Allow List can be specified for more than one F_Port. For example, to set the list of allowed devices for ports 1, 10, and 13 to all access: 1. Connect to the switch and log in as admin. 2. Enter the ag --adsset "1;10;13""*" command. switch:admin> ag­-adsset"1;10;13""*" WWN list set successfully as the Allow Lists of the F_Port[s] Access Gateway Administrator's Guide 53-1000605-02 9 2 Access Gateway policies Setting which devices cannot log in if ADS policy is enabled For example, to set the list of allowed devices for ports 11 and 12 to no access: 1. Connect to the switch and log in as admin. 2. Enter the ag --adsset "11;12 "" command. switch:admin > ag ­-adsset "11;12" "" WWN list set successfully as the Allow Lists of the F_Port[s] Removing devices from the list of devices allowed at login Use the ag --adsdel command to delete the specified WWNs from the list of devices allowed to log in to the specified F_Ports. Lists must be enclosed in double quotation marks. List members must be separated by semicolons. Replace the F_Port list with an asterisk (*) to remove the specified WWNs from all the F_Ports' allow lists. The ADS policy must be enabled for this command to succeed. For example, to remove two devices from the list of allowed devices for ports 3 and 9, use the following syntax: ag--adsdel "F_Port [;F_Port2;...]" "WWN [;WWN2;...]" 1. Connect to the switch and log in as admin. 2. Enter the ag --adsdel "3;9 "" "22:03:08:00:88:35:a0:12;22:00:00:e0:8b:88:01:8b" command. switch:admin> ag --adsdel "3;9" "22:03:08:00:88:35:a0:12;22:00:00:e0:8b:88:01:8b" WWNs removed successfully from Allow Lists of the F_Port[s]Viewing F_Ports allowed to login Adding new devices to the list of devices allowed at login Use the adsadd command to add the specified WWNs to the list of devices allowed to log in to the specified F_Ports. Lists must be enclosed in double quotation marks. List members must be separated by semicolons. Replace the F_Port list with an asterisk (*) to add the specified WWNs to all the F_Ports' allow lists. The ADS policy must be enabled for this command to succeed. For example, to add two new devices to the list of allowed devices for ports 3 and 9, use the following syntax: ag--adsadd "F_Port [;F_Port2;...]" "WWN [;WWN2;...]" 1. Connect to the switch and log in as admin. 2. Enter the ag --adsadd "3;9" "20:03:08:00:88:35:a0:12;21:00:00:e0:8b:88:01:8b" command. switch:admin> ag --adsadd "3;9" "20:03:08:00:88:35:a0:12;21:00:00:e0:8b:88:01:8b" WWNs added successfully to Allow Lists of the F_Port[s] 10 Access Gateway Administrator's Guide 53-1000605-02 Access Gateway policies 2 Displaying the list of devices on the switch 1. Connect to the switch and log in as admin. 2. Enter the ag --adsshow command. switch:admin> ag --adsshow F_Port WWNs Allowed -------------------------------------------------------------------------1 ALL ACCESS 3 20:03:08:00:88:35:a0:12 21:00:00:e0:8b:88:01:8b 9 20:03:08:00:88:35:a0:12 21:00:00:e0:8b:88:01:8b 10 ALL ACCESS 11 NO ACCESS 12 NO ACCESS 13 ALL ACCESS -------------------------------------------------------------------------- Automatic Port Configuration policy Automatic Port Configuration (APC) is an optional policy and is disabled by default. When APC is enabled, the switch automatically discovers the port type. For example, when a switch in AG mode is connected to a port, AG configures the port as an N_Port. If a host is connected to a port on Access Gateway, then AG determines that it is connected and configures the port as an F_Port. After all the port types are determined, dynamic mapping between F_Ports and N_Ports is created and F_Ports are evenly distributed across all N_Ports. While the APC is enabled, you cannot manually configure F_Port-to-N_Port mapping. ATTENTION Enabling the APC policy is disruptive to F_Ports and N_Ports. You must disable the switch before you enable the APC policy because when you enable the APC policy, existing F_Port-to-N_Port mappings are deleted. Because the APC policy enforcement erases port mappings existing on the switch, it is recommended to perform a configupload before enabling the APC policy. After you enable the APC policy, the policy immediately takes effect; a reboot is not required. When you disable the APC policy, the N_Port configuration and the F_Port-to-N_Port mapping revert back to the default factory configuration for that platform. The APC policy is mutually exclusive with the Port Grouping policy. When the APC policy is enabled on a switch connected to multiple fabrics, no attempt is made by AG to restrict failover behavior even if the N_Ports are connected to unrelated fabrics. Do not to use the APC policy when Access Gateway is connected to multiple fabrics. Access Gateway Administrator's Guide 53-1000605-02 11 2 Access Gateway policies Enabling the Automatic Port Configuration policy 1. Connect to the switch and log in as admin. 2. Ensure that the switch is disabled, enter the switchdisable command 3. Enter the ag --policyenable auto command to enable the APC policy. switch:admin> ag --policyenable auto All Port related Access Gateway configurations will be lost. Please save the current configuration using configupload. Do you want to continue? (yes, y, no, n): [no] y 4. Enter the configupload command to save the switch's current configuration. 5. At the command prompt, type Y to enable the policy. The switch is ready; a reboot is not required. Disabling the Automatic Port Configuration policy 1. Connect and log in to the switch. 2. Enter the command ag --policydisable auto to disable the APC policy. 3. At the command prompt, type Y to disable the policy. switch:admin> ag --policydisable auto Default factory settings will be restored. Default mappings will come into effect. Please save the current configuration using configupload. Do you want to continue? (yes, y, no, n): [no] y Access Gateway configuration has been restored to factory default 4. Enter the switchenable command to enable the switch. Rebalancing F_Ports with APC policy enabled When the APC policy is enabled, there are no static mappings between F_Ports and N_Ports and no F_Ports are tied to a specific N_Port. When an F_Port comes online after the initial mapping is done, the F_Ports are automatically routed through one of the available N_Ports such that the F_Ports are evenly balanced across all the available N_Ports. Similarly, if a new N_Port comes online after the initial F_Port initialization, some of the F_Ports being routed through existing N_Ports will fail over to the new N_Port, if rebalancing is needed. Because of the disruption caused by the redistribution of F_Ports, it is recommended to add new N_Ports to the module. For more information on adding N_Ports, see "Adding an N_Port to a port group" on page 20. NOTE 12 Access Gateway Administrator's Guide 53-1000605-02 Access Gateway policies 2 Failover Policy When a port is configured as an N_Port and if by default, the Failover policy is enabled, F_Ports are not disabled if its N_Port goes off line. If you specify a Preferred Secondary N_Port for any of the F_Ports, and if the N_Port goes offline, the F_Ports will fail over to the Preferred Secondary N_Port and then re-enable. The specified Preferred Secondary N_Port must be online; otherwise, not the F_Ports will become disabled. Alternatively, if a Preferred Secondary N_Port is not set for any of F_Ports, the F_Ports will fail over to other online N_Ports belonging to the same N_Port group, and then re-enable. The FLOGI and FDISC requests are forwarded from F_Ports through the new N_Port. If multiple N_Ports are available as candidates for failover, Access Gateway selects one or more N_Ports so that the F_Ports are evenly balanced across all the N_Ports. NOTE Failover of F_Ports to new a N_Port generates a RASLOG message. The Failover policy allows hosts to automatically remap to an online N_Port if the primary N_Port goes offline. The Failover policy is enabled (or enforced) during power-up. The Failover policy evenly distributes the F_Ports that are mapped to an offline N_Port among all the online N_Ports. The Failover policy is a parameter of each N_Port. By default, the Failover policy is enabled for all N_Ports. The following sequence describes how a failover event occurs: · An N_Port goes offline. · All F_Ports mapped to that N_Port are disabled. · If the N_Port Failover policy is enabled, and a Preferred Secondary N_Port is specified for the F_Port and that N_Port is online, the F_Port fails over to the respective Preferred Secondary N_Port, and then re-enables. NOTE The Preferred Secondary N_Port is defined per F_Port. For example, if two F_Ports are mapped to a primary N_Port1, you can define a secondary N_Port for one of those F_Ports and not define a secondary N_Port for the other F_Port. Typically, this is done by the server administrator. You must determine whether you want to define a preferred secondary map for each of the servers or just a subset of the servers. · If the Preferred Secondary N_Port is not online, those F_Ports are disabled. · If the Preferred Secondary N_Port is not set for any of the F_Ports, those F_Ports will fail over to other available N_Ports belonging to the same N_Port group, and then re-enables. · The host establishes a new connection with the fabric. Example: Failover Policy This example shows the failover behavior in a scenario where two fabric ports go offline, one after the other. Note that this example assumes that no Preferred Secondary N_Port is set for any of the F_Ports. · First the edge switch F_A1 port goes offline, as shown in Figure 4 on page 14 Example 1 (left), causing the corresponding Access Gateway N_1 port to be disabled. The ports mapped to N_1 fail over; F_1 fails over to N_2 and F_2 fails over to N_3. · Next the F_A2 port goes offline, as shown in Figure 4 on page 14 Example 2 (right), causing the corresponding Access Gateway N_2 port to be disabled. Access Gateway Administrator's Guide 53-1000605-02 13 2 Access Gateway policies The ports mapped to N_2 (F_1, F_3, and F_4) fail over to N_3 and N_4. Note that the F_Ports are evenly distributed to the remaining online N_Ports and that the F_2 port did not participate in the failover event. Example 1 Hosts Host_1 Access Gateway F_1 Fabric Edge Switch (Switch_A) Host_2 F_2 N_1 Host_3 F_3 F_A2 N_2 Host_4 F_4 Edge Switch (Switch_B) Host_5 F_5 N_3 Host_6 F_6 N_4 Host_7 F_7 F_B1 NPIV enabled NPIV enabled Example 2 Hosts Host_1 Access Gateway F_1 Fabric Edge Switch (Switch_A) F_A1 NPIV enabled Host_2 F_2 N_1 F_A1 NPIV enabled Host_3 F_3 F_A2 N_2 NPIV enabled Host_4 F_4 Edge Switch (Switch_B) Host_5 F_5 N_3 F_B1 NPIV enabled F_B2 NPIV enabled Host_6 F_6 N_4 F_B2 NPIV enabled Host_7 F_7 Host_8 F_8 Host_8 F_8 Legend Physical connection Mapped online Failover route online Original mapped route (offline) FIGURE 4 Example 1 and 2 Failover policy behavior Enabling the Failover policy 1. Connect to the switch and log in as admin. 2. Enter the ag command with the --failovershow operand to display the failover setting. switch:admin> ag --failovershow 13 Failover on N_Port 13 is not supported 3. Enter the ag command with the --failoverenable operand to enable failover. switch:admin> ag --failoverenable 13 Failover policy is enabled for port 13 14 Access Gateway Administrator's Guide 53-1000605-02 Access Gateway policies 2 Disabling the Failover policy 1. Connect to the switch and log in as admin. 2. Enter the ag command with the --failovershow operand to display the failover setting. switch:admin> ag --failovershow 13 Failover on N_Port 13 is supported 3. Enter the ag --failoverdisable operand to disable failover. switch:admin> ag --failoverdisable 13 Failover policy is disabled for port 13 Failback policy The Failback policy automatically reroutes the F_Ports back to the primary mapped N_Ports as those N_Ports come back online, if the Failback policy is enabled for the N_Port. Only the originally mapped F_Ports fail back. In the case of multiple N_Port failures, only F_Ports that were mapped to the recovered N_Port experience failback. The remaining F_Ports are not redistributed among the online N_Ports during the failback. If the APC policy is enabled, by default, the failback policy is disabled. NOTE The Failback policy is an N_Port parameter. By default, the Failback policy is enabled. The following sequence describes how a failback event occurs: · When an N_Port comes back online, with the Failback policy enabled, the F_Ports that were originally mapped to it are disabled. · The F_Port is rerouted to the primary mapped N_Port, and then re-enabled. · The host establishes a new connection with the fabric. Example: Failback Policy In Example 3, described in Figure 5 on page 16, the Access Gateway N_1 remains disabled because the corresponding F_A1 port is offline. However, N_2 comes back online. See Figure 4 on page 14 for the original failover scenario. The ports F_1 and F_2 are mapped to N_1 and continue routing to N_3. Ports F_3 and F_4, which were originally mapped to N_2, are disabled and rerouted to N_2, and then enabled. Access Gateway Administrator's Guide 53-1000605-02 15 2 Access Gateway policies Example 3 Hosts Host_1 F_1 Access Gateway Edge Switch (Switch_A) F_A1 N_1 Fabric Host_2 F_2 NPIV enabled F_A2 Host_3 F_3 N_2 NPIV enabled Host_4 F_4 N_3 Edge Switch (Switch_B) F_B1 NPIV enabled Host_5 F_5 F_B2 N_4 NPIV enabled Host_6 F_6 Host_7 F_7 Legend Physical connection Mapped online Failover route online Original mapped route (offline) Host_8 F_8 FIGURE 5 Failback policy behavior Enabling the Failback policy 1. Connect to the switch and log in as admin. 2. Enter the ag --failbackshow command with the n_portnumber operand to display the failover setting. switch:admin> ag --failbackshow 13 Failback on N_Port 13 is not supported 3. Enter the ag --failbackenable command with the n_portnumber operand to enable failover. switch:admin> ag --failbackenable 13 Failback policy is enabled for port 13 Disabling the Failback policy 1. Connect to the switch and log in as admin. 2. Enter the ag --failbackshow command with the n_portnumber operand to display the failback setting. switch:admin> ag --failbackshow 13 Failback on N_Port 13 is supported 3. Enter the ag --failbackdisable command with the n_portnumber operand to disable failover. switch:admin> ag --failbackdisable 13 Failback policy is disabled for port 13 16 Access Gateway Administrator's Guide 53-1000605-02 Access Gateway policies 2 Cold Failover policy All F_Ports for an N_Port that goes offline are failed over to other N_Ports. However, if the N_Port fails to come online after the switch comes online, it triggers cold failover of its F_Ports. If any of these F_Ports have a Preferred Secondary N_Port set, and if the Preferred Secondary N_Port is online, those F_Ports fail over to the Preferred Secondary N_Port during cold failover. If the Preferred Secondary N_Port is not online, those F_Ports are disabled. If the Preferred Secondary N_Port is not set for any of these F_Ports, these F_Ports failover to any N_Ports on the switch so that the F_Ports are evenly balanced across all the N_Ports belonging to the same N_Port group. NOTE Access Gateway incorporates a number of Failover and Failback policies to ensure maximum up time for the servers. Port Grouping policy When connecting a switch in AG mode to multiple fabrics or isolating a subset of servers from other servers, you can group a number of servers and its corresponding fabric ports. You can do this by enabling the Port Grouping policy (PG), which can only be performed on N_Ports. Port groups cannot be overlapped. This means that an N_Port cannot belong to two different groups. The Failover and Failback policies remain the same within each port group and the Preferred Secondary N_Port can only specify the N_Ports from the same port group. This is why it is recommended to form groups before defining the preferred secondary path. This behavior is only in Fabric OS v6.0.0. When upgrading from Fabric OS v6.0.0 to Fabric OS v6.1.0, the PG policy that was enforced in Fabric OS v6.0.0 continues to be enforced in Fabric OS v6.1.0 and the port groups are retained. For example, Figure 8 on page 19 shows an example of pg0. If N_Port1 and 2 are in pg0 and F_Ports 1 and 2 are using N_Port1 and N_Port1 goes offline, then F_Ports1 and 2 are routed through N_Port2 because N_Port2 is in the same port group, pg0. Figure 6 shows that if you create port groups and when an N_Port goes offline, the F_Ports being routed through that port will fail over to any of the N_Ports that are part of that port group and are currently active. For example, if N_Port4 goes offline then F_Ports7 and 8 are routed through to N_Port 3 as long as N_Port 3 is online because both N_Ports3 and 4 belong to the same port group, PG2. If no active N_Ports are available, the F_Ports are disabled. The F_Ports belonging to a port group do not failover to N_Ports belonging to another port group. Access Gateway Administrator's Guide 53-1000605-02 17 2 Access Gateway policies FIGURE 6 Port grouping behavior When a dual redundant fabric configuration is used, F_Ports connected to a switch in AG mode can access the same target devices from both of the fabrics. In this case, you must group the N_Ports connected to the redundant fabric into a single port group. It is recommended to have paths fail over to the redundant fabric when the primary fabric goes down. FIGURE 7 ATTENTION pg1 setup If N_Ports are connected to unrelated fabrics are grouped together, N_Port failover within a port group can cause the F_Ports to connect to a different fabric and the F_Ports may lose connectivity to the targets they were connected to before the failover, thus causing I/O disruption as shown in Figure 7. 18 Access Gateway Administrator's Guide 53-1000605-02 Access Gateway policies 2