SECURING FIBRE CHANNEL FABRICS - Brocade

The Brocade SAN Security Modelrestricting device communication only to member devices inside agiven zone. Today, zoning is an accepted standard and plays an integralrole in SAN security.For Brocade switches, there are two ways to identify zone members,and zone enforcement is performed either in the switch Name Serveror inside the switch ASICs. Identification methods include DID/PID(DP), the switch domain ID and the switch port number; and port WorldWide Name (pWWN), the storage or host port WWN. Brocade recommendspWWN identification because of the management flexibility itprovides; also, several advanced Brocade features require pWWNzoning.Brocade switches that operate at 2 Gbps or faster enforce both DP andpWWN zones in hardware. This was not the case with Brocade 1 Gbpsswitches, and users frequently chose DP identification because it wasthe only hardware-enforced zoning method at the time. Now, a zonewith all DP identification or all pWWN identification uses the moresecure hardware enforcement.However, there are some cases when mixing identification methodsresults in software enforcement. These cases include mixing DP andpWWN identification within a zone or using a DP identification for onezone and the pWWN attached to that DP in another zone. For this reason,Brocade recommends using the same zoning identificationmethod (preferably pWWN) across the entire SAN to ensure that:• All zoning is hardware enforced• Advanced features such as Fibre Channel Routing are usable• Zoning management methods are consistentAs a security best practice, organizations should use single-initiator, orsingle-HBA, zones. This means that each zone should have only onehost defined, although it can have multiple target storage nodes. Single-HBAzoning improves security, helps contain RSCNs, and makesthe SAN much easier to manage and troubleshoot. An extension of thisbest practice for mixed disk and tape traffic on the same HBA is to utilizetwo zones for each HBA: one for disk nodes and one for tapenodes. This approach isolates the disk and tape devices, even thoughthey continue to communicate through the same HBA.Another best practice is to activate Default Zoning. By default, if nozones are defined or the current zoning configuration is disabled, alldevices can see each other in the SAN, which can create a variety ofproblems. First, the SAN is more vulnerable from a security perspective.Securing Fibre Channel Fabrics 99