SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 7: Deploying SAN-Attached Devices in a DMZA server connected to a fabric can potentially see all of the storagedevices and servers connected to the fabric unless proper measuresare taken. This chapter explores several techniques that accomplishthe secure configuration of a SAN containing servers that are within aDMZ. The subject matter is intended to enable experienced SAN orsecurity administrators to address DMZ-related security concerns. Ifyou are an avid reader and intend to read the entire book, you willnotice several redundant sections in this chapter. Please feel free toskip over them if desired.Securing the Management InterfacesEvery FC switch has an Ethernet port used as a primary managementinterface. Switches are usually managed using a command-line interface(CLI) or a graphical user interface (GUI) via the Ethernet port usingan IP address. It is extremely important to ensure that managementinterfaces are located on a network segment that is isolated from theInternet, and if necessary the production network as well. The switchmanagement interfaces should never be accessible from the Internet,at least not without a secure VPN (Virtual Private Network). This can beimplemented in several ways using one or more of the following technologies:a separate physical network, non-routable subnets, VLAN(typically, a private VLAN is used), ACLs, Policy-Based Routing (PBR),and/or firewalls (implementing a VPN).The management interfaces should also be used in conjunction withsecure protocols such as SSH, SSL (HTTPS, SCP, SFTP), and SNMPv3.Conventional protocols such as telnet, HTTP, and SNMPv1/2 exchangedata in standard readable or cleartext format and should be disabledonce the secure protocols are configured. Information such as passwordsand user IDs can easily be captured using network sniffing tools.Secure protocols such as SSH and SSL use encryption algorithms to protectunauthorized viewing of data, including passwords and user IDs.User accounts and passwords are the first line of defense for a networkdevice management interface and are an important component for preventingunauthorized access. It is important to assign a separateaccount to each individual administrator who has access to the switchesinstead of a shared account between all or some administrators. Role-Based Access Controls (RBAC) are used to assign specific rights, whichare tied to a person’s user account on the network or on a particulardevice.The factory default passwords for all default accounts must bechanged before a network device goes into production. This is usuallydone during the initial switch configuration. Companies should have122 Securing Fibre Channel Fabrics