SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 7: Deploying SAN-Attached Devices in a DMZthe FC switch. This prevents a host with the same WWN as another productionhost on the fabric from joining the fabric. While these portcontrol methods add some additional management steps to the configurationof an FC switch, they significantly increase the security of theswitch and reduce the risk of rogue devices joining the fabric.ZoningZoning is a common technique implemented within an FC fabric. Zoningallows for devices such as servers, disks, and tape drives to begrouped together and isolated from other devices. Devices can onlycommunicate with other devices that are in the same zone. All BrocadeFC switches are capable of hardware-enforced zoning, in whichan ASIC enforces the decision to allow or prevent devices to communicatewith each other, as defined by the zoning configuration. Hardwareenforcement is always performed on Brocade FC switches if all zoneidentification in a zone configuration is DID/PID (port zoning) or pWWN(WWN zoning). Mixing identification methods in a zone configurationwill cause the zone enforcement to be performed by the less secureName Server enforcement method. Brocade recommends using allpWWN definitions when configuring zoning to ensure that all zones arehardware enforced and to enable some advanced Brocade featuressuch as Fibre Channel Routing (see “Zoning” on page 29).LUN MaskingLUN masking, can be implemented on the HBA (Host Bus Adapter) or onthe disk controller. This feature assigns a specific LUN to a specificpWWN in the SAN. No other server will be able to see or access that LUNunless multiple LUN masking mappings are configured. Typically, LUNmasking will be configured on the storage subsystem. LUN masking isless effective when it is configured only on the server, since the maskingcan be disabled if the server is compromised. A server breach is morelikely than a storage subsystem breach.Administrative DomainsThe last technique, Administrative Domains (ADs), are used to logicallygroup FC switches, switch ports, and device pWWNs (in a physical fabric)that should be managed separately from other components in thefabric. Zoning logically groups devices that communicate with eachother, while ADs create a Logical Fabric, with logically grouped devices,that can be managed independently as though they were separateswitches.124 Securing Fibre Channel Fabrics