SECURING FIBRE CHANNEL FABRICS - Brocade

Securing FOS-Based Fabrics8When it comes to SAN security, each organization has its own requirementsand level of tolerance to risk. Although Brocade FC switches canbe secured to a very high degree, organizations usually use a morepragmatic approach by finding the right balance between ease of SANmanagement and minimizing security risks. A FOS-based fabric providesmore than 100 security features. Clearly, not all features need tobe implemented in a fabric, but you have the flexibility to implementthose that are necessary to achieve the precise level of protection thatyour organization requires.To protect FOS-based SANs, use the defense-in-depth strategydescribed earlier in “The Brocade SAN Security Model” on page 91.This chapter covers most of the security features available in Fabric OS(FOS) 7.0 and earlier. It is not intended to be an implementation manual;but it does cover features and their associated commands at ahigh level. For further details on implementing these features, pleaserefer to the appropriate version of the Brocade Fabric OS Administrator'sGuide and the Brocade Fabric OS Command Reference.NOTE: The FOS CLI commands in this chapter are written with uppercaseletters to make them easier to read. However, when commandsare executed, they are case insensitive and are normally typed as alllowercase, as shown in code examples. Additionally, bold text is usedfor commands in order to highlight them.Secure Fabric OS: A Historical OverviewIn the early 2000s, when the FC protocol was gaining momentum inenterprise environments while more mission-critical and sensitive informationwas being stored on the SAN, customers began expressingconcern about the security of this new environment. Security professionalsrealized that the SAN was just another type of network and alsorequired specific measures to protect the information residing on it.Securing Fibre Channel Fabrics 131