SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 8: Securing FOS-Based FabricsTo address these new enterprise security requirements, Brocade introducedthe first security features for the FC SAN environment with theintroduction of Secure Fabric OS (SFOS) in 2002 (released with FOS2.6.0). SFOS introduced the first ACLs FC switch authentication mechanism(using PKI and digital certificates), and secure IP protocols toaccess the management interface. Although PKI can still be used, ithas now been replaced with the industry standard DH-CHAP authenticationmethod using shared secrets.Most of the security features previously available in SFOS have sincebeen replaced with equivalent or more powerful and flexible functionalityin the base Fabric OS (version 5.3.0 and later). Appendix A provides acomprehensive list of technical security features that can be implementedin an FOS-based SAN environment. Brocade is continuallyenhancing existing features and creating new ones to ensure that FCfabric infrastructures and the data moving through them remain secureand highly available as new security vulnerabilities are discovered.It is important to note that even though the ACLs in SFOS and the newbase FOS equivalents share the same names, they are not compatible.A secure fabric running SFOS must be converted to the equivalentFOS-based security features according to the procedures detailed inthe Fabric OS Administrator's Guide.With SFOS, all switches in a secured fabric were required to be insecure mode in order to join and participate in the fabric. With thestandard FOS-based secure mode, fabrics can be in either strict or tolerantmode:• In strict mode, all switches must participate in the fabric, as wasthe case with SFOS.• In tolerant mode, not all switches need to participate, which isparticularly useful when a fabric contains older switches that cannotbe upgraded to a firmware release greater than FOS 5.2.0.However, this mode is not recommended from a security perspective,as a fabric will only be as secure as its weakest link. A switchthat does not participate in a secure fabric will become the vulnerablepoint that could be used to gain access to the fabric.132 Securing Fibre Channel Fabrics