SECURING FIBRE CHANNEL FABRICS - Brocade

FC-Specific SecurityFC-Specific SecurityBrocade has developed several FC-specific security features thatwould not normally be available in a conventional LAN. For example,devices connecting to a Fibre Channel fabric can be authenticatedusing a strong protocol with the DCC policy.FC Port Access ManagementThe FC ports on a switch are particularly vulnerable for several reasons.They can be used to introduce unauthorized devices into thefabric, such as another FC switch. They can also be used to connect anauthorized device prematurely, for example, before an HBA has beenconfigured, which may cause unexpected switch behavior.The simplest method of protecting unused FC ports is to disable them.Use the portDisable command, but note that port status changes do notsurvive reboots. Changes using the persistentPortDisable command, onthe other hand, persist and survive reboots.An additional layer of defense that can be used to prevent unauthorizedswitches from joining a fabric is to disable the ability of an FC portto become an E_Port using the portCfgPort command.Single Point of Management AccessManaging an FOS-based fabric by default can be performed from anyswitch. However, it is always simpler to secure one entry point than tosecure multiple entry points, and this rule applies to FC fabrics as well.In large fabrics made up of numerous FC switches, there are many possiblemanagement points that all need to be secured properly. To createa single point of control for fabric management, Brocade introduced theFCS policy in FOS 5.3.0. The FCS policy identifies one switch as the primarypoint of control (the fabric configuration server) to manage allswitches in the fabric. Administrators must perform changes to zoning,user accounts, passwords, or policies via the primary FCS, therebyreducing the number of possible entry points for a potential attacker.The FCS policy can be defined using the secPolicyCreate command(secPolicyCreate "FCS_POLICY", "member ;…;"member"),where the “member” is the switch domain ID.Example:switch:admin> secpolicycreate "FCS_POLICY", "2;4"FCS_POLICY has been createdSecuring Fibre Channel Fabrics 143