SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 8: Securing FOS-Based FabricsSwitch and Device Access ControlsBrocade created a set of ACLs to prevent unauthorized access ofswitches and devices in a fabric in the form of the SCC and DCC policies.In a FOS 4.4.0 environment or later, use the SCC policy to define whichswitches are allowed to participate in a fabric. The switches are defined asmembers of the SCC using their WWN. The SCC policy can be defined usingthe secPolicyCreate command (secPolicyCreate "SCC_POLICY","member ;…;"member"), where the “member” is the switch domain IDand an asterisk (*) is used to define all switches in a fabric.Example:switch:admin> secpolicycreate "SCC_POLICY", "2;4"In a FOS 5.3.0 environment or later, use the DCC policy to define whichdevices are allowed to join a fabric. The DCC policy can identify memberdevices using their WWN or the physical port in the fabric to whichthey are connected. To further enhance security, a WWN can be lockeddown to a specific port (as a WWN spoofing countermeasure) by preventinga device that is configured to mimic an existing device fromjoining a fabric, unless the device being spoofed is first disconnectedand then physically replaced with an unauthorized device.The SCC policy is defined using the secPolicyCreate command(secPolicyCreate "DCC_POLICY_policyname", "member;…;"member"), where the “member” is either a WWN or the switchdomain ID (portID). When both the WWN and the switch ID/port ID definitionsare used together, this is called “locking down a port” and onlythe WWNs associated with that port are allowed to join the fabric.Example:switch:admin> secpolicycreate "DCC_POLICY_server","11:22:33:44:55:66:77:aa;1(3)"This example creates a policy called DCC_POLICY_server and locksdown the device with WWN 11:22:33:44:55:66:77:aa to port 3 of theswitch with domain ID 1.Switch and Device AuthenticationACLs such as the DCC and SCC policies provide an identification methodfor devices joining a fabric. Since a WWN can be spoofed, some organizationsrequire more than simple identification and require that devicesauthenticate to prove they really are what they “say” they are. Authenticationin an FC fabric can be accomplished using different protocols such asSLAP, FCAP, and DH-CHAP. Some of these protocols are based on the useof digital certificates and others use shared secrets.144 Securing Fibre Channel Fabrics