SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 8: Securing FOS-Based Fabricssince the FSPF routing protocol could not distinguish between the twotypes of traffic and simply shared the load between the two availableISLs. Traffic Isolation zones were created to address this issue. Trafficisolation can force traffic from one source to be sent over one pathand traffic from a different source to another path. In the previousexample, the backup traffic could be sent over one path and the datareplication traffic over another path.TI zones can be created using the zone command (zone - - create-t ti zone_name -p "ports").Example:zone --create -t ti red_zone -p "1,1; 2,4; 1,8; 2,6"Logging and Change ManagementThe primary logging mechanism on Brocade switches is the syslog(system log). The first rule when using logs is to ensure that the clockson all switches in the fabric are synchronized so that log files have consistenttime stamps across the SAN. This is easily accomplished withNTP (Network Time Protocol). An NTP server is used as the primarysource of accurate time for the entire SAN. NTP is defined by providingthe IP address of an NTP server and for redundancy, more than oneNTP server can be specified (up to eight servers). NTP servers aredefined using the tscLockServer command.As mentioned in previous chapters, one of the first things a sophisticatedhacker may do is try to remove all traces of his or her activity ona system once an attack is completed. The syslog is one file that is typicallyremoved in this process, so it is important to redirect the syslogto a secure server in a different location from the actual switchesusing the syslogDIpAdd command.As an extra precaution, log files redirected to a secure server shouldalso be backed up regularly. Furthermore, backups for this servershould probably be retained for a longer period of time than mostother backups. It would be preferable to retain all backups in the eventof a security incident that is only detected several months after itoccurred. The backup of the log files could be the only way to obtainproof of the incident, if required at trial.Audit logCertain classes of events that occur in a SAN may be of great interestto security professionals. These events include login failures, zone configurationchanges, firmware downloads, and other configurationchanges, all of which may have a serious effect on the operation andsecurity of the switch. These events can be recorded and filtered using148 Securing Fibre Channel Fabrics