SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 8: Securing FOS-Based FabricsWhen installing new firmware on a switch that has been configured forfirmware signature validation, the public key is retrieved from the localpublic key file included with the firmware package and the firmware isvalidated.A switch must be configured to enforce firmware signature validationand this is done using the configure command.Example:switch:admin> configureNot all options will be available on an enabled switch.To disable the switch, use the "switchDisable" command.Configure...System services (yes, y, no, n): [no]…cfgload attributes (yes, y, no, n): [no] yesEnforce secure config Upload/Download (yes, y, no, n):[no]Enforce firmware signature validation (yes, y, no, n):[no] yesFabric Watch Security ClassFabric Watch is a Brocade licensed feature in FOS that is used to monitorswitch events and send alerts in the form of SNMP traps or e-mails. Fabric Watch events are grouped into classes, one of which is ofparticular interest to security personnel: the security class.The Fabric Watch security class includes the following events:• API violations • DCC violations• Front panel violations • HTTP violations• Illegal commands • Incompatible• Security database • Invalid certificates• Invalid signatures • Invalid time stamps• Login violations • MS violations• No FCS violations • RSNMP violations• SCC Violations • Serial Violations• SES Violations • SLAP Bad Packets• SLAP Failures • Telnet Violations• TS out of sync • WSNMP Violations152 Securing Fibre Channel Fabrics