Computer Accessories User Manual

ManualsBrandsBrocade Communications Systems ManualsComputer Accessories53-1001778-01

53-1001778-01

30 March 2010

Brocade SMI Agent

User’s Guide

Supporting SMI Agent 120.11.0

Summary of content (90 pages)

PAGE 1
53-1001778-01 30 March 2010 Brocade SMI Agent User’s Guide Supporting SMI Agent 120.11.
PAGE 2
Copyright © 2006-2010 Brocade Communications Systems, Inc. All Rights Reserved. Brocade, Fabric OS, File Lifecycle Manager, MyView, and StorageX are registered trademarks and the Brocade B-wing symbol, DCX, and SAN Health are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other countries. All other brands, products, or service names are or may be trademarks or service marks of, and are used to identify, products or services of their respective owners.
PAGE 3
Title Publication number Summary of changes Date Brocade SMI Agent User’s Guide 53-1001199-01 Updated to support Fabric OS 6.2.0 and SMI-A 120.8.0 December 2008 Brocade SMI Agent User’s Guide 53-1001199-02 Minor corrections to the previous version. February 2009 Brocade SMI Agent User’s Guide 53-1001263-01 Updated to support Fabric OS 6.1.2_cee and SMI-A 120.9.0 March 2009 Brocade SMI Agent User’s Guide 53-1001263-02 Updated the procedure for adding proxy connections.
PAGE 4
iv Brocade SMI Agent User’s Guide 53-1001778-01
PAGE 5
Contents About This Document In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix How this document is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix Supported hardware and software . . . . . . . . . . . . . . . . . . . . . . . . . . . x What’s new in this document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Document conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 6
Service Location Protocol (SLP) support . . . . . . . . . . . . . . . . . . . . . . . 7 slptool commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 SLP on Linux, Solaris, and AIX. . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 SLP on Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Disable HTTP for security reasons . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Connection monitoring . . . . . . . . . . . . . . . . . . .
PAGE 7
Fabric Manager database server configuration . . . . . . . . . . . . . . . . 34 Configuring the Fabric Manager database server connection parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Firmware download software locations configuration . . . . . . . . . . . 35 Configuring software locations for firmware download. . . . . . . 35 Debugging and logging options configuration. . . . . . . . . . . . . . . . . . 37 Debugging options for CIMOM . . . . . . . . . . .
PAGE 8
Appendix A Licenses and Attributions In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Open source software used in SMI-A. . . . . . . . . . . . . . . . . . . . . . . . . 57 Sun Industry Standards Source License . . . . . . . . . . . . . . . . . . . . . . 58 IBM Common Public License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 OpenSLP License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 9
About This Document In this chapter • How this document is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix • Supported hardware and software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x • What’s new in this document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi • Document conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi • Notice to the reader . . . . . . . . . . .
PAGE 10
Supported hardware and software In those instances in which procedures or parts of procedures documented here apply to some switches but not to others, this guide identifies exactly which switches are supported and which are not. Although many different software and hardware configurations are tested and supported by Brocade Communications Systems, Inc. for SMI-A 120.11.0, documenting all possible configurations and scenarios is beyond the scope of this document.
PAGE 11
• • • • • • • • • • • Brocade 8000 Application Appliance Brocade 8470 switch Brocade VA-40FC switch Brocade 12000 director (only on Fabric OS 5.0.
PAGE 12
italic text Provides emphasis Identifies variables Identifies class properties Identifies paths and Internet addresses Identifies document titles code text Identifies CLI output Identifies command syntax examples For readability, command names in the narrative portions of this guide are presented in mixed lettercase: for example, switchShow. In actual examples, command lettercase is often all lowercase. Otherwise, this manual specifically notes those cases in which a command is case sensitive.
PAGE 13
Corporation Referenced Trademarks and Products Sun Microsystems, Inc. Sun, Solaris Red Hat, Inc. Red Hat, Red Hat Network VMware, Inc. VMware Additional information This section lists additional Brocade and industry-specific documentation that you might find helpful. Brocade resources The following SMI-A documentation can be obtained from developer support at Brocade: • Brocade SMI Agent Installation Guide • Brocade SMI Agent Developer’s Guide To get up-to-the-minute information, go to http://my.
PAGE 14
For information about the Fibre Channel industry, visit the Fibre Channel Industry Association Web site: http://www.fibrechannel.org Getting technical help Contact your switch support supplier for hardware, firmware, and software support, including product repairs and part ordering. To expedite your call, have the following information available: 1.
PAGE 15
• • • • Brocade 8470—On the top of the chassis Brocade 12000, 24000, and 48000—Inside the chassis next to the power supply bays Brocade DCX—On the bottom right on the port side of the chassis Brocade DCX-4S—On the bottom right on the port side of the chassis, directly above the cable management comb. • Brocade Multiprotocol Router Model AP7420—On the bottom of the chassis and on the back of the chassis. 1. World Wide Name (WWN) Use the licenseIdShow command to display the WWN of the chassis.
PAGE 16
Document feedback Quality is our first concern at Brocade and we have made every effort to ensure the accuracy and completeness of this document. However, if you find an error or an omission, or you think that a topic needs further development, we want to hear from you. Forward your feedback to: documentation@brocade.com Provide the title and version number of the document and as much detail as possible about your comment, including the topic heading and page number and your suggestions for improvement.
PAGE 17
Chapter 1 Overview In this chapter • Common Information Model (CIM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 • Brocade SMI-S Initiative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 • Brocade SMI Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 18
1 Brocade SMI-S Initiative Brocade SMI-S Initiative Storage Management Initiative (SMI) is a broad-based initiative sponsored by the Storage Networking Industry Association (SNIA) that is standardizing all aspects of storage management for multivendor storage networking products. SMI encompasses the storage aspects of CIM, as shown in Figure 1.
PAGE 19
Brocade SMI Agent Management Application CIM Client CIM Client 1 CIM Client Brocade SMI Agent CIM Object Manager (CIMOM) Provider FIGURE 2 Brocade Provider Provider Provider Brocade SMI Agent high-level architecture The Brocade SMI Agent supports the evolving SMI-S standard and the Brocade functionality not available through the standard.
PAGE 20
1 Brocade SMI Agent • SLP (Service Location Protocol) to discover SMI-S profiles • CIM agent management using CIM • Indications: life-cycle indications for fabrics, SANs, nodes, switches, and switch ports; and alert indications for many fabric events.
PAGE 21
Chapter Brocade SMI Agent 2 In this chapter • Start the Brocade SMI Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 • Stop the Brocade SMI Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 • Service Location Protocol (SLP) support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 • Disable HTTP for security reasons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 • Connection monitoring . . . . . . . . .
PAGE 22
2 Stop the Brocade SMI Agent On Windows: \agent\server\jserver\bin\start_server.bat On Windows, you can also click Start > Programs > SMIAgent > Start CIMOM. The SMI-A is now ready to use. Starting the SMI-A as a service 1. Type the following at the command line: On Linux, Solaris, and AIX: sh /agent/server/jserver/bin/start_agent_service.sh On Windows: \agent\server\jserver\bin\start_agent_service.
PAGE 23
Service Location Protocol (SLP) support 2 Stopping the SMI-A when mutual authentication for clients is enabled 1. Modify the stop_server script to specify the CLASSPATH for the WbemClient.properties file. (See “Client configuration to use client certificates” on page 48 if the WbemClient.properties file is not used.) The CLASSPATH should contain only the path to the directory where the file is present and not the path to the file itself. For example, if the WbemClient.
PAGE 24
2 Service Location Protocol (SLP) support • slptool script that starts up the slptool platform-specific program • slptool program that can be used to verify that SLP is operating properly. A different slptool exists for Solaris, Linux, AIX, and Windows. By default, the SMI-A is configured to advertise itself as a Service Agent (SA). The advertised SLP template shows its location (IP address) and the WBEM Services it supports.
PAGE 25
Service Location Protocol (SLP) support 2 Starting SLP on Linux, Solaris, and AIX 1. Become the root user: % su root 2. Check that the SLP daemon is not already started: # ps -eaf | grep slpd 3. Start the SLP daemon, if one is not already started: # /agent/bin/slpd Stopping SLP on Linux, Solaris, and AIX 1. Become the root user: % su root 2. Find the process ID for the SLP daemon: # ps -eaf | grep slpd 3.
PAGE 26
2 Service Location Protocol (SLP) support # /agent/bin/slptool findattrs service:wbem:http://192.168.0.100:5988 # /agent/bin/slptool findattrs service:wbem:https://192.168.0.100:5989 SLP on Windows This section describes how to install, start, and verify the SLP daemon on Windows. On Windows, the SLP service must be installed from a command prompt. It need only be installed once, but must be installed before starting the SMI-A. Installing SLP on Windows 1.
PAGE 27
Disable HTTP for security reasons 2 Verifying that the SLP service is correctly installed and operating 1. Start the SLP service and SMI-A. 2. Open a command prompt via Start > Programs > Accessories > Command Prompt. 3. Change to the directory where slpd.bat is located: cd C:\\agent\bin 4. Verify that the SLP service is properly running as a Service Agent. > slptool findsrvs service:service-agent 5.
PAGE 28
2 Enable multi-homed support Enable multi-homed support The Brocade SMI Agent supports multi-homed hosts; that is, hosts configured with multiple IPs. This means that you can configure which IP address the SMI Agent should use for Event and ARR registration on the switch. Configuring IP address for switch-to-SMIAgent communication in multi-homed systems 1. Edit the SMIAgentConfig.xml file found at .../server/jserver/bin with the following entry: PAGE 29
Chapter 3 Brocade SMI Agent Configuration In this chapter • About the Brocade SMI Agent Configuration Tool . . . . . . . . . . . . . . . . . . . . . • Launch the Brocade SMI-A Configuration Tool . . . . . . . . . . . . . . . . . . . . . . . • Proxy connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . • Access control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . • SMI Agent security. . . . . . . . . . .
PAGE 30
3 About the Brocade SMI Agent Configuration Tool • Server buttons Some of the commands require you to start or stop the SMI-A server before they take effect. Use the Start Server and Stop Server buttons to start and stop the SMI-A server. If the SMI-A is configured as a service, the Start Server and Stop Server buttons start and stop the SMI-A as a service. These buttons also show the current status of the SMI-A server.
PAGE 31
Launch the Brocade SMI-A Configuration Tool 3 Launch the Brocade SMI-A Configuration Tool Because this is a graphical tool, for Linux, Solaris, and AIX, you must be on a console with an XWindows Manager or, if you are working remotely, export the display. Launching the Brocade SMI Agent Configuration Tool (Linux, Solaris, and AIX) 1. Navigate to the directory where the tool is located. /agent/server/jserver/bin where is the directory where the Brocade SMI Agent is installed. 2.
PAGE 32
3 Proxy connections Proxy connections The SMI-A installation wizard automatically configures the provider.xml file with the fabric information that is added during the installation process. This section describes how you can add or remove proxy entries manually after installation is done. You can also choose to have the SMI-A attempt to reload the provider.xml when fabric segmentation occurs. When you add proxy entries, the SMI-A attempts to log in to every one.
PAGE 33
Proxy connections 3 The configuration values for the new fabric are displayed in the content pane. The value in the Status column is Not Connected, which means that the proxy entry is configured but the SMI-A is not connected to the fabric. FIGURE 5 Proxy Configuration dialog box 5. Click Apply. You are prompted to start the SMI-A if it is not already started. Click Start Server in the lower left corner of the window. The SMI-A attempts to log in to the fabric.
PAGE 34
3 Access control TABLE 1 Login failure status messages LoginAsUser Return Code Status message in Proxies panel Description RT_NOT_SUPPORTED Not supported Access protocol is not supported. RT_ALREADY_EXISTS Duplicate Connection Attempt to make an additional connection to an already connected switch, or an attempt to make a connection to a switch in a fabric that is already connected through another switch. RT_PWD_EXPIRED Password Expired Login failed due to password expired.
PAGE 35
Access control 3 Mapping an SMI-A user to a switch user 1. Launch the Brocade SMI Agent Configuration Tool. 2. Click User Mapping in the menu tree (see Figure 6 on page 19). FIGURE 6 User mapping 3. Click the Stop Server to stop the SMI-A, if it is running. This button is unavailable if the server is already stopped. 4. Click Add. 5. Fill out the User Mapping Configuration dialog box and click OK. The Proxy IP, SMIA User name, and Switch User name fields are mandatory.
PAGE 36
3 Access control The value in the Status column changes from Not Persisted to Persisted, which means the values are persisted to the provider.xml configuration file. Setting up default SMI-A user mapping You can set up a default mapping that applies to all SMI-A users that are not explicitly mapped in the User Mapping section. If a default mapping is not provided, then all unmapped SMI-A users inherit the same access as the account used to connect to the switch.
PAGE 37
SMI Agent security FIGURE 9 3 User Mapping Configuration dialog box 6. Click Apply. The value in the Status column changes from Not Persisted to Persisted. Limitations of SMI-A user-to-switch user mapping • Indications are not filtered based on the SMI-A user names. Indications related to fabrics for which the SMI-A user does not have access will still be delivered. • It is not recommended to map default SMI-A users to a zoneadmin switch user.
PAGE 38
3 SMI Agent security Mutual authentication setup Before you enable mutual authentication for clients and indications, you need to do the following so the Configuration Tool will know the location of the certificate files: • Configure the WbemClient.properties file with the location of the certificate files. • Update the CLASSPATH variable in two files with the location of the WbemClient.properties file.
PAGE 39
SMI Agent security b. 3 Configure the WBEM client to use client certificates to communicate with the SMI-A. (See “Client configuration to use client certificates” on page 48.) The changes take effect when you restart the server. Click Start Server to restart the server.
PAGE 40
3 SMI Agent security FIGURE 10 Mutual authentication for indications Configuring HTTP access When HTTP access is disabled, only HTTPS access is available to the clients. The SMI-A server must be stopped to enable HTTP access, and must be running to disable HTTP access. You must have Administrator privileges (Windows) or root/admin privileges (Linux, Solaris, and AIX) to enable or disable HTTP access. This option is disabled if you do not have the appropriate privilege. 1.
PAGE 41
SMI Agent security FIGURE 11 3 HTTP access Importing client certificates If you enable mutual authentication for clients or mutual authentication for indications, you can import a client certificate into the SMI Agent server truststore. This certificate will be used for authentication if mutual authentication is enabled. NOTE You can import only certificates generated using Java Keytool or OpenSSL.
PAGE 42
3 SMI Agent security FIGURE 12 Importing client certificates 3. Enter information for the client certificate to be used for mutual authentication for clients. a. Type the path of the client certificate in the Certificate File Name field, or click Select File to browse for the file. b. Type the alias name of the certificate in the Alias Name field. 4. Enter information for the client certificate to be used for mutual authentication for indications. 5. Click Apply.
PAGE 43
SMI Agent security FIGURE 13 3 Exporting client certificates 3. Enter the output folder and file name for the certificate used for mutual authentication for clients. a. Type the path of the output folder to which the server certificate will be exported in the Output Folder field, or click Select File to browse for the file. b. Type the file name in the Output File Name field. 4. Enter the output folder and file name for the certificate used for mutual authentication for indications. 5. Click Apply.
PAGE 44
3 SMI Agent security FIGURE 14 Viewing and deleting client certificates in server truststore 3. Click Client Authentication or Indication Authentication to view the corresponding list of certificates. 4. Select the certificate in the left side of the pane. The right side of the pane displays the selected certificate. Use the scroll bars to view the certificate. 5. To delete the selected certificate from the SMI-A truststore, click Delete, and click Yes in the confirmation window.
PAGE 45
SMI Agent security 3 Disabling user authentication does not take effect until after the server is restarted. So even if you disable user authentication in this window, you will still be prompted to provide user credentials until you restart the server. 4. Windows only: You can enable domain authentication by checking the Windows Domain Authentication check box and providing the domain name in the field provided. To disable domain authentication, clear the Windows Domain Authentication check box.
PAGE 46
3 SMI Agent security Encoding proxy connection details For additional security you can encode the contents of the provider.xml file. 1. Launch the Brocade SMI Agent Configuration Tool. 2. Click Encode Proxy Details in the menu tree (see Figure 16). The content pane displays the current setting, which is selected and dimmed. 3. Click the Stop Server to stop the SMI-A, if it is running. This button is unavailable if the server is already stopped. 4.
PAGE 47
SMI Agent service configuration and removal 3 SMI Agent service configuration and removal You must have Administrator privileges (Windows) or root/admin privileges (Linux, Solaris, and AIX) to configure or remove the SMI Agent as a service. This option is disabled if you do not have the appropriate privilege. Configuring or removing the SMI Agent as a service 1. Launch the Brocade SMI Agent Configuration Tool. 2. Click Configure / Remove in the menu tree (see Figure 17).
PAGE 48
3 Port configuration Port configuration This section describes how to configure the HTTP, HTTPS, ARR, and Eventing ports. • “Configure HTTP and HTTPS ports” on page 32 • “Configure ARR and eventing ports” on page 33 Configure HTTP and HTTPS ports The SMI-A includes the CIM-XML and CIM-XMLS Client Protocol Adapters (CPA). By default, all are installed and enabled for use. Each CPA uses a different TCP port to exchange WBEM requests and responses.
PAGE 49
Port configuration FIGURE 18 3 Configure HTTP and HTTPS ports Configure ARR and eventing ports You can configure both the secure and non-secure ARR and eventing ports using the procedure in this section. The ARR port is the port through which the switches in the fabric send data (large payload responses) back to the SMI-A. The eventing port is the port through which the switch connects to the SMI-A to deliver events.
PAGE 50
3 Fabric Manager database server configuration 4. Click Apply. The changes take effect when you restart the server. Click Start Server to restart the server. FIGURE 19 Configure ARR and eventing ports Fabric Manager database server configuration Configuring a Fabric Manager database server connection allows the Brocade SMI Agent to report on historical port statistics by retrieving the data from the Fabric Manager database server.
PAGE 51
Firmware download software locations configuration 3 3. To change the settings, type new values in the URL, User Name, and Password fields: URL URL to locate the database. If the Fabric Manager server is installed on the same host as the SMI-A, the URL is: jdbc:sybase:Tds:localhost:2638/fabman Otherwise, replace localhost with the Fabric Manager server’s host IP address, in IPv4 or IPv6 format. User Name User name for the database user.
PAGE 52
3 Firmware download software locations configuration FIGURE 21 Configure firmware download software locations 3. To add a new entry, click the Add button and fill out the Software Location dialog box (Figure 22) with the following values: HostName/IP Address Type the host name or host IP address (in IPv4 or IPv6 format). User name and Password Type the user name and password with which to log in to the host. File Path Type either the absolute or relative path to the software file.
PAGE 53
Debugging and logging options configuration 3 Debugging and logging options configuration This section explains how to use the Brocade SMI Agent Configuration Tool to configure debugging and logging options for the CIMOM and Provider. This information can be useful in diagnosing problems during development of client applications, providers, and other components.
PAGE 54
3 Debugging and logging options configuration 4. Click Apply. The changes take effect when you restart the server. Click Start Server to restart the server. FIGURE 23 Configure debugging options for CIMOM Debugging options for the provider This section describes how you can update the debugging configuration. By default, debug logging for the provider is enabled. You can update debugging configuration dynamically or you can update the debug properties file.
PAGE 55
Debugging and logging options configuration 3 Configuring debugging options for the provider 1. Launch the Brocade SMI Agent Configuration Tool. 2. Click Debug in the menu tree (see Figure 24 on page 40). The content pane displays the current debugging configuration for the provider. 3. To enable debugging: a. Check the Enable Debug logging check box. b. Click one of the following: • Dynamic Update Update the configuration immediately, when you click Apply.
PAGE 56
3 Debugging and logging options configuration 4 - Info Exceptions that are of no interest to the user. For example, an exception logged when the SMI-A first attempts a secure login to a non-secure switch if the user specifies “ProtocolToUse” as “Any.” NOTE Increasing the value of the exception level causes a decrease in performance because the amount of data to be logged increases. 4. To disable debugging, clear the Enable Debug logging check box. 5. Click Apply.
PAGE 57
Debugging and logging options configuration 3 4. To enable file logging: a. Check the Enable File logging check box. b. Type the full path to the log file, or click Select File to browse for the file location. c. Type the size of the log file (in kilobytes). The log file size can be between 1 and 51200 kilobytes (between 1024 and 52428800 bytes). d. Type the number of log files. To disable file logging, clear the Enable File logging check box. 5. Click Apply.
PAGE 58
3 Debugging and logging options configuration . . -------------> Contents from the first time run . . . -------------> Contents from the second time run .
PAGE 59
Support information collection FIGURE 26 3 Configure provider cache Support information collection This section explains how to collect support information in case of any product-related issues. • “Collect support information” on page 43 • “XML dump” on page 44 Collect support information Use this procedure to collect all support information in one file. The required information is collected and zipped in a file named SMISupportFiles.zip.
PAGE 60
3 Support information collection Collecting support information 1. Launch the Brocade SMI Agent Configuration Tool. 2. Click Collect Information in the menu tree (see Figure 27). The content pane displays the current path for the zip file. 3. To change the path of the zip file, type a new path or click Select Folder to browse for the location. 4. Click Apply.
PAGE 61
CIMOM server configuration FIGURE 28 3 Run XML dump CIMOM server configuration If the server is running on a system using multiple IP addresses, the server binds to an IP address arbitrarily chosen by the underlying operating system. Using the following procedure, you can configure the server to use a specific IP address. Configuring the CIMOM server 1. Launch the Brocade SMI Agent Configuration Tool. 2. Click Server Configuration in the menu tree (see Figure 29 on page 46).
PAGE 62
3 CIMOM server configuration FIGURE 29 Configure the CIMOM server Configuring log file options You cannot configure log file options with the SMI Agent Configuration Tool. The following procedure describes how to change the log file options by modifying the jserver.properties file. 1. Open the jserver.properties file found at …server/jserver/bin. 2. Uncomment the following lines: # com.wbemsolutions.jserver.logdirectory=/mylogfiledir #com.wbemsolutions.jserver.log.maxfilesize=5000000 #com.wbemsolutions.
PAGE 63
Chapter 4 Mutual Authentication for Clients and Indications In this chapter • Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . • Mutual authentication for clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . • Mutual authentication for indications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . • Client configuration to use client certificates . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 64
4 Mutual authentication for indications Enabling mutual authentication for clients 1. Configure the SMI-A to support mutual authentication for clients. This can be done either during installation using the installation wizard, or after installation, as described in “Configuring mutual authentication for clients” on page 22. 2. Optionally, disable HTTP access so that only HTTPS access is available to the clients. HTTPS communication is preferred if mutual authentication is enabled.
PAGE 65
Client configuration to use client certificates 4 • .client.ind.truststore • clientind.cer There are three ways to configure a WBEM client to use a client certificate with the SMI-A: • using a property file • using system property values when invoking the WBEM client • using a WBEM client listener program (mutual authentication for indications only) Configuring a client to use client certificates using a property file 1. Create a WbemClient.
PAGE 66
4 Client configuration to use client certificates for default SSL indications Mutual authentication for indications: java -classpath /agent/wbem.jar -Dwbem.indications.keyStore=/agent/client/.client.ind.keystore -Dwbem.indications.keyStorePassword=SSLindication -Dwbem.indications.trustStore=/agent/client/.client.ind.truststore -Dwbem.indications.
PAGE 67
Troubleshooting 4 wbem.indications.keyStorePassword=SSLindication 2. Modify the CLASSPATH environment variable to reference this file. The CLASSPATH should contain only the path to the directory where the file is present and not the path to the file itself. For example, if the WbemClient.
PAGE 68
4 Troubleshooting • If keystore or truststore information is not set up correctly, then the keystore and truststore information on the server does not correspond to the keystore and truststore information on the client. In this scenario, the following error is issued on the client side: XMLERROR: enumerateInstances,java.net.ConnectException: javax.net.ssl.SSLHandshakeException - Received fatal alert: bad_certificate at javax.wbem.client.adapter.http.CIMClientXML.
PAGE 69
Chapter Frequently Asked Questions 5 In this chapter • General questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 • Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 70
5 General questions What are some situations that might require restarting the SMI Agent? Restarting of the SMIAgent is required when: • configuration parameters, such as the debug level or log file name, are changed. • host IP, HTTP, or HTTPS port is changed. • firmware download configuration entry in SMIAgentConfig.xml is changed. What are the Eventing and ARR TCP Ports? Do they relate to indications? These are ports that are used by the agent to receive events and ARP responses from the fabric.
PAGE 71
General questions 5 Can the SMI Agent proxy for two fabrics that are in different subnets? Yes. Should I designate multiple proxies into a fabric? What are the best practices concerning this? You can have only one connection at a time into the fabric. The only advantage in designating multiple proxies is that if the first proxy fails to connect, the SMI-A tries the next proxy until it finds one that works.
PAGE 72
5 Troubleshooting Troubleshooting • How do I prevent the SMI Agent process from getting terminated on Solaris when I start the agent in a Bourne shell and then log out? • If the Brocade SMI Agent hangs, how do I capture the thread dump? • Why is there no change in the status of a non-proxy Brocade_Switch when a LAN cable from the non-proxy switch is unplugged? • What does the error message "Host Message: Duplicate connection to fabric ....
PAGE 73
Appendix A Licenses and Attributions In this chapter • Open source software used in SMI-A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . • Sun Industry Standards Source License . . . . . . . . . . . . . . . . . . . . . . . . . . . . • IBM Common Public License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . • OpenSLP License. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . • Bouncy Castle . . . . . . . . . . . . . . . .
PAGE 74
A Sun Industry Standards Source License • Remotetea (ONC RPC), version 1.0.1 (GNU Library General Public License) • util.concurrent package, release 1.3.4 (Public Domain) • SUN J2SDK, version 1.4.2_x (Sun Binary Code License Agreement) Sun Industry Standards Source License Sun Industry Standards Source License - Version 1.2 1.1 "Commercial Use" means distribution or otherwise making the Original Code available to a third party. 1.
PAGE 75
Sun Industry Standards Source License A 2.
PAGE 76
A Sun Industry Standards Source License You may distribute Original Code in Executable and Source form only if the requirements of Sections 3.1 and 3.2 have been met for that Original Code, and if You include a notice stating that the Source Code version of the Original Code is available under the terms of this License.
PAGE 77
Sun Industry Standards Source License A 8.0 TERMINATION 8.1 This License and the rights granted hereunder will terminate automatically if You fail to comply with terms herein and fail to cure such breach within 30 days of becoming aware of the breach. All sublicenses to the Original Code which are properly granted shall survive any termination of this License. Provisions which, by their nature, must remain in effect beyond the termination of this License shall survive. 8.
PAGE 78
A IBM Common Public License The Initial Developer of the Original Code is: Sun Microsystems, Inc. Portions created by: Sun Microsystems, Inc. are Copyright © 2001 Sun Microsystems, Inc. All Rights Reserved. Contributor(s): _______________________________________ EXHIBIT B - Standards The Standard is defined as the following: CIM Specification v2.2 XML Mapping Specifications v2.0.0 CIM Operations over HTTP v1.0 WBEM Services Specification 1.0 as defined pursuant to the JCP 2.0 (http://java.sun.
PAGE 79
IBM Common Public License A "Recipient" means anyone who receives the Program under this Agreement, including all Contributors. 2. GRANT OF RIGHTS a) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a nonexclusive, worldwide, royalty-free copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, distribute and sublicense the Contribution of such Contributor, if any, and such derivative works, in source code and object code form.
PAGE 80
A IBM Common Public License Each Contributor must identify itself as the originator of its Contribution, if any, in a manner that reasonably allows subsequent Recipients to identify the originator of the Contribution. 4. COMMERCIAL DISTRIBUTION Commercial distributors of software may accept certain responsibilities with respect to end users, business partners and the like.
PAGE 81
OpenSLP License A If Recipient institutes patent litigation against a Contributor with respect to a patent applicable to software (including a cross-claim or counterclaim in a lawsuit), then any patent licenses granted by that Contributor to such Recipient under this Agreement shall terminate as of the date such litigation is filed.
PAGE 82
A Bouncy Castle THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
PAGE 83
Public Domain A Public Domain Originally written by Doug Lea and released into the public domain. This may be used for any purposes whatsoever without acknowledgment. Thanks for the assistance and support of Sun Microsystems Labs, and everyone contributing, testing, and using this code. Sun Binary Code License Agreement Sun Microsystems, Inc. Binary Code License Agreement for the JAVATM 2 SOFTWARE DEVELOPMENT KIT (J2SDK), STANDARD EDITION, VERSION 1.4.2_X SUN MICROSYSTEMS, INC.
PAGE 84
A Sun Binary Code License Agreement warranty will be at Sun's option to replace Software media or refund the fee paid for Software. Any implied warranties on the Software are limited to 90 days. Some states do not allow limitations on duration of an implied warranty, so the above may not apply to you. This limited warranty gives you specific legal rights. You may have others, which vary from state to state. 5.DISCLAIMER OF WARRANTY.
PAGE 85
Sun Binary Code License Agreement A 11.TRADEMARKS AND LOGOS. You acknowledge and agree as between you and Sun that Sun owns the SUN, SOLARIS, JAVA, JINI, FORTE, and iPLANET trademarks and all SUN, SOLARIS, JAVA, JINI, FORTE, and iPLANET-related trademarks, service marks, logos and other brand designations ("Sun Marks"), and you agree to comply with the Sun Trademark and Logo Usage Requirements currently located at http://www.sun.com/policies/trademarks.
PAGE 86
A Sun Binary Code License Agreement C.License to Distribute Redistributables.
PAGE 87
Sun Binary Code License Agreement A Publication.
PAGE 88
A 72 Sun Binary Code License Agreement Brocade SMI Agent User’s Guide 53-1001778-01
PAGE 89
Index A access control, 18 ARR ports, configuring, 33 B Brocade SMI Agent.
PAGE 90
licenses, 57 logging options, configuring, 40 login status information, 17 M mapping default, 20 SMI-A user to switch user, 19 multi-homed support, enabling, 12 mutual authentication for clients, enabling, 47 mutual authentication for indications, enabling, 48 U user authentication, enabling and disabling, 28 user mapping, 19 W Web Based Enterprise Management (WBEM), xiii, 1 X XML dump, generating, 44 P provider.