Users Guide

236 Fabric OS Administrator’s Guide
53-1002920-02
FCS policies
8
Table 38 shows the commands for switch operations for Primary FCS enforcement.
In Fabric OS v7.1.0 and later, to avoid segmentation of ports due to a member-list order mismatch,
security policy members are sorted based on WWN. By default, DCC and SCC policy members are
sorted based on WWN. Switches running earlier Fabric OS versions will have the member list in the
unsorted manner. Any older-version switch with a policy already created in unsorted order will have
port segmentation due to order mismatch when attempting to join any switch with Fabric OS v7.1.0
or later. To overcome the order mismatch, you can modify the member list in the switch by using the
-legacy option in the secPolicyAdd and secPolicyCreate commands.
Ensuring fabric domains share policies
Whether your intention is to create new FCS policies or manage your current FCS policies, you must
follow certain steps to ensure the domains throughout your fabric have the same policy.
The local-switch WWN cannot be deleted from the FCS policy.
1. Create the FCS policy using the secPolicyCreate command.
2. Activate the policy using the secPolicyActivate command.
If the command is not entered, the changes are lost when the session is logged out.
3. To distribute the policies, enter the distribute -p policy_list -d switch_list command to either
send the policies to intended domains, or enter the distribute -p policy_list -d wild_card (*)
command to send the policies to all switches.
Creating an FCS policy
1. Connect to the switch and log in using an account with admin permissions, or an account with
OM permissions for the Security RBAC class of commands.
2. Enter the secPolicyCreate “FCS_POLICY” command.
TABLE 38 FCS switch operations
Allowed on FCS switches Allowed on all switches
secPolicyAdd (Allowed on all switches for SCC and DCC
policies as long as it is not fabric-wide)
secPolicyShow
secPolicyCreate (Allowed on all switches for SCC and
DCC policies as long as it is not fabric-wide)
fddCfg
–-localaccept or fddCfg --localreject
secPolicyDelete (Allowed on all switches for SCC and
DCC policies as long as its not fabric-wide)
userconfig, Passwd, Passwdcfg (Fabric-wide distribution
is not allowed from a backup or non-FCS switch.)
secPolicyRemove (Allowed on all switches for SCC and
DCC policies as long as its not fabric-wide)
secPolicyActivate
fddCfg –-fabwideset secPolicySave
Any fabric-wide commands secPolicyAbort
All zoning commands except the show commands SNMP commands
All AD commands configupload
Any local-switch commands
Any AD command that does not affect fabric-wide
configuration