Glossary
● FIP frames are allowed to pass through the switch on the enabled VLANs and are processed to generate FIP snooping ACLs.
● FCoE traffic is allowed on VLANs only after a successful virtual-link initialization (fabric login FLOGI) between an ENode and
an FCF. All other FCoE traffic is dropped.
● You must configure at least one interface for FCF (FCoE Forwarder) mode on a FIP snooping-enabled VLAN. You can
configure multiple FCF trusted interfaces in a VLAN.
● A maximum of eight VLANS are supported for FIP snooping on the switch. When enabled globally, FIP snooping processes
FIP packets in traffic only from the first eight incoming VLANs. When enabled on a per-VLAN basis, FIP snooping is
supported on up to eight VLANs.
Configure the FC-MAP Value
You can configure the FC-MAP value to be applied globally by the switch on all or individual FCoE VLANs to authorize FCoE
traffic.
The configured FC-MAP value is used to check the FC-MAP value for the MAC address assigned to ENodes in incoming FCoE
frames. If the FC-MAP value does not match, FCoE frames are dropped. A session between an ENode and an FCF is established
by the switch-bridge only when the FC-MAP value on the FCF matches the FC-MAP value on the FIP snooping bridge.
Configure a Port for a Bridge-to-Bridge Link
If a switch port is connected to another FIP snooping bridge, configure the FCoE-Trusted Port mode for bridge-bridge links.
Initially, all FCoE traffic is blocked. Only FIP frames with the ALL_FCF_MAC and ALL_ENODE_MAC values in their headers are
allowed to pass. After the switch learns the MAC address of a connected FCF, it allows FIP frames destined to or received from
the FCF MAC address.
FCoE traffic is allowed on the port only after the switch learns the FC-MAP value associated with the specified FCF MAC
address and verifies that it matches the configured FC-MAP value for the FCoE VLAN.
Configure a Port for a Bridge-to-FCF Link
If a port is directly connected to an FCF, configure the port mode as FCF. Initially, all FCoE traffic is blocked; only FIP frames
are allowed to pass.
FCoE traffic is allowed on the port only after a successful fabric login (FLOGI) request/response and confirmed use of the
configured FC-MAP value for the VLAN.
FLOGI and fabric discovery (FDISC) request/response packets are trapped to the CPU. They are forwarded after the necessary
ACLs are installed.
Impact on Other Software Features
When you enable FIP snooping on a switch, other software features are impacted. The following table lists the impact of FIP
snooping.
Table 29. Impact of Enabling FIP Snooping
Impact Description
MAC address learning MAC address learning is not performed on FIP and FCoE
frames, which are denied by ACLs dynamically created by FIP
snooping on server-facing ports in ENode mode.
MTU auto-configuration MTU size is set to mini-jumbo (2500 bytes) when a port is in
Switchport mode, the FIP snooping feature is enabled on the
switch, and FIP snooping is enabled on all or individual VLANs.
Link aggregation group (LAG) FIP snooping is supported on port channels on ports on which
PFC mode is on (PFC is operationally up).
STP If you enable an STP protocol (STP, RSTP, PVSTP, or MSTP)
on the switch and ports enter a blocking state, when the state
326 FIP Snooping