Users Guide

congurations are synchronized. By default, all FCoE and FIP frames are dropped unless specically permitted by existing FIP snooping-
generated ACLs. You can recongure any of the FIP snooping settings.
If you disable FCoE transit, FIP and FCoE trac are handled as normal Ethernet frames and no FIP snooping ACLs are generated. The
VLAN-specic and FIP snooping conguration is disabled and stored until you re-enable FCoE transit and the congurations are re-applied.
Enable FIP Snooping on VLANs
You can enable FIP snooping globally on a switch on all VLANs or on a specied VLAN.
When you enable FIP snooping on VLANs:
• FIP frames are allowed to pass through the switch on the enabled VLANs and are processed to generate FIP snooping ACLs.
• FCoE trac is allowed on VLANs only after a successful virtual-link initialization (fabric login FLOGI) between an ENode and an FCF. All
other FCoE trac is dropped.
• You must congure at least one interface for FCF (FCoE Forwarder) mode on a FIP snooping-enabled VLAN. You can congure
multiple FCF trusted interfaces in a VLAN.
• A maximum of eight VLANS are supported for FIP snooping on the switch. When enabled globally, FIP snooping processes FIP packets
in trac only from the rst eight incoming VLANs. When enabled on a per-VLAN basis, FIP snooping is supported on up to eight
VLANs.
Congure the FC-MAP Value
You can congure the FC-MAP value to be applied globally by the switch on all or individual FCoE VLANs to authorize FCoE trac.
The congured FC-MAP value is used to check the FC-MAP value for the MAC address assigned to ENodes in incoming FCoE frames. If
the FC-MAP value does not match, FCoE frames are dropped. A session between an ENode and an FCF is established by the switch-
bridge only when the FC-MAP value on the FCF matches the FC-MAP value on the FIP snooping bridge.
Congure a Port for a Bridge-to-Bridge Link
If a switch port is connected to another FIP snooping bridge, congure the FCoE-Trusted Port mode for bridge-bridge links.
Initially, all FCoE trac is blocked. Only FIP frames with the ALL_FCF_MAC and ALL_ENODE_MAC values in their headers are allowed to
pass. After the switch learns the MAC address of a connected FCF, it allows FIP frames destined to or received from the FCF MAC
address.
FCoE trac is allowed on the port only after the switch learns the FC-MAP value associated with the specied FCF MAC address and
veries that it matches the congured FC-MAP value for the FCoE VLAN.
NOTE
: It is not recommended to use the Brigde-to-bridge links.
Congure a Port for a Bridge-to-FCF Link
If a port is directly connected to an FCF, congure the port mode as FCF. Initially, all FCoE trac is blocked; only FIP frames are allowed to
pass.
FCoE trac is allowed on the port only after a successful fabric login (FLOGI) request/response and conrmed use of the congured FC-
MAP value for the VLAN.
FLOGI and fabric discovery (FDISC) request/response packets are trapped to the CPU. They are forwarded after the necessary ACLs are
installed.
320
FIP Snooping