HP StorageWorks Fabric OS 6.2 administrator guide (5697-0016, May 2009)

140 Configuring advanced security features
The ACL policy database is managed as follows:
• Switch database distribution setting: Controls whether or not the switch accepts or rejects databases
distributed from other switches in the fabric. The distribute command sends the database from one
switch to another, overwriting the target switch database with the distributed one. To send or receive a
database the setting must be accept. For configuration instructions, see ”Database distribution settings”
on page 140.
Virtual Fabric considerations: FCS, DCC, SCC, and AUTH databases can be distributed using the
-distribute command, but the PWD and IPFILTER databases are blocked from distribution.
• Manually distribute an ACL policy database: Run the distribute command to push the local
database of the specified policy type to target switches. ”ACL policy distribution to other switches” on
page 142.
• Fabric-wide consistency policy: Used to ensure that switches in the fabric enforce the same policies. Set a
strict or tolerant fabric-wide consistency policy for each ACL policy type to automatically distribute that
database when a policy change is activated. If a fabric-wide consistency policy is not set, the policies
are managed on a per-switch basis. For configuration instructions, see ”Fabric-wide enforcement” on
page 142.
Virtual Fabric considerations: Fabric-wide consistency policies are configured on a per-Logical
Switch-basis and are applied to the fabrics connected to the Logical Switches. Automatic policy
distribution behavior for DCC, SCC and FCS is the same as that of pre-6.2.0 releases and are
configured on a per-Logical Switch basis.
Table 34 explains how the local database distribution settings and the fabric-wide consistency policy affect
the local database when the switch is the target of a distribution command.
Database distribution settings
The distribution settings control whether a switch accepts or rejects distributions of databases from other
switches and whether or not the switch may initiate a distribution. Configure the distribution setting to reject
when maintaining the database on a per-switch basis.
Table 35 lists the databases supported in Fabric OS 5.3.0 and later switches.
Table 34 Interaction between fabric-wide consistency policy and distribution settings
Distribution
setting
Fabric-wide consistency policy
Absent (default) Tolerant Strict
Reject Database is protected; it
cannot be overwritten.
May not match other
databases in the fabric.
Invalid configuration.
1
1. An error is returned indicating that the distribution setting must be accepted before you can set the
fabric-wide consistency policy.
Invalid configuration.
1
Accept
(default)
Database is not protected;
the database can be
overwritten.
If the switch initiating a
distribute command has a
strict or tolerant
fabric-wide consistency
policy, the fabric-wide
policy is also overwritten.
May not match other
databases in the fabric.
Database is not protected.
Automatically distributes
activated changes to other
5.20 switches in the fabric.
Allows switches running
Fabric OS 5.1.x and earlier
in the fabric.
May not match other
databases in the fabric.
Database is not protected.
Automatically distributes
activated changes to all
switches in the fabric.
Fabric can contain only
switches running Fabric OS
5.2.0 or later.
Active database is the same
for all switches in the fabric.