HP SN6000 Command Line Interface Manual

Command Line Interface Guide This guide provides information about using the HP StorageWorks SN6000 Fibre Channel Switch command line interface (CLI) describing fabric, switch, and port management tasks. This guide also provides an alphabetical listing of the CLI commands, including the command syntax, operands, and notes, and examples of their use. This guide is for users who are responsible for installing and servicing Fibre Channel equipment using the command line interface. Part Number: 5697-0406 Published June 2010 Edition: 2

© Copyright 2010 Hewlett-Packard Development Company, L.P. © Copyright 2010. This software includes technology under a license from QLogic Corporation. All rights reserved. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Microsoft, Windows, and Internet Explorer are U.S. registered trademarks of Microsoft Corporation. HP StorageWorks SN6000 Fibre Channel Switch Command Line Interface Guide

3 1 Command Line Interface Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Logging in to the switch through Telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Opening and closing an admin session. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Entering commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Getting help. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Setting page breaks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Creating a support file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Downloading and uploading files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 2 User Account Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Displaying user account information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Creating user accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Modifying user accounts and passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 3 Network Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Displaying the network configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Configuring the Ethernet port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 IPv4 configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 IPv6 configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 DNS server configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Verifying a switch in the network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Managing IP security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 IP security concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Uses of security policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Applying IP security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Displaying IP security information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Policy and association information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 IP security configuration history. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 IP security configuration limits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Managing the security policy database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Creating a policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Deleting a policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Modifying a user-defined policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Renaming a user-defined policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Copying a policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Managing the security association database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Creating an association. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Deleting an association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Modifying a user-defined association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Renaming a user-defined association. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Copying an association. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Resetting the IP security configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 4 Switch Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Displaying switch information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Name server information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Switch operational information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 System process information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Elapsed time between resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Configuration information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Switch configuration parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Zoning configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Security configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Hardware information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Contents

Managing switch services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Managing switch configurations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Displaying a list of switch configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Activating a switch configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Copying a switch configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Deleting a switch configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Modifying a switch configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Backing up and restoring a switch configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Creating the backup file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Downloading the configuration file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Restoring the configuration file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Paging a switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Managing the date and time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Displaying the date and time. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Setting the date and time explicitly. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Setting the time through an NTP server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Resetting a switch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Installing firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Non-disruptive activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 One-step firmware installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Custom firmware installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Testing a switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Online tests for switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Offline tests for switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Connectivity tests for switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Displaying switch test status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Canceling a switch test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Verifying and tracing Fibre Channel connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Managing switch feature upgrades. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Displaying feature licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Installing a feature license key. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Managing idle session timers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 5 Port Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Displaying port information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Port configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Port operational information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Port threshold alarm configuration parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Port performance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Transceiver information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Modifying port operating characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Configuring transparent routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Port binding. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Resetting a port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Configuring port threshold alarms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Testing a port. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Online tests for ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Offline tests for ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Displaying port test results. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Canceling a port test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 6 Zoning Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Displaying zoning database information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Configured zone set information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Active zone set information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Merged zone set information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Edited zone set information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Zone set membership information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

5 Zone membership information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Orphan zone information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Alias and alias membership information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Zoning modification history. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Zoning database limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Configuring the zoning database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Modifying the zoning database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Saving the active and merged zone sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Resetting the zoning database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Deleting inactive zone sets, zones, and aliases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Managing zone sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Creating a zone set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Deleting a zone set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Renaming a zone set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Copying a zone set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Adding zones to a zone set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Removing zones from a zone set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Activating a zone set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Deactivating a zone set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Managing zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Creating a zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Deleting a zone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Renaming a zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Copying a zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Adding members to a zone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Removing members from a zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Managing aliases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Creating an alias. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Deleting an alias . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Renaming an alias . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Copying an alias. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Adding members to an alias . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Removing members from an alias . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 7 Connection Security Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Managing SSL and SSH services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Displaying SSL and SSH services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Creating an SSL security certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 8 Device Security Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Displaying security database information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Configured security set information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Active security set information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Security set membership information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Group membership information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Security database modification history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 Security database limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 Configuring the security database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Modifying the security database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Resetting the security database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Managing security sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Creating a security set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Deleting a security set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Renaming a security set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Copying a security set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Adding groups to a security set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Removing groups from a security set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Activating a security set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Deactivating a security set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Creating a group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Deleting a group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Renaming a group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Copying a group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Adding members to a group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Modifying a group member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Removing members from a group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 9 RADIUS Server Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Displaying RADIUS server information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Configuring a RADIUS server on the switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 10Event Log Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Starting and stopping event logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Displaying the event log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Filtering the event log display . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Controlling messages in the output stream. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Managing the event log configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Configuring the event log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Displaying the event log configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Restoring the event log configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Clearing the event log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Logging to a remote host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Creating and downloading a log file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 11Call Home Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Call Home concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Call Home requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Call Home messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Technical support interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Configuring the Call Home service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Managing the Call Home database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Displaying Call Home database information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Creating a profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Deleting a profile. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Modifying a profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Renaming a profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Copying a profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Adding a data capture configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Modifying a data capture configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Deleting a data capture configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Testing a Call Home profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Changing Simple Mail Transfer Protocol servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Clearing the Call Home message queue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Resetting the Call Home database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 12Simple Network Management Protocol Configuration . . . . . . . . . . . . . . . . . . . . . . . . 117 Managing the SNMP service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Displaying SNMP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 Modifying the SNMP configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Resetting the SNMP configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Managing the SNMP version 3 configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Creating an SNMP version 3 user account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Displaying SNMP version 3 user accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Modifying an SNMP version 3 user account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 13Command Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Access authority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Syntax and operands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

7 Notes and examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 admin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 alias . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 callhome . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 capture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 clone config port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 create . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 date . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 exit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 fcping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 fctrace. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 firmware install. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 hardreset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 history. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 hotreset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 ipsec. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 ipsec association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 ipsec list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 ipsec policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 lip. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 logout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 passwd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 ping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174 profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 ps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 quit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 securityset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 set alarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 set beacon. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 set config port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 set config security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 set config security portbinding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200 set config switch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 set config threshold. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 set config zoning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 set log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206 set pagebreak . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209 set port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 set setup callhome . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 set setup radius . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 set setup services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 set setup snmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 set setup system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 set switch state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 set timezone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 show about . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 show alarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 show broadcast . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 show chassis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 show config port. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236 show config security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238 show config security portbinding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239

show config threshold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 show config zoning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 show domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 show donor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244 show env. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 show fabric . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 show fdmi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 show interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 show log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 show lsdb . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 show media. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 show mem. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 show ns. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 show pagebreak . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258 show perf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 show port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 show postlog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 show setup callhome. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266 show setup mfg . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 show setup radius. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268 show setup services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269 show setup snmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 show setup system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 show steering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273 show switch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 show system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276 show temp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277 show testlog. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 show timezone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 show topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 show users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 show version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 show voltage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284 shutdown. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285 snmpv3user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 test cancel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289 test port. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290 test status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292 test switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 uptime. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296 user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297 whoami. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299 zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300 zoneset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303 zoning active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305 zoning cancel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 zoning clear . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 zoning configured . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308 zoning delete orphans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309 zoning edit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310 zoning edited. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311 zoning history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312 zoning limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313 zoning list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314 zoning merged. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315 zoning restore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316 zoning save. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317

9 14Support and Other Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319 Document conventions and symbols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319 Contacting HP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319 HP contact information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319 Subscription service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320 Documentation feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320 New and changed information in this edition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320 Related information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320 Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320 Other HP websites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 Tables 1 Command-line completion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2 Factory user accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 3 Heartbeat LED activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 4 Switch reset methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 5 Event log message format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 6 Call Home queue statistics parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 7 Data capture configuration parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 8 ISL group member attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 9 Port group member attributes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 10 MS group member attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 11 Group type parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 12 Group member attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 13 Association configuration parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 14 Policy configuration parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 15 Profile configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 16 Call Home service configuration defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 17 Switch configuration defaults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 18 Port configuration defaults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 19 Port threshold alarm configuration defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184 20 Zoning configuration defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184 21 SNMP configuration defaults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184 22 RADIUS configuration defaults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 23 Switch services configuration defaults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 24 DNS host name configuration defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 25 IPv4 Ethernet configuration defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 26 IPv6 Ethernet configuration defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 27 Event logging configuration defaults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 28 NTP server configuration defaults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 29 Timer configuration defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 30 Security configuration defaults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 31 Output stream alarm parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 32 Beacon state parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 33 Port configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 34 Security configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 35 Port binding configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200 36 Switch configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 37 Port alarm threshold parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 38 Zoning configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 39 Component event monitoring filter parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206 40 Event display filter parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 41 Severity level monitoring parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 42 Port monitoring parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 43 Pagebreak state parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209 44 Transmission speed parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 45 Port administrative state parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

47 Common RADIUS server configuration attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 48 Server-specific RADIUS server configuration attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 49 Switch services settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 50 Common SNMP configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 51 SNMP trap configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 52 DNS host name configuration parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 53 IPv4 Ethernet configuration parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 54 IPv6 Ethernet configuration parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 55 Event logging configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224 56 NTP server configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224 57 Timer configuration parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 58 Switch administrative state parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 59 Show about display entries. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 60 Log monitoring components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 61 Event log display filter parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 62 Transceiver information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 63 Name server display parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 64 Show port display entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 65 Switch operational parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 66 Show version display entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 67 SNMP version 3 user account parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 68 Offline port loopback types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290 69 Port test parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290 70 Connectivity loopback types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 71 Offline loopback types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 72 Switch test parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 73 Zoning database parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310 74 Zoning database limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313 75 Document conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

11 1 Command Line Interface Usage This section describes how to use the command line interface. NOTE: Throughout this document, references in the text to commands and keywords use initial capitalization for clarity. Actual command and operand entries are not case-sensitive. Logging in to the switch through Telnet To log in to a switch through Telnet: 1. Open a command line window on the workstation and enter the telnet command followed by the switch Internet Protocol (IP) address: # telnet ip_address The IP address can be one of the following: • 4-byte IP version 4 (IPv4) address • 16-byte IP version 6 (IPv6) address • Domain Name System (DNS) host name (requires a DNS server) The Telnet window opens prompting you for a login. 2. Enter an account name and password. The default account name is admin, and its password is password. switch login:admin password: xxxxxxxx The following warning appears each time you log in until you change the default password. Warning: Your user account password has not been changed. It is strongly recommended that you do so before proceeding. To log off, enter the exit command: SN6000 FC Switch #> exit

To log in to a switch through the serial port: 1. Configure the workstation port with the following settings: • 9,600 baud • 8-bit character • 1 stop bit • No parity 2. Enter an account name and password when prompted. The default account name is admin, and its password is password. NOTE: A switch supports a combined maximum of 19 logins or sessions, which are reserved as follows: • 4 logins or sessions for internal applications, such as management server and Simple Network Management Protocol (SNMP) • 9 high priority Telnet sessions • 6 logins or sessions for Simple SAN Connection Manager (SSCM) inband and out-of-band logins, QuickTools logins, Enterprise Fabric Management Suite logins, and Telnet logins. Additional logins will be refused. Opening and closing an admin session The command line interface (CLI) performs monitoring and configuration tasks. Commands that perform monitoring tasks are available to all user accounts. Commands that perform configuration tasks are available only after entering the admin start command to open an Admin session. A user account must have Admin authority to enter the admin start command. The following is an example of how to open and close an Admin session: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> . . . SN6000 FC Switch (admin) #> admin end Entering commands The command-line completion feature makes entering and repeating commands easier. Table 1 describes the command-line completion keystrokes. Table 1 Command-line completion Keystroke Effect Tab Completes the command line. Enter at least one character and press the tab key to complete the command line. If more than one possibility exists, press the Tab key again to display all possibilities. Up Arrow Scrolls backward through the list of previously entered commands. Down Arrow Scrolls forward through the list of previously entered commands. Control-A Moves the cursor to the beginning of the command line Control-E Moves the cursor to the end of the command line. Control-U Clears the command line.

13 Getting help To display help for a command, enter the help command followed by the command you are inquiring about. The following is an example of the help that is available for the config edit command. SN6000 FC Switch #> help config edit config edit [CONFIG_NAME] This command initiates a configuration session and places the current session into config edit mode. If CONFIG_NAME is given and it exists, it gets edited; otherwise, it gets created. If it is not given, the currently active configuration is edited. Admin mode is required for this command. Usage: config edit [CONFIG_NAME] Setting page breaks Some display commands deliver so much information to the screen that it scrolls by too quickly to read it. You can limit the display to 20 lines at a time by turning on page breaks. By default, page breaks are turned off.The following is an example of how to turn page breaks on and how it affects the display. SN6000 FC Switch #> set pagebreak on SN6000 FC Switch #> zone list Zone ZoneSet ---- ------- Zone1 alpha beta Zone2 delta echo Zone3 sierra tango Zone4 gamma delta Press any key to continue, 'q' to quit ... Creating a support file If you contact technical support about a problem with your switch, they may request that you create and send a support file. This support file contains all of the switch configuration information, which can be helpful in diagnosing the problem. The create support command creates the support file (dump_support.tgz) on the switch. If your workstation has an File Transfer Protocol (FTP) server, you can proceed with the command prompts to send the file from the switch to a remote host. Otherwise, you can use FTP to download the support file from the switch to your workstation. NOTE: Support files are deleted from the switch during a power-cycle or switch reset.

The following example creates a support file and sends it to a remote host using a workstation with an FTP server. SN6000 FC Switch #> create support Log Msg:[Creating the support file - this will take several seconds] FTP the dump support file to another machine? (y/n): y Enter address of ftp server (hostname, IPv4, or IPv6): 10.20.33.130 Login name: johndoe Enter remote directory name: bin/support Would you like to continue downloading support file? (y/n) [n]: y Connected to 10.20.33.130 (10.20.33.130). 220 localhost.localdomain FTP server (Version wu-2.6.1-18) ready. 331 Password required for johndoe. Password: xxxxxxx 230 User johndoe logged in. cd bin/support 250 CWD command successful. lcd /itasca/conf/images Local directory now /itasca/conf/images bin 200 Type set to I. put dump_support.tgz local: dump_support.tgz remote: dump_support.tgz 227 Entering Passive Mode (10,20,33,130,232,133) 150 Opening BINARY mode data connection for dump_support.tgz. 226 Transfer complete. 43430 bytes sent in 0.292 secs (1.5e+02 Kbytes/sec) Remote system type is UNIX. Using binary mode to transfer files. 221-You have transferred 43430 bytes in 1 files. 221-Total traffic for this session was 43888 bytes in 1 transfers. 221 Thank you for using the FTP service on localhost.localdomain. If your workstation does not have an FTP server, enter the create support command to create the support file, and then use FTP to download the support file from the switch to your workstation, as shown in the following example: SN6000 FC Switch #> create support Log Msg:[Creating the support file - this will take several seconds] FTP the dump support file to another machine? (y/n): n To download the support file from the switch to the workstation: 1. Open a terminal window and move to the directory where you want to download the support file. 2. Enter the ftp command and the switch IP address or symbolic name. >ftp 10.0.0.1 3. When prompted for a user and password, enter the FTP account name and password (images, images). user: images password: images 4. Set binary mode and use the get command to download the file (dump_support.tgz). ftp>bin ftp>get dump_support.tgz xxxxx bytes sent in xx secs. ftp>quit

15 Downloading and uploading files Several files that reside on the switch can be downloaded to the workstation for examination or for safekeeping. These files include the following: • Backup configuration file (configdata) • Log files (logfile) • Support files (dump_support.tgz) You can upload firmware image files or backup configuration files to the switch to reinstall firmware or restore a corrupted configuration. The switch uses FTP to exchange files between the switch and the workstation. To download a file from the switch to the workstation: 1. Enter the ftp command and the switch IP address or symbolic name. >ftp 10.0.0.1 2. When prompted for a user and password, enter the FTP account name and password (images, images). user: images password: images 3. Set binary mode and use the get command to download the file (configdata). ftp>bin ftp>get configdata xxxxx bytes sent in xx secs. ftp>quit To upload a file from the workstation to the switch: 1. Enter the ftp command and the switch IP address or symbolic name. >ftp 10.0.0.1 2. When prompted for a user and password, enter the FTP account name and password (images, images). user:images password: images 3. Set binary mode and use the put command to upload the file (config_switch_169). ftp>put config_switch_169 configdata xxxxx bytes sent in xx secs. ftp>quit For more information about reinstallation, backup and restore, and creating support and log files: • See ”Installing firmware” (page 50). • See ”Backing up and restoring a switch configuration” (page 46). • See ”Creating and downloading a log file” (page 104). • See ”Creating a support file” (page 13).

17 2 User Account Configuration User accounts and their respective passwords are the first line of switch security. A user account consists of an account name, an authority level, and an expiration date. Switches come from the factory with certain user accounts defined for special purposes. Table 2 describes these accounts, their passwords, and their purpose. These accounts cannot be deleted from the switch. Displaying user account information You can display all user accounts defined on the switch (user accounts command) or just those user accounts that are logged on (user list or show users commands). The following example displays all user accounts defined on the switch. Account information includes account name, authority, and expiration date. SN6000 FC Switch (admin) #> user accounts Current list of user accounts ----------------------------- images (admin authority = False, never expires) admin (admin authority = True , never expires) chuckca (admin authority = False, expires in < 50 days) gregj (admin authority = True , expires in < 100 days) fred (admin authority = True , never expires) The following example displays user accounts that are logged on to the switch: SN6000 FC Switch (admin) #> user list User Ethernet Addr-Port Logged in Since ---- ------------------ --------------- admin@OB-session1 10.20.68.108-1031 day month date time year admin@OB-session2 10.20.68.108-1034 day month date time year snmp@OB-session3 Unknown day month date time year snmp@IB-session4 Unknown day month date time year admin@OB-session5 Unknown day month date time year Table 2 Factory user accounts User Account Name Password Purpose admin password Provides access to the Telnet server for managing the switch. Admin is the only account name that has permission to create and modify other user accounts. To secure your admin user account, be sure to change the password for this account. images images Provides access to the FTP server for exchanging files between the switch and the workstation. prom prom When in Maintenance mode, provides access to the Maintenance menu to perform switch recovery tasks. For information about using Maintenance mode, see the HP StorageWorks SN6000 Fibre Channel Switch Installation and Reference Guide.

Creating user accounts A user account consists of an account name, an authority level, and an expiration date, which have the following requirements: • The account name can be up to 15 characters: the first character must be alphanumeric; the remaining characters must be American Standard Code for Information Interchange (ASCII) characters except semicolon (;), comma (,), #, and period (.). • The authority level grants admin authority (true) or denies it (false). • The expiration date sets the date when the user account expires. Only the Admin user account can create user accounts. Add user accounts with the user add command. The following example creates a new user account named user1 with admin authority that expires in 100 days. SN6000 FC Switch (admin) #> user add Press 'q' and the ENTER key to abort this command. account name (1-15 chars) : user1 account password (8-20 chars) : ******* please confirm account password: ******* set account expiration in days (0-2000, 0=never): [0] 100 should this account have admin authority? (y/n): [n] y OK to add user account 'user1' with admin authority and to expire in 100 days? Please confirm (y/n): [n] y Modifying user accounts and passwords Only the admin user account can modify a user account, delete a user account, or change the password of another user account. However, all user accounts can change their own passwords. • The user command edits and deletes user accounts. • The passwd command changes passwords. The following example removes the expiration date and admin authority for the user account named user1. SN6000 FC Switch (admin) #> user edit Press 'q' and the ENTER key to abort this command. account name (1-15 chars) : user1 set account expiration in days (0-2000, 0=never): [0] should this account have admin authority? (y/n): [n] OK to modify user account 'user1' with no admin authority and to expire in 0 days? Please confirm (y/n): [n] The following example deletes the user account named user3. SN6000 FC Switch (admin) #> user delete user3 The user account will be deleted. Please confirm (y/n): [n] y

19 In the following example, the admin user account changes the password for the user account named user2. SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> passwd user2 Press 'q' and the ENTER key to abort this command. account OLD password : ******** account NEW password (8-20 chars) : ******** please confirm account NEW password: ******** password has been changed.

21 3 Network Configuration Network configuration consists of the IP parameters that identify the switch in the network and provide for IP security. This section describes the network configuration tasks. Displaying the network configuration The show fabric command displays IP addresses (Enet IP Addr) for all switches in the fabric, as shown in the following example. SN6000 FC Switch #> show fabric Domain *133(0x85) WWN 10:00:00:c0:dd:0d:53:91 SymbolicName SN6000 FC Switch HostName EthIPv4Address 10.20.116.133 EthIPv6Address * indicates principal switch The show setup system command displays the entire switch network configuration, which includes the following: • IP configurations (versions 4 and 6) • DNS server configuration To display specific information, add the corresponding keyword. For example, to display IPv6 configuration information, enter the show setup system ipv6 command: SN6000 FC Switch #> show setup system ipv6 System Information ------------------ EthIPv6NetworkEnable False EthIPv6NetworkDiscovery Static EthIPv6NetworkAddress 2001::1/64 EthIPv6GatewayAddress fe80::1

Use the set setup system command in an Admin session to configure the Ethernet port and other network parameters. You can configure all of the following parameters in one session, or you can configure specific parameters by adding the corresponding keyword: • IPv4 configuration, page 22 • IPv6 configuration, page 23 • DNS server configuration, page 24 IPv4 configuration The switch supports IPv4, which includes the following: • Network discovery method • IP address • Subnet mask • IP gateway address The network discovery method determines how the switch acquires its IP address. The IP address can come from the IP address that resides on the switch or from a server. The switch supports network discovery from the following server types: • Bootstrap Protocol (BootP) • Reverse Address Resolution Protocol (RARP) • Dynamic Host Configuration Protocol (DHCP) To configure the IPv4 parameters, enter the set setup system ipv4 command: SN6000 FC Switch (admin) #> set setup system ipv4 A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Current Values: EthIPv4NetworkEnable True EthIPv4NetworkDiscovery Static EthIPv4NetworkAddress 10.20.116.133 EthIPv4NetworkMask 255.255.255.0 EthIPv4GatewayAddress 10.20.116.1 New Value (press ENTER to accept current value, 'q' to quit, 'n' for none): EthIPv4NetworkEnable (True / False) : EthIPv4NetworkDiscovery (1=Static, 2=Bootp, 3=Dhcp, 4=Rarp) : EthIPv4NetworkAddress (dot-notated IP Address) : 10:20:30:40 EthIPv4NetworkMask (dot-notated IP Address) : 255.0.0.0 EthIPv4GatewayAddress (dot-notated IPv4 Address) : 10.20.30.254 Do you want to save and activate this system setup? (y/n): [n] y

23 IPv6 configuration The switch supports IPv6, which includes the following: • Network discovery method • IP address • IP gateway address The network discovery method determines how the switch acquires its IP address. The IP address can come from the IP address (static) that resides on the switch or from a DHCP server; or it can be learned from a router through the Neighbor Discovery Protocol (NDP). To configure the IPv6 parameters, enter the set setup system ipv6 command: SN6000 FC Switch (admin) #> set setup system ipv6 A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Current Values: EthIPv6NetworkEnable False EthIPv6Discovery Static EthIPv6NetworkAddress EthIPv6GatewayAddress New Value (press ENTER to accept current value, 'q' to quit, 'n' for none): EthIPv6NetworkEnable (True / False) : EthIPv6Discovery (1=Static, 2=Dhcpv6, 3=Ndp) : EthIPv6NetworkAddress (IPv6 Address/Mask Length format) : EthIPv6GatewayAddress (IPv6 Address) : Do you want to save and activate this system setup? (y/n): [n]

A DNS server manages the host names for a fabric. This enables you to specify servers and switches by a meaningful name rather than IP address. To configure a DNS server, enter the set setup system dns command in an Admin session, as shown in the following example: SN6000 FC Switch (admin) #> set setup system dns A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Current Values: DNSClientEnabled False DNSLocalHostname DNSServerDiscovery Static DNSServer1Address DNSServer2Address DNSServer3Address DNSSearchListDiscovery Static DNSSearchList1 DNSSearchList2 DNSSearchList3 DNSSearchList4 DNSSearchList5 New Value (press ENTER to accept current value, 'q' to quit, 'n' for none): DNSClientEnabled (True / False) : DNSLocalHostname (hostname) : DNSServerDiscovery (1=Static, 2=Dhcp, 3=Dhcpv6) : DNSServer1Address (IPv4, or IPv6 Address) : DNSServer2Address (IPv4, or IPv6 Address) : DNSServer3Address (IPv4, or IPv6 Address) : DNSSearchListDiscovery (1=Static, 2=Dhcp, 3=Dhcpv6) : DNSSearchList1 (domain name) : DNSSearchList2 (domain name) : DNSSearchList3 (domain name) : DNSSearchList4 (domain name) : DNSSearchList5 (domain name) : Do you want to save and activate this system setup? (y/n): [n] Verifying a switch in the network You can use the ping command to verify that a switch is communicating in the network. The following example successfully tests the network for a switch with IP address 10.20.11.57. SN6000 FC Switch #> ping 10.20.11.57 Ping command issued. Waiting for response... SN6000 FC Switch #> Response successfully received from 10.20.11.57. If the switch was unreachable, you would see the following display: SN6000 FC Switch #> ping 10.20.11.57 Ping command issued. Waiting for response... No response from 10.20.11.57. Unreachable.

25 Managing IP security To modify IP security, you must open an Admin session with the admin start command, then open an Ipsec Edit session with the ipsec edit command. The Admin session prevents other accounts from making changes at the same time through Telnet, Simple SAN Connection Manager, or any other management application. The Ipsec Edit session provides access to the ipsec, ipsec association and ipsec policy commands with which you make modifications to the IP security configuration, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> ipsec edit SN6000 FC Switch (admin-ipsec)#> ipsec . . . SN6000 FC Switch (admin-ipsec)#> ipsec policy . . . SN6000 FC Switch (admin-ipsec)#> ipsec association. . . The ipsec save command saves the changes you made during the Ipsec Edit session. Changes take effect immediately. SN6000 FC Switch (admin-ipsec)#> ipsec save To close the Ipsec Edit session without saving changes, enter the ipsec cancel command. SN6000 FC Switch (admin-ipsec)#> ipsec cancel The admin end command releases the Admin session for other administrators when you are finished making changes to the switch. To remove all IP security policies and associations, enter the reset ipsec command. SN6000 FC Switch (admin) #> reset ipsec The following subsections describe IP security concepts and IP security management tasks. IP security concepts IP security provides encryption-based security for IPv4 and IPv6 communications through the use of security policies and associations. Security policies are located in the security policy database and define the following parameters: • Connection source and destination • Data traffic direction: inbound or outbound • Protocols for which to protect data traffic • Security protocols; Authentication Header (AH) or Encapsulating Security Payload (ESP) • Level of protection: IP Security, discard, or none Security associations are located in the security association database and define the encryption algorithm and encryption key to apply when called by a security policy. A security policy may call several associations at different times, but each association is related to only one policy. Uses of security policies Policies can define security for host-to-host, host-to-gateway, and gateway-to-gateway connections; providing one policy for each direction. For example, to secure the connection between two hosts, you need two policies: one for outbound traffic from the source to the destination, and another for inbound traffic to the source from the destination. You can specify sources and destinations by IP addresses (version 4 or 6) or DNS host names. If a host name resolves to more than one IP address, the switch creates the necessary policies and associations. You can recognize these dynamic policies and associations because their names begin with DynamicSP_ and DynamicSA_ respectively. Applying IP security You can apply IP security to all communication between two systems, or to selected protocols, such as the Internet Control Message Protocol (ICMP), Transmission Control Protocol (TCP), or the User Datagram Protocol (UDP). Furthermore, instead of applying IP security, you can choose to discard all inbound or outbound traffic, or to allow all traffic without encryption. Both the AH and ESP security protocols provide source authentication, ensure data integrity, and protect against replay.

and associations that isolate a switch from all communication. If this happens, you can disable IP security by placing the switch in maintenance mode, and correct the problem through the serial port interface. For information about using maintenance mode and connecting through the serial port, see the HP StorageWorks SN6000 Fibre Channel Switch Installation and Reference Guide. Displaying IP security information You can display the security policy and security association databases sorted by the following parameters: • Active policies and associations; that is, policies and associations currently in use • Configured policies and associations; that is, policies and associations that have been saved in the database • Policies and associations that are being edited, but have not been saved You can display the following types of IP security configuration information: • Policy and association information, page 26 • IP security configuration history, page 27 • IP security configuration limits, page 27 Policy and association information To display general or specific policy and association information, enter the ipsec list command. The ipsec list command does not require an Admin session or an Ipsec Edit session. However, in an Ipsec Edit session, the ipsec association list and ipsec policy list commands display the same information. The following example displays all active policies and associations: SN6000 FC Switch #> ipsec list Active IPsec Information Security Association Database ----------------------------- h2h-sh-sa h2h-hs-sa Security Policy Database ------------------------ h2h-hs-sp h2h-sh-sp Summary ------- Security Association Count: 2 Security Policy Count: 2

27 IP security configuration history To display the IP security configuration history, enter the ipsec history command to display a record of policy and association modifications, as shown in the following example: SN6000 FC Switch #> ipsec history IPsec Database History ---------------------- ConfigurationLastEditedBy johndoe@OB-session5 ConfigurationLastEditedOn Sat Mar 8 07:14:36 2008 Active Database Checksum 00000144 Inactive Database Checksum 00000385 History includes the following information: • Time of the most recent activation and the user account that performed it • Time of the most recent modification to the IP security configuration and the user account that made it • Checksum for the active and inactive databases IP security configuration limits To display a summary of the objects in the IP security configuration and their maximum limits, enter the ipsec limits command, as shown in the following example: SN6000 FC Switch #> ipsec limits Configured (saved) IPsec Information IPsec Attribute Maximum Current --------------- ------- ------- MaxConfiguredSAs 512 0 MaxConfiguredSPs 128 0 In an Ipsec Edit session, the ipsec limits command displays the number of both configured associations and policies, plus those created in the edit session but not yet saved. Managing the security policy database The security policy database is made up of user-defined policies and dynamic policies (policies created by the switch). In addition to creating a policy, you can delete, modify, rename, and copy user-defined policies. Dynamic policies can only be copied.

To create a policy, enter the ipsec policy create command as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> ipsec edit SN6000 FC Switch (admin-ipsec) #> ipsec policy create h2h-sh-sp A list of attributes with formatting will follow. Enter a value or simply press the ENTER key to skip specifying a value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Required attributes are preceded by an asterisk. Value (press ENTER to not specify value, 'q' to quit): Description (string value, 0-127 bytes) : Host-to-host:switch->host *SourceAddress (IPv4, IPv6 or hostname/[PrefixLength]) : fe80::2c0:ddff:fe03:d4c1 SourcePort (decimal value, 1-65535) : *DestinationAddress (IPv4, IPv6 or hostname/[PrefixLength]) : fe80::250:daff:feb7:9d02 DestinationPort (decimal value, 1-65535) : *Protocol (decimal value, or keyword) Allowed keywords icmp, icmp6, ip4, tcp, udp or any : any *Direction (1=in, 2=out) : 2 Priority (value, -2147483647 to +214783647) : *Action (1=discard, 2=none, 3=ipsec) : 3 *ProtectionDesired (select one, transport-mode only) 1=ah Authentication Header 2=esp Encapsulating Security Payload 3=both : 2 *espRuleLevel (1=default, 2=use, 3=require) : 3 The security policy has been created. This configuration must be saved with the 'ipsec save' command before it can take effect, or to discard this configuration use the 'ipsec cancel' command. Deleting a policy To delete a user-defined policy, enter the ipsec policy delete command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> ipsec edit SN6000 FC Switch (admin-ipsec) #> ipsec policy delete policy_1 The security policy will be deleted. Please confirm (y/n): [n] y SN6000 FC Switch (admin-ipsec) #> ipsec save The IPsec configuration will be saved and activated. Please confirm (y/n): [n] y

29 Modifying a user-defined policy To modify an existing user-defined policy, enter the ipsec policy edit command in an Admin session and an Ipsec Edit session, as shown in the following example. An asterisk (*) indicates a required entry. SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> ipsec edit SN6000 FC Switch (admin-ipsec) #> ipsec policy edit h2h-sh-sp A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. To remove a value for an optional attribute, use ’n’. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Current Values: Description Host-to-host: switch->host . . . espRuleLevel require New Value (press ENTER to not specify value, 'q' to quit, 'n' for none): Description (string value, 0-127 bytes) : *SourceAddress (IPv4, IPv6 or hostname/[PrefixLength]) : SourcePort (decimal value, 1-65535) : *DestinationAddress (IPv4, IPv6 or hostname/[PrefixLength]) : DestinationPort (decimal value, 1-65535) : *Protocol (decimal value, or keyword) Allowed keywords icmp, icmp6, ip4, tcp, udp or any : tcp *Direction (1=in, 2=out) : Priority (value, -2147483647 to +2147483647) : *Action (1=discard, 2=none, 3=ipsec) : *ProtectionDesired (select one, transport-mode only) 1=ah Authentication Header 2=esp Encapsulating Security Payload 3=both : *ahRuleLevel (1=default, 2=use, 3=require) : *espRuleLevel (1=default, 2=use, 3=require) : The security policy has been edited. This configuration must be saved with the 'ipsec save' command before it can take effect, or to discard this configuration use the 'ipsec cancel' command. SN6000 FC Switch (admin-ipsec) #> ipsec save The IPsec configuration will be saved and activated. Please confirm (y/n): [n] y

To rename a policy (policy_1), enter the ipsec policy rename command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> ipsec edit SN6000 FC Switch (admin-ipsec) #> ipsec policy rename policy_1 policy_4 The security policy will be renamed. Please confirm (y/n): [n] y SN6000 FC Switch (admin-ipsec) #> ipsec save The IPsec configuration will be saved and activated. Please confirm (y/n): [n] y Copying a policy You can copy both user-defined and dynamic policies. To copy a policy (policy_1), enter the ipsec policy copy command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> ipsec edit SN6000 FC Switch (admin-ipsec) #> ipsec policy copy policy_1 policy_a SN6000 FC Switch (admin-ipsec) #> ipsec save The IPsec configuration will be saved and activated. Please confirm (y/n): [n] y Managing the security association database The security association database is made up of user-defined associations and dynamic associations (associations created by the switch). In addition to creating an association, you can delete, modify, rename, and copy user-defined associations. Dynamic associations can only be copied.

31 Creating an association To create an association, enter the ipsec association create command as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> ipsec edit SN6000 FC Switch (admin-ipsec) #> ipsec association create h2h-sh-sa A list of attributes with formatting will follow. Enter a value or simply press the ENTER key to skip specifying a value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Required attributes are preceded by an asterisk. Value (press ENTER to not specify value, 'q' to quit): Description (string value, 0-127 bytes) : Host-to-host:switch->host *SourceAddress (hostname, IPv4, or IPv6 Address) : fe80::2c0:ddff:fe03:d4c1 *DestinationAddress (hostname, IPv4, or IPv6 Address) : fe80::250:daff:feb7:9d02 *Protocol (1=esp, 2=esp-old, 3=ah, 4=ah-old) : 1 *SPI (decimal value, 256-4294967295) : 333 Authentication (select an authentication algorithm) 1=hmac-md5 (16 byte key) 2=hmac-sha1 (20 byte key) 3=hmac-sha256 (32 byte key) 4=aes-xcbc-mac (16 byte key) authentication algorithm choice : 2 *AuthenticationKey (quoted string or raw hex bytes) : "12345678901234567890" *Encryption (select an encryption algorithm) 1=des-cbc (8 byte key) 2=3des-cbc (24 byte key) 3=null (0 byte key) 4=blowfish-cbc (5-56 byte key) 5=aes-cbc (16/24/32 byte key) 6=twofish-cbc (16-32 byte key) encryption algorithm choice : 2 *EncryptionKey (quoted string or raw hex bytes) : "123456789012345678901234" The security association has been created. This configuration must be saved with the 'ipsec save' command before it can take effect, or to discard this configuration use the 'ipsec cancel' command. Deleting an association To delete a user-defined association, enter the ipsec association delete command as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> ipsec edit SN6000 FC Switch (admin-ipsec) #> ipsec association delete association_1 The security association will be deleted. Please confirm (y/n): [n] y SN6000 FC Switch (admin-ipsec) #> ipsec save The IPsec configuration will be saved and activated. Please confirm (y/n): [n] y

To modify an existing user-defined association, enter the ipsec association edit command in an Admin session and an Ipsec Edit session as shown in the following example. An asterisk (*) indicates a required entry. SN6000 FC Switch (admin-ipsec) #> ipsec association edit h2h-sh-sa A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. To remove a value for an optional attribute, use ’n’. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Current Values: Description Host-to-host:switch->host . . EncryptionKey 123456789012345678901234 New Value (press ENTER to not specify value, 'q' to quit, 'n' for none): Description (string value, 0-127 bytes) : *SourceAddress (hostname, IPv4, or IPv6 Address) : *DestinationAddress (hostname, IPv4, or IPv6 Address) : *Protocol (1=esp, 2=esp-old, 3=ah, 4=ah-old) : ah *SPI (decimal value, 256-4294967295) : Authentication (select an authentication algorithm) 1=hmac-md5 (16 byte key) 2=hmac-sha1 (20 byte key) 3=hmac-sha256 (32 byte key) 4=aes-xcbc-mac (16 byte key) authentication algorithm choice : *AuthenticationKey (quotes string or raw hex bytes) : *Encryption (select an encryption algorithm) 1=des-cbc (8 byte key) 2=3des-cbc (24 byte key) 3=null (0 byte key) 4=blowfish-cbc (5-56 byte key) 5=aes-cbc (16/24/32 byte key) 6=twofish-cbc (32 byte key) encryption algorithm choice : *EncryptionKey (quoted string or raw hex bytes) : The security association has been edited. This configuration must be saved with the 'ipsec save' command before it can take effect, or to discard this configuration use the 'ipsec cancel' command. SN6000 FC Switch (admin-ipsec) #> ipsec save The IPsec configuration will be saved and activated. Please confirm (y/n): [n] y

33 Renaming a user-defined association To rename a user-defined association (association_1), enter the ipsec association rename command as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> ipsec edit SN6000 FC Switch (admin-ipsec) #> ipsec association rename association_1 association_4 The security association will be renamed. Please confirm (y/n): [n] y SN6000 FC Switch (admin-ipsec) #> ipsec save The IPsec configuration will be saved and activated. Please confirm (y/n): [n] y Copying an association You can copy both user-defined and dynamic associations. To copy an association (association_1), enter the ipsec association copy command as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> ipsec edit SN6000 FC Switch (admin-ipsec) #> ipsec association copy association_1 association_a SN6000 FC Switch (admin-ipsec) #> ipsec save The IPsec configuration will be saved and activated. Please confirm (y/n): [n] y Resetting the IP security configuration Resetting the IP security configuration deletes all policies and associations from the switch. You can use either the ipsec clear command or the reset ipsec command to do this. In an Ipsec Edit session, enter the ipsec clear command, then save the changes as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> ipsec edit SN6000 FC Switch (admin-ipsec) #> ipsec clear SN6000 FC Switch (admin-ipsec) #> ipsec save The IPsec configuration will be saved and activated. Please confirm (y/n): [n] y The reset ipsec command deletes all polices and associations from the switch, but does not require an Ipsec Edit session. SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> reset ipsec The IPsec configuration will be reset and the default values activated. Please confirm (y/n): [n] y Reset and activation in progress ....

35 4 Switch Configuration Switch configuration consists of the following tasks: • Displaying switch information, page 35 • Managing switch services, page 42 • Managing switch configurations, page 44 • Paging a switch, page 47 • Managing the date and time, page 47 • Resetting a switch, page 49 • Installing firmware, page 50 • Testing a switch, page 52 • Verifying and tracing Fibre Channel connections, page 55 • Managing switch feature upgrades, page 55 • Managing idle session timers, page 56 Displaying switch information You can display the following types of the switch information: • Name server information, page 36 • Switch operational information, page 37 • System process information, page 38 • Elapsed time between resets, page 38 • Configuration information, page 38 • Hardware information, page 41 • Firmware information, page 41

The show ns all command displays the list of worldwide names (WWNs) in the fabric, as shown in the following example. The show ns command displays the WWNs that are local to the switch. SN6000 FC Switch #> show ns all Seq Domain Port Port No ID ID Type COS PortWWN NodeWWN --- ------ ------ ---- --- ------- ------- No entries found for domain ID 1. Seq Domain Port Port No ID ID Type COS PortWWN NodeWWN --- ------ ------ ---- --- ------- ------- No entries found for domain ID 4. Seq Domain Port Port No ID ID Type COS PortWWN NodeWWN --- ------ ------ ---- --- ------- ------- 1 8 (0x8) 0824ba NL 3 22:00:00:20:37:2b:08:00 20:00:00:20:37:2b:08:00 2 8 (0x8) 0824c3 NL 3 22:00:00:20:37:2b:08:78 20:00:00:20:37:2b:08:78 3 8 (0x8) 0824c5 NL 3 22:00:00:20:37:1b:cf:fd 20:00:00:20:37:1b:cf:fd 4 8 (0x8) 0824c6 NL 3 22:00:00:20:37:2b:07:b4 20:00:00:20:37:2b:07:b4 5 8 (0x8) 0824c9 NL 3 22:00:00:20:37:2b:08:57 20:00:00:20:37:2b:08:57 6 8 (0x8) 0824cb NL 3 22:00:00:20:37:1b:cf:f6 20:00:00:20:37:1b:cf:f6 7 8 (0x8) 0824cc NL 3 22:00:00:20:37:2b:0b:ec 20:00:00:20:37:2b:0b:ec 8 8 (0x8) 0824d6 NL 3 22:00:00:20:37:2b:07:e1 20:00:00:20:37:2b:07:e1 9 8 (0x8) 0824da NL 3 22:00:00:20:37:2b:0b:1a 20:00:00:20:37:2b:0b:1a 10 8 (0x8) 0824e0 NL 3 22:00:00:20:37:1b:f0:7d 20:00:00:20:37:1b:f0:7d 11 8 (0x8) 0824e1 NL 3 22:00:00:20:37:2b:02:f6 20:00:00:20:37:2b:02:f6 12 8 (0x8) 0824e2 NL 3 22:00:00:20:37:1b:ea:b7 20:00:00:20:37:1b:ea:b7 13 8 (0x8) 0824e8 NL 3 22:00:00:20:37:1b:cb:e5 20:00:00:20:37:1b:cb:e5 Seq Domain Port Port No ID ID Type COS PortWWN NodeWWN --- ------ ------ ---- --- ------- ------- No entries found for domain ID 10. Seq Domain Port Port No ID ID Type COS PortWWN NodeWWN --- ------ ------ ---- --- ------- ------- No entries found for domain ID 34.

37 Switch operational information The show switch command displays a variety of switch operational information. These include the switch WWN, domain ID, firmware version, administrative state, and operational state, as shown in the following example: SN6000 FC Switch #> show switch Switch Information ------------------ SymbolicName SN6000 FC Switch SwitchWWN 10:00:00:c0:dd:00:bc:56 BootVersion Vx.x.x.x-0 (day month date time year) CreditPool 0 DomainID 19 (0x13) FirstPortAddress 130000 FlashSize - MBytes 128 LogFilterLevel Critical MaxPorts 20 NumberOfResets 15 ReasonForLastReset PowerUp ActiveImageVersion - build date Vx.x.x.0 (day month date time year) PendingImageVersion - build date Vx.x.x.0 (day month date time year) ActiveConfiguration default AdminState Online AdminModeActive False BeaconOnStatus Off OperationalState Online PrincipalSwitchRole False POSTFaultCode 00000000 POSTStatus Passed TestFaultCode 00000000 TestStatus NeverRun BoardTemp (1) - Degrees Celsius 32 SwitchTemperatureStatus Normal

The ps command displays system process information to help you determine what processes are running and central processing unit (CPU) usage. The column titles in the following example are: • PID—Process identifier • PPID—Parent process identifier • %CPU—Percentage CPU usage • %MEM—Percentage memory usage • TIME—Actual processing time • ELAPSED—Elapsed time since the process started • COMMAND—The command that initiated the process. The following example displays current system processes. SN6000 FC Switch #> ps PID PPID %CPU %MEM TIME ELAPSED COMMAND 244 224 0.0 0.3 00:00:04 2-03:02:31 cns 245 224 0.0 0.3 00:00:06 2-03:02:31 ens 246 224 0.0 0.3 00:00:09 2-03:02:31 dlog 247 224 0.0 0.6 00:00:33 2-03:02:31 ds 248 224 0.3 2.8 00:09:59 2-03:02:31 mgmtApp 249 224 0.0 0.3 00:00:16 2-03:02:31 sys2swlog 251 224 0.0 0.4 00:00:06 2-03:02:30 fc2 252 224 0.0 0.6 00:00:16 2-03:02:30 nserver 253 224 0.0 0.8 00:00:08 2-03:02:30 PortApp 254 224 0.0 0.5 00:00:03 2-03:02:30 qfsApp 255 224 0.0 0.5 00:00:09 2-03:02:30 mserver 256 224 0.0 0.7 00:00:06 2-03:02:30 eport 257 224 0.0 0.6 00:00:13 2-03:02:30 zoning 282 254 0.0 0.5 00:00:00 2-03:02:26 qfsApp 284 224 0.0 0.6 00:00:08 2-03:02:26 snmpservicepath 285 282 0.0 0.5 00:00:00 2-03:02:26 qfsApp 308 224 0.0 0.8 00:00:29 2-03:02:25 cim_server Elapsed time between resets The uptime command displays the elapsed time since the switch was last reset and the reset method. Note that a hot reset or non-disruptive firmware activation does not reset the elapsed time reported by this command. The following example displays the time since the last reset. SN6000 FC Switch #> uptime Elapsed up time : 0 day(s), 2 hour(s), 28 min(s), 44 sec(s) Reason last reset: NormalReset Configuration information The show config command displays a variety of configuration information at the port and switch levels. In addition to the basic switch configurations, the show config command displays parameters that control how data is maintained in the security and zoning databases. The show config command displays the following types of information: • Switch configuration parameters, page 39 • Zoning configuration parameters, page 39 • Security configuration parameters, page 40 See also ”Displaying port information” (page 57).

39 Switch configuration parameters To display the switch configuration parameters, enter the show config switch command. These parameters determine the operational characteristics of the switch. See Table 36 for descriptions these parameters. SN6000 FC Switch #> show config switch Configuration Name: default ------------------- Switch Configuration Information -------------------------------- AdminState Online BroadcastEnabled False InbandEnabled True FDMIEnabled False FDMIEntries 10 DefaultDomainID 19 (0x13) DomainIDLock True SymbolicName sw108 R_A_TOV 10000 E_D_TOV 2000 PrincipalPriority 254 ConfigDescription Default Config ConfigLastSavedBy admin@OB-session5 ConfigLastSavedOn day month date time year InteropMode Standard Zoning configuration parameters To display the zoning configuration parameters, enter the show config zoning command. These determine how zoning is applied to the switch. See Table 38 for descriptions of these parameters. SN6000 FC Switch #> show config zoning Configuration Name: default ------------------- Zoning Configuration Information -------------------------------- MergeAutoSave True DefaultZone Allow DiscardInactive False

To display security configuration and port binding parameters, enter the show config security command. These parameters determine how security is applied to the switch. See Table 34 for descriptions of the switch security configuration parameters. See Table 35 for descriptions of the port binding parameters. SN6000 FC Switch #> show config security Configuration Name: default ------------------- Switch Security Configuration Information ----------------------------------------- FabricBindingEnabled False AutoSave True Port Binding Status WWN ---- -------------- --- 0 True 10:20:30:40:50:60:70:80 1 True 10:20:30:40:50:60:70:80 2 False No port binding entries found. 3 True 10:20:30:40:50:60:70:80 4 True 10:20:30:40:50:60:70:80 5 False No port binding entries found. 6 True 10:20:30:40:50:60:70:81 7 False No port binding entries found. 8 True 10:20:30:40:50:60:70:80 9 False No port binding entries found. 10 False No port binding entries found. 11 False No port binding entries found. 12 False No port binding entries found. 13 False No port binding entries found. 14 False No port binding entries found. 15 False No port binding entries found. 16 False No port binding entries found. 17 False No port binding entries found. 18 False No port binding entries found. 19 False No port binding entries found.

41 Hardware information To display the status of the switch hardware, including fans, power supplies, internal temperature, and Heartbeat LED status, enter the show chassis command. The following is an example of the show chassis command: SN6000 FC Switch #> show chassis Chassis Information ------------------- BoardTemp (1) - Degrees Celsius 26 BoardTemp (2) - Degrees Celsius 31 BoardTemp (3) - Degrees Celsius 31 PowerSupplyStatus (1) Good HeartBeatCode 1 HeartBeatStatus Normal The HeartBeatCode and HeartBeatStatus entries indicate the power-on self test (POST) results revealed by the Heartbeat LED blink patterns. The result is normal operation or a blink pattern indicating a critical error as described in Table 3. For information about Heartbeat LED blink patterns, see the HP StorageWorks SN6000 Fibre Channel Switch Installation and Reference Guide. Firmware information To display a summary of switch identity information, including the firmware version, enter the show version command. The following is an example of the show version command: SN6000 FC Switch #> show version ***************************************************** * * * Command Line Interface SHell (CLISH) * * * ***************************************************** SystemDescription HP StorageWorks SN6000 DualPower Supply Fibre Channel Switch HostName EthIPv4NetworkAddress 10.20.11.192 EthIPv6NetworkAddress :: MACAddress 00:c0:dd:00:71:ee WorldWideName 10:00:00:c0:dd:00:71:ed ChassisSerialNumber FAM033100024 SymbolicName SN6000 FC Switch ActiveSWVersion V8.0.x.x.xx.xx ActiveTimestamp day month date time year POSTStatus Passed LicensedPorts 24 SwitchMode Full Fabric Table 3 Heartbeat LED activity HeartBeatCode–HeartBeatStatus Description 1-Normal One blink per second–Normal operation 2-AppDied Two blink cluster–Internal firmware failure 3-PostFailed Three blink cluster–Fatal POST error 4-CorruptFilesystem Four blink cluster–Configuration file system error 5-Overheating Five blink cluster– Over temperature

You can configure your switch to suit the demands of your environment by enabling or disabling a variety of switch services using the set setup services commands. To display the status of the switch services, use the show setup services command. See Table 49 for descriptions of the switch services settings. IMPORTANT: Simple SAN Connection Manager version 1.0 does not support the SSL service. If SSL is enabled, you will be unable to manage the switch using this version of Simple SAN Connection Manager. To display the current switch services settings, enter the show setup services command, as shown in the following example: SN6000 FC Switch #> show setup services System Services ----------------------------- Telnet Enabled True SSHEnabled False GUIMgmtEnabled True SSLEnabled False EmbeddedGUIEnabled True SNMPEnabled True NTPEnabled True CIMEnabled True FTPEnabled True MgmtServerEnabled True CallHomeEnabled True

43 To configure the switch services, enter the set setup services command in an Admin session, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> set setup services A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. PLEASE NOTE: ----------- * Further configuration may be required after enabling a service. * If services are disabled, the connection to the switch may be lost. * When enabling SSL, please verify that the date/time settings on this switch and the workstation from where the SSL connection will be started match, and then a new certificate may need to be created to ensure a secure connection to this switch. TelnetEnabled (True / False) [True ] SSHEnabled (True / False) [False] GUIMgmtEnabled (True / False) [True ] SSLEnabled (True / False) [False] EmbeddedGUIEnabled (True / False) [True ] SNMPEnabled (True / False) [True ] NTPEnabled (True / False) [False] CIMEnabled (True / False) [False] FTPEnabled (True / False) [True ] MgmtServerEnabled (True / False) [True ] CallHomeEnabled (True / False) [True ] Do you want to save and activate this services setup? (y/n): [n]

The switch configuration determines the basic operational characteristics of the switch. A switch can store up to 10 configurations, including the default configuration (Default Config). The current switch operating characteristics are determined by the active configuration. Only one configuration can be active at a time. Each switch configuration contains switch, port, port threshold alarm, and zoning configuration components. Displaying a list of switch configurations To display the configurations stored on the switch, enter the config list command, as shown in the following example. Notice that the config list command does not require an Admin session. SN6000 FC Switch #> config list Current list of configurations ------------------------------ default config_1 config_2 Activating a switch configuration To activate a switch configuration (config_1), enter the config activate command in an Admin session, as shown in the following example: SN6000 FC Switch (admin) config activate config_1 Copying a switch configuration To create a copy of an existing configuration, enter the config copy command in an Admin session, as shown in the following example: SN6000 FC Switch (admin) config copy config_1 config_2 Deleting a switch configuration To delete a configuration from the switch, enter the config delete command in an Admin session, as shown in the following example. You cannot delete either the active configuration or the default configuration (Default Config). SN6000 FC Switch (admin) config delete config_2

45 Modifying a switch configuration To modify a switch configuration, you must open an Admin session with the admin start command. The Admin session prevents other accounts from making changes at the same time through Telnet, Simple SAN Connection Manager, or any other management application. You must also open a Config Edit session with the config edit command and indicate which configuration you want to modify. If you do not specify a configuration name, the active configuration is assumed. The Config Edit session provides access to the set config commands with which you make modifications to the port, switch, port threshold alarm, or zoning configuration components, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> config edit The config named default is being edited. SN6000 FC Switch (admin-config)#> set config port . . . SN6000 FC Switch (admin-config)#> set config switch . . . SN6000 FC Switch (admin-config)#> set config security . . . SN6000 FC Switch (admin-config)#> set config threshold . . . SN6000 FC Switch (admin-config)#> set config zoning . . . The config save command saves the changes you made during the Config Edit session. In this case, changes to the configuration named Default are being saved to a new configuration named config_10132003. However, the new configuration does not take effect until you activate it with the config activate command: SN6000 FC Switch (admin-config)#> config save config_10132003 SN6000 FC Switch (admin)#> config activate config_10132003 SN6000 FC Switch (admin)#> admin end The admin end command releases the Admin session for other administrators when you are finished making changes to the switch. To make temporary changes to the switch administrative state, enter the set switch state command. The following is an example of the set config switch command. See Table 36 for descriptions of the switch configuration parameters. SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> config edit SN6000 FC Switch (admin-config) #> set config switch A list of attributes with formatting and default values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. AdminState (1=Online, 2=Offline, 3=Diagnostics) [Online ] BroadcastEnabled (True / False) [True ] InbandEnabled (True / False) [True ] FDMIEnabled (True / False) [True ] FDMIEntries (decimal value, 0-1000) [1000 ] DefaultDomainID (decimal value, 1-239) [2 ] DomainIDLock (True / False) [False ] SymbolicName (string, max=32 chars) [SN6000 FC Switch] R_A_TOV (decimal value, 100-100000 msec) [10000 ] E_D_TOV (decimal value, 10-20000 msec) [2000 ] PrincipalPriority (decimal value, 1-255) [254 ] ConfigDescription (string, max=64 chars) [Default Config]

Successful management of switches and fabrics depends on the effective use of switch configurations. Backing up and restoring a switch configuration is useful both to protect your work and to use the configuration as a template. Backing up and restoring the switch configuration involves the following tasks: • Creating the backup file, page 46 • Downloading the configuration file, page 46 • Restoring the configuration file, page 46 Creating the backup file The config backup command creates the configdata file on the switch. This file can be used to restore a switch configuration only from the CLI; it cannot be used with QuickTools or Enterprise Fabric Management Suite to restore a switch. SN6000 FC Switch #> config backup The configdata file contains the following switch configuration information: • All named switch configurations including port, switch, port threshold alarm and zoning configurations. • All SNMP and network information defined with the set setup command. • The zoning database includes all zone sets, zones, and aliases. • The security database, except the group primary and secondary secrets. • The Call Home database and Call Home service configuration. NOTE: Configuration backup files are deleted from the switch during a power-cycle or a switch reset. Downloading the configuration file Use FTP to download the configdata file to your workstation for safekeeping and to upload the file back to the switch for the restore function. To download the configdata file, open an FTP session on the switch and login with the account name images and password images. Transfer the file in binary mode with the get command, as shown in the following example: >ftp ip_address user:images password: images ftp>bin ftp>get configdata xxxxx bytes sent in xx secs. ftp>quit You should rename the configdata file on your workstation with the switch name and date, for example, config_switch_169_10112003. Restoring the configuration file The restore operation begins by using FTP to upload the configuration file from the workstation to the switch, then finishes with a Telnet session and the config restore command. To upload the configuration file, config_switch_169_10112003 in this case, open an FTP session with account name images and password images. Transfer the file in binary mode with the put command, as shown in the following example: ftp ip_address user: images password: images ftp> bin ftp> put config_switch_169_10112003 configdata Local file config_switch_169_10112003 Remote file configdata ftp>quit

47 The restore process replaces all configuration information on the switch and afterwards the switch is automatically reset. If the restore process changes the IP address, all management sessions are terminated. Use the set setup system command to return the IP configuration to the values you want. To restore the switch, open a Telnet session (a new IP address may be required), then enter the config restore command from in an Admin session, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> config restore The switch will be reset after restoring the configuration. Please confirm (y/n): [n] y Alarm Msg: [day month date time year][A1005.0021][SM][Configuration is being restored - this could take several minutes] Alarm Msg: [day month date time year][A1000.000A][SM][The switch will be reset in 3 seconds due to a config restore] SN6000 FC Switch (admin) #> Alarm Msg: [day month date time year][A1000.0005][SM][The switch is being reset] Paging a switch To help you locate a particular switch in a rack of switches, you can turn on the beacon feature with the set beacon command. This causes all port Logged-In LEDs to flash in unison. The following is an example of how to turn the beacon on and off: SN6000 FC Switch #> set beacon on SN6000 FC Switch $> set beacon off Managing the date and time The switch date and time can be set explicitly using the date command or it can be set automatically through a Network Time Protocol (NTP) server. The date command also displays the current time. Unlike the date command, the NTP server also synchronizes the date and time on the switch with the date and time on the workstation, which is required for SSL connections. NOTE: To set the date with the date command, the switch NTP client must be disabled. For information about disabling the NTPClientEnabled parameter, see ”set setup system” (page 222). If you are using the date command, you can set the time zone using the set timezone command. The default time zone is Universal Time (UTC) also known as Greenwich Mean Time (GMT). Changing the time zone converts the current time to the time in the new time zone. For this reason, if you are not using an NTP server, set the time zone first, then set the date and time. See the following date and time management examples: • Displaying the date and time, page 47 • Setting the date and time explicitly, page 48 • Setting the time through an NTP server, page 49 Displaying the date and time To display the date and time, enter the date command, as shown in the following example: SN6000 FC Switch #> date Mon Apr 07 07:51:24 2008

To set the switch date and time explicitly, use the set timezone and date commands. 1. To change the time zone (to America/North Dakota, for example), enter the set timezone command in an Admin session, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> set timezone Africa America Antarctica Asia Atlantic Australia Europe Indian Pacific UTC Press ENTER for more options or 'q' to make a selection. America/Grenada America/Guadeloupe America/Guatemala America/Guayaquil America/Guyana America/Halifax America/Havana America/Hermosillo America/Indiana America/Indianapolis . . . America/Monterrey America/Montevideo America/Montreal America/Montserrat America/Nassau America/New_York America/Nipigon America/Nome America/Noronha America/North_Dakota America/Panama America/Pangnirtung Press ENTER for more options or 'q' to make a selection. q Enter selection (or 'q' to quit): america/north_dakota America/North_Dakota/Center Enter selection (or 'q' to quit): q 2. To set the date and time (January 31, 10:15 AM, 2008), enter the date command, as shown in the following example: SN6000 FC Switch (admin) #> date 013110152008 SN6000 FC Switch (admin) #> date Thu Jan 31 10:15:03 america/north_dakota/center 2008

49 Setting the time through an NTP server An NTP server can automatically set the switch date and time. To configure the switch to use an NTP server, enter the set setup system ntp command in an Admin session to enable the NTP client on the switch and specify the NTP server IP address, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> set setup system ntp A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Current Values: NTPClientEnabled False NTPServerDiscovery Static NTPServerAddress 10.20.10.10 New Value (press ENTER to accept current value, 'q' to quit, 'n' for none): NTPClientEnabled (True / False) : True NTPServerDiscovery (1=Static, 2=Dhcp, 3=Dhcpv6) : NTPServerAddress (hostname, IPv4, or IPv6 Address) : 10.20.3.4 Do you want to save and activate this system setup? (y/n): [n] y Resetting a switch Table 4 describes the methods for resetting a switch, the corresponding command, and the impact on the switch. Table 4 Switch reset methods Description Hot reset hotreset command Soft reset reset switch command Hard reset hardreset command Activates pending firmware X X X Disrupts I/O traffic X X Reconnects Simple SAN Connection Manager, QuickTools, and Enterprise Fabric Management Suite sessions afterwards X X X Clears the event log X X X Deletes supports files, firmware image files that have not been unpacked, and configuration backup files X X Closes all management sessions X X X Performs power-on self test (POST) X

firmware on a switch involves the following steps: 1. Downloading the firmware image file to the switch. 2. Unpacking the firmware image file. 3. Activating the new firmware. The activation can be disruptive or non-disruptive. See ”Non-disruptive activation” (page 50). The firmware install and the image install commands automate the firmware installation process and perform a disruptive activation as described in ”One-step firmware installation” (page 51). To perform a non-disruptive activation, see ”Custom firmware installation” (page 52). Non-disruptive activation You can load and activate firmware upgrades on an operating switch without disrupting data traffic or having to re-initialize attached devices. If the non-disruptive activation fails, you will usually be prompted to try again later. Otherwise, the switch will perform a disruptive activation. A disruptive activation interrupts Fibre Channel data traffic on the switch, while a non-disruptive activation does not. For information about non-disruptive firmware versions, see the Firmware Release Notes. To ensure a successful non-disruptive activation, you should first satisfy the following conditions: • No changes are being made to switches in the fabric including powering up, powering down, disconnecting or connecting inter-switch links (ISLs), changing switch configurations, or installing firmware. • No port on the switch is in the diagnostic state. • No Zoning Edit sessions are open on the switch. • No changes are being made to attached devices including powering up, powering down, disconnecting, connecting, and Host Bus Adapter (HBA) configuration changes. If you are installing firmware on more than one switch in the fabric, wait until the activation is complete on the first switch before installing firmware on a second switch. If you attempt to activate firmware on a second switch before activation is complete on the first, you will receive a message advising you to wait and perform a hot reset later on the second switch to complete the installation. Ports that change states during the non-disruptive activation are reset. When the non-disruptive activation is complete, Simple SAN Connection Manager sessions, QuickTools sessions, and Enterprise Fabric Management Suite sessions are automatically reconnected. However, Telnet sessions must be restarted manually. TIP: After upgrading firmware that includes changes to QuickTools, a QuickTools session that was open during the upgrade may indicate that the new firmware is not supported. To correct this, close the QuickTools session and the browser window, then open a new QuickTools session.

51 One-step firmware installation The firmware install and image install commands download the firmware image file from an FTP or Trivial File Transfer Protocol (TFTP) server to the switch, unpack the image file, and perform a disruptive activation all in one step. The one-step installation process prompts you to enter the following information: • The file transfer protocol (FTP or TFTP) • IP address of the remote host • An account name and password on the remote host (FTP only) • Pathname for the firmware image file To install the firmware: 1. Enter the following commands to download the firmware from a remote host to the switch, install the firmware, and then reset the switch to activate the firmware. SN6000 FC Switch #> admin start SN6000 FC Switch #> firmware install The switch will be reset. This process will cause a disruption to I/O traffic. Continuing with this action will terminate all management sessions,including any Telnet sessions. When the firmware activation is complete, you may log in to the switch again. Do you want to continue? [y/n]: y Press 'q' and the ENTER key to abort this command. 2. Enter your choice for the file transfer protocol with which to download the firmware image file. FTP requires an user account and a password; TFTP does not. FTP or TFTP : ftp 3. Enter your account name on the remote host (FTP only) and the IP address of the remote host. When prompted for the source file name, enter the path for the firmware image file. User Account : johndoe IP Address : 10.0.0.254 Source Filename : 8.0.00.11_epc About to install image. Do you want to continue? [y/n] y 4. When prompted to install the new firmware, enter y to continue or n to cancel. Entering y will disrupt traffic. This is the last opportunity to cancel. About to install image. Do you want to continue? [y/n] y Connected to 10.20.20.200 (10.20.20.200). 220 localhost.localdomain FTP server (Version wu-2.6.1-18) ready. 5. Enter the password for your account name (FTP only). 331 Password required for johndoe. Password:****** 230 User johndoe logged in. The firmware will now be downloaded from the remote host to the switch, installed, and activated.

A custom firmware installation downloads the firmware image file from a remote host to the switch, unpacks the image file, and resets the switch in separate steps. This allows you to choose the type of switch reset and whether the activation will be disruptive (reset switch command) or non-disruptive (Hotreset command). The following example illustrates a custom firmware installation with a non-disruptive activation. 1. Download the firmware image file from the workstation to the switch. • If your workstation has an FTP server, you can enter the image fetch command: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> image fetch account_name ip_address filename • If your workstation has a TFTP server, you can enter the image tftp command to download the firmware image file. SN6000 FC Switch (admin) #> image tftp ip_address filename • If your workstation has neither an FTP nor a TFTP server, open an FTP session and download the firmware image file by entering the following FTP commands: >ftp ip_address or switchname user:images password: images ftp>bin ftp>put filename ftp>quit 2. Display the list of firmware image files on the switch to confirm that the file was loaded: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) $> image list 3. Unpack the firmware image file to install the new firmware in flash memory. SN6000 FC Switch (admin) $> image unpack filename 4. Wait for the unpack to be completed. Image unpack command result: Passed 5. A message will prompt you to reset the switch to activate the firmware. Use the hotreset command to attempt a non-disruptive activation. If the non-disruptive activation fails, you will usually be prompted to try again later. Otherwise, the switch will perform a disruptive activation. SN6000 FC Switch (admin) $> hotreset Testing a switch You can test all ports on a switch using the test switch command. There are three test types: online, offline, and connectivity. See ”Testing a port” (page 67).

53 Online tests for switches An online test is a non-disruptive test that exercises port-to-device connections for all ports that are online. The online switch test excludes TR_Ports. The following is an example of an online test: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> test switch online A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the default value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. LoopCount (decimal value, 1-4294967295) [100 ] FrameSize (decimal value, 40-2148) [256 ] DataPattern (32-bit hex value or 'Default') [Default] StopOnError (True / False) [True ] LoopForever (True / False) [False ] Do you want to start the test? (y/n) [n] y Offline tests for switches An offline test is a disruptive test that exercises all port connections for a switch in the diagnostics state. The test requires that you place the switch in the diagnostics state using the set switch state command before starting. There are two types of offline test: internal loopback and external loopback. • An internal loopback test exercises all internal port connections. • An external loopback test exercises all internal port and transceiver connections. A transceiver with a loopback plug is required for all ports. The following example performs an offline internal loopback test on a switch: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #>set switch state diagnostics SN6000 FC Switch (admin) #> test switch offline internal A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the default value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. LoopCount (decimal value, 1-4294967295) [100 ] FrameSize (decimal value, 40-2148) [256 ] DataPattern (32-bit hex value or 'Default') [Default] StopOnError (True / False) [True ] LoopForever (True / False) [False ] Do you want to start the test? (y/n) [n] y When the test is complete, remember to place the switch back online. The switch resets when it leaves the diagnostics state. SN6000 FC Switch (admin) #> set switch state online Connectivity tests for switches A connectivity test is a disruptive test that exercises all port and inter-port connections for a switch in the diagnostics state. Therefore, before starting the test, you must place the switch in the diagnostics state using the set switch state command. There are two types of connectivity tests: internal loopback and external loopback. • An internal loopback test exercises all internal port and inter-port connections. • An external loopback test exercises all internal ports, transceivers, and inter-port connections. A transceiver with a loopback plug is required for all ports.

SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> set switch state diagnostics SN6000 FC Switch (admin) #> test switch connectivity internal A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the default value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. LoopCount (decimal value, 1-4294967295) [100 ] FrameSize (decimal value, 40-2148) [256 ] DataPattern (32-bit hex value or 'Default') [Default] StopOnError (True / False) [True ] LoopForever (True / False) [False ] Do you want to start the test? (y/n) [n] y When the test is complete, remember to place the switch back online. The switch resets when it leaves the diagnostics state. SN6000 FC Switch (admin) #> set switch state online Displaying switch test status You can display the test status while the test is in progress by entering the test status switch command, as shown in the following example: SN6000 FC Switch #> test status switch Test Test Test Loop Test Level Type Status Count Failures ----- ---- ------ ----- -------- Switch Offline internal Passed 4 0 Port Test Test Loop Test Num Type Status Count Failures ---- ---- ------ ----- -------- 0 Offline internal Passed 4 0 1 Offline internal Passed 4 0 2 Offline internal Passed 4 0 3 Offline internal Passed 4 0 4 Offline internal Passed 4 0 5 Offline internal Passed 4 0 6 Offline internal Passed 4 0 7 Offline internal Passed 4 0 8 Offline internal Passed 4 0 9 Offline internal Passed 4 0 10 Offline internal Passed 4 0 11 Offline internal Passed 4 0 12 Offline internal Passed 4 0 13 Offline internal Passed 4 0 14 Offline internal Passed 4 0 15 Offline internal Passed 4 0 16 Offline internal Passed 4 0 17 Offline internal Passed 4 0 18 Offline internal Passed 4 0 19 Offline internal Passed 4 0 Canceling a switch test To cancel a switch test that is in progress, enter the test cancel switch command.

55 Verifying and tracing Fibre Channel connections You can verify Fibre Channel connections between the switch and the fabric and display routing information. Enter the fcping command to verify a Fibre Channel connection to a switch or a device, as shown in the following example. The target device can be defined as a Fibre Channel address or a WWN. SN6000 FC Switch #> fcping 970400 count 3 28 bytes from local switch to 0x970400 time = 10 usec 28 bytes from local switch to 0x970400 time = 11 usec 28 bytes from local switch to 0x970400 time = 119 usec The following is an example of a connection failure: SN6000 FC Switch #> fcping 0x113344 count 3 28 bytes from local switch to 0x113344 failed Enter the fctrace command to display Fibre Channel routing information between two devices, as shown in the following example. The devices can be defined as Fibre Channel addresses or WWNs. SN6000 FC Switch#> fctrace 970400 970e00 hops 5 36 bytes from 0x970400 to 0x970e00, 5 hops max Domain Ingress Port WWN Port Egress Port WWN Port ------ ---------------- ---- --------------- ---- 97 20:04:00:c0:dd:02:cc:2e 4 20:0e:00:c0:dd:02:cc:2e 14 97 20:0e:00:c0:dd:02:cc:2e 14 20:04:00:c0:dd:02:cc:2e 4 Managing switch feature upgrades A feature license key is a password that you can purchase from your switch distributor or authorized reseller to upgrade your switch. License keys vary according to the features you purchase. The following license key features are available: • The HP StorageWorks SN6000 Stackable 20Gb ISL Upgrade LTU enables the XPAK ports to transmit at 20 Gb/s instead of the default 10 Gb/s. • The HP StorageWorks SN6000 Stackable 4-port FC Switch Upgrade LTU enables additional SFP ports in increments of four on the HP StorageWorks SN6000 Stackable 8Gb 12-port Single Power FC Switch for totals of 16, 20, or 24 ports. Installing a feature license key is not disruptive, nor does it require a switch reset. To order a license key, contact your switch distributor or your authorized reseller. TIP: To obtain the switch serial number and license key, follow the step-by-step instructions on the firmware feature entitlement request certificate for the license key. Displaying feature licenses To display the license keys that are installed, enter the feature log command on your switch, as shown in the following example: SN6000 FC Switch #> feature log Mfg Feature Log: ---------------- No 20G capability Customer Feature Log: --------------------- 1) day month date 19:39:24 year - 20 Gb/s capability 1-LCVXOWUNOJBE6

To install a license key on your switch, enter the feature add command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> feature add 1-LCVXOWUNOJBE6 License upgrade to 20 Gb capability Do you want to continue with license upgrade procedure? (y/n): [n] y Alarm Msg:[day mon date time year][8400.0045][SM][License 20Gb/s capability] Managing idle session timers You can limit the duration of idle login sessions and idle Admin sessions (admin start command). You can specify limits up to 1,440 minutes; specifying 0 means unlimited duration. Idle login sessions that exceed the timeout limit are logged off (InactivityTimeout). An idle Admin session that exceeds the timeout limit is ended, but the login session may be maintained (AdminTimeout). By default, no timeout limit is enforced on idle login sessions; idle Admin sessions are ended after 30 minutes. To display the idle login and Admin session configuration, enter the show setup system timers command, as shown in the following example: SN6000 FC Switch #> show setup system timers System Information ------------------ AdminTimeout 30 InactivityTimeout 0 To configure idle login and Admin session limits, enter the set setup system timers command as shown in the following example: SN6000 FC Switch (admin) #> set setup system timers A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Current Values: AdminTimeout 30 InactivityTimeout 0 New Value (press ENTER to accept current value, 'q' to quit): AdminTimeout (dec value 0-1440 minutes, 0=never) : InactivityTimeout (dec value 0-1440 minutes, 0=never) : Do you want to save and activate this system setup? (y/n): [n]

57 5 Port Configuration This section contains port configuration information. Displaying port information You can display the following port information: • Port configuration parameters, page 57 • Port operational information, page 58 • Port threshold alarm configuration parameters, page 59 • Port performance, page 60 • Transceiver information, page 60 Port configuration parameters To display the port configuration parameters, enter the show config port command. These parameters determine the operational characteristics of the port. See Table 33 for descriptions of these parameters. SN6000 FC Switch #> show config port 3 Configuration Name: default ----------------------------- Port Number: 3 ------------ AdminState Online LinkSpeed Auto PortType GL SymbolicName Port3 ALFairness False DeviceScanEnabled True ForceOfflineRSCN False ARB_FF False InteropCredit 0 ExtCredit 0 FANEnabled True AutoPerfTuning True MSEnabled True NoClose False IOStreamGuard Auto PDISCPingEnabled True

To display port operational information, enter the show port command. SN6000 FC Switch #> show port 1 Port Number: 1 ------------ AdminState Online AsicNumber 0 AsicPort 2 ConfigType GL DownstreamISL False EpConnState Connected EpIsoReason NotApplicable IOStreamGuard Disabled Licensed True LinkSpeed 8Gb/s LinkState Active LoginStatus LoggedIn MaxCredit 16 MediaPartNumber PLRXPLVCSH422N MediaRevision 1 MediaSpeeds 2, 4, 8Gb/s MediaType 800-MX-SN-I MediaVendor JDSU MediaVendorID 0000019c OperationalState Online PerfTuningMode Normal PortID 2d0100 PortWWN 20:01:00:c0:dd:0d:70:c9 POSTFaultCode 00000000 POSTStatus Passed RunningType E SupportedSpeeds 1, 2, 4, 8Gb/s SymbolicName Port1 SyncStatus SyncAcquired TestFaultCode 00000000 TestStatus NeverRun UpstreamISL False XmitterEnabled True Port Statistics ALInit 2 LIP_F8_F7 0 ALInitError 0 LinkFailures 0 BadFrames 0 Login 1 BBCR_FrameFailures 0 Logout 0 BBCR_RRDYFailures 0 LongFramesIn 0 Class2FramesIn 0 LoopTimeouts 0 Class2FramesOut 0 LossOfSync 0 Class2WordsIn 0 LostFrames 0 Class2WordsOut 0 LostRRDYs 0 Class3FramesIn 4432 PrimSeqErrors 0 Class3FramesOut 28640 RxLinkResets 2 Class3Toss 0 RxOfflineSeq 0 Class3WordsIn 300995 ShortFramesIn 0 Class3WordsOut 483225 TotalErrors 0 DecodeErrors 0 TotalLinkResets 2 EpConnects 1 TotalLIPsRecvd 2 FBusy 0 TotalLIPsXmitd 3

59 FlowErrors 0 TotalOfflineSeq 1 FReject 0 TotalRxFrames 4432 InvalidCRC 0 TotalRxWords 300995 InvalidDestAddr 0 TotalTxFrames 28640 LIP_AL_PD_AL_PS 0 TotalTxWords 483225 LIP_F7_AL_PS 0 TxLinkResets 0 LIP_F7_F7 2 TxOfflineSeq 1 LIP_F8_AL_PS 0 Port threshold alarm configuration parameters To display the port threshold alarm parameters, enter the show config threshold command. These parameters determine the error thresholds at which the switch issues alarms. See Table 37 for descriptions of these parameters. SN6000 FC Switch #> show config threshold Configuration Name: default ------------ Threshold Configuration Information ----------------------------------- ThresholdMonitoringEnabled False CRCErrorsMonitoringEnabled True RisingTrigger 25 FallingTrigger 1 SampleWindow 10 DecodeErrorsMonitoringEnabled True RisingTrigger 25 FallingTrigger 0 SampleWindow 10 ISLMonitoringEnabled True RisingTrigger 2 FallingTrigger 0 SampleWindow 10 LoginMonitoringEnabled True RisingTrigger 5 FallingTrigger 1 SampleWindow 10 LogoutMonitoringEnabled True RisingTrigger 5 FallingTrigger 1 SampleWindow 10 LOSMonitoringEnabled True RisingTrigger 100 FallingTrigger 5 SampleWindow 10

show perf command. You can display continuous live performance information for one or more ports, or an instantaneous summary. The following example displays an instantaneous summary in bytes and frames. Values are expressed in thousands (K) and millions (M) of bytes or frames per second. SN6000 FC Switch #> show perf Port Bytes/s Bytes/s Bytes/s Frames/s Frames/s Frames/s Number (in) (out) (total) (in) (out) (total) ------ ------- ------- ------- -------- -------- -------- 0 7K 136M 136M 245 68K 68K 1 58K 0 58K 1K 0 1K 2 0 0 0 0 0 0 3 0 0 0 0 0 0 4 0 0 0 0 0 0 5 0 0 0 0 0 0 6 0 7K 7K 0 245 245 7 136M 58K 136M 68K 1K 70K 8 7K 136M 136M 245 68K 68K 9 58K 0 58K 1K 0 1K 10 0 0 0 0 0 0 11 0 0 0 0 0 0 12 0 0 0 0 0 0 13 0 0 0 0 0 0 14 0 7K 7K 0 245 245 15 136M 58K 136M 68K 1K 70K 16 47M 23K 47M 23K 726 24K 17 0 0 0 0 0 0 18 23K 47M 47M 726 23K 24K 19 0 0 0 0 0 0 20 0 0 0 0 0 0 21 0 0 0 0 0 0 22 0 0 0 0 0 0 23 0 0 0 0 0 0 Transceiver information Enter the show media command to display operational information about a transceiver, as shown in the following example. For a description of the transceiver information in the show media display, see Table 62. SN6000 FC Switch #> show media 4 Port Number: 4 ------------- MediaType 800-MX-SN-S MediaVendor FINISAR CORP. MediaPartNumber FTLF8528P2BNV MediaRevision A MediaSerialNumber P6G22RL MediaSpeeds 2Gb/s, 4Gb/s, 8Gb/s Temp Voltage Tx Bias Tx Pwr Rx Pwr (C) (V) (mA) (mW) (mW) ----------- ----------- ------------ ----------- ----------- Value 37.32 3.33 7.30 0.373 0.000 Status Normal HighWarning Normal Normal LowAlarm HighAlarm 95.00 3.90 17.00 0.637 1.264 HighWarning 90.00 3.70 14.00 0.637 0.791 LowWarning -20.00 2.90 2.00 0.082 0.028 LowAlarm -25.00 2.70 1.00 0.073 0.019

61 Modifying port operating characteristics You can make permanent or temporary changes to port operating characteristics. The set config port command makes permanent port configuration changes. These changes are saved in the active configuration and are preserved across switch or port resets. The set port command makes temporary changes that apply until the next port or switch reset, or until you activate a configuration. IMPORTANT: 8 Gb/s SFPs do not support the 1 Gb/s setting. Setting a Fibre Channel port that has an 8-Gb/s SFP transceiver to 1-Gb/s will down the port. The following example permanently changes port administrative state of port 1: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> config edit SN6000 FC Switch (admin-config) #> set config port 1 A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Configuring Port Number: 1 ------------------------ AdminState (1=Online, 2=Offline, 3=Diagnostics, 4=Down) [Online] offline LinkSpeed (1=1Gb/s, 2=2Gb/s, 4=4Gb/s, 8=8Gb/s, A=Auto) [Auto ] PortType (GL, G, F, FL, TR) [GL ] SymPortName (string, max=32 chars) [Port1 ] ALFairness (True / False) [False ] DeviceScanEnable (True / False) [True ] ForceOfflineRSCN (True / False) [False ] ARB_FF (True / False) [False ] InteropCredit (decimal value, 0-255) [0 ] FANEnable (True / False) [True ] AutoPerfTuning (True / False) [True ] MSEnable (True / False) [True ] NoClose (True / False) [False ] IOStreamGuard (Enable / Disable / Auto) [Auto ] PDISCPingEnable (True / False) [True ] Finished configuring attributes. This configuration must be saved (see config save command) and activated (see config activate command) before it can take effect. To discard this configuration use the config cancel command. SN6000 FC Switch (admin-config) #> config save SN6000 FC Switch (admin-config) #> config activate You can configure all ports based on a specified source port using the set config ports command. The set config ports command prompts you to configure the parameters of the source port, and then applies those values to all of the ports. The following example configures all ports based on port 3: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) config edit SN6000 FC Switch (admin) #> set config ports 3 . . . SN6000 FC Switch (admin-config)#> config save SN6000 FC Switch (admin)#> config activate SN6000 FC Switch (admin)#> admin end

clone config port command. The following example configures ports 8–19 based on port 0: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) config edit SN6000 FC Switch (admin) #> clone config port 0 8-19 SN6000 FC Switch (admin-config)#> config save SN6000 FC Switch (admin)#> config activate SN6000 FC Switch (admin)#> admin end The following example temporarily changes the administrative state of port 1 to down: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> set port 1 state down Configuring transparent routing IMPORTANT: Simple SAN Connection Manager (SSCM) version 3.0 or later is required for the HP SN6000 Fibre Channel Switch. The SSCM application can manage SN6000 Fibre Channel Switches with active TR_Ports; however, SSCM cannot manage or discover remote switches or devices in the remote fabric. Use QuickTools or Enterprise Fabric Management Suite and the storage management interface to present Logical Unit Numbers (LUNs) to remote devices. The transparent routing feature provides inter-fabric routing to enable controlled and limited access between devices on a SN6000 Fibre Channel Switch (local) fabric and devices on a remote fabric consisting of switches made by other vendors. For a list of switches that are supported in a remote fabric, see the HP StorageWorks SN6000 Fibre Channel Switch Release Notes, and the HP StorageWorks SAN Design Reference Guide on the HP website: http://www.hp.com/go/sandesignguide. This type of inter-fabric connection uses the Fibre Channel industry N-Port ID Virtualization (NPIV), and makes local and remote devices accessible to each other while maintaining the local and remote fabrics as separate fabrics. You can connect multiple SN6000 Fibre Channel Switches to one or more remote fabrics using multiple TR_Ports. Local and remote devices are identified by their respective port worldwide names. Consider the following mapping rules: • A TR_Port can support a maximum of 32 local device/remote device mappings. • A specific local device can be mapped to devices on one remote fabric only. Local devices on the same SN6000 Fibre Channel Switch can each be mapped to different remote fabrics. • For mappings between a specific SN6000 Fibre Channel Switch and a remote fabric, each local device or remote device can be mapped over one TR_Port only. Additional mappings to either device must use that same TR_Port. • Mulitple local devices connected to different local switches can be mapped to the same remote device over one TR_Port on each local switch. • A local device cannot be mapped over an E_Port to another local switch, then over a TR_Port to the remote device. The local switch to which the local device is connected must connect directly to the remote fabric over a TR_Port. NOTE: When a local device is mapped over a TR_Port to a remote device, the local device and its TR_Port appear as an NPIV connected device in the remote fabric. It is possible, though not recommended, to map such a local device over a second TR_Port to a local device in a second local fabric. In this case, if you merge the two local fabrics, the transparent route becomes inactive for the devices that now have a path over an ISL, and an alarm is generated.

63 NOTE: Although transparent routing can be configured with the CLI, the QuickTools web applet and Enterprise Fabric Management Suite are designed to simplify the configuration process. See the HP StorageWorks SN6000 Fibre Channel Switch QuickTools Switch Management User Guide and the HP StorageWorks 8/20q and SN6000 Fibre Channel Switch Enterprise Fabric Management Suite User Guide. To configure transparent routing: 1. Determine what devices on the local fabric require access to devices on the remote fabric. Local devices must be attached directly to the SN6000 Fibre Channel Switch. In this example, the device WWNs are as follows: • Local device: 21:00:00:e0:8b:0e:d3:59 • Remote device: 22:00:00:04:cf:a8:7f:2d 2. Configure one or more TR_Ports on the local SN6000 Fibre Channel Switch: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> config edit SN6000 FC Switch (admin-config) #> set config port 1 A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Configuring Port Number: 1 ------------------------ AdminState (1=Online, 2=Offline, 3=Diagnostics, 4=Down) [Online] LinkSpeed (1=1Gb/s, 2=2Gb/s, 4=4Gb/s, 8=8Gb/s, A=Auto) [Auto ] PortType (GL, G, F, FL, TR) [GL ] TR SymPortName (string, max=32 chars) [Port1 ] . . . Finished configuring attributes. This configuration must be saved (see config save command) and activated (see config activate command) before it can take effect. To discard this configuration use the config cancel command. SN6000 FC Switch (admin-config) #> config save SN6000 FC Switch (admin-config) #> config activate 3. Connect the TR_Port to the remote fabric. For remote HP StorageWorks B-series or C-series fabrics, the switch to which the TR_Port is connected must support NPIV, and for B-series fabrics the interoperability mode must be configured to InteropMode=0. Other B-series or C-series switches in the remote fabric need not support NPIV. 4. Map local devices to remote devices by creating an inter-fabric zone. The inter-fabric zone contains the port WWNs of the local device, the remote device, and the TR_Port. The name of the inter-fabric zone begins with IFZ followed by the lowest device port WWN followed by the remaining port WWN, all uppercase, separated by underscores (_). a. Create the inter-fabric zone: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #>zone create IFZ_210000E08B0ED359_22000004CFA87F2D b. Add the device and TR_Port WWNs to the inter-fabric zone: SN6000 FC Switch (admin-zoning) #>zone add IFZ_210000E08B0ED359_22000004CFA87F2D 21:00:00:e0:8b:0e:d3:59 22:00:00:04:cf:a8:7f:2d 20:01:00:c0:dd:0d:53:a5

SN6000 FC Switch (admin-zoning) #>zoneset add zoneset_alpha IFZ_210000E08B0ED359_22000004CFA87F2D SN6000 FC Switch (admin-zoning) #> zoning save The changes have been saved; however, they must be activated before they can take effect -- see Zoneset Activate command. SN6000 FC Switch (admin) #> zoneset activate zoneset_alpha 5. Apply the same inter-fabric zone that was created on the local fabric to the active zoning on the remote HP StorageWorks B-series or C-series fabric. When modifications to the active zoning on both fabrics are complete, the transparent routing connection becomes active, and local devices will discover remote devices. To remove a transparent route, in addition to removing the local inter-fabric zone, you must also remove the corresponding remote inter-fabric zone. Port binding Port binding establishes up to 32 switches or devices that are permitted to log in to a particular switch port. Switches or devices that are not among the established 32 are refused access to the port. To display the port binding configuration for all ports, enter the show config security portbinding command, as shown in the following example: SN6000 FC Switch #> show config security portbinding Configuration Name: default ------------------- Port Binding Status WWN ---- -------------- ----------------------- 0 True 10:20:30:40:50:60:70:80 1 True 10:20:30:40:50:60:70:80 2 False No port binding entries found. 3 True 10:20:30:40:50:60:70:80 4 True 10:20:30:40:50:60:70:80 5 False No port binding entries found. 6 True 10:20:30:40:50:60:70:81 7 False No port binding entries found. 8 True 10:20:30:40:50:60:70:80 9 False No port binding entries found. 10 False No port binding entries found. 11 False No port binding entries found. 12 False No port binding entries found. 13 False No port binding entries found. 14 False No port binding entries found. 15 False No port binding entries found. 16 False No port binding entries found. 17 False No port binding entries found. 18 False No port binding entries found. 19 False No port binding entries found.

65 To enable port binding for the selected port and to specify the WWNs of the authorized ports/devices, enter the set config security portbinding command. The following example enables port binding on port 1 and specifies two device world wide names: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> config edit SN6000 FC Switch (admin-config) #> set config security port 1 A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. PortBindingEnabled (True / False)[False] true WWN (N=None / WWN)[None ] 10:00:00:c0:dd:00:b9:f9 WWN (N=None / WWN)[None ] 10:00:00:c0:dd:00:b9:f8 WWN (N=None / WWN)[None ] n Finished configuring attributes. This configuration must be saved (see config save command) and activated (see config activate command) before it can take effect. To discard this configuration use the config cancel command. Resetting a port To reinitialize one or more ports and to discard any temporary changes that have been made to the administrative state or link speed, enter the reset port command. The following example reinitializes port 1: SN6000 FC Switch #> reset port 1 Configuring port threshold alarms The switch can monitor a set of port errors and generate alarms based on user-defined sample windows and thresholds. These port errors include the following: • Cyclic redundancy check (CRC) errors • Decode errors • ISL connection count • Device login errors • Device logout errors • Loss-of-signal errors You make changes to the port threshold alarms by modifying the switch configuration as described in ”Modifying a switch configuration” (page 45). See Table 37 for a description of the port alarm threshold parameters. The switch will down a port if an alarm condition is not cleared within three consecutive sampling windows (by default, 30 seconds). Reset the port to bring it back online. An alarm is cleared when the threshold monitoring detects that the error rate has fallen below the falling trigger.

command: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> config edit SN6000 FC Switch (admin-config) #> set config threshold A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. ThresholdMonitoringEnabled (True / False) [False ] CRCErrorsMonitoringEnabled (True / False) [True ] RisingTrigger (decimal value, 1-1000) [25 ] FallingTrigger (decimal value, 0-1000) [1 ] SampleWindow (decimal value, 1-1000 sec) [10 ] DecodeErrorsMonitoringEnabled (True / False) [True ] RisingTrigger (decimal value, 1-1000) [25 ] FallingTrigger (decimal value, 0-1000) [0 ] SampleWindow (decimal value, 1-1000 sec) [10 ] ISLMonitoringEnabled (True / False) [True ] RisingTrigger (decimal value, 1-1000) [2 ] FallingTrigger (decimal value, 0-1000) [0 ] SampleWindow (decimal value, 1-1000 sec) [10 ] LoginMonitoringEnabled (True / False) [True ] RisingTrigger (decimal value, 1-1000) [5 ] FallingTrigger (decimal value, 0-1000) [1 ] SampleWindow (decimal value, 1-1000 sec) [10 ] LogoutMonitoringEnabled (True / False) [True ] RisingTrigger (decimal value, 1-1000) [5 ] FallingTrigger (decimal value, 0-1000) [1 ] SampleWindow (decimal value, 1-1000 sec) [10 ] LOSMonitoringEnabled (True / False) [True ] RisingTrigger (decimal value, 1-1000) [100 ] FallingTrigger (decimal value, 0-1000) [5 ] SampleWindow (decimal value, 1-1000 sec) [10 ] Finished configuring attributes. This configuration must be saved (see config save command) and activated (see config activate command) before it can take effect. To discard this configuration use the config cancel command. SN6000 FC Switch (admin-config) #> config save SN6000 FC Switch (admin-config) #> config activate

67 Testing a port You can test a port using the test port command using online or offline tests. The following sections describe the test types, displaying test results, and cancelling a test. Online tests for ports An online test is a non-disruptive test that exercises the port, transceiver, and device connections. The port must be online and connected to a device. Online testing of TR_Ports is not allowed. The following is an example of an online test: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> test port 1 online A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the default value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. LoopCount (decimal value, 1-4294967295) [429496729] FrameSize (decimal value, 40-2148) [256 ] DataPattern (32-bit hex value or 'Default') [Default ] StopOnError (True / False) [True ] LoopForever (True / False) [False ] Do you want to start the test? (y/n) [n] y The test has been started. A notification with the test result(s) will appear on the screen when the test has completed. SN6000 FC Switch (admin) #> Test for port 1 Passed.

An offline test is a disruptive test that exercises the port connections. You must place the port in the diagnostics state using the set port command before starting the test. There are two types of offline test: internal loopback and external loopback. • An internal loopback test exercises the internal port connections. • An external loopback test exercises the port and its transceiver. A transceiver with a loopback plug is required for the port. The following example performs an offline test: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> set port 1 state diagnostics SN6000 FC Switch (admin) #> test port 1 offline internal A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the default value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. LoopCount (decimal value, 1-4294967295) [429496729] FrameSize (decimal value, 40-2148) [256 ] DataPattern (32-bit hex value or 'Default') [Default ] StopOnError (True / False) [True ] LoopForever (True / False) [False ] Do you want to start the test? (y/n) [n] y The test has been started. A notification with the test result(s) will appear on the screen when the test has completed. SN6000 FC Switch (admin) #> Test for port 1 Passed. When the test is complete, remember to place the port back online. SN6000 FC Switch (admin) #> set port 1 state online Displaying port test results You can display the test status while the test is in progress by entering the test status port command, as shown in the following example: SN6000 FC Switch #> test status port 1 Port Test Test Loop Test Num Port Type Status Count Failures ---- -------- ---- ------ ----- -------- 1 1 Offline Internal Passed 12 0 Canceling a port test To cancel a port test that is in progress, enter the test cancel port command.

69 6 Zoning Configuration Access to devices within the fabric is controlled by zoning. Some zoning strategies are: • Separating devices by operating system • Separating devices that have no need to communicate with other devices in the fabric or have classified data • Separating devices into department, administrative, or other functional group • Reserving a path and its bandwidth from one port to another A zone is a named group of ports or devices. Members of the same zone can communicate with each other and transmit outside the zone, but cannot receive inbound traffic from outside the zone. Zoning divides the fabric for purposes of controlling discovery and inbound traffic. Zoning is hardware-enforced only when a port/device is a member of no more than eight zones whose combined membership does not exceed 64. If this condition is not satisfied, that port behaves as a soft zone member. You can assign ports/devices to a zone individually or as a group by creating an alias. A zone can be a component of more than one zone set. Several zone sets can be defined for a fabric, but only one zone set can be active at one time. The active zone set determines the current fabric zoning. This section describes the zoning configuration tasks. Displaying zoning database information A switch maintains three zoning databases: • Non-volatile—This zoning database is permanent and contains all zone sets, zones, and aliases that you create and save on a switch. The zone sets in the non-volatile zoning database are known as configured zone sets. • Volatile—This zoning database is temporary. This means it is not retained across switch resets. The volatile zoning database can be the working copy of a zone set being edited or an active zone set received from another switch. In the latter case, this is also known as the merged zone set. • Active—This zoning database is the active zone set. You can display the following information about the zoning database: • Configured zone set information, page 69 • Active zone set information, page 71 • Merged zone set information, page 72 • Edited zone set information, page 72 • Zone set membership information, page 72 • Orphan zone information, page 73 • Alias and alias membership information, page 74 • Zoning modification history, page 74 • Zoning database limits, page 75 Configured zone set information The zoneset list and the zoning list commands display information about all zone sets in the non-volatile zoning database. To display a list of the zone sets, enter the zoneset list command, as shown in the following example: SN6000 FC Switch #> zoneset list Current List of ZoneSets ------------------------ alpha beta

the zoning list command, as shown in the following example. Merged and edited zone sets are displayed if they exist. SN6000 FC Switch #> zoning list Active (enforced) ZoneSet Information ZoneSet Zone ZoneMember -------------------------------- wwn wwn_23bd31 50:06:04:82:bf:d2:18:c2 50:06:04:82:bf:d2:18:d2 10:00:00:00:c9:23:bd:31 wwn_221416 50:06:04:82:bf:d2:18:c2 50:06:04:82:bf:d2:18:d2 10:00:00:00:c9:22:14:16 wwn_2215c3 50:06:04:82:bf:d2:18:c2 50:06:04:82:bf:d2:18:d2 10:00:00:00:c9:22:15:c3 Configured (saved in NVRAM) Zoning Information ZoneSet Zone ZoneMember -------------------------------- wwn wwn_23bd31 50:06:04:82:bf:d2:18:c2 50:06:04:82:bf:d2:18:d2 10:00:00:00:c9:23:bd:31 wwn_221416 50:06:04:82:bf:d2:18:c2 50:06:04:82:bf:d2:18:d2 10:00:00:00:c9:22:14:16 wwn_2215c3 50:06:04:82:bf:d2:18:c2 50:06:04:82:bf:d2:18:d2 10:00:00:00:c9:22:15:16

71 Active zone set information The zoning list and zoneset active commands display information about the active zone set. To display component zones and zone members, enter the zoning active command, as shown in the following example: SN6000 FC Switch #> zoning active Active (enforced) ZoneSet Information ZoneSet Zone ZoneMember -------------------------------- wwn wwn_b0241f 50:06:04:82:bf:d2:18:c2 50:06:04:82:bf:d2:18:d2 21:00:00:e0:8b:02:41:2f wwn_23bd31 50:06:04:82:bf:d2:18:c2 50:06:04:82:bf:d2:18:d2 10:00:00:00:c9:23:bd:31 wwn_221416 50:06:04:82:bf:d2:18:c2 50:06:04:82:bf:d2:18:d2 10:00:00:00:c9:22:14:16 wwn_2215c3 50:06:04:82:bf:d2:18:c2 50:06:04:82:bf:d2:18:d2 10:00:00:00:c9:22:15:c3 To display the name of the active zone set and its activation history, enter the zoneset active command, as shown in the following example: SN6000 FC Switch #> zoneset active Active ZoneSet Information -------------------------- ActiveZoneSet Bets LastActivatedBy admin@OB-session6 LastActivatedOn day month date time year

A merged zone set is a zone set that is received from another switch as a result of a change to the active zone set. You can display the merged zone set on your switch if the MergeAutoSave parameter is set to False. For more information about the MergeAutoSave parameter, see ”Configuring the zoning database” (page 75). To display merged zone set information, enter the zoning merged command, as shown in the following example: SN6000 FC Switch #> zoning merged ********************************************************************* To permanently save the merged database locally, execute the 'zoning merged capture' command. To edit the merged database use the ’zoning edit merged’ command. To remove the merged database use the ’zoning restore’ command. ********************************************************************** Merged (unsaved) Zoning Information ZoneSet Zone ZoneMember ------- ---- ---------- ZS1 Z1 10:00:00:c0:dd:00:b9:f9 10:00:00:c0:dd:00:b9:fa Z2 10:00:00:c0:dd:00:b9:fb 10:00:00:c0:dd:00:b9:fc Edited zone set information The edited zone set is a zone set that you were modifying when a change occurred to the active zone set or a fabric merge occurred. To display the unsaved edited zone set information, enter the zoning edited command in an Admin session and a Zoning Edit session, as shown in the following example: SN6000 FC Switch (admin-zoning) #> zoning edited Edited (unsaved) Zoning Information ZoneSet Zone ZoneMember ------- ---- ---------- ZS1 Z1 10:00:00:c0:dd:00:b9:f9 10:00:00:c0:dd:00:b9:fa Zone set membership information The zoneset zones, zone list, and zone zonesets commands display zone set membership information. To display the member zones for a specified zone set, enter the zoneset zones command, as shown in the following example: SN6000 FC Switch #> zoneset zones ssss Current List of Zones for ZoneSet: ssss ---------------------------------- zone1 zone2 zone3

73 To display the zones and the zone sets to which they belong, enter the zone list command, as shown in the following example: SN6000 FC Switch #> zone list Zone ZoneSet ---- ------- wwn_b0241f zone_set_1 wwn_23bd31 zone_set_1 wwn_221416 zone_set_2 wwn_2215c3 zone_set_2 wwn_0160ed zone_set_3 To display the zone sets for which a specified zone is a member, enter the zone zonesets command, as shown in the following example: SN6000 FC Switch #> zone zonesets zone1 Current List of ZoneSets for Zone: zone1 ---------------------------------- zone_set_1 Zone membership information To display the members for a specified zone, enter the zone members command, as shown in the following example: SN6000 FC Switch #> zone members wwn_b0241f Current List of Members for Zone: wwn_b0241f --------------------------------- 50:06:04:82:bf:d2:18:c2 50:06:04:82:bf:d2:18:d2 21:00:00:e0:8b:02:41:2f Orphan zone information To display a list of zones that are not members of any zone set, enter the zone orphans command, as shown in the following example: SN6000 FC Switch #> zone orphans Current list of orphan zones ---------------------------- zone3 zone4

The alias list and alias members commands display information about aliases. To display a list of all aliases, enter the alias list command, as shown in the following example: SN6000 FC Switch #> alias list Current list of Zone Aliases ---------------------------- alias1 alias2 To display the membership for a specified alias, enter the alias members command, as shown in the following example: SN6000 FC Switch #> alias members alias1 Current list of members for Zone Alias: alias1 --------------------------------------- 50:06:04:82:bf:d2:18:c4 50:06:04:82:bf:d2:18:c5 50:06:04:82:bf:d2:18:c6 Zoning modification history To display a record of zoning modifications, enter the zoning history command, as shown in the following example: SN6000 FC Switch #> zoning history Active Database Information --------------------------- ZoneSetLastActivated/DeactivatedBy Remote ZoneSetLastActivated/DeactivatedOn day mon date hh:mm:ss yyyy Database Checksum 00000000 Inactive Database Information ----------------------------- ConfigurationLastEditedBy admin@OB-session17 ConfigurationLastEditedOn day mon date hh:mm:ss yyyy Database Checksum 00000000 History information includes the following data: • Time of the most recent zone set activation or deactivation and the user account that performed it • Time of the most recent modifications to the zoning database and the user account that made them. • Checksum for the zoning database

75 Zoning database limits To display a summary of the objects in the zoning database and their maximum limits, enter the zoning limits command, as shown in the following example: SN6000 FC Switch #> zoning limits Configured (saved in NVRAM) Zoning Information Zoning Attribute Maximum Current [Zoning Name] ---------------- ------- ------- ------------- MaxZoneSets 256 6 MaxZones 2000 17 MaxAliases 2500 1 MaxTotalMembers 10000 166 MaxZonesInZoneSets 2000 19 MaxMembersPerZone 2000 10 D_1_JBOD_1 23 D_1_Photons 9 D_2_JBOD1 16 D_2_NewJBOD_2 5 E1JBOD1 5 E2JBOD2 3 LinkResetZone 3 LinkResetZone2 8 NewJBOD1 8 NewJBOD2 24 Q_1Photon1 8 Q_1_NewJBOD1 13 Q_1_Photon_1 21 Q_2_NewJBOD2 3 ZoneAlias 3 ZoneDomainPort 4 ZoneFCAddr MaxMembersPerAlias 2000 2 AliasInAZone ActiveZones 19 ActiveZoneMembers 160 To display abbreviated limits information, enter the zoning limits brief command. Configuring the zoning database You can configure how the zoning database is applied to the switch and exchanged with the fabric by using the zoning configuration parameters. The following zoning configuration parameters are available through the set config zoning command. For more information about the zoning configuration parameters, see Table 38. • MergeAutoSave—Enables or disables the automatic saving of a new active zone set to the switch non-volatile zoning database. • DefaultZone—Allows or denies communication among ports/devices that are not defined in the active zone set. • DiscardInactive—Enables or disables the discarding of all zone sets except the active zone set.

fabric merge occurs, you can choose how to dispose of the merged zone set: • To display the merged zone set, enter the zoning merged command. • To edit the merged zone set, enter the zoning edit merged command. • To save the merged zone set to the non-volatile zoning database, enter the zoning merged capture command. • To discard the merged zone set, enter the zoning restore command. If you are editing the configured zone set that corresponds to the active zone set and a zone set merge occurs, you have the same editing options. In addition, you can enter the zoning edited command to display the edited zoning database. To restore the zoning configuration to its factory values, enter the reset config or reset factory commands. Notice, however, these commands restore other aspects of the switch configuration as well. To modify the zoning configuration, you must open an Admin session with the admin start command. An Admin session prevents other accounts from making changes at the same time through Telnet, QuickTools, Enterprise Fabric Management Suite, or another management application. You must also open a Config Edit session with the config edit command and indicate which configuration you want to modify. If you do not specify a configuration name, the active configuration is assumed. The Config Edit session provides access to the set config zoning command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> config edit The config named default is being edited. SN6000 FC Switch (admin-config) #> set config zoning A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. MergeAutoSave (True / False) [True ] DefaultZone (Allow / Deny) [Allow ] DiscardInactive (True / False) [False] Finished configuring attributes. This configuration must be saved (see config save command) and activated (see config activate command) before it can take effect. To discard this configuration use the config cancel command. SN6000 FC Switch (admin-config)#> config save SN6000 FC Switch (admin)#> config activate SN6000 FC Switch (admin)#> admin end

77 Modifying the zoning database To modify the non-volatile zoning database: 1. Enter the admin start command. SN6000 FC Switch #> admin start An Admin session prevents other accounts from making changes at the same time through Telnet, QuickTools, Enterprise Fabric Management Suite, or any other management application. 2. Take one of the following actions: • To open a Zoning Edit session, enter the zoning edit configured command. The Zoning Edit session provides access to the zoneset, zone, alias, and zoning commands with which you make modifications to the zoning database SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning)#> zoneset . . . SN6000 FC Switch (admin-zoning)#> zone . . . SN6000 FC Switch (admin-zoning)#> alias . . . SN6000 FC Switch (admin-zoning)#> zoning . . . • To modify the temporary merged zone set (if one exists), enter the zoning edit merged command. SN6000 FC Switch (admin) #> zoning edit merged 3. When you are finished making changes: • To save the changes and close the Zoning Edit session, enter the zoning save command. SN6000 FC Switch (admin-zoning)#> zoning save • To close the Zoning Edit session without saving changes, enter the zoning cancel command. SN6000 FC Switch (admin-zoning)#> zoning cancel 4. To activate the changes to the active zone set, enter the zoneset activate command. SN6000 FC Switch (admin)#> zoneset activate zoneset_1 The active zone set is propagated throughout the fabric. 5. When you are finished making changes to the switch, enter the admin end command to release the Admin session for other administrators. SN6000 FC Switch (admin)#> admin end To remove all zoning database objects (aliases, zones, and zone sets) and restore the zoning database to its factory state, enter the reset zoning command, as shown in the following example: SN6000 FC Switch (admin) #> reset zoning Saving the active and merged zone sets You can save the active zone set and merged zone set to the non-volatile zoning database. To save the active zone set, enter the zoning active capture command, as shown in the following example: SN6000 FC Switch (admin) #> zoning active capture This command will overwrite the configured zoning database in NVRAM. Please confirm (y/n): [n] y The active zoning database has been saved. To the save the merged zone set, enter the zoning merged capture command, as shown in the following example: SN6000 FC Switch (admin) #> zoning merged capture This command will overwrite the configured zoning database in NVRAM. Please confirm (y/n): [n] y The merged zoning database has been saved.

There are two ways to remove all aliases, zones, and zone sets from the zoning database: • Enter the reset zoning command, as shown in the following example. This is the preferred method. SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> reset zoning The zoning configuration parameters, MergeAutoSave, DefaultZone, and DiscardInactive remain unchanged. • Enter the zoning clear command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zoning clear SN6000 FC Switch (admin-zoning) #> zoning save Deleting inactive zone sets, zones, and aliases To delete all objects from the zoning database except those in the active zone set, enter the zoning delete orphans command. SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning delete orphans This command will remove all zonesets, zones, and aliases that are not currently active. Please confirm (y/n): [n] y SN6000 FC Switch (admin) #> zoning save Managing zone sets All zone set management tasks except ”Activating a zone set” (page 79) and ”Deactivating a zone set” (page 79) require an Admin session and a Zoning Edit session. Creating a zone set To create a new zone set, enter the zoneset create command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zoneset create zoneset_1 SN6000 FC Switch (admin-zoning) #>zoning save Deleting a zone set To delete a zone set, enter the zoneset delete command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zoneset delete zoneset_1 SN6000 FC Switch (admin-zoning) #>zoning save Renaming a zone set To rename a zone set, enter the zoneset rename command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zoneset rename zoneset_old zoneset_new SN6000 FC Switch (admin-zoning) #>zoning save

79 Copying a zone set To copy a zone set and its contents to a new zone set, enter the zoneset copy command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zoneset copy zoneset_1 zoneset_2 SN6000 FC Switch (admin-zoning) #>zoning save Adding zones to a zone set To add a zone to a zone set, enter the zoneset add command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zoneset add zoneset_1 zone_1 zone_2 SN6000 FC Switch (admin-zoning) #>zoning save Removing zones from a zone set To remove zones from a zone set, enter the zoneset remove command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zoneset remove zoneset_1 zone_1 zone_2 SN6000 FC Switch (admin-zoning) #>zoning save Activating a zone set To apply zoning to the fabric, enter the zoneset activate command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoneset activate zoneset_1 Deactivating a zone set To deactivate the active zone set and disable zoning in the fabric, enter the zoneset deactivate command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoneset deactivate Managing zones All zone management tasks require an Admin session and a Zoning Edit session. Creating a zone To create a new zone, enter the zone create command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zone create zone_1 SN6000 FC Switch (admin-zoning) #> zoning save Deleting a zone To delete zone_1 from the zoning database, enter the zone delete command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zone delete zone_1 SN6000 FC Switch (admin-zoning) #> zoning save

To rename zone_1 to zone_a, enter the zone rename command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zone rename zone_1 zone_a SN6000 FC Switch (admin-zoning) #> zoning save Copying a zone To copy the contents of an existing zone (zone_1) to a new zone (zone_2), enter the zone copy command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zone copy zone_1 zone_2 SN6000 FC Switch (admin-zoning) #> zoning save Adding members to a zone To add ports/devices to zone_1, enter the zone add command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zone add zone_1 alias_1 1,4 1,5 SN6000 FC Switch (admin-zoning) #> zoning save Removing members from a zone To remove ports/devices from zone_1, enter the zone remove command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> zone remove zone_1 alias_1 1,4 1,5 SN6000 FC Switch (admin-zoning) #> zoning save

81 Managing aliases All alias management tasks require an Admin session and a Zoning Edit session. Creating an alias To create a new alias, enter the alias create command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> alias create alias_1 SN6000 FC Switch (admin-zoning) #> zoning save Deleting an alias To delete alias_1 from the zoning database, enter the alias delete command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> alias delete alias_1 SN6000 FC Switch (admin-zoning) #> zoning save Renaming an alias To rename alias_1 to alias_a, enter the alias rename command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> alias rename alias_1 alias_a SN6000 FC Switch (admin-zoning) #> zoning save Copying an alias To copy alias_1 and its contents to alias_2, enter the alias copy command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> alias copy alias_1 alias_2 SN6000 FC Switch (admin-zoning) #> zoning save Adding members to an alias To add ports/devices to alias_1, enter the alias add command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> alias add alias_1 1,4 1,5 SN6000 FC Switch (admin-zoning) #> zoning save Removing members from an alias To remove ports/devices from alias_1, enter the alias remove command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> zoning edit SN6000 FC Switch (admin-zoning) #> alias remove alias_1 1,4 1,5 SN6000 FC Switch (admin-zoning) #> zoning save

83 7 Connection Security Configuration The SN6000 Fibre Channel Switch supports secure connections with Telnet and switch management applications. The Secure Shell protocol (SSH) secures Telnet connections to the switch. The Secure Sockets Layer (SSL) protocol secures switch connections to the following management applications: • Simple SAN Connection Manager • QuickTools • Enterprise Fabric Management Suite • Storage Management Initiative-Specification (SMI-S) Managing SSL and SSH services Consider the following when enabling SSH and SSL services: • Simple SAN Connection Manager version 1.0 does not support the SSL service. If SSL is enabled, you will be unable to manage the switch using this version of Simple SAN Connection Manager. • To establish a secure Telnet connection, your workstation must use an SSH client. • To enable secure SSL connections, you must first synchronize the date and time on the switch and workstation. See ”Managing the date and time” (page 47). • The SSL service must be enabled to authenticate users through a Remote Authentication Dial-In Service (RADIUS) server. See ”Configuring a RADIUS server on the switch” (page 98). • To disable SSL when using a user authentication RADIUS server, the RADIUS server authentication order must be local. • Enabling SSL automatically creates a security certificate on the switch.

To manage both SSH and SSL services, enter the set setup services command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> set setup services A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. PLEASE NOTE: ----------- * Further configuration may be required after enabling a service. * If services are disabled, the connection to the switch may be lost. * When enabling SSL, please verify that the date/time settings on this switch and the workstation from where the SSL connection will be started match, and then a new certificate may need to be created to ensure a secure connection to this switch. TelnetEnabled (True / False) [True ] SSHEnabled (True / False) [False] True GUIMgmtEnabled (True / False) [True ] SSLEnabled (True / False) [False] True EmbeddedGUIEnabled (True / False) [True ] SNMPEnabled (True / False) [True ] NTPEnabled (True / False) [False] CIMEnabled (True / False) [False] FTPEnabled (True / False) [True ] MgmtServerEnabled (True / False) [True ] Do you want to save and activate this services setup? (y/n): [n] y Displaying SSL and SSH services To display the status of the SSH and SSL services, enter the show setup services command, as shown in the following example: SN6000 FC Switch #> show setup services System Services ----------------------------- TelnetEnabled True SSHEnabled False GUIMgmtEnabled True SSLEnabled False EmbeddedGUIEnabled True SNMPEnabled True NTPEnabled True CIMEnabled True FTPEnabled True MgmtServerEnabled True CallHomeEnabled True

85 Creating an SSL security certificate Enabling SSL automatically creates a security certificate on the switch. The security certificate is required to establish an SSL connection with a management application such as Simple SAN Connection Manager, QuickTools, or Enterprise Fabric Management Suite. The certificate is valid 24 hours before the certificate creation date and expires 365 days after the creation date. Should the original certificate become invalid, enter the create certificate command to create a new one, as shown in the following example: SN6000 FC Switch (admin) #> create certificate The current date and time is day mon date hh:mm:ss UTC yyyy. This is the time used to stamp onto the certificate. Is the date and time correct? (y/n): [n] y Certificate generation successful. To ensure that the security certificate will be valid, be sure that the switch and the workstation date and time are the same. See ”Managing the date and time” (page 47).

87 8 Device Security Configuration Device security provides for the authorization and authentication of devices that you attach to a switch. You can configure a switch with a group of devices against which the switch authorizes new attachments by devices, other switches, or devices issuing management server commands. Device security is defined through the use of security sets and groups. A group is a list of device WWNs that are authorized to attach to a switch. There are three types of groups: one for other switches (ISL), another for devices (port), and a third for devices that issue management server commands (MS). A security set is a set of up to three groups with no more than one of each group type. The security database is made up of all security sets on the switch. In addition to providing authorization, the switch can be configured to require authentication to validate the identity of the connecting switch, device, or host. Authentication can be performed locally using the switch’s security database, or remotely using a RADIUS server such as Microsoft RADIUS. Displaying security database information You can display the following information about the security database: • Configured security set information, page 87 • Active security set information, page 88 • Security set membership information, page 89 • Group membership information, page 89 • Security database modification history, page 90 • Security database limits, page 90 Configured security set information The securityset list and the security list commands display information about all security sets in the security database. To display a list of the security sets, enter the securityset list command, as shown in the following example: SN6000 FC Switch #> securityset list Current list of SecuritySets ---------------------------- alpha beta

To display all security sets, groups, and group members in the security database, enter the security list command, as shown in the following example: SN6000 FC Switch #> security list Active Security Information SecuritySet Group GroupMember ----------- ----- ----------- No active securityset defined. Configured Security Information SecuritySet Group GroupMember ----------- ----- ----------- alpha group1 (ISL) 10:00:00:00:00:10:21:16 Authentication Chap Primary Hash MD5 Primary Secret ******** Secondary Hash SHA-1 Secondary Secret ******** Binding 0 10:00:00:00:00:10:21:17 Authentication Chap Primary Hash MD5 Primary Secret ******** Secondary Hash SHA-1 Secondary Secret ******** Binding 0 Active security set information The security active and securityset active commands display information about the active security set. To display component groups and group members, enter the security active command, as shown in the following example: SN6000 FC Switch #> security active Active Security Information SecuritySet Group GroupMember ----------- ----- ----------- alpha group1 (ISL) 10:00:00:00:00:10:21:16 Authentication Chap Primary Hash MD5 Primary Secret ******** Secondary Hash SHA-1 Secondary Secret ******** Binding 0 10:00:00:00:00:10:21:17 Authentication Chap Primary Hash MD5 Primary Secret ******** Secondary Hash SHA-1 Secondary Secret ******** Binding 0

89 To display the name of the active security set and its activation history, enter the securityset active command, as shown in the following example: SN6000 FC Switch #> securityset active Active SecuritySet Information ------------------------------ ActiveSecuritySet alpha LastActivatedBy Remote LastActivatedOn day month date time year Security set membership information The securityset groups and group securitysets commands display security set membership information. To display the member groups for a specified security set, enter the securityset groups command, as shown in the following example: SN6000 FC Switch #> securityset groups alpha Current list of Groups for SecuritySet: alpha --------------------------------------- group1 (ISL) group2 (Port) To display the security sets for which a specified group is a member, enter the group securitysets command, as shown in the following example: SN6000 FC Switch #> group securitysets group_1 Current list of SecuritySets for Group: group_1 --------------------------------------- SecuritySet_1 SecuritySet_2 SecuritySet_A SecuritySet_B Group membership information To display the members for a specified group, enter the group members command, as shown in the following example: SN6000 FC Switch #> group members group_1 Current list of members for Group: group_1 ---------------------------------- 10:00:00:c0:dd:00:71:ed 10:00:00:c0:dd:00:72:45 10:00:00:c0:dd:00:90:ef 10:00:00:c0:dd:00:b8:b7

Security database modification history To display a record of security database modifications, enter the security history command, as shown in the following example: SN6000 FC Switch #> security history Active Database Information --------------------------- SecuritySetLastActivated/DeactivatedBy Remote SecuritySetLastActivated/DeactivatedOn day month date time year Database Checksum 00000000 Inactive Database Information ----------------------------- ConfigurationLastEditedBy admin@IB-session11 ConfigurationLastEditedOn day month date time year Database Checksum 00007558 Security database history includes the following information: • Time of the most recent security set activation or deactivation, and the user account that performed it • Time of the most recent modifications to the security database and the user account that made them • Checksum for the security database Security database limits To display a summary of the objects in the security database and their maximum limit, enter the security limits command, as shown in the following example: SN6000 FC Switch #> security limits Security Attribute Maximum Current [Name] ------------------ ------- ------- ------ MaxSecuritySets 4 1 MaxGroups 16 2 MaxTotalMembers 1000 19 MaxMembersPerGroup 1000 4 group1 15 group2

91 Configuring the security database You can configure how the security database is applied to the switch and exchanged with the fabric through the security configuration parameters. The following security configuration parameters are available through the set config security command: • AutoSave—This parameter enables or disables the saving of changes to active security set in the switch’s non-volatile security database. • FabricBindingEnabled—This parameter enables or disables the configuration and enforcement of fabric binding on all switches in the fabric. Fabric binding associates switch worldwide names with a domain ID in the creation of ISL groups. If AutoSave is False, you can reverse device security changes that have been received from another switch through the activation of a security set or the merging of fabrics. To replace the volatile security database with the contents of the non-volatile security database, enter the security restore command. To restore the security configuration to its factory values, you can enter the reset config or reset factory command. Notice however, that these commands restore other aspects of the switch configuration as well. To modify the security configuration, you must open an Admin session with the admin start command. An Admin session prevents other accounts from making changes at the same time either through Telnet, QuickTools, Simple SAN Connection Manager, or Enterprise Fabric Management Suite. In addition, you must open a Config Edit session with the config edit command and indicate which configuration you want to modify. If you do not specify a configuration name, the active configuration is assumed. The Config Edit session provides access to the set config security command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> config edit SN6000 FC Switch (admin-config) #> set config security A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. FabricBindingEnabled (True / False) [False] AutoSave (True / False) [True ] Finished configuring attributes. This configuration must be saved (see config save command) and activated (see config activate command) before it can take effect. To discard this configuration use the config cancel command. SN6000 FC Switch (admin-config)#> config save SN6000 FC Switch (admin)#> config activate SN6000 FC Switch (admin)#> admin end

Modifying the security database To modify the security database: 1. Open an Admin session with the admin start command. SN6000 FC Switch #> admin start An Admin session prevents other accounts from making changes at the same time either through Telnet, QuickTools, Enterprise Fabric Management Suite, or Simple SAN Connection Manager. 2. To open a Security Edit session, enter the security edit command. The Security Edit session provides access to the securityset, group, and security commands used to make modifications to the security database. SN6000 FC Switch (admin) #> security edit SN6000 FC Switch (admin-security)#> securityset . . . SN6000 FC Switch (admin-security)#> group . . . SN6000 FC Switch (admin-security)#> security . . . 3. When you finish making changes, take one of the following actions: • To save the changes and close the Security Edit session, enter the security save command. SN6000 FC Switch (admin-security)#> security save • To close the Security Edit session without saving changes, enter the security cancel command. SN6000 FC Switch (admin-security)#> security cancel 4. To activate the changes to the active security set, enter the security activate command. SN6000 FC Switch (admin)#> security activate 5. To release the Admin session for other administrators, enter the admin end command. SN6000 FC Switch (admin)#> admin end Resetting the security database There are two ways to remove all groups and security sets from the security database: • Enter the security clear command, as shown in the following example: SN6000 FC Switch (admin-security) #> security clear All security information will be cleared. Please confirm (y/n): [n] y SN6000 FC Switch (admin-security) #> security save • Enter the reset security command, as shown in the following example. SN6000 FC Switch (admin) #> reset security The security configuration values, Autosave and FabricBindingEnabled, remain unchanged. Managing security sets All security set management tasks except Activating a security set, page 93 and Deactivating a security set, page 93 require a Security Edit session. Creating a security set To create a new security set, enter the securityset create command, as shown in the following example: SN6000 FC Switch (admin-security) #> securityset create securityset_1 Deleting a security set To delete a security set, enter the securityset delete command, as shown in the following example: SN6000 FC Switch (admin-security) #> securityset delete securityset_1 Renaming a security set To rename a security set. enter the securityset rename command, as shown in the following example: SN6000 FC Switch (admin-security) #> securityset rename securityset_old securityset_new

93 Copying a security set To copy a security set and its contents to a new security set, enter the securityset copy command, as shown in the following example: SN6000 FC Switch (admin-security) #> securityset copy securityset_1 securityset_2 Adding groups to a security set To add a group to a security set, enter the securityset add command, as shown in the following example: SN6000 FC Switch (admin-security) #> securityset add securityset_1 group_isl group_port Removing groups from a security set To remove groups from a security set, enter the securityset remove command, as shown in the following example: SN6000 FC Switch (admin-security) #> sescurityset remove securityset_1 group_isl group_port Activating a security set To apply security to the fabric, enter the securityset activate command, as shown in the following example: SN6000 FC Switch (admin) #> securityset activate securityset_1 Deactivating a security set To deactivate the active security set and disable security in the fabric, enter the securityset deactivate command, as shown in the following example: SN6000 FC Switch (admin) #> securityset deactivate Managing groups All group management tasks require an Admin session and a Security Edit session. Creating a group Creating a group involves specifying a group name and a group type. There are three types of groups: • ISL group—secures connected switches • Port group—secures connected devices • MS group—secures management server commands To create a new port group, enter the group create command, as shown in the following example: SN6000 FC Switch (admin-security) #> group create group_port port Deleting a group To delete group_port from the security database, enter the group delete command, as shown in the following example: SN6000 FC Switch (admin-security) #> group delete group_port Renaming a group To rename group_port to port_1, enter the group rename command, as shown in the following example: SN6000 FC Switch (admin-security) #> group rename group_port port_1 Copying a group To copy the contents of an existing group (group_port) to a new group (port_1), enter the group copy command, as shown in the following example: SN6000 FC Switch (admin-security) #> group copy group_port port_1

Adding members to a group Adding a member to a group involves specifying a group, the member worldwide name, and the member attributes. The member attributes define the authentication method, encryption method, secrets, and fabric binding, depending on the group type. • For ISL member attributes, see Table 8. • For Port member attributes, see Table 9. • For MS member attributes, see Table 10. To add a member to a group, enter the group add command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> security edit SN6000 FC Switch (admin-security) #> group add Group_1 A list of attributes with formatting and default values will follow Enter a new value or simply press the ENTER key to accept the current value with exception of the Group Member WWN field which is mandatory. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Group Name Group_1 Group Type ISL Member (WWN) [00:00:00:00:00:00:00:00] 10:00:00:c0:dd:00:90:a3 Authentication (None / Chap) [None ] chap PrimaryHash (MD5 / SHA-1) [MD5 ] PrimarySecret (32 hex or 16 ASCII char value) [ ] 0123456789abcdef SecondaryHash (MD5 / SHA-1 / None) [None ] SecondarySecret (40 hex or 20 ASCII char value) [ ] Binding (domain ID 1-239, 0=None) [0 ] Finished configuring attributes. To discard this configuration use the security cancel command. Modifying a group member Modifying a group member involves changing the member attributes. The member attributes define the authentication method, encryption methods, secrets, and fabric binding, depending on the group type. • For ISL member attributes, see Table 8. • For Port member attributes, see Table 9. • For MS member attributes, see Table 10. To change the attributes of a group member, enter the group edit command, as shown in the following example: SN6000 FC Switch #> admin start SN6000 FC Switch (admin) #> security edit SN6000 FC Switch (admin-security) #> group edit G1 10:00:00:c0:dd:00:90:a3 A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value.

95 If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. Group Name g1 Group Type ISL Group Member 10:00:00:c0:dd:00:90:a3 Authentication (None / Chap) [None] chap PrimaryHash (MD5 / SHA-1) [MD5 ] sha-1 PrimarySecret (40 hex or 20 ASCII char value) [ ] 12345678901234567890 SecondaryHash (MD5 / SHA-1 / None) [None] md5 SecondarySecret (32 hex or 16 ASCII char value) [ ] 1234567890123456 Binding (domain ID 1-239, 0=None) [3 ] Finished configuring attributes. To discard this configuration use the security cancel command. Removing members from a group To remove a member from a group, enter the group remove command, as shown in the following example: SN6000 FC Switch (admin-security) #> group remove group_1 10:00:00:c0:dd:00:90:a3

97 9 RADIUS Server Configuration Authentication can be performed locally using the switch’s security database, or remotely using a Remote Dial-In User Service (RADIUS) server such as Microsoft RADIUS. With a RADIUS server, the security database for the entire fabric resides on the server. In this way, the security database can be managed centrally, rather than on each switch. However, when using a RADIUS server, every switch in the fabric must have a network connection. You can configure up to five RADIUS servers to provide failover. You can configure a RADIUS server to authenticate only the switch or both the switch and the initiator device, if the device supports authentication. A RADIUS server can also be configured to authenticate user accounts. See ”User Account Configuration” (page 17). A secure connection is required to authenticate user logins with a RADIUS server. See ”Connection Security Configuration” (page 83). Displaying RADIUS server information To display RADIUS server information, enter the show setup radius command, as shown in the following example. For information about RADIUS server configuration parameters, see Table 47. SN6000 FC Switch #> show setup radius Radius Information ------------------ DeviceAuthOrder Local UserAuthOrder Local TotalServers 2 Server: 1 ServerIPAddress 10.0.0.13 ServerUDPPort 1812 DeviceAuthServer False UserAuthServer False AccountingServer False Timeout 2 Retries 0 SignPackets False Secret ******** Server: 2 ServerIPAddress bacd:1234:bacd:1234:bacd:1234:bacd:1234 ServerUDPPort 1812 DeviceAuthServer True UserAuthServer True AccountingServer True Timeout 2 Retries 0 SignPackets False Secret ********

Configuring a RADIUS server on the switch To configure a RADIUS server on the switch, enter the set setup radius command. There are two groups of RADIUS configuration parameters. One group of parameters is common to all RADIUS server configurations. The second group is server-specific. You can configure both groups of parameters for all RADIUS servers, or you can configure the common and server-specific parameters separately. See Table 47 and Table 48 for descriptions of the common and server-specific RADIUS configuration parameters. The following example configures the common RADIUS server configuration parameters: SN6000 FC Switch (admin) #> set setup radius common A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the attributes for the server being processed, press 'q' or 'Q' and the ENTER key to do so. If you wish to terminate the configuration process completely, press 'qq' or 'QQ' and the ENTER key to so do. PLEASE NOTE: ----------- * SSL must be enabled in order to configure RADIUS User Authentication SSL can be enabled using the 'set setup services' command. Current Values: DeviceAuthOrder Local UserAuthOrder Local TotalServers 1 New Value (press ENTER to not specify value, 'q' to quit): DeviceAuthOrder 1=Local, 2=Radius, 3=RadiusLocal : UserAuthOrder 1=Local, 2=Radius, 3=RadiusLocal : TotalServers decimal value, 0-5 : Do you want to save and activate this radius setup? (y/n): [n]

99 The following example configures RADIUS server 1: SN6000 FC Switch (admin) #> set setup radius server 1 A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the attributes for the server being processed, press 'q' or 'Q' and the ENTER key to do so. If you wish to terminate the configuration process completely, press 'qq' or 'QQ' and the ENTER key to so do. PLEASE NOTE: ----------- * SSL must be enabled in order to configure RADIUS User Authentication SSL can be enabled using the 'set setup services' command. Server 1 Current Values: ServerIPAddress 10.20.11.8 ServerUDPPort 1812 DeviceAuthServer True UserAuthServer True AccountingServer False Timeout 10 Retries 0 SignPackets False Secret ********** New Server 1 Value (press ENTER to accept current value, 'q' to skip): ServerIPAddress (hostname, IPv4, or IPv6 address) : ServerUDPPort (decimal value) : DeviceAuthServer (True / False) : UserAuthServer (True / False) : AccountingServer (True / False) : Timeout (decimal value, 1-30 secs) : Retries (decimal value, 1-3, 0=None) : SignPackets (True / False) : Secret (1-63 characters, recommend 22+) : Do you want to save and activate this radius setup? (y/n): [n]