Cisco DCNM SAN Client Online Help

SSL Certificate Requirements and Format

To limit access to the CIM server to authorized clients, you can enable the HTTPS transport protocol between the CIM server and client. On the switch side, you must install a Secure Socket Library (SSL) certificate generated on the client and enable the HTTPS server. Certificates may be generated using third-party tools, such as openssl (available for UNIX, Mac, and Windows), and may be certified by a CA or self-signed.

The SSL certificate that you install on the switch must meet the following requirements:

• The certificate file contains the certificate and the private key.
• The private key must be RSA type.
• The certificate file should be in Private Electronic Mail (PEM) style format and have .pem as the extension.

Only one certificate file can be installed at a time.

Fibre Channel Time-Out Values

You can modify Fibre Channel protocol related timer values for the switch by configuring the following time-out values (TOVs):

• Distributed services TOV (D_S_TOV)—The valid range is from 5,000 to 10,000 milliseconds. The default is 5,000 milliseconds.
• Error detect TOV (E_D_TOV)—The valid range is from 1,000 to 10,000 milliseconds. The default is 2,000 milliseconds. This value is matched with the other end during port initialization.
• Resource allocation TOV (R_A_TOV)—The valid range is from 5,000 to 10,000 milliseconds. The default is 10,000 milliseconds. This value is matched with the other end during port initialization.

Note The fabric stability TOV (F_S_TOV) constant cannot be configured.

About fctimer Distribution

You can enable per-VSAN fctimer fabric distribution for all Cisco MDS switches in the fabric. When you perform fctimer configurations, and distribution is enabled, that configuration is distributed to all the switches in the fabric.

You automatically acquire a fabric-wide lock when you issue the first configuration command after you enabled distribution in a switch. The fctimer application uses the effective and pending database model to store or commit the commands based on your configuration.

Refer to the Cisco MDS 9000 Family NX-OS System Management Configuration Guide for more information on the CFS application.

Fabric Lock Override

If you have performed a fctimer fabric task and have forgotten to release the lock by either committing or discarding the changes, an administrator can release the lock from any switch in the fabric. If the administrator performs this task, your changes to the pending database are discarded and the fabric lock is released.

Tip The changes are only available in the volatile directory and are subject to being discarded if the switch is restarted.

World Wide Names

The world wide name (WWN) in the switch is equivalent to the Ethernet MAC address. As with the MAC address, you must uniquely associate the WWN to a single device. The principal switch selection and the allocation of domain IDs rely on the WWN. The WWN manager, a process-level manager residing on the switch’s supervisor module, assigns WWNs to each switch.

Cisco MDS 9000 Family switches support three network address authority (NAA) address formats (see Table 27-1 ).

Link Initialization WWN Usage

Exchange Link Protocol (ELP) and Exchange Fabric Protocol (EFP) use WWNs during link initialization. The usage details differ based on the Cisco NX-OS software release.

Both ELPs and EFPs use the VSAN WWN by default during link initialization. However, the ELP usage changes based on the peer switch’s usage:

• If the peer switch ELP uses the switch WWN, then the local switch also uses the switch WWN.
• If the peer switch ELP uses the VSAN WWN, then the local switch also uses the VSAN WWN.

Note As of Cisco SAN-OS Release 2.0(2b), the ELP is enhanced to be compliant with FC-SW-3.

FC ID Allocation for HBAs

Fibre Channel standards require a unique FC ID to be allocated to an N port attached to a Fx port in any switch. To conserve the number of FC IDs used, Cisco MDS 9000 Family switches use a special allocation scheme.

Some HBAs do not discover targets that have FC IDs with the same domain and area. Prior to Cisco SAN-OS Release 2.0(1b), the Cisco SAN-OS software maintained a list of tested company IDs that do not exhibit this behavior. These HBAs were allocated with single FC IDs, and for others a full area was allocated.

The FC ID allocation scheme available in Release 1.3 and earlier, allocates a full area to these HBAs. This allocation isolates them to that area and are listed with their pWWN during a fabric login. The allocated FC IDs are cached persistently and are still available in Cisco SAN-OS Release 2.0(1b) (see the “FC ID Allocation for HBAs” section).

To allow further scalability for switches with numerous ports, the Cisco NX-OS software maintains a list of HBAs exhibiting this behavior. Each HBA is identified by its company ID (also known known as Organizational Unique Identifier, or OUI) used in the pWWN during a fabric login. A full area is allocated to the N ports with company IDs that are listed, and for the others a single FC ID is allocated. Regardless of the kind (whole area or single) of FC ID allocated, the FC ID entries remain persistent.

Default Company ID List

All switches in the Cisco MDS 9000 Family that ship with Cisco SAN-OS Release 2.0(1b) or later, or NX-OS 4.1(1) contain a default list of company IDs that require area allocation. Using the company ID reduces the number of configured persistent FC ID entries. You can configure or modify these entries using the CLI.

The list of company IDs have the following characteristics:

• A persistent FC ID configuration always takes precedence over the list of company IDs. Even if the company ID is configured to receive an area, the persistent FC ID configuration results in the allocation of a single FC ID.
• New company IDs added to subsequent releases are automatically added to existing company IDs.
• The list of company IDs is saved as part of the running and saved configuration.
• The list of company IDs is used only when the fcinterop FC ID allocation scheme is in auto mode. By default, the interop FC ID allocation is set to auto, unless changed.

Tip We recommend that you set the fcinterop FC ID allocation scheme to auto and use the company ID list and persistent FC ID configuration to manipulate the FC ID device allocation.

Switch Interoperability

Interoperability enables the products of multiple vendors to interact with each other. Fibre Channel standards guide vendors towards common external Fibre Channel interfaces.

If all vendors followed the standards in the same manner, then interconnecting different products would become a trivial exercise. However, not all vendors follow the standards in the same way, thus resulting in interoperability modes. This section briefly explains the basic concepts of these modes.

Each vendor has a regular mode and an equivalent interoperability mode, which specifically turns off advanced or proprietary features and provides the product with a more amiable standards-compliant implementation.

Note For more information on configuring interoperability for the Cisco MDS 9000 Family switches, refer to the Cisco MDS 9000 Family Switch-to-Switch Interoperability Configuration Guide.

About Interop Mode

Cisco NX-OS software supports the following four interop modes:

• Mode 1— Standards based interop mode that requires all other vendors in the fabric to be in interop mode.
• Mode 2—Brocade native mode (Core PID 0).
• Mode 3—Brocade native mode (Core PID 1).
• Mode 4—McData native mode.

For information about configuring interop modes 2, 3, and 4, refer to the Cisco MDS 9000 Family Switch-to-Switch Interoperability Configuration Guide .

Table 27-2 lists the changes in switch behavior when you enable interoperability mode. These changes are specific to switches in the Cisco MDS 9000 Family while in interop mode.

Installing an SSL Certificate for the CIM Server

To install a conforming SSL certificate for the CIM server, follow these steps:

Configuring the Transport Protocol for the CIM Server

The default transport protocol for the CIM server is HTTP. This protocol uses the wbem-http port (TCP port 5988). HTTPS for CIM uses the wbem-https port (TCP port 5989).

To configure the CIM server to use only the HTTPS protocol, follow these steps:

Enabling the CIM Server

The CIM server is disabled in all switches in the Cisco MDS 9000 Family by default. To use the CIM server, you must explicitly enable it on the required switches in the fabric.

To enable the CIM server, follow these steps:

Task Flow for Configuring Time Across All VSANs

Follow these steps to configure time across all VSANs:

Step 1 Configure the timer per-VSAN.

Step 2 Enable the fctimer distribution.

Step 3 Make the required configuration changes and committ the fctimer changes.

Step 4 Discard the changes if you choose to discard the configuration changes.

Configuring Timer Per-VSAN

You can also issue the fctimer for a specified VSAN to configure different TOV values for VSANs with special links like FC or IP tunnels. You can configure different E_D_TOV, R_A_TOV, and D_S_TOV values for individual VSANs. Active VSANs are suspended and activated when their timer values are changed.

Note This configuration must be propagated to all switches in the fabric—be sure to configure the same value in all switches in the fabric.

If a switch is downgraded to Cisco MDS SAN-OS Release 1.2 or 1.1 after the timer is configured for a VSAN, an error message is issued to warn against strict incompatibilities. Refer to the Cisco MDS 9000 Family Troubleshooting Guide .

To configure per-VSAN Fiber Channel timers, follow these steps:

To configure per-VSAN Fiber Channel timers using Device Manager, follow these steps:

Step 1 Click FC > Advanced > VSAN Timers.

You see the VSANs Timer dialog box.

Step 2 Fill in the timer values that you want to configure.

Step 3 Click Apply to save these changes.

Enabling fctimer Distribution

To enable or disable fctimer fabric distribution, follow these steps:

To enable and distribute fctimer configuration changes using Device Manager, follow these steps:

Step 1 Choose FC > Advanced > VSAN Timers.

You see the VSANs Timer dialog box.

Step 2 Fill in the timer values that you want to configure.

Step 3 Click Apply to save these changes.

Step 4 Select commit from the CFS drop-down menu to distribute these changes or select abort from the CFS drop-down menu to discard any unsaved changes.

Committing fctimer Changes

When you commit the fctimer configuration changes, the effective database is overwritten by the configuration changes in the pending database and all the switches in the fabric receive the same configuration. When you commit the fctimer configuration changes without implementing the session feature, the fctimer configurations are distributed to all the switches in the physical fabric.

To commit the fctimer configuration changes, follow these steps:

Discarding fctimer Changes

After making the configuration changes, you can choose to discard the changes by discarding the changes instead of committing them. In either case, the lock is released.

To discard the fctimer configuration changes, follow these steps:

Configuring a Secondary MAC Address

To allocate secondary MAC addresses, follow these steps:

To allocate secondary MAC addresses using Device Manager, follow these steps:

Step 1 Choose FC > Advanced > WWN Manager.

You see the list of allocated WWNs.

Step 2 Supply the BaseMacAddress and MacAddressRange fields.

Step 3 Click Apply to save these changes, or click Close to discard any unsaved changes.

Allocation Company IDs

Use the fcinterop FCID allocation auto command to change the FC ID allocation and the show running-config command to view the currently allocated mode.

• When you issue a write erase , the list inherits the default list of company IDs shipped with a relevant release.

To allocate company IDs, follow these steps:

Configuring Interop Mode 1

The interop mode1 in Cisco MDS 9000 Family switches can be enabled disruptively or nondisruptively.

Note Brocade’s msplmgmtdeactivate command must explicitly be run prior to connecting from a Brocade switch to either Cisco MDS 9000 Family switches or to McData switches. This command uses Brocade proprietary frames to exchange platform information, which Cisco MDS 9000 Family switches or McData switches do not understand. Rejecting these frames causes the common E ports to become isolated.

To configure interop mode 1 in any switch in the Cisco MDS 9000 Family, follow these steps:

Step 1 Place the VSAN of the E ports that connect to the OEM switch in interoperability mode.

Note You cannot enable interop modes on FICON-enabled VSANs.

Step 2 Assign a domain ID in the range of 97 (0x61) through 127 (0x7F).

Note This is an limitation imposed by the McData switches.

In Cisco MDS 9000 switches, the default is to request an ID from the principal switch. If the preferred option is used, Cisco MDS 9000 switches request a specific ID, but still join the fabric if the principal switch assigns a different ID. If the static option is used, the Cisco MDS 9000 switches do not join the fabric unless the principal switch agrees and assigns the requested ID.

Note When changing the domain ID, the FC IDs assigned to N ports also change.

Step 3 Change the Fibre Channel timers (if they have been changed from the system defaults).

Note The Cisco MDS 9000, Brocade, and McData FC Error Detect (ED_TOV) and Resource Allocation (RA_TOV) timers default to the same values. They can be changed if needed. The RA_TOV default is 10 seconds, and the ED_TOV default is 2 seconds. Per the FC-SW2 standard, these values must be the same on each switch within the fabric.

Step 4 When making changes to the domain, you may or may not need to restart the Cisco MDS domain manager function for the altered VSAN.

• Force a fabric reconfiguration with the disruptive option.

or

• Do not force a fabric reconfiguration.

To configure interop mode 1 for a VSAN, follow these steps:

Step 1 Choose VSANxxx > VSAN Attributes from the Logical Domains pane.

Step 2 Select Interop-1 from the Interop drop-down menu.

Step 3 Click Apply Changes to save this interop mode.

Step 4 Expand VSANxxx and then select Domain Manager from the Logical Domains pane.

You see the Domain Manager configuration in the Information pane.

Step 5 Set the Domain ID in the range of 97 (0x61) through 127 (0x7F).

a. Click the Configuration tab.

b. Click in the Configure Domain ID column under the Configuration tab.

c. Click the Running tab and check that the change has been made.

Note This is a limitation imposed by the McData switches.

Note When changing the domain ID, the FC IDs assigned to N ports also change.

Step 6 Change the Fibre Channel timers (if they have been changed from the system defaults).

Note The Cisco MDS 9000, Brocade, and McData FC error detect (ED_TOV) and resource allocation (RA_TOV) timers default to the same values. They can be changed if needed. The RA_TOV default is 10 seconds, and the ED_TOV default is 2 seconds. Per the FC-SW2 standard, these values must be the same on each switch within the fabric.

a. Expand Switches > FC Services, and then select Timers and Policies. You see the timer settings in the Information pane.

b. Click Change Timeouts to modify the time-out values.

c. Click Apply to save the new time-out values.

Step 7 (Optional) Choose VSANxxx > Domain Manager> Configuration and select disruptive or nonDisruptive in the Restart column to restart the domain.

Verifying the Company ID Configuration

You can view the configured company IDs by issuing the show fcid-allocation area command (see Example 27-1). Default entries are listed first and the user-added entries are listed next. Entries are listed even if they were part of the default list and you later removed them.

Example 27-1 Displays the List of Default and Configured Company IDs

To view the configured company IDs using Device Manager, choose FC > Advanced > FcId Area Allocation.

You can implicitly derive the default entries shipped with a specific release by combining the list of company IDs displayed without any identification with the list of deleted entries.

Some WWN formats do not support company IDs. In these cases, you may need to configure the FC ID persistent entry.

You can also view or obtain the company IDs in a specific WWN by issuing the show fcid-allocation company-id-from-wwn command (see Example 27-2). Some WWN formats do not support company IDs. In these cases, you many need to configure the FC ID persistent entry.

Example 27-2 Displays the Company ID for the Specified WWN

Verifying Interoperating Status

This section highlights the commands steps used to verify if the fabric is up and running in interoperability mode.

To verify the resulting status of issuing the interoperability command in any switch in the Cisco MDS 9000 Family, follow these steps:

Step 1 Use the show version command to verify the version.

Step 2 Use the show interface brief command to verify if the interface states are as required by your configuration.

Step 3 Use the show run command to verify if you are running the desired configuration.

Step 4 Use the show vsan command to verify if the interoperability mode is active.

Step 5 Use the show fcdomain vsan command to verify the domain ID.

Step 6 Use the show fcdomain domain-list vsan command to verify the local principal switch status.

Step 7 Use the show fspf internal route vsan command to verify the next hop and destination for the switch.

Step 8 Use the show fcns data vsan command to verify the name server information.

Note The Cisco MDS name server shows both local and remote entries, and does not time out the entries.

To verify the interoperability status of any switch in the Cisco MDS 9000 Family using DCNM for SAN, follow these steps:

Step 1 Choose Switches in the Physical Attributes pane and check the release number in the Information pane to verify the Cisco NX-OS release.

Step 2 Expand Switches > Interfaces, and then select FC Physical to verify the interface modes for each switch.

Step 3 Expand Fabricxx in the Logical Domains pane and then select All VSANs to verify the interop mode for all VSANs.

Step 4 Expand Fabricxx > All VSANs and then select Domain Manager to verify the domain IDs, local, and principal sWWNs for all VSANs.

Step 5 Using Device Manager, choose FC > Name Server to verify the name server information.

You see the Name Server dialog box.

Step 6 Click Close to close the dialog box.

Displaying CIM Information

To display CIM information, use the show cimserver command (see Example 27-3 through Example 27-13).

Example 27-3 Displays CIM Server Status

Example 27-4 Displays the CIM Server HTTPS Status

Example 27-5 Displays the CIM Server HTTP Status

Example 27-6 Displays CIM Server Indication

Example 27-7 Displays CIM Server Indication Filters

Example 27-8 Displays CIM Server Indication Recipients

Example 27-9 Displays CIM Server Indication Subscriptions

Example 27-10 Displays the CIM Server Configuration

Example 27-11 Displays CIM Server Logs

Example 27-12 Configuring CIM Server Loglevel

Example 27-13 Displays CIM Server Certificate Files

Displaying Configured fctimer Values

Use the show fctimer command to display the configured fctimer values (see Examples 27-14 and 27-15 ).

Example 27-14 Displays Configured Global TOVs

Note The F_S_TOV constant, though not configured, is displayed in the output of the show fctimer command.

Example 27-15 Displays Configured TOVs for a Specified VSAN

Displaying WWN Information

Use the show wwn commands to display the status of the WWN configuration. See Examples 27-16 to 27-18 .

Example 27-16 Displays the Status of All WWNs

Example 27-17 Displays Specified Block ID Information

Example 27-18 Displays the WWN for a Specific Switch

To display WWN information using Device Manager, choose FC > Advanced > WWN Manager. You see the list of allocated WWNs.

Related Document

Standards

RFCs

MIBs