Cisco Technology, Inc.

Claudio Desanti

Fabio Rodolfo Maino

Marco Di Benedetto

Silvano Gai

Dinesh Ganapathy Dutt

Dante Malagrino

Thomas James Edsall

Maurilio Cometto

John F Wakerly

Sachin Jain

Davide Bergamasco

Andrea Baldini

Marco Dibenedetto

Methods and apparatus are provided for improving both node-based and message-based security in a fiber channel network. Entity to entity authentication and key exchange services can be included in existing initialization messages used for introducing fiber channel network entities into a fiber channel fabric, or with specific messages exchanged over an already initialized communication channel. Both per-message authentication and encryption mechanisms can be activated using the authentication and key exchange services. Messages passed between fiber channel network entities can be encrypted and authenticated using information provided during the authentication sequence. Security services such as per-message authentication, confidentiality, integrity protection, and anti-replay protection can be implemented.

Methods and apparatus for security over fibre channel

Techniques are provided for performing discovery in a Fiber Channel over Ethernet (FCoE) network. An FCoE Node (ENode) discovers the FCoE Forwarders (FCFs) connected to its network segment by transmitting a solicitation message to the multicast MAC address 'All-FCF-MACs'. All FCFs receive packets with this multicast MAC address including the solicitation message that announces the presence of the ENode. Each FCF replies with a unicast advertisement message that provides the ENode with a MAC address of the responding FCF. The ENode builds a list of the FCFs available on its network segment and may then establish a virtual link with one or more of the FCFs through a Fabric Login (FLOGI) exchange.

Discovery for fibre channel over ethernet devices

Methods and apparatus for implementing an access list key for accessing information associated with a packet from an access list are disclosed. The packet includes an IP source address field and an IP destination address field, the IP source address field including an IP source address and the IP destination address field including an IP destination address, the IP source address and the IP destination address each having a number of bits (e.g., 128 bits in the case of IPv6). An IP source address is obtained from the IP source address field of the packet and an IP destination address is obtained from the IP destination address field of the packet. A modified IP source address is generated from the obtained IP source address such that the number of bits in the modified IP source address is less than the number of bits in the obtained IP source address. In addition, a modified IP destination address is generated from the obtained IP destination address such that the number of bits in the modified IP destination address is less than the number of bits in the obtained IP destination address. The access list key is then composed from the modified IP source address and the modified IP destination address.

Access list key compression

Techniques are provided for performing discovery in a Fiber Channel over Ethernet (FCoE) network. An FCF discovers other FCoE Forwarders (FCFs) connected to its network segment by transmitting a solicitation message to the multicast MAC address 'All-FCF-MACs'. All FCFs receive packets with this multicast MAC address including the solicitation message that announces the presence of the FCF. Each FCF replies with a unicast advertisement message that provides the new FCF with a MAC address of the responding FCF. The FCF builds a list of the FCFs available on its network segment and may then establish a virtual link with one or more of the FCFs through an exchange link parameter (ELP) exchange.

An apparatus and method for a Generic Service locking mechanism that enables a Host to lock the Fibre Channel Switching Fabric of a storage area network while applying changes across the Switching Fabric of the network is disclosed. The apparatus includes a network interface configured to send and receive Fibre Channel frames across the Fabric, a session element, responsive to the network interface, and configured to establish sessions with the Fabric; and a locking element configured issue commands to establish a lock over the Fabric so that replicated information across the Fabric can be consistently updated when the session element establishes a session with the Fabric. In one embodiment of the invention, the network interface, session element and the locking element are all implemented on each Switch of the Fabric.

Apparatus and method for a generic service locking mechanism for a fibre channel switching fabric of a storage area network

A reliable asymmetric method for distributing security information within a Fiber Channel Fabric. The Switching Fabric includes a set of security servers, which maintain among themselves a replicated copy of the Fabric security databases using the currently defined Merge and Change protocols. The other Switches of the Fabric are configured as client-Switches. They maintain only the subset of the authorization and authentication information required for their correct operation. A client-Switch queries the security server when a new end-device is connected to it, or when it is connected to the Fabric. When the security configuration of the Fabric changes by an administrative action, a security server solicits the client-Switches to update their information. In an alternative embodiment, the end-devices may query directly the security server, usually for authentication purposes. A Fabric with a plurality of security servers balances among them the load of inquiries from clients, and is more reliable because it continues to operate in the event of failure of one or more servers. Reliability is achieved in a stateless manner through the FSPF protocol, the Fiber Channel routing protocol. Each security server announces itself to the Fabric by advertising an adjacency to a predefined virtual Domain_ID in its FSPF LSRs. Clients access servers by directing queries to this virtual Domain_ID.

Method and apparatus for reliably and asymmetrically distributing security information within a fibre channel fabric

A storage area network and method for defining a static Fibre Channel Fabric that does not require a Principal Switch. The storage area network comprises one or more hosts, one or more storage devices, and a static Fabric connecting the one or more hosts and storage devices. Within the static Fabric, the Switches have their Domain_ID and Fabric_Name statically set. The method comprises accessing the Fabric, selecting a Switch in the Fabric, and statically configuring the Domain_ID and Fabric_Name for the selected Switch. The above sequence is repeated for each Switch in the static Fabric. In one embodiment, after being statically configured, the Switch is isolated from any dynamically set Switches in the Fabric. The Switch detects which of its Ports are connected to dynamically set Switches, and then isolates them, while maintaining operational the Ports connected to statically configured Switches.

Apparatus and method for defining a static fibre channel fabric

Methods and apparatus are provided for improving both node-based and message-based security in a fibre channel network. Entity to entity authentication and key exchange services can be included in existing initialization messages used for introducing fibre channel network entities into a fibre channel fabric, or with specific messages exchanged over an already initialized communication channel. Both per-message authentication and encryption mechanisms can be activated using the authentication and key exchange services. Messages passed between fibre channel network entities can be encrypted and authenticated using information provided during the authentication sequence. Security services such as per-message authentication, confidentiality, integrity protection, and anti-replay protection can be implemented.

A method and apparatus for encapsulating long messages over limited Fiber Channel ELSs. The method includes ascertaining if the authentication message has a length that exceeds the message length supported by the device with which communication is sought, and either: fragmenting the authentication message into message fragments if the length of the message exceeds the message length supported by that particular device and sequentially sending the message fragments one by one; or sending the authentication message in its entirety if the length of the authentication message is less than the message length supported by that particular device. When the message is fragmented, a fragmentation bit in the message fragment is set except for the last message fragment. The set fragmentation bit indicates that subsequent fragments are to be sent. The fragmentation bit of the last fragment is reset to indicate that it is the last fragment in the authentication message. This fragmentation method enables initiating and target entities implementing a limited form of ELSs to send long authentication messages to one another in a Fiber Channel Switching Fabric.

Method and apparatus for encapsulating long messages over limited fibre channel extended link service

An apparatus and method for preventing the disruption of Fibre Channel Fabrics caused by ReConfigure Fabric (RCF) messages is disclosed. The apparatus includes a storage area network and a plurality of Fibre Channel Switches arranged in a Fabric. Each of the plurality of Switches includes logic to selectively configure their Ports to either reject or accept RCF messages. When configured to reject RCF messages, the Switch Port that receives an RCF message will generate a reject message along with a reason code explanation 'E_Port Isolated', and then transition into an Isolated state. When the Switch that generated the RCF message receives the reject message, its Port also transition into the Isolated state. In accordance with the method of the present invention, either a Storage Service Provider or a client can access the Switches of the Fabric through either a command line interpreter or a management application. Once access to the Fabric is established, the logic of the Ports of the Switches can be selectively configured to reject or accept RCF messages as described above.

Apparatus and method for preventing disruption of fibre channel fabrics caused by reconfigure fabric (RCF) messages

An apparatus and method for preventing the disruption of Fiber Channel Fabrics caused by ReConfigure Fabric (RCF) messages is disclosed. The apparatus includes a storage area network and a plurality of Fiber Channel Switches arranged in a Fabric. Each of the plurality of Switches includes logic to selectively configure their Ports to either reject or accept RCF messages. When configured to reject RCF messages, the Switch Port that receives an RCF message will generate a reject message along with a reason code explanation 'E_Port Isolated', and then transition into an Isolated state. When the Switch that generated the RCF message receives the reject message, its Port also transition into the Isolated state. In accordance with the method of the present invention, either a Storage Service Provider or a client can access the Switches of the Fabric through either a command line interpreter or a management application. Once access to the Fabric is established, the logic of the Ports of the Switches can be selectively configured to reject or accept RCF messages as described above.

Apparatus and method for preventing disruption of fibre channel fabrics caused by ReConfigure Fabric (RCF) messages

A system and method maps Virtual Local Area Network (VLAN) designations to Internet Protocol version 6 (IPv6) site identifiers (IDs), and embeds site IDs into scoped internet addresses in such a way as to facilitate processing by primarily hardware-oriented forwarding tables. A router has a plurality of interfaces for receiving and forwarding packets, and a route processor for making forwarding decisions for received packets. The route processor includes a routing engine, a routing table, a forwarding information base (FIB), a VLAN store and a site ID store. At least some of the router's interfaces are associated with corresponding VLAN IDs, and the site ID store is preconfigured with a mapping of VLAN IDs to site IDs. For IPv6 packets with link-local unicast destination addresses, embedding the VLAN ID associated with the inbound interface into the address, while for packets with site-local unicast destination addresses, using the retrieved VLAN ID as an index to obtain the corresponding site ID, which is then embedded into the address. The modified destination address is then applied to the FIB, which is a forwarding table optimized to permit fast lookups, to derive the outbound interface from which the packet is to be forwarded to reach the destination entity.

Growing community of inventors

San Jose, CA, United States of America

Claudio Desanti