Fibre Channel Specialist Lab

Transcription

1 Fibre Channel Specialist Lab SANbox FC Switch Command Line Interface (CLI) Allotted time for this lab: 75 minutes Objective: This lab exercise will demonstrate the operation of the CLI for configuration purposes and go through a process of gathering information to mitigate issues or assist Technical Support. Copyright 2009 QLogic Corporation All Rights Reserved

2 Table of Contents 1.0 Initial Configuration of a SANbox FC Switch Connection to the switch Setting System Parameters Setting SNMP Parameters Date / Time User Accounts Firmware Update Switch & Port Configuration Managing config files Backup / Restore Gathering Information Alarms Logs Command: create support Fabric-level Information Switch Configuration commands Port-level commands Blade-level commands (SANbox 9000 Director) Additional Configuration Features Zoning Security Appendix A: Tech Tips March Copyright 2009 QLogic Corporation

3 1.0 Initial Configuration of a SANbox FC Switch If equipped, the serial port connection will speed along the process of configuring the SANbox switch. By changing the IP Address of the switch through the serial port, you will not have to reconfigure an IP Address on a workstation, or wait for the Configuration Wizard during the powercycle of the switch. Directly out of the box, the SANbox switch may be configured from the Serial Port. Although the Configuration Wizard let allow you to initially configure your SANbox, if you are familiar with the Command Line Interface, it may actually prove faster to configure through the serial port. Changes to be made on the initial configuration IP Networking information (can be done via CLI or GUI) SNMP (CLI or GUI) Date and Time Settings (can be done via CLI or GUI) User Accounts created (CLI or GUI) Firmware at current level (CLI or GUI, Ethernet connection required for image upload) Switch Name (CLI or GUI. Requires editing config file in CLI) Port Configurations (CLI or GUI. Requires editing config file in CLI) Tech Tip 1 : CLI utilizes the Up ( ) and Down ( ) for command history and Tab for command completion. You can find previously used commands by using the Up arrow on the keyboard. When you have completed enough keystrokes for the switch to recognize the command, press the <tab> key to complete the command. Example: entering sy<tab> will complete system. March Copyright 2009 QLogic Corporation

4 1.1 Connection to the switch The lab server has a serial port connection to Switch_A. There is an icon on the Lab Server Desktop that reads, Serial. This will open an application called Tera Term that has been preinstalled and preconfigured on the system. Serial Port The settings for the serial port are shown at right. Connect the proper serial cable connections. Open communication program. Press Enter to get login prompt Ethernet Port Default IP Address is Change workstation address to communicate with x network. Use Crossover cable for direct connection Telnet to switch IP Address User Log In For the lab exercise we will use Telnet, as the switch has already has an IP Address in our network. 1. Open a terminal program on your workstation. Windows users have an icon called, Telnet 2. Using your lab schematic for the address, telnet to Switch_A of your lab area. 3. Login with a username/password of: admin/password 4. Type: admin start <return> You could also use the command admin begin This will put the user in Admin mode. This locks out all other Admin privileges to any other user, including EFS & QuickTools. 5. Test the admin lockout by opening QuickTools (or EFS) and attempt to take a port offline. You should receive an error in the GUI. March Copyright 2009 QLogic Corporation

5 6. Use these commands to clear alarms & logs: a. (admin) #> set alarm clear b. (admin) #> set log clear 1.2 Setting System Parameters IP Networking parameters are done through the command set setup system. Here are a list of parameters that are configured through this command: IPv4 Network Configuration IPv6 Network Configuration DNS Network Configuration NTP Network Configuration Logging Network Configuration Timer Configuration 7. At the (admin) prompt type: set setup system <enter> 8. Continue through the options without making any changes. Note 1: A complete listing of the parameters is shown in Appendix A of this lab document. Note 2: If you are connected via Ethernet, then you will lose your IP connection and have to log back in to the switch. As it is, you will lose admin privileges automatically. 1.3 Setting SNMP Parameters Note: There is no SNMP Management in the QLogic Lab area. Do not make changes. Simple Network Management Protocol (SNMP) settings are completed using the command set setup snmp. The switch can be configured to send SNMP traps to up to 5 different monitoring locations. Information regarding SNMP must be gathered from the administrators of the data center for configuration. Below are the parameters that can be configured: March Copyright 2009 QLogic Corporation

6 <Default> Values: SnmpEnabled True Contact <syscontact undefined> Location <syslocation undefined> ReadCommunity public WriteCommunity private AuthFailureTrap False ProxyEnabled True SNMPv3Enabled False Trap Configuration TrapxEnabled False TrapxAddress TrapxPort 162 TrapxSeverity warning TrapxVersion 2 TrapxCommunity public 1.4 Date / Time The date command displays the date and time. To change, enter date followed by the date/time string, which is formatted [MMDDhhmmCCYY]. Remember that CCYY actually means YYYY 9. You can verify the configured date just by entering #> date If the date or time is not correct; change it using the instructions above. For configuring NTP, use the set setup system ntp command. For configuring your Time Zone, use the set timezone command. 1.5 User Accounts There are several commands that will show user accounts and user sessions. 10. Enter the command, user list You are seeing the users that currently have active sessions in the switch. 11. Enter the command show users 12. Is this the same information? show users and user list are the same command March Copyright 2009 QLogic Corporation

7 13. Enter the command user accounts 14. What 2 accounts cannot be deleted from the switch? If you see additional accounts other than admin & images, these will be accounts that were created in earlier lab exercises. New User Account 15. Enter the command user add 16. Enter an account name. (your choice) 17. Enter and confirm a minimum 8 character password. (qlogic01) 18. Set account expiration to 3 days. 19. Give this account admin authority and confirm. 20. Enter the command from above that will show you the user accounts information. Testing User Accounts 21. Enter another user account that does not have admin authority. 22. Minimize the Telnet window. 23. On the desktop, there is another icon labeled, serial. This will open up a serial connection to Switch_A. 24. Log in using the user account that you created above that has admin authority. 25. Enter the command admin start (or admin begin) 26. Did this user account gain admin authority? 27. Enter the command admin cancel. Confirm with y 28. Did you get a log message? 29. Enter the command admin start (or admin begin) 30. Did you attain admin authority? 31. Minimize this window while still maintaining admin authority. 32. Bring up the Telnet session and enter set setup system. 33. Were you able to use this command? 34. Enter the command user list or show users to determine which session has the admin authority. 35. Do whatever is necessary to give admin authority to the user account admin. March Copyright 2009 QLogic Corporation

8 Tech Tip 2 : Only 1 user with admin authority is able to operate in a switch at any given time. If a CLI session has admin authority, a user in EFS or QuickTools will get a dialog box that states, Cannot obtain admin privilege on the error message. EFS and QuickTools only obtain admin authority while they are making changes to the switch, so there is no need for an admin time out when using the GUIs. 1.6 Firmware Update 36. Do a version check of the firmware on the switch by using either: a. show about b. show switch 37. Upgrade the firmware version on your switch using the procedures below. If your firmware has already been upgraded, use these procedures to downgrade and then upgrade the firmware. Part 1 FTP code to the switch 38. Make sure the code is available to your workstation, either on CD or loaded onto the hard drive. 39. Using the command line of your workstation s operating system, navigate to the directory in which the new firmware image is located. 40. Start an ftp session, usually with the following command: ftp <ip address of switch> 41. Login to the ftp server of the switch, using the username / password: images / images 42. At the ftp prompt, enter bin to start a binary transfer. 43. You may also enter hash to have the download progress displayed on the screen. 44. Use the ftp put command to put the filename into the switch s memory. Example: put <filename> 45. After the download is complete, you should close the ftp session by entering bye This places a compressed image of the firmware into the switch. This image must be unpacked and activated. Tech Tip 3 : Firmware images have a file extension to identify the type of CPU the switch is using. If the wrong firmware type is uploaded to the switch, it will not unpack nor install. _ipc = 14xx switches _mpc = 52xx & 56xx switches _epc = 58xx switches _ThCP = SANbox 9000 FC Switches March Copyright 2009 QLogic Corporation

9 Part 2 Unpack and Activate 46. Using telnet (or serial port), login to the switch. 47. Establish admin authority. 48. Enter image list to verify that there is a compressed image on the switch. 49. Uncompress the image from the (admin) prompt by entering image unpack <filename> The file will unpack to the area where the pending image was stored. 50. Activate the new firmware with one of the reset commands. a. hotreset: This command will perform the NDCLA operation. (Non Disruptive Code Load Activation). A stable fabric is required. b. reset: This command will reboot the switch (disruptive) while loading the new firmware. c. hardreset: This command will reboot the switch, run POST on all of the hardware and load the new firmware. 1.7 Switch & Port Configuration Switch and Port properties are changed in the CLI as part of a config file. You MUST have configuration authority to edit a config file. You can only get configuration authority from admin authority. Make sure that your prompt is: SANbox (admin) #> From the admin prompt, enter: >config edit Your prompt changed to: SANbox (admin-config) #> This tells you that you are in config edit mode. The first line you see will describe which config file you are now editing. March Copyright 2009 QLogic Corporation

10 Switch Configuration Switch information such as the Symbolic Switch Name and Domain ID are stored in a config file. 51. From the (admin-config) prompt, enter the command set config switch 52. While going through the settings, change the Domain ID of Switch_A to 99. The default values are shown in the box below. SANbox (admin-config) #> set config switch A list of attributes with formatting and current values will follow. Enter a new value or simply press the ENTER key to accept the current value. If you wish to terminate this process before reaching the end of the list press 'q' or 'Q' and the ENTER key to do so. AdminState (1=Online, 2=Offline, 3=Diagnostics) [Online ] BroadcastEnabled (True / False) [True ] InbandEnabled (True / False) [True ] FdmiEnabled (True / False) [True ] FdmiEntries (decimal value, ) [1000 ] DefaultDomainID (decimal value, 1-239) [1 ] DomainIDLock (True / False) [False ] SymbolicName (string, max=32 chars) [SANbox ] R_A_TOV (decimal value, msec) [10000 ] E_D_TOV (decimal value, msec) [2000 ] PrincipalPriority (decimal value, 1-255) [254 ] ConfigDescription (string, max=64 chars) [Default Config] Finished configuring attributes. This configureation must be saved (see config save command) and activated (see config activate command) before it can take effect. To discard this configuration use the config cancel command. SANbox (admin-config) #> March Copyright 2009 QLogic Corporation

11 Port Configuration All Ports 53. From (admin-config) prompt, enter the command set config ports Notice that ports is plural. Take a moment to read the opening paragraph above the AdminState parameter. This command will show Port 0, but apply all changes made to every port (except the stackable ports.) This will allow you to configure a single port and have those attributes apply to all device ports in the switch. These parameters will not include the port symbolic name. 54. Go through the settings without making any changes. 55. Enter set config port (without the s on the end) 56. When you find the selection, SymPortName change the entry to hbaa0 57. Accept the defaults for all settings for the port 0 by pressing <enter> for each setting. 58. What happened when you where done with the port 0 parameters? 59. Press q and <enter> without the quotes. What happened to the screen? 60. Press qq and <enter> without the quotes. That should remove you from the command. Single Port Configuration For this exercise, we will want to change the port properties as follows: Switch A Port # Type of Device Changes Port 0 HBA Port Type = F_Port Sym Name = hbaa0 I/O Stream Guard = Auto Port 6 JBOD Sym Name = jboda Finding the devices 1. Use the command: show ns to see the Name Server information on the switch. 2. Use the command: show port to see the operation of each port. This can be accomplished two ways. Both commands are shown below: >set config port # This will take you directly to the settings for port # March Copyright 2009 QLogic Corporation

12 >set config port This will start with the settings for port 0, then 1, etc. If you use this command, use qq command to quit the procedure after configuring port 7 (or the highest port # in use). 61. Using either command, make the changes shown in the table. Save Config 62. Save the configuration using a new filename config1. (admin-config) #> config save config1 63. Notice that you are now out of the config edit mode and the prompt has changed. 64. What authority level are you now? 65. Enter: (admin) #> config list This will list the configurations that are stored in the SANbox switch. 66. Besides the file that you just created, what is the other filename shown? There will always be a config file named, default. Activate a config 67. Activate the configuration that you just created: >config act config1 68. Type >y <enter> at the confirmation. Your configuration just became active. Tech Tip 4 : There are a couple of commands that can be shortened to save keystrokes. The activate command may be shortened to act, the deactivate command is deact, while the delete command may be del. All others must be completely spelled out. This is where command completion, <Tab> comes in handy. Verify the Activation 69. To verify your activation enter: #> show switch 70. What is the ActiveConfiguration? This should read, config1 71. Enter #> show port 72. What is the Config type of the HBA port (Port 0)? 73. What is the running port type of the JBOD port? The config type and running type of the HBA port is F, while on the JBOD port the config type is GL and the running type is FL. March Copyright 2009 QLogic Corporation

13 1.8 Managing config files Copy a config 74. Enter: >config list This gives a list of config files in the switch. 75. Enter: >config copy default newcopy You will get a message saying that the Configuration has been copied. 76. Enter in the command to verify that the copy is in the switch (or use the up arrow to select the command). 77. What command did you use? 78. Was the file copied? 79. Enter the following command to copy config1 to default. (admin) #> config copy config1 default 80. Were you successful? You cannot copy over an existing configuration. You can however, use the editing function to achieve this result. Continue through the next section, and you will make the config file config1 the default config. Editing a config Use the filename of the configuration that you activated earlier. 81. Enter: >config edit config1 This opens up a configuration editing session with the new filename 82. Did your prompt change? 83. Enter: (admin-config) #> config save default This replaced the default file with the config1 information. 84. Enter the command: (admin) #> config delete default 85. Press y to delete. Did the default config get deleted? Tech Tip 5 : The default config file cannot be deleted. Also, no named config file may be copied over. While this is good for a testing environment, as a best practice in a production environment, use only the default config file. If configuration is completed via the CLI, the default config file can be copied with the date & time it was activated, to have a backup stored on the switch. March Copyright 2009 QLogic Corporation

14 86. Activate the default config. What command did you use? 87. Verify that the default config is active. What command did you use? 88. Enter the command: #> show config port Does the port show the symbolic name that you entered earlier? If not, notify your instructor. 90. Delete the other config files on your switch by using the config delete <filename> command. 1.9 Backup / Restore Backing up a Config 91. Make sure that you are in admin mode and enter: (admin) #> config backup 92. Did you see anything happen? 93. Leave the telnet session open. Open a command prompt and change to the c:\qlogic directory of your system. 94. FTP to the switch. When using ftp, you will need to use the special password for working with the images on the switch. 95. What is the login and password that you use with FTP? / 96. Log in using images. When you see the prompt, enter: ftp> ls 97. Do you see a file name configdata? 98. Enter: ftp> get configdata Tech Tip 6 : The configdata file was created by the switch when you entered the config backup command. Each time you run this command, you will overwrite the configdata file on the switch. Make sure to get the configdata when you perform the config backup. 99. Close the FTP session with the bye command. Check the directory to see if the configdata file is on the workstation Go back to the open telnet session. Verify you are in admin mode. March Copyright 2009 QLogic Corporation

15 101. Use the following commands to change the Switch Symbolic Name a. (admin) #> config edit b. (admin-config) #> set config switch c. Change SymbolicName to MySwitch d. (admin-config) #> config save e. (admin) #> config act -- Press y <Enter> 102. Use the command, show switch or show about to verify that the Symbolic Name of the switch has changed. We will now restore the old configuration. Restore a config 103. Using FTP, put the configdata file that you saved onto the switch. You may close the ftp session Go back to your open telnet session. Make sure you are in admin mode Restore the configuration by entering the command: (admin) #> config restore 106. Did you have to reset the switch or was it done automatically? 107. During this reboot, the switch will run a full Power On Self Test (POST) Wait 2 minutes and log back into the switch from Telnet. If your serial port session is still open, you can watch the booting process of the switch What is the Symbolic Name of the switch? If your answer is something other than Switch_A, see your instructor Did the Restore work the way you thought it should? Congratulations!! You have completed most of the common configuration of the SANbox switch via the CLI. You may want to take a few minutes (or a break) to reflect on what you have done before continuing on with the lab exercise. The next section of the lab will allow you to explore the CLI commands and command structure, before you complete some zoning configurations. March Copyright 2009 QLogic Corporation

16 2.0 Gathering Information 2.1 Alarms 1. Enter the command, show alarm 2. Were any alarms returned? You may or may not have any entries. 2.2 Logs 3. Enter the command, show log 4. Were any log entries returned? 5. Note the format of the entries. This would be the same for the alarm messages. Here is an format of the messages: [#][Date][Type][MessageCode][Received From][Message] Tech Tip 7 : There is a document available from QLogic called the SANbox Switch Event Messages Guide. If you look up the Message Code in the guide, it will explain what the message is and what needs to be done to correct the issue. 2.3 Command: create support 6. Enter the command show support. 7. Did the information scroll off the screen? If you were connected via Ethernet, the information would have scrolled and outrun the buffers on the terminal program. Tech Tip 8 : It is not advisable to use the show support command via the serial connection. Due to the slower speed of the serial port, the user must press <enter> after each command is run. 8. Enter the command create support 9. Did you get a message saying this would take several seconds? The switch is capturing the show support command along with gathering engineering information from the switch and putting it in a file called dump_support.tgz. 10. After the file is created, were you prompted to FTP the file? If you had an FTP Server available, you could input the FTP information in the switch and it would ftp it off for you. For the lab exercise, we will manually retrieve this file. 11. Enter n <enter> You will return to the (admin) prompt. 12. Minimize the application and open a Command Prompt. March Copyright 2009 QLogic Corporation

17 Retrieve a File from the Switch 13. At the command prompt enter: cd c:\qlogic 14. Enter ftp <ip address Switch_A> 15. For the user enter images 16. For the password enter images 17. At the ftp> prompter enter ls 18. Is the dump_support.tgz file listed? 19. Enter bin 20. Enter get dump_support.tgz 21. Enter bye to close the FTP session. Review the Dump Support file 22. Using File Manager, navigate to c:\qlogic 23. Open and extract the dump_support.tgz until the files are listed. 24. Open the showsupport.txt file. This is the main file Technical Support will use. Spend a couple of minutes looking over the information in this file. For the rest of the 2.x portion of the lab, you can use the show support file, or just enter the commands shown to gather information about your fabric & switch. 2.4 Fabric-level Information 25. Command: show ns all Displays the Name Server information for the fabric. 26. Command: show fabric Displays the switches attached in the fabric and their Management Port information 27. Command: show lsdb Displays the Link State DataBase for the fabric 28. Command: show domains Displays the Principal switch and the Domain ID List 29. Command: show topology Displays the connections on each port of the switch 30. Command: show topology 19 Displays additional information regarding the topology on a specific port March Copyright 2009 QLogic Corporation

18 2.5 Switch Configuration commands 31. Command: date 32. Command: show timezone 33. Command: uptime 34. Command: show chassis Displays Temperature & Heartbeat status 35. Command: show about Banner information 36. Command: show switch More comprehensive than show about 37. Command: show config switch Switch parameters stored in the config file 38. Command: config list List of config files 39. Command: show setup mfg Hardware information from manufacturing setup 40. Command: show setup services 41. Command: show setup system IP Address information 42. Command: show setup snmp 43. Command: show interface Ethernet Mgmt Port operation 44. Command: feature log List of features licensed on the switch 45. Command: show users 46. Command: show users brief 47. Command: user accounts 48. Command: whoami 2.6 Port-level commands 49. Command: show port looking for E_Ports 50. Command: show port = E_Port 51. Command: show config port 19 Looking for non-default settings 52. Command: show config threshold Looking for what is enabled and the settings 53. Command: show donor In the rare instance of using buffer credits to extend distance. 54. Command: show ns <port id> Use to narrow down the Name Server information to a specific port. March Copyright 2009 QLogic Corporation

19 2.7 Blade-level commands (SANbox 9000 Director) All of the previous commands will work with the SANbox 9000 Director Switch. The commands shown here are specific to the SANbox 9000 which will be assigned to you later in the course. 55. Command: show config blade 56. Command: show blade 57. Command: show blade io# Where # is the slot the blade is installed 58. Command: show blade io# aux Displays the auxiliary ports for the I/O Blade 59. Command: show blade io# env Displays the temperature and voltage sensor information 60. Command: show blade io# temp Displays the temperature information only 61. Command: show blade io# leds Displays the status of the LED indicators for the specified blade 62. Command: show blade io# media 63. Command: show blade io# ports 64. Command: show blade cpu# Displays the information regarding CPU Blade (0 or 1) 65. Command: show blade cpu# aux Displays the auxiliary port information 66. Command: show blade cpu# env 67. Command: show blade cpu# leds 68. Command: show blade cpu# ports 69. Command: show blade ps# Displays the information regarding Power Supply Blade (0 or 1) 70. Command: show blade ps# leds 71. Command: show blade fan# Displays the information regarding Fan Blade (0 or 1) 72. Command: show blade fan# leds 73. Command: show blade mp Displays the information regarding Maintenance Panel 74. Command: show blade mp leds March Copyright 2009 QLogic Corporation

20 3.0 Additional Configuration 3.1 Features 1. Enter the command: feature log 2. Does this show the feature keys that have been entered through the various lab exercises? You should see all of the keys added during the course. 3. If an additional key is to be added through the CLI, use the command: feature add <feature key> The information regarding the feature key will be displayed. 4. Enter y <enter> to continue loading the key. 3.2 Zoning 1. Enter the command zoning list 2. Does this show that there is an Active Zoneset? 3. If so, then we will restore the zoning database to the beginning of class. Enter the command reset zoning. Confirm with y <enter> You have completed the lab exercise. Notify the instructor that you have reached zoning. Note: The rest of this lab exercise is optional. Start a zoning edit session 4. Enter:>admin start 5. This will give you admin authority, which you need before you can be granted permission to open a zoning edit session. 6. Enter: >zoning edit 7. This will open a session to create zoning. Similar to config edit with one exception. You will not be creating zoning filenames. March Copyright 2009 QLogic Corporation

21 Create Zone Set The command to create a zoneset is #> zoneset create <zonesetname> 8. Enter: >zoneset create clizs 9. Remember that names in zoning are case-sensitive Create Zones 10. Enter: >zone create red This will create a zone, but it is not included in a Zone Set at this time. We will be doing that later. 11. Enter: >zone create blue 12. Enter: >zone create green We have now created 3 zones, with no members. 13. Enter: >zoning list This command will show you what you have done up to this point. 14. Enter: #> zoneset list 15. Enter: #> zone list 16. Did you get the same information as #> zoning list? Adding Members to a zone The table below shows the format for adding a member to a zone. Command Member Type Format (Description) >zone add Port 1,0 (Domain ID, Port #) >zone add WWN 21:00:00:e0:8b:24:79:50 (Use Port WWN with colons) >zone add FC Address 0100c6 (Domain, Area, Port in hex) Port Member Example: >zone add <zonename> 1,0 1,1 1,2 3. This adds ports 0-2 of Domain ID 1 to the zone. WWN Member Example: >zone add <zonename> 21:00:00:e0:8b:24:79:50 4. This adds the WWN to the port. You may string these together. Fibre Channel Address Example: >zone add <zonename> This adds the Fibre Channel addresses for Domain 1, ports 0-2 to the zone March Copyright 2009 QLogic Corporation

22 17. Enter: >show ns This command will show the Name Server entries. This will allow you to enter the proper information for the zoning configuration. If you had multiple switches the command would be: #> show ns all 18. Enter: >zone add red (member) Use an unused port for the member. Example: If your Domain ID is 1, the format of the command would be: >zone add red 1,0 19. Add 3, other unused ports to the red zone, with 1 command. 20. Verify those members got added: > zone members red 21. Using the above commands, add the members to the zones as shown below: blue green HBA port and WWN of 2 drives on Switch_A HBA port and WWN of 2 drives on Switch_B Adding Zones to Zone Sets This is the command used to place the zones into the zonesets. 22. Enter: >zoneset add clizs red blue This format is shown as follows: >zoneset add [ZONESET] [ZONE] Save the Zoning Information 23. Enter: >zoning save You will get a message that zoning will take effect when activating and return you to the admin prompt. Check your zoning 24. Enter: >zoning list This will display the Zone Sets, Zones, and members that are configured. 25. If you were to activate your clizs zoneset, how many devices would your HBA see? March Copyright 2009 QLogic Corporation

23 Activate a Zone Set 26. Enter: >zoneset activate clizs This will activate the Zone Set with your server port and 2 disks by WWN. 27. Enter:>admin end This will end the admin session so that you can validate your zoning. 28. Enter: #> zoning list 29. What is the active Zoneset shown? 3.3 Security 30. Enter the command security list 31. Does this show that there is an Active SecuritySet? 32. If so, then we will restore the security database to the beginning of class. Enter the command reset security. Confirm with y <enter> Note: The rest of this lab exercise is optional. In this OPTIONAL part of the lab, you will create and activate a security set that will allow only one of your HBA Ports to attach as well as refuse an E-Port connect from your other switch. 33. If not already, log into the switch through the Command Line and start an admin session. 34. Determine the WWN of your switch: Switch WWN: (show about or show switch) 35. Determine the NODE WWN of your HBA connection in Port 0 (hint: show ns) HBA NodeWWN: 36. To start a Security Edit Session, type the following command: SANbox (admin) #> security edit 37. Your prompt should change to let you know you are in the Security Edit mode. 38. Create a new Security Set called classroom with the following command: SANbox (admin-security) #> securityset create classroom 39. Create a Security Group for ISL with the following: SANbox (admin-security) #> group create switches isl March Copyright 2009 QLogic Corporation

24 40. Add an entry into the switches group with the following command: SANbox (admin-security) #> group add switches 41. Enter the WWN of switch and press <enter> 42. Set the Authorization to none, press <enter> 43. Add the switches group to your securityset with the following command: SANbox (admin-security) #> securityset add classroom switches 44. Now create a Security Group for devices with the following command: SANbox (admin-security) #> group create devices port 45. Add the swtich to this group with the following: SANbox (admin-security) #> group add devices 46. Enter the WWN of switch and set the Authorization to none 47. Add the HBA to this group with the following: SANbox (admin-security) #> group add devices 48. Enter the NodeWWN for the one HBA and set the Authorization to none 49. Assign the group to the classroom securityset with the following command: SANbox (admin-security) #> securityset add classroom devices 50. Save your changes with: SANbox (admin-security) #> security save 51. Make sure you have one ISL group and one Devices group with: SANbox (admin-security) #> security list 52. When you are ready to activate your Security Set, use the following command: SANbox (admin-security) #> securityset activate classroom 53. How many error messages were generated? There should be multiple error messages, depending upon the ports activated. 54. Look at the error messages and compare to the bullet points below: Security Group ISL only has Switch_A WWN. This will cause any E_Port to isolate. Group Devices only allows the HBA to connect to Switch_A. This will cause the JBOD devices to report an Invalid Attach 55. Do these bullet points explain the error messages? If not, ask your instructor. You have reached the end of the lab exercise. Please enter the command reset security to clear the security database. End the admin session and logout of the switch. March Copyright 2009 QLogic Corporation

25 Appendix A: set setup system options/defaults Command: set setup system Note: Screen information altered to show only default values and no data entry. Items in Bold are available in QuickTools and EFS. SANbox (admin) #> set setup system IPv4 Network Configuration - may optionally use 'set setup system ipv4'command. <Default> Values: EthIPv4NetworkEnable True EthIPv4NetworkDiscovery Static EthIPv4NetworkAddress EthIPv4NetworkMask EthIPv4GatewayAddress IPv6 Network Configuration - may optionally use 'set setup system ipv6' command. A user may choose to retain the default settings for IPv6 and allow auto-configuration to assign an IPv6 address automatically. <Default> Values: EthIPv6NetworkEnable True EthIPv6Discovery Ndp EthIPv6NetworkAddress ::/64 EthIPv6GatewayAddress :: NTP Network Configuration - may optionally use 'set setup system ntp' command. <Default> Values: NTPClientEnabled False NTPServerDiscovery Static NTPServerAddress (continued) March Copyright 2009 QLogic Corporation

26 DNS Network Configuration - may optionally use 'set setup system dns' command. <Default> Values: DNSClientEnabled False DNSLocalHostname <undefined> DNSServerDiscovery Static DNSServer1Address <undefined> DNSServer2Address <undefined> DNSServer3Address <undefined> DNSSearchListDiscovery Static DNSSearchList1 <undefined> DNSSearchList2 <undefined> DNSSearchList3 <undefined> DNSSearchList4 <undefined> DNSSearchList5 <undefined> Logging Network Configuration - may optionally use 'set setup system logging' command. <Default> Values: LocalLogEnabled True RemoteLogEnabled False RemoteLogHostAddress Timer Configuration - may optionally use 'set setup system timers' command. <Default> Values: AdminTimeout 30 InactivityTimeout 0 Timer Configuration is ONLY available through the CLI on the switch. March Copyright 2009 QLogic Corporation

27 Appendix B: Tech Tips 1 Saving Keystrokes: CLI utilizes Up Arrow history and Tab completion features. You can find previously used commands by using the Up arrow on the keyboard. When you have completed enough keystrokes for the switch to recognize the command, then press the <tab> key to complete the command. Example: entering sy<tab> will complete system. 2 Admin Authority: Only 1 user with admin authority is able to operate in a switch at any given time. If a CLI session has admin authority, a user in EFS or QuickTools will get a dialog box that states, Cannot obtain admin privilege on the error message. EFS and QuickTools only obtain admin authority while they are making changes to the switch, so there is no need for an admin time out when using the GUIs. 3 Firmware images have a file extension to identify the type of CPU the switch is using. If the wrong firmware type is uploaded to the switch, it will not unpack nor install. _ipc = 14xx switches _mpc = 52xx & 56xx switches _epc = 58xx switches _ThCP = SANbox 9000 FC Switches 4 Saving Keystrokes (Part II): There are a couple of commands that can be shortened to save keystrokes. The activate command may be shortened to act while the delete command may be del. 5 The default config file cannot be deleted. Also, no named config file may be copied over. While this is good for a testing environment, as a best practice in a production environment, use only the default config file. If configuration is completed via the CLI, the default config file can be copied with the date & time it was activated, to have a backup stored on the switch. 6 configdata file: The configdata file is created on the switch using the config backup command. Each time this command is run, the existing configdata file is overwritten on the switch. The configdata file should be retrieved via FTP every time the config backup command is run. 7 Alarm and Log Message Decoding: There is a document available from QLogic called the SANbox Switch Event Messages Guide. If you look up the Message Code in the guide, it will explain what the message is and what needs to be done to correct the issue. 8 It is not advisable to use the show support command via the serial connection. Due to the slower speed of the serial port, the user must press <enter> after each command is run. March Copyright 2009 QLogic Corporation