COMPANY X PROOF-OF- CONCEPT LAB FOR THE DELL M1000E CHASSIS

Transcription

1 COMPANY X PROOF-OF- CONCEPT LAB FOR THE DELL M1000E CHASSIS Victor Lama DELL Network Sales Engineer Banking and Securities v April 2012 This document focuses on deploying the Dell M8428-k FCoE blade switch module for the Dell PowerEdge M1000e blade chassis. It contains a high-level overview of Fibre Channel-over-Ethernet technology and product information, as well as a detailed presentation of the architecture, design and configuration of the networking components of the COMPANY X PoC lab.

2 About This Paper The purpose of this paper is to document the architectural, design and configuration details of a Proofof-Concept Lab that was created at a Dell client site. The client name has been replaced with Company X for privacy purposes. Since the PoC is an ongoing evolution, this document will be periodically updated with new and useful information. Part I details all the work that was done to get the basic lab infrastructure online and ready for executing a test plan. Although the requirements from one PoC to another will vary, the reader will become familiar with the necessary building blocks and apply that information to other scenarios as necessary. Part II begins at the point after the initial lab setup is complete. As new requirements surface and new tasks are performed to support those requirements, this document will be updated for edification purposes. Document Revisions 9 Jul 2011 v1.1 Information was added regarding Monitor session capabilities on the M8428-k. 15 Nov 2011 v1.2 Added configcommit command and non-port-channel scenario 15 Feb 2012 v1.3 Added Device Management and Security Configurations under FC Section 25 Apr 2012 v1.4 Added Accessing the Blade Switch Modules section

3 Introducing the Dell M8428-k Fibre Channel-over-Ethernet Switch What it is and How it Works The Dell M8428-k is a 10 Gigabit converged Ethernet (10GbE) switch module for the Dell TM PowerEdge TM M1000e modular blade enclosure. It offers 600 ns ultra-low-latency, wire-speed, cut-through 10GbE performance, IP Ethernet and Fibre Channel over Ethernet (FCoE) switching, and low-latency 8G Fibre Channel (FC) switching and connectivity. It is a Fibre Channel over Ethernet Forwarder (FCoE Forwarder or FCF) and is in full compliance with the INCITS T11 BB5 FCoE standard. Unlike legacy IP Ethernet switches, that run only one protocol stack (TCP/IP), the Dell M8428-k converged switch is able to execute complex control and data plane operations for three separate protocol stacks at once: TCP/IP, FCoE and FC. From an operational perspective, it means that the Dell M8428-k has the protocol intelligence to receive, process, and forward both IP and FC frames. From a hardware I/O perspective, this means that separate Ethernet and FC switches and adapters are no longer needed. Instead, 10G Ethernet and 8G FC adapters can now be replaced by a unified network adapter known as a Converged Network Adapter (CNA). Furthermore, the Ethernet and Fibre Channel switching modules can now be replaced by a single multi-protocol, unified switching element: the Dell M8428-k converged switch. The obvious benefit of doing this is hardware and cable consolidation, reduced power consumption and reduced cooling requirements. Figure 1 - Hardware Consolidation with the Dell M8428-k

4 Dell M8428-k Interfaces The Dell M8428-k converged switch has sixteen internal auto-sensing 1/10G Converged Enhanced Ethernet-enabled (CEE) interfaces, eight external CEE-enabled 10G interfaces and four external native FC ports that can auto sense to 2, 4 or 8Gbps full duplex speeds. Each internal port on the Dell M8428-k connects to a port on a CNA via the midplane of the Dell M1000e chassis using 10GBase-KR (KR) technology. The chassis can support sixteen half-height or eight fullheight server blades, which explains why there are sixteen internal ports on the switches. Each internal port can be configured as a legacy access or 802.1Q trunk port, or as a converged interface that can support FCoE. The external 10Gbps Ethernet ports on the Dell M8428-k are CEE-enabled and are typically connected to a top-of-rack or end-of-row 10G Ethernet switch. They can be bundled in a standard layer 2 LACP (802.3ad) port channel to support up to 80G of uplink bandwidth per switch. When the two LACP bundles of each switch in the fabric are connected to a Cisco vpc domain, a Brocade VCS cluster, or a Juniper Q-Fabric-enabled network, all sixteen 10G uplinks will be forwarding traffic in a non-blocking architecture that will provide 160Gbps of uplink bandwidth. Each of the four external FC ports can auto sense to 2, 4 or 8Gbps full-duplex speeds. They can be configured as E, F, M and FL ports when the M8428-k is deployed as a fully featured FC switch, or as N- ports when deployed in AG (Access Gateway) mode, which is a technology that leverages NPIV (N-port ID Virtualization). Figure 2 - Dell M8428-k Multi-Network Support

5 Features and Functionality on the Dell M8428-k Recall that the Dell M8428-k operates in three different protocol stacks: TCP/IP, FCoE and FC. Therefore, it has separate management interfaces for each technology. It is basically two switches in the same box. There is an Ethernet side (which includes the FCoE stack) and an FC side that runs a Fibre Channel switch operating system, known as Fabric OS (FOS). Some of the protocols and functionality supported from an IP/Ethernet perspective on the Dell M8428-k include the following: VLANs; standards-based STP, RSTP, and MSTP; 802.1Q Trunking; 802.3ad LACP; industry-common Command Line Interface (CLI); Security Shell (SSH) v2; Authentication, Authorization, and Accounting (AAA); Role-Based Access Control (RBAC); RADIUS; Simple Network Management Protocol (SNMP) v1, v2, and v3; Unified username and passwords across CLI and SNMP; Syslog; advanced debugs; Microsoft Challenge Handshake Authentication Protocol (MS-CHAP); Remote Monitoring (RMON); Per-port ingress and egress counters; Power-On Self-Test (POST); Comprehensive boot-up diagnostics; Ethernet-like Interface MIB; RFC 1643; RFC 1213 MIB-II; RFC 2865; and others. From a Fibre Channel perspective, the Dell M8428-k can be deployed as a full-featured FC switch with all the complex control and data plane functions that come along with that, such as Simple Name Server (SNS), ISL Trunking, Advanced Performance Monitoring, and Fabric Watch. On the other hand, to ensure seamless integration and interoperability in a multi-vendor environment, the FC component of the M8428-k can be deployed in Access Gateway (AG) mode, which renders it transparent to- and sitting outside of the FC SAN fabric. In such an instance, several CEE ports are mapped to a single external FC port, which is used as a gateway for all SAN-bound traffic. To the fabric, the external FC port on the M8428-k looks like an N-port, and in that case NPIV is leveraged to allow it to execute a single N-port FLOGI and multiple subsequent Fabric Discoveries (FDISCs) on behalf of the internal ports (CNAs) that are mapped to it. This simplifies deployment and troubleshooting considerably and conserves domain IDs. The M8428-k is in AG mode by default. Managing the Dell M8428-k switch can be achieved through several management platforms, including a Web interface through Web Tools, Command-line interface (CLI), an SNMP agent, EZ Switch Wizard, Brocade Network Advisor (BNA), Data Center Fabric Manager (DCFM) Professional, DCFM Professional Plus and DCFM Enterprise.

6 Traffic Flow through the Dell M8428-k Starting from the beginning, each application server, regardless of the operating system it is running, will contain the Ethernet and FC drivers necessary to support the deployed CNA. The CNA presents itself to the operating system as a separate Ethernet and FC adapter, which allows it to be configured using traditional management tools. Figure 3 - CNA Presents Itself to the OS as a NIC and an HBA The traffic leaving the CNA is a combination of IP Ethernet frames and FC frames encapsulated in an Ethernet frame (FCoE). The EtherType in the header of each of these Ethernet frames indicates whether the frame s payload is an IP datagram, an FC frame, or an FCoE FIP packet, which is necessary for endnode FCoE-based SAN logins.

7 Figure 4 - FC Frame Encapsulation and Resulting FCoE Frame Upon receipt of the Ethernet frames at the internal ingress port of the M8428-k, the configured forwarding policies are applied to each type of traffic. The Ethernet -encapsulated FC frames will be deencapsulated and forwarded out the external native FC ports while the IP traffic will be forwarded out the external 10Gbps Ethernet uplinks.

8 Part I Dell M1000e COMPANY X Proof-of-Concept: Lab Design and Low-Level Configurations Overview The proposed deployment scenario for COMPANY X s new private cloud infrastructure consists of the Dell M1000e blade chassis as the compute platform, with converged networking I/O support. The servers in the chassis will consist of M910 full-height blades and M710 HD half-height blades. The proposed I/O solution for the chassis under test is the Dell M8428-k converged network switch. Existing Lab Topology As of the writing of this paper, there is one Dell M1000e blade chassis under test in cabinet 33 of the COMPANY X lab. It is configured with Dell Power Edge M910 full height servers in slots 1(9) and 2(10) and Power Edge M710HD servers in slots 3 and 4. The Dell M8428-k switches are occupying fabrics B and C, but only fabric B is wired into the network. Each switch in fabric B is dual-homed to a Cisco vpc domain being provided by two Cisco Nexus 5020 switches. Only four (out of a maximum of 8) 10G uplinks are being used on each M8428-k; two are uplinked to one Cisco Nexus 5020 and two are uplinked to the other in a Multi-chassis Ether Channel (MCEC). Two external FC ports (out of a maximum of 4) on each M8428-k are connected to separate Brocade FC switches. The M8428-k is operating in Access Gateway mode. Recall that there are four AG port groups by default, each consisting of a number of CEE ports and one external FC port. Given the internal ports activated for the lab, it was necessary to remap the internal ports to the external ports that were cabled up and activated (25 and 26). Notes: 1.) For the CNAs to be able to log into the fabric when the M8428-k is in AG mode, the external FC ports must be connected to an FC switch that is part of the fabric and can provide login services. Each native FC port is recognized by the edge fabric switch (the Brocade 48000) as an N-Port. That N-Port performs a standard F-Port Login (FLOGI), and after that it will act as a proxy, so to speak, for subsequent F-port logins by the E-Nodes (CNAs). The CNAs will initiate a FLOGI, but the switch in AG mode will convert the FLOGI into an FDISC and forward it out the N-Port to the edge fabric switch for login services.

9 2.) Executing a Telnet or SSH to the M8428-k switch s management address will place the administrator on the FC side of the switch the FOS. To access the Ethernet management interface, enter the cmsh command at the FOS command prompt. To access configuration mode, enter configure terminal (conf t) at the Ethernet command prompt. 3.) The initial username and password for the M8428-k, as well as the management IP address, subnet mask and default gateway can be set through the Chassis Management Interface (CMC).

10 `STAT L1 L2 MGMT 0 MGMT 1 CONSOLE PS1 PS2 FAN STATUS Cisco Nexus 5020 PS1 PS v-6A 50~60Hz L1 L2 MGMT 0 MGMT 1 CONSOLE MGT `STAT Cisco Nexus 5020 PS1 SLOT3 SLOT2 PS v-6A 50~60Hz Cisco CON Catalyst 4948 L3 SLOT3 SLOT2 L2 Nexus 5020 switches vpc Peer Links Nexus Lab 3 Nexus Lab Po 50 Po 60 M8428-k switches AIG_POC B AIG_POC B2 EXISTING SAN SAN A Brocade DCX SAN B Brocade DCX Figure 5 COMPANY X POC Lab Network Topology

11 Accessing the Blade Switch Modules The switch modules can be accessed in various ways: 1. Plug the laptop s serial cable directly into the USB port on the front panel of the switch. 2. TELNET or SSH to the CMC s IP address and console into the blade through the CMC s CLI. 3. TELNET or SSH directly to the blade switch s management IP address. 4. Browse to the CMC s IP address and click on the Launch Switch GUI button from the CMC GUI. Methods 1 and 2 are serial connections to the switch, while methods 3 and 4 use TCP/IP. Methods 1 and 2 cannot be used simultaneously. Method 2 Example: (Open Terminal Access software, like Putty or Secure CRT, and Telnet or SSH to CMC s IP Address) login as: root (The CMC s default username is root ) root@ 's password: (The CMC s default password is calvin ) Welcome to the CMC firmware version 3.21.A $ connect switch-3 (The $ is the CLI prompt for the CMC. This is the command to console (serial) into the switch in Fabric B1 from the CMC s CLI. The 3 represents the slot numbering scheme that is used: A1=1, A2=2, B1=3, B2=4, C1=5, C2=6. Auto-generated output follows below.) connect: acquiring remote port. Connected to remote port. Escape character is '^\'. COMPANY X_POC_8428_B1:admin> (This is the FOS Prompt i.e. the FC side of the switch. Executing a Telnet or SSH to the M8428-k switch s management address will place the administrator on the FC side of the switch the FOS. So, too, will consoling into the switch from the CMC CLI, as shown above. In either case, to access the Ethernet management interface, enter the cmsh command at the FOS command prompt. To access configuration mode, enter configure terminal (conf t) at the Ethernet command prompt.) COMPANY X_POC_8428_B1:admin> cmsh COMPANY X_POC_8428_B1# (This is the command prompt for the Ethernet side of the switch)

12 M8428-k Converged Switch Configurations for COMPANY X Proof-of- Concept Lab Ethernet Configuration COMPANY X_POC_8428_B1# show run (The # indicates that this is the Ethernet (IP) command prompt) protocol spanning-tree rstp bridge-priority (STP choices are STP, RSTP or MSTP. Bridge Priority was set to ensure non-root status.) cee-map default priority-group-table 1 weight 40 pfc priority-group-table 2 weight 60 (A CEE Map is used to configure Data Center Bridging for different traffic classes. To facilitate rapid deployment, the M8428-k automatically configures a CEE map with default values that are suitable for most deployments. The default CEE map is labeled as "default." To understand the CEE map, you should have a good understanding of Priority Flow Control (IEEE 802.1Qbb) and Enhanced Transmission Selection (IEEE 802.1Qaz). Also keep in mind that the M8428-k classifies FCoE traffic as CoS 3 by default. The Priority Groups, which pertain to a certain traffic type, are defined using a PGID that immediately follows the priority-group-table keywords. The PGID determines the packet scheduling algorithm that will be used. If the PGID includes a prefix of "15" [15.7 through 15.0], it means that the traffic pertaining to that Priority Group will be forwarded using Strict Priority scheduling. If the PGID is between 0 and 7, the scheduling method used will be DWRR (Deficit Weighted Round Robin), which is the default scheduling algorithm that most vendors use for traffic that falls under the ETS Traffic Class, as defined by the ETS standard. Within the DWRR scheduled traffic, there is a concept known as "relative priority," which is once again dictated by the PGID. A PGID of "0" is the highest priority and "7" the lowest (DO NOT confuse PGID numbers with CoS numbers). So, in this case, the non-fcoe traffic is of a lower relative priority than the FCoE traffic. The "weight" keyword followed by a number defines that amount of bandwidth that will be allocated to each Priority Group, in accordance with Enhanced Transmission Selection operation.) priority-table (With regard to the Priority Table, each digit is in its own column and the column represents a certain CoS identifier. The digit all the way to the left corresponds to a CoS value of 0, the next column over to the right corresponds to a CoS value of 1 and so on to the end. Notice the number "1" in the CoS 3 column. Remember that FCoE traffic is in CoS 3 by default, so it is understood that a PGID of 1is referring to the FCoE traffic.) Therefore, the first Priority Group statement in the CEE map is referring to FCoE traffic: it is forwarded using DWRR scheduling; it has been allocated a minimum guaranteed bandwidth of 40 percent of the total link bandwidth; and it is in a no-drop class because it will leverage PFC.

13 The second Priority Group statement is referring to the drop-class of traffic, which is everything else. It also will use DWRR scheduling and is allocated a minimum of bandwidth of 60 percent of the link. The number "2" in all the other CoS columns signifies that the QoS settings are at a default for non-fcoe traffic.) fcoe-map default fcoe-vlan 1002 (The CEE map is nested inside of the FCoE map. The FCoE map also points to the FCoE VLAN, which by default is 1002 and is created automatically.) interface Vlan 1 no shutdown (VLAN 1 is the native VLAN and all Ethernet switch ports are placed in it by default. It should be brought up using the "no shut" command to ensure that control plane and other untagged traffic can be forwarded.) interface Vlan 2001 description SERVER VLAN 1 no shutdown interface Vlan 2002 description SERVER VLAN 2 no shutdown interface Vlan 2004 description VMOTION VLAN no shutdown (Three user-defined VLANs were created) interface InTengigabitEthernet 0/1 (Internal ports are CNA-facing.) mtu 9208 (Internal converged interfaces should be configured to support Jumbo frames.) fcoeport (The fcoeport command applies the FCoE Map to the interface. The FCoE map is a nested map that points to the CEE Map and calls the FCoE VLAN [1002]. Sometimes the fcoeport keyword must be negated [no fcoeport] and re-entered when a CNA does not log into the switch.) switchport (The switchport command makes the interface a layer 2 port.) switchport mode converged (The mode is set to converged because a CNA is connected to this interface and it will be receiving FCoE traffic. Placing the interface in "converged" mode also means that it will pass both tagged and untagged traffic, like a trunk port.) switchport converged allowed vlan all

14 (The underlying assumption is that an ESX/ESXi host will be connected and each VM will be on a different VLAN; hence, the need to allow tagged traffic from multiple VLANs.) no shutdown interface InTengigabitEthernet 0/2 (This port is also configured to accept traffic from an ESX/ESXi host with multiple VLANs. However, the native VLAN is also changed from VLAN 1 to VLAN 2002 so that the port can place untagged traffic in that VLAN in the event that a non-esx host is connected to the port.) mtu 9208 fcoeport switchport switchport mode converged switchport converged vlan 2002 switchport converged allowed vlan all no shutdown interface InTengigabitEthernet 0/3 0/16 (The remaining internal ports are configured exactly like interface 0/1 or 0/2, as necessary.) mtu 9208 fcoeport switchport switchport mode converged switchport converged allowed vlan all no shutdown interface ExTengigabitEthernet 0/17 0/20 (External Ethernet interfaces 0/17 through 0/20 are placed in a LACP group (50). See diagram for topology information.) channel-group 50 mode on type standard (The channel mode must match the mode set at the other end of the link. In this case, LACP negotiation is NOT used, but is instead set to on. Take note that each vendor has their own requirements with regard to matching port configurations at both ends when creating port-channels (ex: speed, duplex settings, allowed VLANs, etc. The channel-group number only has local significance and does not have to match at both ends.) no shutdown interface ExTengigabitEthernet 0/21 0/24 (The unused external Ethernet ports remain shutdown.) switchport switchport mode access shutdown

15 interface Port-channel 50 (A logical Port-Channel interface is automatically created by the switch when the physical ports are placed in the LACP group.) mtu 9208 switchport switchport mode trunk (The mode must be set to trunk [dot1q, of course] on the logical interface, not the physical interfaces that comprise the Port-Channel group.) switchport trunk allowed vlan all (Allow VLAN traffic accordingly) no shutdown (NOTE: The depicted deployment scenario, which includes multiple dot1q uplinks to the Cisco environment, was tested in the AIG lab and is one of the deployment scenarios in the production network. This deployment scenario requires port-channels to be configured. HOWEVER, another deployment scenario at AIG includes only a SINGLE dot1q uplink to the Cisco environment. In other words, only ONE external 10GE interface is activated. In that case, of course, the channel-group command is NOT necessary under the physical interface, and therefore the logical port-channel will not be automatically created by the switch. In this case, simply migrate the port-channel commands to the physical 10GE external link.) EXAMPLE: interface ExTengigabitEthernet 0/17 (notice only ONE single uplink) mtu 9208 switchport switchport mode trunk (The mode must be set to trunk *dot1q, of course+ on the logical interface, not the physical interfaces that comprise the Port-Channel group.) switchport trunk allowed vlan all (Allow VLAN traffic accordingly) no shutdown protocol lldp system-name COMPANY X_POC_8428_B1 advertise dcbx-fcoe-app-tlv advertise dcbx-fcoe-logical-link-tlv (LLDP works with DCBx to advertise the necessary FCoE application and logical link information between DCB-capable devices upon initialization.)

16 line console 0 login line vty 0 31 login (Ensure that the login command is entered under the console 0 and VTY interfaces [Telnet/SSH) to allow for management login and authentication) end COMPANY X_POC_8428_B1# Useful Verification and Troubleshooting Commands The M8428-k offers a rich set of show command utilities, plus debugs, to verify the switch s configuration operation and performance. Listed below are the ones that will be used most often. The management interface includes a syntax help utility that can be leveraged by typing a? at the command prompt or a keyword. show tech-support: Executes 33 show commands at once. Use when opening a support case. show version: Shows the firmware version running on the switch show running-config: Shows the current configuration of the CEE switch show startup-config: Shows the configuration that will be loaded if the switch is rebooted show ip interface brief: Fast way to see status of all CEE interfaces (up or down) show interface: Displays the detailed interface configuration and capabilities of all Ethernet interfaces. Includes errors and discards. show interface switchport: Specifies the configured Layer 2 interface. show lldp neighbors detail: Shows LLDP information for discovered switches show lacp counter: Shows lacp statistics show spanning-tree brief: Shows a brief look at the spanning tree show spanning-tree: Gives a detailed look at the spanning tree per CEE interface show vlan brief: Shows all created VLANs, their status, and interfaces assigned to each interface show mac-address-table: Shows the MAC address table for the switch show mac access-group: Shows the MAC address list per CEE interface show cee maps: Shows the priority group table and weights

17 Fibre Channel The Fibre Channel side of the M8428-k converged switch is deployed in the COMPANY X lab in Access Gateway mode. As a result, as far as the actual Fibre Channel configuration is concerned, the switch largely configures itself, leaving little to do for the administrator, except enable/disable the external FC ports as necessary and ensure that the AG mapping is correct for the deployment scenario is use. Recall that each external FC port is mapped to a group of 6 internal and external Ethernet ports by default. However, since there are only two FC ports cabled up to the Brocade switch (ports 25 and 26 see drawing), the default mapping had to be reconfigured to ensure that the Ethernet ports in use are mapped to the active FC ports. Configuring device management and access protocols, such as RADIUS, NTP, SNMP and others, are done from the Fibre Channel side of the Switch. See Note: There are TWO dashes in the FOS command line syntax. For example, ag mapshow is ag<space><dash><dash>mapshow. COMPANY X_POC_8428_B1:admin> (This is the FC (FOS) command prompt for managing the FC side of the switch.) COMPANY X_POC_8428_B1:admin>version (Use this command to verify FOS version. V6.3.0 and above should be deployed) COMPANY X_POC_8428_B1:admin> ag --mapshow (Output shows the mapping between each N_Port *external FC port+ and its associated Configured F Ports *internal and external Ethernet ports+. ) N_Port Configured_F_Ports Current_F_Ports Failover Failback PG_ID PG_Name ;14;15;16;23;24 None pg0 25 1;2;3;4;17; pg0 26 5;6;7;8;9;10;19;20 None pg ;12;21;22 None pg0 COMPANY X_POC_8428_B1:admin> ag --mapdel (Delete the existing map if necessary) COMPANY X_POC_8428_B1:admin> ag --mapadd 26 9;10 (Add the mapping as necessary. In this case, external FC port 26 is being mapped to internal Ethernet ports 9 and 10) COMPANY X_POC_8428_B1:admin> portcfgpersistentdisable <port#> (Use this command to disable an external FC port)

18 COMPANY X_POC_8428_B1:admin> portcfgpersistentenable <port#> (Use this command to enable an external FC port) COMPANY X_POC_8428_B1:admin> fcoe --disable <port#> (Use this command to disable an FCoE port [internal port]. Disabling and enabling the FCoE port in this manner is said to reinitiate the FCoE logical link and restart the FIP process. Use this procedure if a CNA fails to log into the M8428-k switch.) COMPANY X_POC_8428_B1:admin> fcoe --enable <port#> (Use this command to enable an FCoE port [internal port]. Disabling and enabling the FCoE port in this manner is said to reinitiate the FCoE logical link and restart the FIP process. Use this procedure if a CNA fails to log into the M8428-k switch.) AIG_POC_8428_B1:admin>configcommit (Execute and Save the FC-side configuration) COMPANY X_POC_8428_B1:admin> switchshow (Use this command to verify the status of all the ports. Ports that are up and ready should be online. In the lab, there is a full height server in slots 1(9) and 2(10). Note that the CNAs for those corresponding ports have logged into the fabric. Note also that the external FC ports [N_Ports] have also successfully logged on and have been assigned a WWN.) switchname: COMPANY X_POC_8428_B1 switchtype: switchstate: Online switchmode: Access Gateway Mode switchwwn: 10:00:00:05:33:4e:6a:c5 switchbeacon: OFF Index Port Address Media Speed State Proto ============================================== id N8 No_Light FC Disabled (Persistent) N10 Online FCoE VF-Port 1 VN-Port(s) 0x016a N10 Online FCoE VF-Port 1 VN-Port(s) 0x016a AN In_Sync FCoE AN In_Sync FCoE AN In_Sync FCoE AN In_Sync FCoE AN In_Sync FCoE AN In_Sync FCoE N10 Online FCoE VF-Port 1 VN-Port(s) 0x011b a00 -- N10 Online FCoE VF-Port 1 VN-Port(s) 0x011b b00 -- AN In_Sync FCoE c00 -- AN In_Sync FCoE d00 -- AN In_Sync FCoE e00 -- AN In_Sync FCoE f00 -- AN In_Sync FCoE AN In_Sync FCoE G In_Sync FCoE

19 G In_Sync FCoE G In_Sync FCoE G In_Sync FCoE G In_Sync FCoE G In_Sync FCoE G In_Sync FCoE G In_Sync FCoE id N4 Online FC N-Port 10:00:00:05:1e:36:62:fc 0x016a a00 id N4 Online FC N-Port 10:00:00:05:1e:36:62:fc 0x011b b00 id N8 No_Light FC Disabled (Persistent) COMPANY X_POC_8428_B1:admin> fcoe loginshow (Use this command to check the status of the CNA logins. Note: The Device MAC will be used for all Non- FCoE traffic [Standard LAN traffic], The Session MAC will be used for all FCoE traffic. The last 24 bits of the session ID is the FC_ID assigned by the FCF [M8428-k].) ================================================================================ Port Te port Device WWN Device MAC Session MAC ================================================================================ 1 InT 0/1 20:01:14:fe:b5:3d:cf:95 14:fe:b5:3d:cf:95 0e:fc:00:01:6a:02 2 InT 0/2 20:01:14:fe:b5:3d:cf:a2 14:fe:b5:3d:cf:a2 0e:fc:00:01:6a:01 9 InT 0/9 20:01:14:fe:b5:3d:cf:fd 14:fe:b5:3d:cf:fd 0e:fc:00:01:1b:02 10 InT 0/10 20:01:14:fe:b5:3d:d0:0a 14:fe:b5:3d:d0:0a 0e:fc:00:01:1b:01 Notes: 1.) Only switch COMPANY X_POC_8428_B1 is shown because COMPANY X_POC_8428_B2 is configured exactly the same from an Ethernet and Fibre Channel perspective, except of course for the management IP address. 2.) Note the status indicators for switch COMPANY X_POC_8428_B2 also shows successful N-Port and CNA logins. COMPANY X_POC_8428_B2:admin> switchshow switchname: COMPANY X_POC_8428_B2 switchtype: switchstate: Online switchmode: Access Gateway Mode switchwwn: 10:00:00:05:33:4e:63:ab switchbeacon: OFF Index Port Address Media Speed State Proto ============================================== id N8 No_Light FC Disabled (Persistent) N10 Online FCoE VF-Port 1 VN-Port(s) 0x N10 Online FCoE VF-Port 1 VN-Port(s) 0x019301

20 AN In_Sync FCoE AN In_Sync FCoE AN In_Sync FCoE AN In_Sync FCoE AN In_Sync FCoE AN In_Sync FCoE N10 Online FCoE VF-Port 1 VN-Port(s) 0x a00 -- N10 Online FCoE VF-Port 1 VN-Port(s) 0x b00 -- AN In_Sync FCoE c00 -- AN In_Sync FCoE d00 -- AN In_Sync FCoE e00 -- AN In_Sync FCoE f00 -- AN In_Sync FCoE AN In_Sync FCoE G In_Sync FCoE G In_Sync FCoE G In_Sync FCoE G In_Sync FCoE G In_Sync FCoE G In_Sync FCoE G In_Sync FCoE G In_Sync FCoE id N4 Online FC N-Port 10:00:00:05:1e:36:63:5e 0x a00 id N4 Online FC N-Port 10:00:00:05:1e:36:63:5e 0x b00 id N8 No_Light FC Disabled (Persistent) COMPANY X_POC_8428_B2:admin> fcoe --loginshow ================================================================================ Port Te port Device WWN Device MAC Session MAC ================================================================================ 1 InT 0/1 20:01:14:fe:b5:3d:cf:97 14:fe:b5:3d:cf:97 0e:fc:00:01:93:02 2 InT 0/2 20:01:14:fe:b5:3d:cf:a4 14:fe:b5:3d:cf:a4 0e:fc:00:01:93:01 9 InT 0/9 20:01:14:fe:b5:3d:cf:ff 14:fe:b5:3d:cf:ff 0e:fc:00:01:74:02 10 InT 0/10 20:01:14:fe:b5:3d:d0:0c 14:fe:b5:3d:d0:0c 0e:fc:00:01:74:01

21 Configuring Device Management and Secure Access These configurations are executed from the Fibre Channel side of the Dell M8428-k. 1) Change the default password for the "root", "factory", "admin" & "user" accounts. Log into the switch using the default password, and upon successful login, follow the automated prompt(s) to change the passwords. The example below changes all account passwords to S1lv3rF15h for user - root Changing password for root Enter new password: S1lv3rF15h Re-type new password: S1lv3rF15h passwd: all authentication tokens updated successfully Please change passwords for switch default accounts now. for user - factory Changing password for factory Enter new password: S1lv3rF15h Re-type new password: S1lv3rF15h passwd: all authentication tokens updated successfully Please change passwords for switch default accounts now. for user - admin Changing password for admin Enter new password: S1lv3rF15h Re-type new password: S1lv3rF15h passwd: all authentication tokens updated successfully Please change passwords for switch default accounts now. for user - user Changing password for user Enter new password: S1lv3rF15h Re-type new password: S1lv3rF15h passwd: all authentication tokens updated successfully Saving passwords to stable storage. Passwords saved to stable storage successfully

22 2) Radius Authentication At the switch FOS prompt, type: aaaconfig --add conf radius -p s we6wj4v92nkeahqdbrgllj133rabtt1j -t 5 -a chap (aaaconfig add <IP address of RADIUS server> -conf < aaa protocol> -p <RADIUS protocol port> -s <secret password> -t <# of authentication attempts> -a <authentication method>) aaaconfig --add conf radius -p s we6wj4v92nkeahqdbrgllj133rabtt1j -t 5 -a chap aaaconfig --add conf radius -p s we6wj4v92nkeahqdbrgllj133rabtt1j -t 5 -a chap aaaconfig --add conf radius -p s we6wj4v92nkeahqdbrgllj133rabtt1j -t 5 -a chap aaaconfig --authspec radius;local (Specifies that the first authentication method to be used should be RADIUS, and if unsuccessful, resort to local passwords as configured in step 1) 3) Configure NTP (Network Timing Protocol) COMPANY X_POC_8428_B1:admin> tsclockserver COMPANY X_POC_8428_B1:admin> tsclockserver (Example assumes that the M8428-k is the NTP client and is pointing to two NTP servers) 4) Set Chassis and Switch name COMPANY X_POC_8428_B1:admin> chassisname <hostname> COMPANY X_POC_8428_B1:admin> switchname <hostname> (The device switchname will be advertised to an adjacent DCB-capable switch by the DCBx protocol) 5) Set Security Banner COMPANY X_POC_8428_B1:admin> bannerset "Warning: These facilities are solely for the use of authorized employees or agents of the Company, its subsidiaries and affiliates. Unauthorized use is prohibited and subject to criminal and civil penalties. Individuals using this computer system are subject to having all of their activities on this system monitored and recorded by systems personnel. " 6) Configuring DNS (All default values are in []. To select the default value, just click enter.) COMPANY X_POC_8428_B1:admin> dnsconfig Enter option

23 1 Display Domain Name Service (DNS) configuration 2 Set DNS configuration 3 Remove DNS configuration 4 Quit Select an item: (1..4) [4] 2 Enter Domain Name: [] network.company X.net Enter Name Server IP address in dot/colon notation: [] Enter Name Server IP address in dot/colon notation: [] DNS parameters saved successfully Verification of DNS Enter option 1 Display Domain Name Service (DNS) configuration 2 Set DNS configuration 3 Remove DNS configuration 4 Quit Select an item: (1..4) [4] 1 Domain Name Server Configuration Information Domain Name = network.company X.net Name Server IP Address = Name Server IP Address = (Device is configured to be part of a domain but not to provide DNS services)

24 7) SNMP Configuration a) Enable SNMPv1 and Trap Recipient SNMPv1 configuration COMPANY X_POC_8428_B1:admin> snmpconfig --set snmpv1 (Configure SNMP for each NMS Server. All default values are in []. To select the default value, just click enter) SNMP community and trap recipient configuration: Community (rw): [xxxx] cauni Trap Recipient's IP address : [ ] Trap recipient Severity level : (0..5) [4] 3 Trap recipient Port : ( ) [162] Community (rw): [xxxx] cauni Trap Recipient's IP address : [ ] Trap recipient Severity level : (0..5) [3] 3 Trap recipient Port : ( ) [162] Community (rw): [xxxx] cauni Trap Recipient's IP address : [ ] Trap recipient Severity level : (0..5) [3] 3 Trap recipient Port : ( ) [162] Community (ro): [xxxx] cauni Trap Recipient's IP address : [ ] Trap recipient Severity level : (0..5) [0] 3 b) Create NMS ACL COMPANY X_POC_8428_B1:admin> snmpconfig --set accesscontrol SNMP access list configuration: Access host subnet area : [ ] Read/Write? (true, t, false, f): [true] Access host subnet area : [ ] Read/Write? (true, t, false, f): [true] Access host subnet area : [ ] Read/Write? (true, t, false, f): [true] f Committing configuration...done. (The ACL above permits traffic from the two defined networks to access the device MIBs everyone else is blocked)

25 c) Set Security Level COMPANY X_POC_8428_B1:admin> snmpconfig --set seclevel Select SNMP GET Security Level (0 = No security, 1 = Authentication only, 2 = Authentication and Privacy, 3 = N o Access): (0..3) [0] 0 Select SNMP SET Security Level (0 = No security, 1 = Authentication only, 2 = Authentication and Privacy, 3 = N o Access): (2..3) [2] 0 (No security is configured for SNMP GETs) d) Set System Group Configuration COMPANY X_POC_8428_B1:admin> snmpconfig --set systemgroup Customizing MIB-II system variables... At each prompt, do one of the following: <Return> to accept current value, enter the appropriate new value, <Control-D> to skip the rest of configuration, or <Control-C> to cancel any change. To correct any input mistake: <Backspace> erases the previous character, <Control-U> erases the whole line sysdescr: [10GbE FCoE with 8G FC NPIV] syslocation: [End User Premise] NOC ( ) syscontact: [Field Support.] NOC ( ) authtrapsenabled (true, t, false, f): [false] Committing configuration...done. 8) Enable Logging COMPANY X_POC_8428_B1:admin> syslogdipadd (Defines syslog server) 9) Saving Configurations in FOS COMPANY X_POC_8428_B1:admin> configcommit

26 Part II Learning More About the Dell M8428-k PoC Lab as the testing progresses. 09 July 2011 Client asked about Dell M8428-k ability to support port mirroring. Port mirroring, monitoring or setting up SPAN ports all refer to the same thing. The purpose is to capture traffic from one or more ports and forward the data to an analyzer. To accomplish this, the switch will replicate inbound and outbound traffic for a defined source port and send it to the destination port, without interfering with the intended traffic flow. The Dell M8428-k converged switch can support up to 24 concurrent Monitor sessions. A monitor session is first created using the monitor session <session #> command. Once in session-mode, you will have to define the source port (the port whose traffic you want to monitor) and a destination port (the port that will be connected to an analyzer). You can also specify which direction of traffic you want to monitor. Multiple ports can be mapped to the same destination port. Example: (Configuring two Monitor Sessions. Each source port is mapped to the same destination port) M8428-k_B1# conf t Enter configuration commands, one per line. End with CNTL/Z. M8428-k_B1(config)#monitor session 1 M8428-k_B1(conf-mon-sess-1)#source in 0/1 destination ex 0/24 direction both M8428-k_B1(conf-mon-sess-1)#monitor session 2 M8428-k_B1(conf-mon-sess-2)#source in 0/2 destination ex 0/24 direction both M8428-k_B1(conf-mon-sess-2)# Please refer to Chapter 13 Configuring Port Mirroring, using the CEE CLI of the Dell Converged Enhanced Ethernet Administrator s Guide for more details regarding caveats and limitations.