Brocade Communications Systems 53-1001763-02 사용자 설명서

DCC policies

7

Virtual Fabric considerations: The DCC policies that have entries for the ports that are being moved 
from one logical switch to another will be considered stale and will not be enforced. You can choose 
to keep stale policies in the current logical switch or delete the stale policies after the port 
movements. Use the secPolicyDelete command to delete stale DCC policies.

DCC policy restrictions

The following restrictions apply when using DCC policies:

•

Some older private-loop HBAs do not respond to port login from the switch and are not 
enforced by the DCC policy. This does not create a security problem because these HBAs 
cannot contact any device outside of their immediate loop.

•

DCC policies cannot manage or restrict iSCSI connections, that is, an FC Initiator connection 
from an iSCSI gateway.

•

You cannot manage proxy devices with DCC policies. Proxy devices are always granted full 
access, even if the DCC policy has an entry that restricts or limits access of a proxy device.

•

DCC policies are not supported on the CEE ports of the Brocade 8000.

Creating a DCC policy

DCC policies must follow the naming convention “DCC_POLICY_nnn,” where nnn represents a 
unique string. The maximum length is 30 characters, including the prefix DCC_POLICY_.

Device ports must be specified by port WWN. Switch ports can be identified by the switch WWN, 
domain ID, or switch name followed by the port or area number. To specify an allowed connection, 
enter the device port WWN, a semicolon, and the switch port identification. 

The following methods of specifying an allowed connection are possible:

•

deviceportWWN;switchWWN (port or area number)

•

deviceportWWN;domainID (port or area number)

•

deviceportWWN;switchname (port or area number)

1. Connect to the switch and log in using an account assigned to the admin role.

2. Enter the secPolicyCreate “DCC_POLICY_nnn” command.

TABLE 29

DCC policy states

Policy state

Characteristics

No policy

Any device can connect to any switch port in the fabric.

Policy with no entries

Any device can connect to any switch port in the fabric. An empty policy is the same as no 
policy.

Policy with entries

If a device WWN is specified in a DCC policy, that device is only allowed access to the 
switch if connected by a switch port listed in the same policy.
If a switch port is specified in a DCC policy, it only permits connections from devices that 
are listed in the policy.
Devices with WWNs that are not specified in a DCC policy are allowed to connect to the 
switch at any switch ports that are not specified in a DCC policy. 
Switch ports and device WWNs may exist in multiple DCC policies.
Proxy devices are always granted full access and can connect to any switch port in the 
fabric.