3 – Managing FabricsSecuring a Fabric59097-02 B 3-9A3.2.4Device SecurityDevice security provides for the authorization and authentication of devices thatyou attach to a switch. You can configure a switch with a group of devices againstwhich the switch authorizes new attachments by devices, other switches, ordevices issuing management server commands. Device security is configuredthrough the use of security sets and groups. A group is a list of device worldwidenames that are authorized to attach to a switch. There are three types of groups:one for other switches (ISL), another for devices (port), and a third for devicesissuing management server commands (MS). A security set is a set of up to threegroups with no more than one of each group type. The security configuration ismade up of all security sets on the switch.In addition to authorization, the switch can be configured to require authenticationto validate the identity of the connecting switch, device, or host. Authenticationcan be performed locally using the switch security database, or remotely using aRemote Dial-In User Service (RADIUS) server. With a RADIUS server, thesecurity database for the entire fabric resides on the server. In this way, thesecurity database can be managed centrally, rather than on each switch. You canconfigure up to five RADIUS servers to provide failover.You can configure the RADIUS server to authenticate just the switch or both theswitch and the initiator device if the device supports authentication. When using aRADIUS server, every switch in the fabric must have a network connection. ARADIUS server can also be configured to authenticate user accounts.Consider the devices, switches, and management agents and evaluate the needfor authorization and authentication. Also consider whether the security databaseis to distributed on the switches or centralized on a RADIUS server and how manyservers to configure.Managing device security involves the following tasks: Creating security sets, groups, and members Editing a security configuration on a switch Viewing properties of a security set, group, or member Archiving a security configuration on a switch to a file Activating and deactivating a security setThe security database is made up of all security sets on the switch. The securitydatabase has the following limits: Maximum number of security sets is 4. Maximum number of groups is 1000. Maximum number of members in a group is 1000. Maximum total number of group members is 1000.
