Cisco Nexus 5000 Series NX-OS Software Configuration Guide

Port Security Enforcement

To enforce port security, configure the devices and switch port interfaces through which each device or switch is connected, and activate the configuration.

• Use the port world wide name (pWWN) or the node world wide name (nWWN) to specify the N port connection for each device.
• Use the switch world wide name (sWWN) to specify the xE port connection for each switch.

Each N and xE port can be configured to restrict a single port or a range of ports.

Enforcement of port security policies are done on every activation and when the port tries to come up.

The port security feature uses two databases to accept and implement configuration changes.

• Configuration database—All configuration changes are stored in the configuration database.
• Active database—The database currently enforced by the fabric. The port security feature requires all devices connecting to a switch to be part of the port security active database. The software uses this active database to enforce authorization.

About Auto-Learning

You can instruct the switch to automatically learn (auto-learn) the port security configurations over a specified period. This feature allows any Cisco Nexus 5000 Series switch to automatically learn about devices and switches that connect to it. Use this feature when you activate the port security feature for the first time as it saves tedious manual configuration for each port. You must configure auto-learning on a per-VSAN basis. If enabled, devices and switches that are allowed to connect to the switch are automatically learned, even if you have not configured any port access.

When auto-learning is enabled, learning happens only for the devices or interfaces that were not already logged into the switch. Learned entries on a port are cleaned up after you shut down that port if auto-learning is still enabled.

Learning does not override the existing configured port security policies. For example, if an interface is configured to allow a specific pWWN, then auto-learning will not add a new entry to allow any other pWWN on that interface. All other pWWNs will be blocked even in auto-learning mode.

No entries are learned for a port in the shutdown state.

When you activate the port security feature, auto-learning is also automatically enabled.

Note If you enable auto-learning before activating port security, you cannot activate port security until auto-learning is disabled.

Port Security Activation

By default, the port security feature is not activated in Cisco Nexus 5000 Series switches.

When you activate the port security feature, the following operations occur:

• Auto-learning is also automatically enabled, which means:

– From this point, auto-learning happens only for the devices or interfaces that were not logged into the switch.

– You cannot activate the database until you disable auto-learning.

• All the devices that are already logged in are learned and are added to the active database.
• All entries in the configured database are copied to the active database.

After the database is activated, subsequent device login is subject to the activated port bound WWN pairs, excluding the auto-learned entries. You must disable auto-learning before the auto-learned entries become activated.

When you activate the port security feature, auto-learning is also automatically enabled. You can choose to activate the port security feature and disable auto-learning.

Tip If a port is shut down because of a denied login attempt, and you subsequently configure the database to allow that login, the port does not come up automatically. You must explicitly enter a no shutdown CLI command to bring that port back online.

Configuring Port Security with Auto-Learning and CFS Distribution

To configure port security, using auto-learning and CFS distribution, perform this task:

Step 1 Enable port security.

See the “Enabling Port Security” section.

Step 2 Enable CFS distribution.

See the “Enabling Distribution” section.

Step 3 Activate port security on each VSAN.

This action turns on auto-learning by default. See the “Activating Port Security” section.

Step 4 Issue a CFS commit to copy this configuration to all switches in the fabric.

See the “Committing the Changes” section. All switches have port security activated with auto-learning enabled.

Step 5 Wait until all switches and all hosts are automatically learned.

Step 6 Disable auto-learn on each VSAN.

See the“Disabling Auto-Learning” section.

Step 7 Issue a CFS commit to copy this configuration to all switches in the fabric.

See the “Committing the Changes” section. The auto-learned entries from every switch are combined into a static active database that is distributed to all switches.

Step 8 Copy the active database to the configure database on each VSAN.

See the “Copying the Port Security Database” section.

Step 9 Issue a CFS commit to copy this configuration to all switches in the fabric.

See the “Committing the Changes” section. This ensures that the configure database is the same on all switches in the fabric.

Step 10 Copy the running configuration to the startup configuration, using the fabric option.

This step saves the port security configure database to the startup configuration on all switches in the fabric.

Configuring Port Security with Auto-Learning without CFS

To configure port security using auto-learning without CFS, perform this task:

Step 1 Enable port security.

See the “Enabling Port Security” section.

Step 2 Activate port security on each VSAN, which turns on auto-learning by default.

See the “Activating Port Security” section.

Step 3 Wait until all switches and all hosts are automatically learned.

Step 4 Disable auto-learn on each VSAN.

See the “Disabling Auto-Learning” section.

Step 5 Copy the active database to the configure database on each VSAN.

See the “Copying the Port Security Database” section.

Step 6 Copy the running configuration to the startup configuration, which saves the port security configuration database to the startup configuration.

Step 7 Repeat Step 1 through Step 6 for all switches in the fabric.

Configuring Port Security with Manual Database Configuration

To configure port security and manually configure the port security database, perform this task:

Step 1 Enable port security.

See the “Enabling Port Security” section.

Step 2 Manually configure all port security entries into the configure database on each VSAN.

See the “Configuring Port Security with Manual Database Configuration” section.

Step 3 Activate port security on each VSAN. This turns on auto-learning by default.

See the “Disabling Auto-Learning” section.

Step 4 Disable auto-learn on each VSAN.

See the “Disabling Auto-Learning” section.

Step 5 Copy the running configuration to the startup configuration, which saves the port security configuration database to the startup configuration.

Step 6 Repeat Step 1 through Step 5 for all switches in the fabric.

Activating Port Security

To activate port security, perform this task:

Database Activation Rejection

Database activation is rejected in the following cases:

• Missing or conflicting entries exist in the configuration database but not in the active database.
• The auto-learning feature was enabled before the activation. To reactivate a database in this state, disable auto-learning.
• The exact security is not configured for each port channel member.
• The configured database is empty but the active database is not.

If the database activation is rejected due to one or more conflicts listed in the previous section, you may decide to proceed by forcing the port security activation.

Forcing Port Security Activation

If the port security activation request is rejected, you can force the activation.

Note If you force the activation, existing devices are logged out if they violate the active database.

You can view missing or conflicting entries using the port-security database diff active vsan command in EXEC mode.

To forcefully activate the port security database, perform this task:

Database Reactivation

Tip If auto-learning is enabled, you cannot activate the database without the force option until you disable auto-learning.

To reactivate the port security database, perform this task:

Step 1 Disable auto-learning.

Step 2 Copy the active database to the configured database.

Tip If the active database is empty, you cannot perform this step.

Step 3 Make the required changes to the configuration database.

Step 4 Activate the database.

To reactivate the port security database, perform this task:

About Enabling Auto-Learning

The state of the auto-learning configuration depends on the state of the port security feature:

• If the port security feature is not activated, auto-learning is disabled by default.
• If the port security feature is activated, auto-learning is enabled by default (unless you explicitly disabled this option).

Tip If auto-learning is enabled on a VSAN, you can only activate the database for that VSAN by using the force option.

Enabling Auto-Learning

To enable auto-learning, perform this task:

Disabling Auto-Learning

To disable auto-learning, perform this task:

Auto-Learning Device Authorization

Table 1-1 summarizes the authorized connection conditions for device requests.

Authorization Scenario

Assume that the port security feature is activated and the following conditions are specified in the active database:

• A pWWN (P1) is allowed access through interface fc2/1 (F1).
• A pWWN (P2) is allowed access through interface fc2/2 (F1).
• A nWWN (N1) is allowed access through interface fc2/2 (F2).
• Any WWN is allowed access through interface vfc3/1 (F3).
• A nWWN (N3) is allowed access through any interface.
• A pWWN (P3) is allowed access through interface fc2/4 (F4).
• A sWWN (S1) is allowed access through interface fc3/1-3 (F10 to F13).
• A pWWN (P10) is allowed access through interface vfc4/1 (F11).

Table 1-2 summarizes the port security authorization results for this active database. The conditions listed refer to the conditions from Table 1-1 .

WWN Identification Guidelines

If you decide to manually configure port security, note the following guidelines:

• Identify switch ports by the interface or by the fWWN.
• Identify devices by the pWWN or by the nWWN.
• If an N port is allowed to log in to SAN switch port F, then that N port can only log in through the specified F port.
• If an N port’s nWWN is bound to an F port WWN, then all pWWNs in the N port are implicitly paired with the F port.
• TE port checking is done on each VSAN in the allowed VSAN list of the VSAN trunk port.
• All port channel xE ports must be configured with the same set of WWNs in the same SAN port channel.
• E port security is implemented in the port VSAN of the E port. In this case, the sWWN is used to secure authorization checks.
• Once activated, the configuration database can be modified without any effect on the active database.
• By saving the running configuration, you save the configuration database and activated entries in the active database. Learned entries in the active database are not saved.

Adding Authorized Port Pairs

After identifying the WWN pairs that need to be bound, add those pairs to the port security database.

Tip Remote switch binding can be specified at the local switch. To specify the remote interfaces, you can use either the fWWN or sWWN-interface combination.

To add authorized port pairs for port security, perform this task:

This example enters the port security database mode for VSAN 2:

This example configures the specified sWWN to only log in through SAN port channel 5:

This example configures the specified pWWN to log in through the specified interface in the specified switch:

This example configures any WWN to log in through the specified interface in any switch:

Enabling Distribution

All the configurations performed in distributed mode are stored in a pending (temporary) database. If you modify the configuration, you need to commit or discard the pending database changes to the configurations. The fabric remains locked during this period. Changes to the pending database are not reflected in the configurations until you commit the changes.

Note Port activation or deactivation and auto-learning enable or disable do not take effect until after a CFS commit if CFS distribution is enabled. Always follow any one of these operations with a CFS commit to ensure proper configuration. See the “Activation and Auto-Learning Configuration Distribution” section.

For example, if you activate port security, follow up by disabling auto-learning, and finally commit the changes in the pending database, then the net result of your actions is the same as entering a port-security activate vsan vsan-id no-auto-learn command.

Tip We recommend that you perform a commit after you activate port security and after you enable auto learning.

To enable the port security distribution, perform this task:

Locking the Fabric

The first action that modifies the existing configuration creates the pending database and locks the feature in the VSAN. Once you lock the fabric, the following situations apply:

• No other user can make any configuration changes to this feature.
• A copy of the configuration database becomes the pending database.

Committing the Changes

If you commit the changes made to the configurations, the configurations in the pending database are distributed to other switches. On a successful commit, the configuration change is applied throughout the fabric and the lock is released.

To commit the port security configuration changes for the specified VSAN, perform this task:

Discarding the Changes

If you discard (abort) the changes made to the pending database, the configuration remains unaffected and the lock is released.

To discard the port security configuration changes for the specified VSAN, perform this task:

Activation and Auto-Learning Configuration Distribution

Activation and auto-learning configurations in distributed mode are remembered as actions to be performed when you commit the changes in the pending database.

Learned entries are temporary and do not have any role in determining if a login is authorized or not. As such, learned entries do not participate in distribution. When you disable learning and commit the changes in the pending database, the learned entries become static entries in the active database and are distributed to all switches in the fabric. After the commit, the active database on all switches are identical and learning can be disabled.

If the pending database contains more than one activation and auto-learning configuration when you commit the changes, the activation and auto-learning changes are consolidated and the resulting operation may change (see Table 1-3 ).

Database Scenarios

Figure 1-1 illustrates various scenarios showing the active database and the configuration database status based on port security configurations.

Figure 1-1 Port Security Database Scenarios

Copying the Port Security Database

Tip We recommend that you copy the active database to the config database after disabling auto-learning. This action will ensure that the configuration database is in synchronization with the active database. If distribution is enabled, this command creates a temporary copy (and consequently a fabric lock) of the configuration database. If you lock the fabric, you need to commit the changes to the configuration databases in all the switches.

Use the port-security database copy vsan command to copy from the active to the configured database. If the active database is empty, this command is not accepted.

Use the port-security database diff active vsan command to view the differences between the active database and the configuration database. This command can be used when resolving conflicts.

Use the port-security database diff config vsan command to obtain information on the differences between the configuration database and the active database.

Deleting the Port Security Database

Tip If the distribution is enabled, the deletion creates a copy of the database. An explicit port-security commit command is required to actually delete the database.

Use the no port-security database vsan command in configuration mode to delete the configured database for a specified VSAN.

Clearing the Port Security Database

Use the clear port-security statistics vsan command to clear all existing statistics from the port security database for a specified VSAN.

Use the clear port-security database auto-learn interface command to clear any learned entries in the active database for a specified interface within a VSAN.

Use the clear port-security database auto-learn vsan command to clear any learned entries in the active database for the entire VSAN.

Note The clear port-security database auto-learn and clear port-security statistics commands are only relevant to the local switch and do not acquire locks. Also, learned entries are only local to the switch and do not participate in distribution.

Use the port-security clear vsan command to clear the pending session in the VSAN from any switch in the VSAN.