Regarding San Switch

Dear All,
I have some quaries about the San switch -DS-C9148D-4G48P-K9 and DS-C9148D-8G48P-K9.We need the cable specification for the connectivity between San switch and servers and tape library and SAN to switch.
waiting for your feed-back .
Thanks,
Whead-Ul-Islam

The parts listed are port licenses. The following document may be of value.
Cisco MDS 9000 Family Pluggable Transceivers Data Sheet
http://www/en/US/prod/collateral/ps4159/ps6409/ps4358/product_data_sheet09186a00801bc698.html
Thank You,
Dan Laden

Similar Messages

Query: Best practice SAN switch (network) access control rules?

Dear SAN experts,
Are there generic SAN (MDS) switch access control rules that should always be applied within the SAN environment?
I have a specific interest in network-based access control rules/CLI-commands with respect to traffic flowing through the switch rather than switch management traffic (controls for traffic flowing to the switch).
Presumably one would want to provide SAN switch demarcation between initiators and targets using VSAN, Zoning (and LUN Zoning for fine grained access control and defense in depth with storage device LUN masking), IP ACL, Read-Only Zone (or LUN).
In a LAN environment controlled by a (gateway) firewall, there are (best practice) generic firewall access control rules that should be instantiated regardless of enterprise network IP range, TCP services, topology etc.
For example, the blocking of malformed TCP flags or the blocking of inbound and outbound IP ranges outlined in RFC 3330 (and RFC 1918).
These firewall access control rules can be deployed regardless of the IP range or TCP service traffic used within the enterprise. Of course there are firewall access control rules that should also be implemented as best practice that require specific IP addresses and ports that suit the network in which they are deployed. For example, rate limiting as a DoS preventative, may require knowledge of server IP and port number of the hosted service that is being DoS protected.
So my question is, are there generic best practice SAN switch (network) access control rules that should also be instantiated?
regards,
Will.

Hi William,
That's a pretty wide net you're casting there, but i'll do my best to give you some insight in the matter.
Speaking pure fibre channel, your only real way of controlling which nodes can access which other nodes is Zones.
for zones there are a few best practices:
* Default Zone: Don't use it. unless you're running Ficon.
* Single Initiator zones: One host, many storage targets. Don't put 2 initiators in one zone or they'll try logging into each other which at best will give you a performance hit, at worst will bring down your systems.
* Don't mix zoning types: You can zone on wwn, on port, and Cisco NX-OS will give you a plethora of other options, like on device alias or LUN Zoning. Don't use different types of these in one zone.
* Device alias zoning is definately recommended with Enhanced Zoning and Enhanced DA enabled, since it will make replacing hba's a heck of a lot less painful in your fabric.
* LUN zoning is being deprecated, so avoid. You can achieve the same effect on any modern array by doing lun masking.
* Read-Only exists, but again any modern array should be able to make a lun read-only.
* QoS on Zoning: Isn't really an ACL method, more of a congestion control.
VSANs are a way to separate your physical fabric into several logical fabrics. There's one huge distinction here with VLANs, that is that as a rule of thumb, you should put things that you want to talk to each other in the same VSANs. There's no such concept as a broadcast domain the way it exists in Ethernet in FC, so VSANs don't serve as isolation for that. Routing on Fibre Channel (IVR or Inter-VSAN Routing) is possible, but quickly becomes a pain if you use it a lot/structurally. Keep IVR for exceptions, use VSANs for logical units of hosts and storage that belong to each other. A good example would be to put each of 2 remote datacenters in their own VSAN, create a third VSAN for the ports on the array that provide replication between DC and use IVR to make management hosts have inband access to all arrays.
When using IVR, maintain a manual and minimal topology. IVR tends to become very complex very fast and auto topology isn't helping this.
Traditional IP acls (permit this proto to that dest on such a port and deny other combinations) are very rare on management interfaces, since they're usually connected to already separated segments. Same goes for Fibre Channel over IP links (that connect to ethernet interfaces in your storage switch).
They are quite logical to use and work just the same on an MDS as on a traditional Ethernetswitch when you want to use IP over FC (not to be confused with FC over IP). But then you'll logically use your switch as an L2/L3 device.
I'm personally not an IP guy, but here's a quite good guide to setting up IP services in a FC fabric:
http://www.cisco.com/en/US/partner/docs/switches/datacenter/mds9000/sw/4_1/configuration/guides/cli_4_1/ipsvc.html
To protect your san from devices that are 'slow-draining' and can cause congestion, I highly recommend enabling slow-drain policy monitors, as described in this document:
http://www.cisco.com/en/US/partner/docs/switches/datacenter/mds9000/sw/5_0/configuration/guides/int/nxos/intf.html#wp1743661
That's a very brief summary of the most important access-control-related Best Practices that come to mind. If any of this isn't clear to you or you require more detail, let me know. HTH!

Why a SAN switch can see vHBA WWPNs but not WWNN?

I have setup UCSM but the SAN switches (EMC) could only see all the WWPN on each server's vHBA, not the WWNN. They are all UCS B200M2 model. I saw the WWNNs are already assign to all service profile as shown in the storage tab.
Has anyone encountered this before? I am digging my head for more than 2 hours but no clue.
Rebooted the blades, disassociate/reassociate blades, re-ack blades, unbind/rebind vHBA templates on the server's vHBA had been done but no luck
Appreciate for any help here.
kind regards,

Simon is correct. In UCSM is where you would only see the WWNN under the storage tab. You are only zoning the WWPN. If I may ask, what reason would you need to see the WWNN if the paths to the HBA is being seen?
Just curious?
Sent from Cisco Technical Support iPhone App

UCS servers with IBM's TotalStorage SAN16B-2 SAN Switch

Hi Experts,
We have IBM TotalStorage SAN16B-2 SAN Switch, & cisco UCS 6120 Fabric Interconnect, dint find any document for compatibilty between this.
This is a SAN switch with each port capable of delivering a throughput of up to 4 gbps.
Can we use this SAN switch to connect ucs Fabric interconnect????
Thanks,
Mazhar

As long as the switch supports NPIV it should be fine.
Regards,
Robert

WWN does not show up on Cisco SAN Switch

We use Cisco SAN Switches MDS 9134 and MDS9222i with NX-IOS 4.2.(3). Our HP c7000 blade enclosure is connect through a Fibre Channel Virtual Connect Card to the SAN switches. For so far is everything working Oke. Now is the problem when I connect the 8th and 9th Blade Server (BL860c i2 Integrity Server) to the c7000 enclosure non of the wwn's show up on the Cisco Switch. Neither on the MDS9134 as the MDS9222i.Firmware on the HP Blade is up to date. The Onboard Administrator show that the HBA's are logged-in to Virtual Connect.
Does anyone know solution for this issue.
Best Regards,
Robert

Hi Robert,
The output of "show flogi database" will show you all the wwn's of devices connected directly to a particular
switch.
Is NPV involved in your topology?
Regards,
Ken

Problems witch channels to the FICON SAN switches

We have some problems witch channels to the FICON SAN switches: channel 56 on Mainframe1 to switch 5B5 (FDBELF5C1_VSAN500_DISK) and channel 28 (on Mainframe1) to switch 5B7 (FDBELF5C1_VSAN510_TAPE). Forr Mainframe2 the channels are 35 to 5B5 and 37 to 5B7.
Hereby an example for switch 5B5 and channels 56 (BAD) and 43 (GOOD):
---> command: D M=DEV(5B5)
IEE174I 10.21.40 DISPLAY M 494
DEVICE 05B5 STATUS=ONLINE
CHP 56 43
ENTRY LINK ADDRESS 6543 655B
DEST LINK ADDRESS 75FE 75FE
PATH ONLINE
N YCHP PHYSICALLY ONLINE Y Y
PATH OPERATIONAL Y Y
MANAGED N N
CU NUMBER 05B5 05B5
MAXIMUM MANAGED CHPID(S) ALLOWED: 0
DESTINATION CU LOGICAL ADDRESS = 00
SCP CU ND = 0MDS9K.513.CSC.1F.00059B7ACEC4.00E0
SCP TOKEN NED = 0MDS9K.513.CSC.1F.00059B7ACEC4.0000
SCP DEVICE NED = 0MDS9K.513.CSC.1F.00059B7ACEC4.0000
When one tries to put the path online then the following error messages are seen:
---> command: VARY PATH(5B5,56),ONLINE
IEE386I PATH(05B5,56) NOT BROUGHT ONLINE
IEE763I NAME= IOSCCMSG CODE= 0000000800000032
IOS291I CONFIGURATION DATA COULD NOT BE READ ON PATH(05B5,56) RC=32
DEVICE SUPPORT CODE DETECTED INCORRECT CDR DATA
IEE763I NAME= IECVIOPM CODE= 0000000400000000
IOS554I CONFIGURATION DATA PROCESSING FAILED
IEE764I END OF IEE386I RELATED MESSAGES µ
We don't think that the problem is port related but switch related!
For the moment problems are present on only one of our 4 mainframe SAN directors. Firmware level of the directors was changed 3 weeks ago to NX-OS 4.2(7b).

Problem solved after IODF weekend.
Channels were toggled.
Rgds,
Ivy

Windows 2012 Hyper-V Virtual SAN Switch Best Practice

I have a four node cluster running W2012 Datacenter edition on each. All systems have Emulex HBA compatible with Hyper-V and Virtual SAN technology. The hosts are connected to a Brocade SAN Switch with NPIV Enabled. I've
created a Virtual SAN on each host. The vSAN is connected to 2 physical HBA. Each HBA is connected to a different physical SAN Switch.
I have some questions about the best practice of the whole system.
1. Do I have to create a vSAN per physical HBA ? Or create one vSAN that include 2 HBA ?
2. Add 2 virtual HBA per VM to have fault tolerance ? Or one virtual HBA that is connected to a vSAN with 2 HBAs ?
3. Do I have to create a virtual port for each VM on the HBA Gui (OCManager) ?
Any best pratice or advice ?
Thanks

Hi,
first you will do almost the same as you do on a physical SAN, normally you build 2 Fabrics right ?
In Case you have that in place you will configure also 2 vSANs to build up your 2 seperate ways/pathes.
Here my top links for that Topic
Hyper-V Virtual Fibre Channel Design Guide
http://blogs.technet.com/b/privatecloud/archive/2013/07/23/hyper-v-virtual-fibre-channel-design-guide.aspx
Very Good Blog with all the Scenarios you can have, sinlge Fabric to Multi ......
Here the TechNet Info around "Hyper-V Virtual Fibre Channel Overview"
http://technet.microsoft.com/en-us/library/hh831413.aspx
and the "Implement Hyper-V Virtual Fibre Channel"
http://technet.microsoft.com/en-us/library/dn551169.aspx
A good Advice is also to install this Hotfix -
http://support.microsoft.com/kb/2894032/en-us
It is a sexy feature but if one point in the chain is doing wrong things with your NPIV Packets you are lost, so in my personal view you miss the for me most inportant point why i do Hyper-V, the Separation of HW and Software :-)
One Problem i had once was after live Migration of a VM with configured vFC the Destination Host lost there FC Connection, but only if the Host have been one SAN Hop away from the HP Storage , was a HP Driver Problem, used the original Qlogic Driver and
everything was fine, so same as with some HP Networking Driver for Broadcom, do not trust every update, test it before puting it in production.
Hope that helps ?
Udo

Configuring Nexus 5k for SAN switching between UCS 6100s and NetApp storage

We are trying to get our UCS environment setup to do SAN boot to LUNs on our NetApp storage. We have a pair of Nexus 5Ks with the Enterprise / SAN license on them and the 6-port FC module installed. What needs to be done to configure the Nexus 5000 to operate as the SAN switch between the storage target and the UCS environment?

I'm still not seeing the LUN on the NetApp device from my service profile. Here are the outputs from the two
commands you referenced here along with a few other commands if they help at all.
Port fc2/1 is the conneciton to the UCS 6100 with FCID 0x640004 being the vHBA in my Server profile.
Port fc2/5 is the NetApp target. I have the LUN masked to the vHBA port name 20:00:00:25:b5:01:00:ff
I have just the wwpn from the vHBA in my server profile and the wwpn of the NetApp target port zoned together. I'm not seeing any FC traffic at the NetApp though from looking at the statistics. Do I need to include something else in my zoning?
Again, any assistance would be appreciated. This is obviously our first venture into FC...

SAN Switch Cisco -16Port

Hi,
Any suggestions for SAN Switch 16 Port ( All Active) from MDS series.
Thanks in advance!!

DCNM-SAN-M91-K9 - very nice to have if you want to track switch utilization, manage multiple fabrics at the same time. Not a must have ..but a nice to have.
M9148PL8-8G-SFP - i believe you must purchase this to activate an extra 8 ports to give you a total of 16 ports.
M9100ENT1K9 - if you have requirements for advances features like IVR then you would need this. If you just need to create zones, VSANs ..you don't need that license.
@dynamoxxx

Nexus 5548UP for SAN Switch

We have purchased a Nexus 5548UP switch for our SAN environment. I've only configured it for jumbo frames and currently doing testing on the performance, as some say use jumbo frames while others say do not. My question is, and I know this is a loaded question but how do you guys go about configuring your SAN switches? What exactly are you configuring on it? Such as for performance tuning or the like. The reason I ask, is we have the switch and it's pretty much working, but I'd like to learn more about it and how to tune it and fully take advantage of the switch.

That is correct, between two Dell Optiplex workstations. We also tested between the server that will go into prod and an Optiplex, but once again the Optiplex could be the limiting factor. You think that could be it? Here's my config, so you know how it's setup right now.
version 5.2(1)N1(7)
hostname N5K
feature telnet
feature lldp
feature vtp
username admin password 5 $1$oZ1234567898765432123456/ role network-admin
banner motd #Nexus 5000 Switch
ip domain-lookup
policy-map type network-qos jumbo
class type network-qos class-default
mtu 9216
multicast-optimize
system qos
service-policy type network-qos jumbo
snmp-server user admin network-admin auth md5 0x422842c9d320064123456789fc703d20
priv d3264f23456789000c703d20 localizedkey
vrf context management
port-profile default max-ports 512
interface Ethernet1/1
flowcontrol receive on
flowcontrol send on
interface Ethernet1/2
interface Ethernet1/3
interface Ethernet1/4
interface Ethernet1/5
flowcontrol receive on
flowcontrol send on
interface Ethernet1/6
interface Ethernet1/7
interface Ethernet1/8
interface Ethernet1/9
flowcontrol receive on
flowcontrol send on
interface Ethernet1/10
interface Ethernet1/11
interface Ethernet1/12
interface Ethernet1/13
flowcontrol receive on
flowcontrol send on
interface Ethernet1/14
interface Ethernet1/15
interface Ethernet1/16
interface Ethernet1/17
interface Ethernet1/18
interface Ethernet1/19
interface Ethernet1/20
interface Ethernet1/21
interface Ethernet1/22
interface Ethernet1/23
interface Ethernet1/24
interface Ethernet1/25
interface Ethernet1/26
interface Ethernet1/27
interface Ethernet1/28
interface Ethernet1/29
interface Ethernet1/30
interface Ethernet1/31
interface Ethernet1/32
interface mgmt0
ip address 11.11.11.11/24
line console
exec-timeout 720
line vty
boot kickstart bootflash:/n5000-uk9-kickstart.5.2.1.N1.7.bin
boot system bootflash:/n5000-uk9.5.2.1.N1.7.bin

JBOD 9-pin connector to SAN switch

I'm a newbie to SAN.
There are JBODs with 9-pin D-type connector. my SAN switch has fibre SFP connector. Is there a cable to connect them?

Yes. There is something called a MIA, Media Interface adapter, and it will convert copper to Fibre. Usually you plug the MIA into the back on the JBOD and attach the fibre to the MIA and the switch. Often times MIA require SC type fibre connections where as the MDS used LC type connects, just make sure you get a fibre cable that is SC on one end and LC on the other. These cables are common since most patch panels use the SC interface.

Can we schedule backup of cisco san switch 9148 through windows backup utility.

can we schedule backup of cisco san switch 9148 through windows backup utility.

sure, you can write a batch/perl/powershell/whatever script that will connect to your switch and then backup the configuration. You need to decided where you are going to back it up to, possible options include TFTP, SCP, FTP, SFTP. For example i am backing to a TFTP server, my perl script connect to the switch and runs this command:
copy startup-config tftp://tfpserver-ip/mds9513.$(TIMESTAMP).config
TIMESTAMP is actually a built-in variable that will be replaced with the date/time configured on the switch.

11g plugin for Brocade VA-40FC SAN switch?

Hello,
Is anyone aware of a 11g plugin for Brocade Fibre Channel SAN switches, particularly the VA-40FC? Google only leads me to a plugin for the Brocade ServerIron appliance.
Many thanks,
R.

VBLOCK 0/1 SAN switch option

Hi,
According to Cisco vblock document. Nexus 5k will act as SAN switch and for vblock 0 and MDS will act as SAN switch for vblock 1. Why can't we use either nexus 5k or MDS for both vblock design.
Foyez Ahammed

Foyez
I think you have asked this question under vblock0 as well and have received responses as well
It is better to continue the discussion there itself rather than duplicating it
Narayan

UCS connecting to SAN switches

I've configued UCS direct connecting into the SAN before, but not SAN switches. My understanding of the main differences between the two is this:
1) With SAN switches, you configure vSANs. To do this go to SAN tab -> SAN Cloud and configure your vSAN ID's here. Then in your vHBA template, configure it to use the appropriate vSAN ID you configured under SAN cloud. Anything else to do here?
2) Whereas with direct attached storage you connect FI-A to SPA and SPB and FI-B to SPA and SPB, with san switches FI-A goes to 'switch-1' and FI-B goes to 'switch-2'. Is this correct? If so, anyone know why it has to be this way?

No problem, tbone-111
As far as I know, only two vHBAs are supported at this time. It's best to use 1 from the A-side and 1 from the B-side.
The vHBAs that are used depend on which wwpns you zoned to your boot luns.
For the example below, assume the following convetions:
1.) my vHBAs are named, vHBA_A1, vHBA_B1, vHBA_A2, vHBA_B2 (A for A-side fabric, and B for B-side)
2.) vHBA_A1 is the first HBA on my A side, and vHBA_B1 is the first HBA on B side
AND
3.) These HBAs' wwpns are zoned properly to my boot LUNs' Storage Processor (SP) ports on the FC Switch
AND
4.) These HBAs' wwpns are LUN masked properly on my array
Those are logical ANDs, by the way, they must ALL be true to prevent headaches later on.
5.) Disk Array SP ports A0 and B1 are connected to my A Fabric FC switch. B0 and A1 are connected to my B Fabric.
6.) This example boot policy will have the A Fabric be the primary boot path
-FYI, best practice to have at least 2 SAN Boot policies (1 for A-side and 1 for B-side, and evenly distribute among your Service Profiles).
In my boot policy, I check the enforce vHBA naming option and specify my vHBAs names (sorry I don't have screenshots available. just started with a new company and don't have lab access yet).
My SAN Primary setting might be: Primary Target: A0's wwpn and Secondary Target: B1's wwpn
My SAN Secondary setting might be: Primary Target: B0's wwpn and Secondary Target: A1's wwpn
It would be a good idea to confer with your Storage Admins while you are setting up the first couple of servers to boot on each Fabric to help with any troubleshooting.
If zoning and LUN masking are configured correctly, you should see WWPNs listed during the UCS Server Boot sequence at the point where the FC Boot driver is being loaded.
Of course, get Cisco TAC on the line if you run into any obstacles that you cannot get past.
I hope that helps,
Trevor
======================================================================================
If my answers have been helpful in any way, please rate accordingly. Thanks!
Message was edited by: Trevor Roberts Jr

Regarding San Switch

Similar Messages

Maybe you are looking for