Articles in this section

See more

Cisco FC Switch | Scan Requirements

Avatar
Oz Gabriely
  • Updated

StorageGuard collects configuration data from Cisco FC switches by running read-only NX-OS and SAN-OS commands over a secure SSH session. It's recommended to scan Cisco NDFC for complementary configuration data collection.

Preparation for Scanning a Cisco FC Switch

The following table lists the requirements for scanning Cisco FC switches:

# Description
1 Provide the network name or IP address of a Cisco FC SAN director. StorageGuard will automatically discover the names and IP addresses of the Cisco FC switches in the network through scanning this director.  
2 Provide a user account (and password) for each Cisco FC SAN director and switch.
3 The user account should be assigned with an unlimited read-only role, capable of running all “show” commands. Examples of read-only commands used:
  • userconfig --show -a
  • snmpconfig --show snmpv3
  • auditcfg --show
4 Verify that IP connectivity through SSH (default is port 22) is available between the StorageGuard server and each Cisco FC director and switch.
 

 

Creating a User Account for Scanning a Cisco FC Switch

The following suggested method can be used to create a user account with appropriate privileges:

username sguard password <password> role <role_name>

Where the selected role enables the user to run all read-only show commands.

Examples:

-- Cisco MDS
configure terminal
role name sguardrole
rule 1 permit show
rule 2 permit show feature running-config
rule 3 permit show feature role
rule 4 permit show feature startup-config
(Optional) description storageguard scan user
exit
(Optional) role commit
username sguard password <password> role sguardrole
(Optional) copy running-config startup-config

-- Cisco Nexus
configure terminal
role name sguardrole
rule 1 permit command show *
rule 2 permit command show running-config *
rule 3 permit command show role *
rule 4 permit command show startup-config *
rule 5 permit read
(Optional) description storageguard scan user
exit
(Optional) role commit
username sguard password <password> role sguardrole
(Optional) copy running-config startup-config

 

Preparation for Scanning Cisco NDFC

StorageGuard collects configuration data also from Cisco NDFC by running read-only API calls.

The following table lists the requirements for scanning Cisco NDFC:

# Description
1 Provide the network name or IP address the Cisco NDFC host.
2 Provide a user account (and password) for the Cisco NDFC application.
3 The user account should be assigned with an unlimited read-only role, capable of running get api calls. Examples of read-only APIs used:
  • SanWSService/SanWS:getFabrics
  • SanWSService/SanWS:getFcPorts
4 Verify that IP connectivity through HTTP (default is port 443) is available between the StorageGuard server and each Cisco NDFC host
 

 

Creating a User Account for Scanning Cisco NDFC

The following suggested method can be used to create a user account with appropriate privileges:

  • Login to the admin console.
  • Assign the designated scan user account with the NDFC Network Operator role (or higher).

 

Related articles

Comments

0 comments

Please sign in to leave a comment.