Redpaper. Fabric Manager FICON 5.2 Quickstart. Introduction. Jon Tate

Transcription

1 Redpaper Jon Tate Fabric Manager FICON 5.2 Quickstart Introduction IBM Fibre Connections (FICON ) is an industry-standard, high-speed input/output (I/O) interface for mainframe connections to storage devices. For a range of storage area network (SAN) devices that support FICON, refer to: Copyright IBM Corp All rights reserved. ibm.com/redbooks 1

2 Fabric Manager 5.2 In this section, we show you differences that were introduced in Fabric Manager (FM) 5.2. We assume that you have upgraded all of the switches in your fabrics to Fabric Operating System 5.2 and that you have installed Fabric Manager 5.2. In Figure 1, we show the layout of the Fabric Manager 5.2 client. There are major differences between the 5.1 and 5.2 layouts. Several of the major differences in the layout are: The 5.1 client has a single panel (Content pane) that displays information in either graphical or tabular form. The 5.2 client has two panels that display information: the View panel displays the topology and the Information panel displays tabular information. You can view both the topology and the tabular information at the same time. The 5.1 client has a fabric tree from which you can select fabric elements to monitor and manage. The 5.2 client does not have a fabric tree; you can select fabric elements from the View panel or the Information panel. Menu bar View panel Scope panel Task panel Information panel Figure 1 Fabric Manager 5.2 client window layout The major difference in the menus is that with Fabric Manager 5.2, you now access most tasks through the menu bar Tasks drop-down instead of the Configuration or Tools menu. You can also access many of these tasks by right-clicking the switch or the fabric when it is displayed in the View panel. Figure 2 on page 3 shows the tasks available from the drop-down Context menu. Tip: Double-clicking the SAN cloud opens that fabric and display the switches in the fabric. 2 Fabric Manager FICON 5.2 Quickstart

3 Context menu Figure 2 Tasks In FM 5.2, the View panel always displays a graphical topology view. The Information panel displays tabular views. In 5.2, you can view graphical and tabular information at the same time. The View panel allows you to display three types of SAN views. You select the type of SAN view that you want in the Scope panel from the View drop-down menu: SAN View displays all of the monitored fabrics in the database. This is the default view when you launch the Fabric Manager client. Fabric View displays the switches and their interconnectivity for a single fabric. Host-Storage View displays the end-to-end connectivity of all of the monitored fabrics. Figure 3 shows selecting the SAN view. Figure 3 Selecting SAN view You can select fabric elements in FM 5.2 from either the View panel or the Information panel. From the Scope panel displayed in Figure 4 on page 4, we have chosen to display the SAN View and to display by IP. Fabric Manager FICON 5.2 Quickstart 3

4 From the View panel, we right-clicked on the switch to show the options that are available to us. Figure 4 Selecting a fabric element In the topics that follow, we will point out the steps that we took and highlight any areas that we think you might overlook if you are familiar with Fabric Manager 5.1 and below. Our initial configuration is for a fabric called IP70. In our first examples, we focus on the switch, M We log in to Fabric Manager to display the fabric, IP70, and the other switches that constitute this fabric. In the Scope panel, we request a SAN View and to display the fabric by name. We show this in Figure 5. Figure 5 SAN view We double-click the fabric IP70 cloud icon to select that fabric and show the switches that it includes. Figure 6 on page 5 shows the switches in IP70. 4 Fabric Manager FICON 5.2 Quickstart

5 Figure 6 IP70 fabric Notice that now the Scope panel has changed to reflect the Fabric view. Launching switch admin Because we want to work with the director named M48256, we select the Admin functions for that director by right-clicking M48256 in the View panel, and then clicking Admin from the Context menu as shown in Figure 7 on page 6. Note: We select switches and use their context menus many times throughout this IBM Redpaper. We suggest that you familiarize yourself with this process. Fabric Manager FICON 5.2 Quickstart 5

6 Figure 7 Admin view After we right-click M48256 in the View panel, and click Admin from the Context menu, you will recognize the Admin windows if you are familiar with FM 5.1. We show the tabs in Figure 8 on page 7. 6 Fabric Manager FICON 5.2 Quickstart

7 Figure 8 Admin view and tab options FICON IBM automatically supports native FICON on Fabric OS and above for the IBM TotalStorage SAN256B director and the IBM TotalStorage SAN32B fabric switch. To incorporate and manage FICON on a switch or a fabric, you must have Fabric OS v4.1.2 or higher installed on your system (Fabric OS 5.0.1b or later for the SAN32B and SAN256B). In addition, your system must have Fabric OS 4.4 or higher installed (Fabric OS 5.0.1b or later for the SAN32B and SAN256B) in order to incorporate and manage the new FICON CUP feature on a switch. The SAN64B-2 (2005-B64) and the SAN18B-R (2005-R18) are supported from Fabric OS v5.2.0b or above. The following models and Fabric OS releases support FICON protocol: Model 2109-F32 Fabric OS v4.1.2 or later. Model 2109-M12, Fabric OS v4.1.2 or later. The dual domain configuration is supported; however, mixed FC-16 and FC2-16 port blade configurations are not supported. Model 2109-M14, Fabric OS v4.2.0 or later. The default one domain configuration is supported; however, dual domain configurations and mixed FC-16 and FC4-16 port blade configurations are not supported. Model 2005-B32, Fabric OS v5.0.1b or later. Model 2109-M48, Fabric OS v5.0.1b or later. A single domain configuration is supported with a mix of 16-port and 32-port blades (FC3416 and FC3432). Feature code (FC) 3450 or FC3450 in a 2109-M48, Fabric OS 5.2.0b or later is supported. FC3448 can exist in a FICON environment; however, FICON device connection to ports on these blades is not supported. Fabric Manager FICON 5.2 Quickstart 7

8 Model 2005-R18, Fabric OS 5.2.0b or later, but you must maintain the two hop FICONs. Model 2005-B64, Fabric OS 5.2.0b or later. Intermixed FICON and Fibre Channel Protocol FICON intermix allows you to run both FICON and Fibre Channel Protocol (FCP) through a shared director-class IBM TotalStorage SAN switch. FICON and Control Unit Port support There are two types of supported FICON configurations: A single-switch configuration, which is called switched point-to-point, requires that the channel is configured to use single-byte addressing. If you set the channel up for two-byte addressing, then the cascaded configuration setup applies. A cascaded configuration, which is also known as a high integrity fabric, requires a list of authorized switches. This authorization feature, which is called fabric binding, is available through Brocade Secure Fabric OS or the Access Control List (ACL) mechanisms. The fabric binding policy allows a predefined list of switches (domains) to exist in the fabric and prevents other switches from joining the fabric. FICON support of cascaded directors means that a native FICON (FC) channel or a FICON channel-to-channel (CTC) can connect a server to a device or other server using two same-vendor directors. FICON support of cascaded directors only supports a two-switch, single-hop configuration. You can use the FICON Management Server (FMS) to support switch management using Control Unit Port (CUP). IBM mainframe management programs use the CUP protocol to provide in-band management for FICON switches. To use this feature, you need to install the FICON with CUP license. To be able to use the CUP functionality, all switches in the fabric must have FICON Management Server mode (FMS mode) enabled. FICON Management Server mode is a per switch setting. After you enable FICON Management Server mode, you can activate a CUP license without rebooting the director. Next, we briefly discuss several of the basic functions available on the FICON CUP tab. For complete information, refer to the Brocade WebTools Administrator s Guide, Fabric Manager FICON 5.2 Quickstart

9 From within the Admin section of WebTools, we use the first tab, FICON Management Server Mode, under the FICON CUP tab to enable the FICON Management Server mode, as shown in Figure 9. Figure 9 FICON Management Server Mode tab of FICON CUP tab The first subpanel determines the mode of the FICON Management server, which is either enabled or disabled. The next subpanel is entitled FICON Management Server Behavior Control and displays several default settings that have already been defined. The Code Page subpanel displays the language that is used to exchange information with Host Programming. The Control Device Allegiance panel shows that the Control Device Allegiance is in a default neutral state. When it is neutral, the Control Device accepts commands from any channel, which has established a logical path with it and will accept commands from alternate managers. When the Control Device is switched, it establishes a logical path and accepts commands only from that logical path (device allegiance). Fabric Manager FICON 5.2 Quickstart 9

10 To check whether a switch has FMS mode enabled, you can also discover that from the Information panel as shown in Figure 10. Figure 10 FMS mode When FMS Mode is true, this indicates that FMS mode is enabled; false indicates that it is disabled. 10 Fabric Manager FICON 5.2 Quickstart

11 After we enable the FICON Management Server, we use the CUP Port Connectivity Configurations tab to configure the ports as shown in Figure 11. Figure 11 CUP Port Connectivity Configurations tab under FICON tab The CUP Port Connectivity Configurations tab shown in Figure 11 has a default view, which displays the CUP configuration list. The functions on this tab are: Activate Activate a configuration Edit Modify an existing configuration (that is inactive) Delete Delete a configuration Copy Copy a configuration New Create a new configuration We will discuss these topics later in greater depth in the context of building the FICON environment. Fabric Manager FICON 5.2 Quickstart 11

12 FICON quickstart In this topic, we discuss the basic steps to configure a switch for FICON in both a switched point-to-point and a cascaded configuration. We will discuss the basic FICON/mainframe steps that you need to perform. It is not our intent to show any of the steps on the mainframe; however, we highlight the considerations. Hardware Configuration Definition An I/O configuration defines the hardware resources available to the operating system and the connections among these resources. The resources include: Channels ESCON/FICON Directors (switches) Control units Devices You must define an I/O configuration to the operating system (software) and the channel subsystem (hardware). The Hardware Configuration Definition (HCD) element of z/os combines hardware and software I/O configuration information under a single interactive user interface. HCD also performs validation checking, which helps to eliminate errors before you attempt to use the I/O configuration. The output of HCD is an I/O definition file (IODF). An IODF is used to define multiple hardware and software configurations to the z/os operating system. When you activate an IODF, HCD defines the I/O configuration to the channel subsystem and/or the operating system. With the HCD activate function or the MVS ACTIVATE operator command, you can make changes to the current configuration without performing an initial program load (IPL) of the software or a power-on reset (POR) the hardware. Making changes while the system is running is known as dynamic configuration or dynamic reconfiguration. You select your I/O configuration when you: POR IPL Activate a dynamic configuration change IPL and activation require that you identify the IODF that contains the definition of your configuration. A data set called an I/O configuration data set (IOCDS) is used at POR. You can create an IOCDS from a configuration definition in an IODF. The IOCDS contains the configuration for a specific processor, while the IODF contains configuration data for multiple processors. Important: We highly recommend that you complete the FICON configuration for the switches before you attempt to bring any CHPIDs or Control Units online. You cannot finish the switch configuration until the HCD configuration is complete. 12 Fabric Manager FICON 5.2 Quickstart

13 We show an example topology, which uses double-byte addressing on all three directors, and the associated statements in Figure 12. RESOURCE PARTITION=((CF206400,D),(CF206401,C),(LPARMVSX,A),(LPARMVSY,E),(VMLPAR02,8)) * SWITCH=LOGICAL SWITCH NUMBER IN HEX CHPID PATH=(86),SHARED,PARTITION=((LPARMVSX,LPARMVSY),(VMLPAR02)),SWITCH=50,TYPE=FC CHPID PATH=(89),SHARED,PARTITION=((LPARMVSX,LPARMVSY),(VMLPAR02)),SWITCH=50,TYPE=FC CHPID PATH=(9E),SHARED,PARTITION=((LPARMVSX,LPARMVSY),(VMLPAR02)),SWITCH=51,TYPE=FC CHPID PATH=(A0),SHARED,PARTITION=((LPARMVSX,LPARMVSY),(VMLPAR02)),SWITCH=51,TYPE=FC * * UNIT=2032=CUP DEVICE IMPLEMENTATION ON SWITCH USING RESERVED PORT HEX 'FE' CHPIDS 86,89,9E,A0 CNTLUNIT CUNUMBR=EF50,PATH=(86,89),UNITADD=((00,001)), LINK=(50FE,50FE),UNIT=2032 CNTLUNIT CUNUMBR=EF51,PATH=(9E,A0),UNITADD=((00,001)), LINK=(51FE,51FE),UNIT=2032 CNTLUNIT CUNUMBR=EF52,PATH=(9E,A0),UNITADD=((00,001)), LINK=(52FE,52FE),UNIT=2032 * * * * LINK=DESTINATION PORT ADDRESS (SWITCH ADDRESS AND PORT ADDRESS) FOR EACH PATH CNTLUNIT CUNUMBR=07C0,PATH=(9E,A0),UNITADD=((00,255)), LINK=(5202,5202),CUADD=0,UNIT=2105 CNTLUNIT CUNUMBR=07D0,PATH=(9E,A0),UNITADD=((00,255)), LINK=(5202,5202),CUADD=1,UNIT=2105 CNTLUNIT CUNUMBR=0D01,PATH=(86,89,9E,A0),UNITADD=((00,255)), LINK=(5020,5020,5103,5103),CUADD=1,UNIT=2105 CNTLUNIT CUNUMBR=35A0,PATH=(9E,A0),UNITADD=((00,016)), LINK=(5204,5204),UNIT=3590 0D01 35A0 7C0/7D0 Figure 12 FICON environment IOCP definitions Note: There is no change to the IODEVICE or ID statements to support SAN. We do not describe the HCD definition process, because you must already be familiar with the HCD definition process before you attempt to code any of the statements shown in Figure 12. For more information about FICON, we recommend the FICON Implementation Guide, SG , which is available at: Configure the routing policy You only need to configure the routing policy for Condor ASIC-based products. Port-based path selection is a routing policy in which paths are chosen based on ingress port and destination only. This also includes user-configured paths. All switches with FICON devices attached must have port-based routing policy enabled. Port-based routing is a per switch routing policy. After you enable port-based routing, you can continue with the rest of the FICON implementation. To enable or disable port-based routing: 1. Click a switch with FICON devices attached from the View panel. 2. Launch the switch admin module by right-clicking on the switch, and then clicking Admin. Fabric Manager FICON 5.2 Quickstart 13

14 3. Click the FICON CUP tab. 4. The FICON CUP tab displays with the FICON Management Server Mode tab page in front as shown in Figure Check Enable in the Port Based Routing subpanel to enable the port-based routing policy. Click to remove the check from this box to disable port-based routing. 6. Click Apply to save your changes. Note: Check the Active=Saved Mode checkbox if you want to save the FICON CUP port connectivity configuration as an IPL file, in addition to activating the configuration. The next time the switch reboots, it loads the configuration from this IPL file. Figure 13 Enable port routing Enabling port-based routing means that all frames received on an ingress port destined for a destination domain are guaranteed to exit the switch in the same order in which they were received. Disabling Dynamic Load Sharing using the command-line interface If Dynamic Load Sharing (DLS) is enabled, traffic on existing inter-switch link (ISL) ports might be affected when one or more new ISLs is added between the same two switches. Specifically, adding the new ISL might result in dropped frames as routes are adjusted to take advantage of the bandwidth provided. You can only disable or enable DLS by using the command-line interface (CLI). 14 Fabric Manager FICON 5.2 Quickstart

15 Note: Using the Cascaded FICON utility, which we describe in Configure a fabric for cascaded FICON setup on page 34, automatically disables DLS. By disabling DLS, you ensure that there are no dropped frames. A similar situation occurs when you take an ISL port offline and then bring it back online. When the ISL port goes offline, the traffic on that port is rerouted to another ISL with a common destination. When the ISL port comes back online and DLS is enabled, the rerouting of traffic back to the ISL port might result in dropped frames. If DLS is not enabled, traffic will not be routed back. You can see how to disable (or also enable) DLS by using the CLI as shown in Example 1. Example 1 dlsreset M48256:admin> dlsshow DLS is set M48256:admin> dlsreset M48256:admin> dlsshow DLS is not set M48256:admin> FICON requires that DLS is not set. Configuring in-order delivery The routing software provides an option to guarantee in-order delivery even during fabric changes. This option is called in-order delivery (IOD). When IOD is set, the routing code enforces a hold-down period after an old route is deleted, before installing a new route to the same destination domain. The hold-down period is equal to E_D_TOV. The order of the delivery of frames is maintained within a switch and determined by the routing policy in effect. Next, we list the frame delivery behaviors for each routing policy. Note: In-order delivery is automatically set to on as part of the cascaded FICON utility process. See Configure a fabric for cascaded FICON setup on page 34 for more details. The frame delivery behaviors are: Port-based routing All frames, which are received on an ingress port destined for a destination domain, are guaranteed to exit the switch in the same order in which they were received. Exchange-based routing All frames, which are received on an ingress port for a given exchange, are guaranteed to exit the switch in the same order in which they were received. Because different paths are chosen for different exchanges, this policy does not maintain the order of frames across exchanges. If even one switch in the fabric delivers out-of-order exchanges, then exchanges are delivered to the target out-of-order, regardless of the policy configured on other switches in the fabric. Fabric Manager FICON 5.2 Quickstart 15

16 Port-based routing is required for FICON. To configure in-order delivery (IOD), click the Routing tab from the Switch Admin tab of the switch that you are configuring (Figure 14 on page 16). Figure 14 In-Order Delivery In-Order Delivery is now set. Configuring Domain ID and Insistent Domain ID In a cascaded configuration, each switch must have a unique Domain ID, and the Insistent Domain ID (IDID) mode must be enabled. When the Insistent Domain ID (IDID) Mode is enabled, the current domain setting for the switch is insistent; that is, the same ID is requested during switch reboots, power cycles, CP failovers, firmware downloads, and fabric reconfiguration. Note: Insistent Domain ID is set on automatically as part of the cascaded FICON utility process. See Configure a fabric for cascaded FICON setup on page 34 for more details. If you do not assign the Insistent Domain ID, the channel will fail the query for security attributes, and the channel will not come online. This parameter is required for use with FICON only. The Query Security Attributes (QSA) exchange is used by the host to determine that the fabric meets the above requirements. 16 Fabric Manager FICON 5.2 Quickstart

17 Note: A QSA is an extended link service (ELS) that a FICON host will send to determine fabric integrity. QSA is a snapshot of the fabric at login time; the host will discover changes in security attributes at the next login. A QSA is issued when the channel is configured for 2-byte addressing to check whether the IDID and Fabric binding bits are set. If they are not, QSA returns FALSE and the channel will not vary online. To set a unique Domain ID and enable IDID mode, we will complete the following steps. Note: There are two methods to set the IDID mode and we will show both of them. Setting unique Domain ID process The steps are: 1. Connect to the switch and launch Admin. 2. Click the Switch tab. 3. Disable the switch. 4. Verify that the switch has a unique Domain ID. If it does not, set a unique Domain ID. 5. Set IDID. We disable the switch and check the Domain ID, as shown in Figure 15. Figure 15 Disable switch We confirm our action by clicking Yes as shown in Figure 16 on page 18. Fabric Manager FICON 5.2 Quickstart 17

18 Figure 16 Confirm disable Verify that the switch has a unique Domain ID (5 in our case) as shown in Figure 17. Figure 17 Domain ID The Domain ID is an integer between 1 and Fabric Manager FICON 5.2 Quickstart

19 Setting Insistent Domain ID Mode (method one) To set the Insistent Domain ID Mode: 1. Go to the Configure tab and enable Insistent Domain ID Mode by clicking in the checkbox as shown in Figure 18. Figure 18 Insistent Domain ID Mode 2. After verifying that the Domain ID is unique, and that Insistent Domain ID Mode is set, we click Enable under Switch Status. Click Apply. This enables the switch as shown in Figure 19. Figure 19 Enable switch Fabric Manager FICON 5.2 Quickstart 19

20 We confirm that we want to enable the switch by clicking Yes as shown in Figure 20. Figure 20 Confirm enabling switch We have now set a unique Domain ID and set Insistent Domain ID mode. Note: You must set both of these values on an individual switch basis. Setting Insistent Domain ID Mode (method two) The second method for setting the IDID is to use the GUI to select the switch as shown in Figure 21 on page 21. Right-click the switch to select Insistent Domain ID (IDID). 20 Fabric Manager FICON 5.2 Quickstart

21 Figure 21 Right-click to select IDID You are prompted to confirm the action as shown in Figure 22 on page 22. Note: You will need to enable the switch manually after configuring IDID. Fabric Manager FICON 5.2 Quickstart 21

22 Figure 22 Switch disable confirmation Clicking Yes will disable the switch and the Admin window for the switch will open. Click the Switch tab, and then select Enable and click Apply to enable the switch as shown in Figure 23. Figure 23 Enabling the switch Click Yes on the Confirm Action window to enable the switch. IDID is now set on the switch. Access Control Lists With FM 5.2, the security features have been changed to remove the dependence on a public key infrastructure (PKI) but still deliver selected security policy enforcement mechanisms without requiring a Secure Mode. 22 Fabric Manager FICON 5.2 Quickstart

23 Access Control List (ACL) support has moved from Secure Fabric OS (SFOS) and does not require a license key. Therefore, you now have the ability to create a cascaded FICON without SFOS. However, there will be limitations in the first release. In the Fabric OS release, there will be no support for ACL configuration under each Admin Domain (AD), and none of the policy configurations will be validated with AD membership. This means that ACL configuration CLIs will be executable only in AD0 and AD255. Also, the FICON administrator using v5.2.0 does not need to learn about Admin Domain configurations, because FICON configurations requiring a high integrity fabric will use the default Admin Domains of AD0 and AD255. The Fabric OS ACL mechanisms and SFOS are mutually exclusive. Switches and directors that upgrade to Fabric OS can continue to run SFOS if you choose, and the security license is installed. However, if you want to take advantage of the built-in ACL mechanisms of Fabric OS that do not require a license, you must first disable Secure Mode on SFOS. Managing Access Control Lists For switches running Fabric OS v5.2.x and higher, you can create and activate Switch Connection Control (SCC) and Device Connection Control (DCC) policies in the base Fabric OS that are functionally equivalent to the SCC and DCC policies supported in Secure Fabric OS. In Secure Fabric OS, these polices are fabric-wide. In the base Fabric OS (for Fabric OS v5.2.x and higher), these polices are switch-based; however, you can distribute these policies to all switches in the fabric. To manage the ACL policies, you must meet the following requirements: You can select only one switch at a time. Note: You can manage ACL on an entire fabric when you use Configure for Cascaded FICON Mode. The switch must be running Fabric OS v5.2.x or higher. Security must not be enabled on the fabric. Your user account must have either the Admin or Fabric Admin role for ACL management. Fabric Manager launches WebTools to manage the ACL policies. The following procedure describes how to launch the WebTools Switch Admin module from Fabric Manager. To manage ACL policies, we right-click a switch (M48256) and select ACL Management from the context menu that appears (alternatively, you can select a switch and then click Tasks Switch Management ACL Management from the Menu bar), as shown in Figure 24 on page 24. Fabric Manager FICON 5.2 Quickstart 23

24 Figure 24 ACL management from the context menu The Switch Admin module launches with the ACL - Switch Connection Control Policy tab selected, as shown in Figure 25. We click Edit to go to the ACL Policy Configuration Wizard in Figure 26. The ACL Policy Configuration Wizard allows you to create or edit SCC and DCC policies. Figure 25 ACL admin 24 Fabric Manager FICON 5.2 Quickstart

25 Figure 26 shows the ACL Policy Configuration Wizard that appears after we click Edit. Figure 26 Select policy If we select the Switch Connection Control Policy (SCC) and click Next, a window similar to Figure 27 displays that shows the defined SCC policy set. We can click Modify to select switches to include or remove from the policy. Figure 27 SCC Policy Configuration Figure 28 shows the switches that we can select. We will add switch M Fabric Manager FICON 5.2 Quickstart 25

26 Figure 28 SCC policy configuration Figure 29 shows the changes that we make. We click Finish to complete the process. Figure 29 Confirmation You can set the SCC Fabric Wide (policy) Consistency Behavior. Select the Distribution tab from Switch Admin; see Figure Fabric Manager FICON 5.2 Quickstart

27 Figure 30 Setting Consistency Behavior The options that you have to set the behavior are: Absent Tolerant Strict For FICON, you must set the Consistency Behavior to Strict. Cascaded FICON setup In the following topics, we will use Fabric Manager 5.2 to configure a fabric for cascaded FICON and to merge two fabrics for cascaded FICON. We will show: How to enable Secure Mode How to disable Secure Mode How to configure a fabric for cascaded FICON How to merge two fabrics Enabling and disabling Secure Mode You enable and disable Secure Mode on a fabric-wide basis. You can enable and disable Secure Mode as often as you choose; however, all Secure Fabric OS policies, including the Fabric Configuration Server (FCS) policy, are deleted each time that you disable Secure Mode. You must recreate the Secure Fabric policies the next time that you enable Secure Mode. With FM 5.2, the process has become simpler with the introduction of wizards to guide you through the work that previously you had to perform manually. Enabling Secure Mode In the process, we show you how to enable Secure Mode for the fabric IP70. To enable Secure Mode, you must install the following licenses: Secure Fabric OS license (Security license) Fabric Manager FICON 5.2 Quickstart 27

28 Advanced Zoning license (Zoning license) And although it is optional, at some stage you might require or need: FICON CUP license Figure 31 on page 28 shows the window where we have highlighted and right-clicked on the fabric IP70 in order to select Enable Secure Mode from the context menu. Note: We are going to enable Secure Mode on a fabric that is currently in ACL mode. You can use this process to convert from ACL mode to Secure Mode. Figure 31 Enable Secure Mode We click Enable Secure Mode, and now, we enter the wizard to enable Secure Mode. Figure 32 shows the start of the process. 28 Fabric Manager FICON 5.2 Quickstart

29 Figure 32 Overview The switch that we will use has this IP address, , so we select this IP address to use for the Fabric Configuration Server (FCS) switch. Figure 33 shows this selection. Figure 33 FCS selection The next option allows us to keep the current passwords or choose new passwords. We elect to keep the same passwords, so we check the Keep Current Passwords box. Figure 34 shows this action. Fabric Manager FICON 5.2 Quickstart 29

30 Figure 34 Passwords At the next window (Figure 35 on page 30), we choose the security level that we want. We choose to accept Low and make no changes to those policy names that are already checked. Figure 35 Security policies After we have made our choice and clicked Next, we confirm our actions before clicking Finish. Figure 36 shows this confirmation window. 30 Fabric Manager FICON 5.2 Quickstart

31 Figure 36 Confirmation After we click Finish, a warning window asks us to reconfirm our choice. Figure 37 on page 31 shows this warning window. Figure 37 Enabling Secure Mode warning We click Yes to start the process. After it has completed, we see the message window shown in Figure 38. Fabric Manager FICON 5.2 Quickstart 31

32 Figure 38 Secure Mode is enabled To confirm that we have been successful, now we look at the SAN view, and now we can see that the IP70 cloud in the View panel now has the Secure Mode padlock associated with it. Figure 39 shows this padlock. Figure 39 Secure Mode padlock 32 Fabric Manager FICON 5.2 Quickstart

33 You can use Secure Mode to secure the fabric if the Fabric OS levels are not all at v5.2.0 or higher. Disabling Secure Mode Now that we have enabled Secure Mode, we will disable it on the IP70 fabric so that we can configure it for cascaded FICON setup using ACL mode and the wizard. The wizard will only work if Secure Mode is disabled. After you disable Secure Mode, we still need to configure the fabric for cascaded FICON to fully implement and activate ACL mechanisms and mode. Important: You need to convert security in the switch while no other support element activity is occurring, such as taking channel paths online or offline, performing an IPL, or activating partitions. If a channel path changes state while you are in the middle of changing security, the channel or channels will go to definition error status as displayed on the support element. To recover the channel path, you must take the specified channel path offline or online after the ACL process has completed. Converting security does not disrupt current activity (jobs) running on the mainframe. In Figure 40 on page 33, we right-click IP70 and from the context menu, we select Security Disable Secure Mode. Figure 40 Disable Secure Mode After we click Disable Secure Mode, we get the warning shown in Figure 41 asking if we want to disable Secure Mode. Fabric Manager FICON 5.2 Quickstart 33

34 Figure 41 Warning We click Yes and Secure Mode is disabled as shown in Figure 42 on page 34. Figure 42 Secure Mode disabled Currently, we do not have any security enabled in our fabric and we need to correct that. At the same time, we also want to implement ACL mode, and we do this by configuring the fabric for cascaded FICON. Configure a fabric for cascaded FICON setup In this example, we show the process to configure a fabric for cascaded FICON setup. Many of the steps that you previously performed manually are now performed automatically as part of the cascaded FICON utility. The cascaded FICON utility: Turns on the Insistent Domain ID flag (IDID) on all switches. Enables port-based routing on 4 Gbps platform switches. Disables Dynamic Load Sharing (DLS) on all switches. Enables In-Order Delivery (IOD) on all switches. Sets High Integrity Fabric Configuration (HIFC) on the seed switch: Configures a fabric-wide consistency policy to include SCC in strict mode. 34 Fabric Manager FICON 5.2 Quickstart

35 Creates or modifies the SCC policy to limit connectivity to only the switches in the selected fabric. (Optional) Turns on FICON Management Server (FMS) mode on all switches. If some switches already have FMS mode enabled, it is re-enabled. Fabric Manager performs a Role Based Access Control (RBAC) check on all the switches in the fabric for the operations listed, except for setting HIFC, for which Fabric Manager performs an RBAC check on the seed switch only. If the RBAC check fails for any operation on any switch, an error message displays listing the errors for each failed operation. If you select FMS mode to be enabled on all switches and some of the switches do not have a CUP license, then after you complete successful configuration, you can access the Port Connectivity (PDCM) matrix, but the host system cannot communicate with the FICON Management Server unless you install a CUP license. If you later install a CUP license on these switches, then you must re-enable FMS mode on these switches. In Figure 43 on page 35, we select Tasks Cascaded FICON Setup Configure a fabric for cascaded FICON setup. Figure 43 Cascaded FICON setup We select our fabric, IP70, for the fabric to configure as shown in Figure 44. Fabric Manager FICON 5.2 Quickstart 35

36 Figure 44 Select fabric We also elect to turn on FMS mode for all switches by checking the box to the left of Turn ON FMS mode on all switches. Then, the pop-up window tells us which actions will be carried out. The actions are: Turn ON Insistent Domain ID (IDID) flag on all switches. Set High Integrity Fabric Configuration (HIFC) on the seed switch. (Set switch connection control policies on all switches to limit connectivity to only the switches in the selected fabric): Configure fabric-wide consistency policy to include SCC in strict mode. Create or modifies SCC policy to limit connectivity to only the switches in the selected fabric. Enable port-based routing on 4 Gbps platform switches. Disable Dynamic Load Sharing (DLS) on all switches. Enables In-Order Delivery (IOD) on all switches. (Optional) Turn on FICON Management Server (FMS) mode on all switches. If some switches already have FMS mode enabled, it is re-enabled. As a consequence of all these actions, an Activate of the SCC policy is carried out and ACL mode security for the fabric is implemented. Figure 45 confirms that we have been successful. 36 Fabric Manager FICON 5.2 Quickstart

37 Figure 45 Successful configuration Now that we have successfully configured IP70 for FICON setup, we will show you the process to merge two fabrics that have both been configured for cascaded FICON setup. Merge two fabrics for cascaded FICON setup Fabric Manager provides a wizard that merges two fabrics for cascaded FICON. You must be a physical fabric administrator on both fabrics that you want to merge. In the following example, we merge two fabrics: IP70 and BeeJay. These fabrics are shown in Figure 46 on page 38. Fabric Manager FICON 5.2 Quickstart 37

38 Figure 46 Fabrics to merge Figure 47 shows how we select the utility. Select Tasks Cascaded FICON Setup Merge two fabrics for cascaded FICON setup. Figure 47 Merge fabrics Figure 48 on page 39 shows an overview of the process that is about to occur. Fabric Manager performs the following operations on the selected fabrics: Check the fabrics for any merge issues. Turn on the Insistent Domain ID (IDID) flag on all of the switches in both fabrics. 38 Fabric Manager FICON 5.2 Quickstart

39 Clear Admin Domain, Access Control Lists (ACLs), and Zoning databases, if they exist, from one of the fabrics (you select which fabric from within the wizard). Configure High Integrity Fabric Configuration (HIFC) on the seed switch of the other fabric: Configure fabric-wide consistency policy to include SCC in strict mode. Create or modify the SCC policy to limit connectivity to only the switches in both fabrics. Enable port-based routing on 4 Gbps platform switches. Disable Dynamic Load Sharing (DLS) on all switches. Enable In-Order Delivery (IOD) on all switches. (Optional) Turn on FICON Management Server (FMS) mode on all switches. If some switches already have FMS mode enabled, it is re-enabled. (Optional) Configure long distance setting on selected ports (requires extended fabric license). If you select FMS mode to be enabled on all switches and if some of the switches do not have a CUP license, then after successful configuration, you can access the Port Connectivity (PDCM) matrix, but the host system cannot communicate with the FICON Management Server unless you install a CUP license. If you install a CUP license later on these switches, then you must re-enable FMS mode on these switches. Figure 48 Overview At least two of the discovered fabrics must meet the requirement that all switches must be running Fabric OS v5.2.0 or higher; otherwise, an informational dialog displays and the wizard does not launch. Note: Only fabrics with Secure Mode disabled will be discovered. You can see the fabrics that we are going to merge in Figure 49 on page 40. Fabric Manager FICON 5.2 Quickstart 39

40 Figure 49 Select fabrics The rest of the process is self-explanatory and driven by the wizard, so we will only show the window process flow. Figure 50 on page 41 allows us to set FMS mode and select the fabrics. This part of the process will clear the Admin Domain, the Access Control Lists (ACLs), and the zone databases, if they exist, from one of the fabrics (you select which fabric from within the wizard). Note: Clearing the ACL database in a large fabric might take a long time; for example, in a 50 switch fabric, this operation might take from 30 minutes to one hour. In our case, we have a small fabric (one switch) joining a much larger fabric so we choose to clear the ACL database on the small fabric. 40 Fabric Manager FICON 5.2 Quickstart

41 Figure 50 Set FMS mode on and select fabric Figure 51 shows the result of the merge check, and the message states that the merge check was successful, so our merge will be successful. Figure 51 Merge check Fabric Manager FICON 5.2 Quickstart 41

42 In Figure 52, we can optionally set our long distance configuration, but we choose to continue the process without setting our long distance configuration. Figure 52 Long distance configuration Figure 53 on page 43 shows a summary of the actions that occur when the fabrics merge. This is your last chance to back out. We click Finish to complete the merge. 42 Fabric Manager FICON 5.2 Quickstart

43 Figure 53 Summary Figure 54 shows we have been successful. Figure 54 Summary status Figure 55 on page 44 shows a view of the SAN fabric. BeeJay has now been merged into IP70. Fabric Manager FICON 5.2 Quickstart 43

44 Figure 55 SAN view This completes the merge of our fabrics. Enabling FICON CUP Host-based management programs manage switches using CUP protocol by sending commands to an emulated control device in Fabric OS. A switch that supports CUP can be controlled by one or more host-based management programs, as well as by WebTools. A mode register controls the behavior of the switch with respect to CUP and the behavior of other management interfaces. You must install the FICON CUP license, enable FICON Management Server (FMS) mode, and set the configure CUP attributes (FMS parameters) for the FICON director on the switch to enable CUP management features. Enabling FMS mode When you enable FMS mode, Fabric OS prevents local switch commands from interfering with host-based management commands by initiating serialized access to switch parameters. If you plan to use more than one switch in the FICON CUP fabric, you must either install Secure Fabric OS or enable the Fabric OS v5.2.0 ACL mechanism. To enable FMS mode from the FICON CUP tab, select Enable under FICON Management Server Mode as shown in Figure 56 on page Fabric Manager FICON 5.2 Quickstart

45 Figure 56 FMS mode To verify that FMS mode is set, we select the switch (M48256) and click the Overview tab. From the resultant display by paging down, we can see that FMS Mode is set for the switch as shown in Figure 57 on page 46. Fabric Manager FICON 5.2 Quickstart 45

46 Figure 57 FMS Mode is true Enabling FMS parameters FMS parameters control the behavior of the switch with respect to CUP, as well as the behavior of other management interfaces, such as the director console and Alternate Managers. You can configure FMS parameters for a switch only after you enable FMS mode on the switch. All FMS parameter settings are persistent across switch power cycles. There are six FMS parameters: Programmed Offline State Control This parameter controls whether host programming is allowed to set the switch offline. The parameter is set as enabled by the hardware after system installation and can be reset by WebTools. Active=Saved Mode This parameter controls the IPL file update. The IPL file saves port connectivity attributes and port names. After a switch reboot or power cycle, the switch reads the IPL file and activates its contents as the default configuration. When Active=Saved Mode is enabled, activating a configuration saves a copy to the IPL configuration file. All changes made to the active connectivity attributes or port names by host programming or alternate 46 Fabric Manager FICON 5.2 Quickstart

47 managers are saved in this IPL file. It keeps the current active configuration persistent across switch reboots and power cycles. You cannot directly modify the IPL file or save a file as an IPL file. When you disable this mode, the IPL file is not altered for either new configuration activation or any changes made on the current active configuration. This parameter is set as enabled by the hardware after system installation, and you can reset it using WebTools. Note: When FMS mode is enabled and the Active=Saved parameter is disabled, you can enable and disable ports, but the setting is not persistent. When the Active=Saved parameter is enabled, you can enable and disable ports and the setting is persistent. Alternate Control Prohibited This parameter determines whether alternate managers are allowed to modify port connectivity. Enabling this mode prohibits alternate manager control of port connectivity; otherwise, alternate managers can manage port connectivity. This parameter is set as enabled by the hardware after system installation, and you can reset it using WebTools. User Alert Mode This parameter controls director console behavior for alerts. Enabling this mode prompts the director consoles to display a warning whenever you attempt an action that will change switch parameters. When you disable this mode, no warning is displayed. In this case, in which WebTools is the director console, WebTools displays warning messages regardless of the setting of the parameter, because WebTools always displays warning messages when you apply a change to a switch that changes parameters. This parameter is always read-only in WebTools. Each time that the switch is powered on, the parameter is reset to disabled. Director Clock Alert Mode This parameter controls behavior for attempts to set the switch timestamp clock through the director console. When it is enabled, the director console (WebTools, in this case) displays warning indications when the switch timestamp is changed by a user application. When it is disabled, you can activate a function to automatically set the timestamp clock. There is no indication for timestamp clock setting. This parameter is set as disabled by the hardware after system installation, and you can reset it by using WebTools. Host Control Prohibited This parameter determines whether host programming allows modifying port connectivity. Enabling this mode prohibits host programming control of port connectivity; otherwise, host programming can manage port connectivity. This parameter is set as disabled by the hardware after system installation, and you can reset it by using WebTools. You set the FMS parameters on the same window that you use to enable FMS mode as shown in Figure 58 on page 48. Fabric Manager FICON 5.2 Quickstart 47

48 Figure 58 FMS parameters Configuring port connectivity The Port Dynamic Connectivity Mask (PDCM) is a mechanism to define port connectivity (also referred to as prohibit/allow). We click the CUP Port Connectivity tab as shown in Figure 59 on page Fabric Manager FICON 5.2 Quickstart

49 Figure 59 CUP Port Connectivity tab In the CUP Port Connectivity Configurations panel (shown in Figure 60 on page 50), you can manage the configuration files and active configuration. The CUP Port Connectivity Configurations panel lists all CUP configuration files and the active configuration. The active configuration is listed as Active Configuration* and the description in the table is Current active configuration on switch. The other special configuration file is the IPL. Any other files that display are user-defined configurations and are stored on the switch. Fabric Manager FICON 5.2 Quickstart 49

50 Figure 60 CUP Port Connectivity Within FM 5.2, Figure 61 shows a second way for you to display CUP Port Connectivity. Figure 61 Port Address Configuration 50 Fabric Manager FICON 5.2 Quickstart

51 You can create, activate, copy, or delete saved CUP port connectivity configurations; however, you can only edit or copy a configuration while it is active. You can also activate, edit, or copy the IPL configuration. You must enable FMS mode before you can make any changes to the configurations. Click Refresh to get the latest configuration file list from the switch. When creating a new configuration or editing an existing configuration, remember that the WebTools port name input is restricted to printable ASCII characters. Therefore, when WebTools displays a port name, if there are characters beyond printable ASCII characters (which would have been created by the Host Program), those characters display as dots (.). When initially installed, a switch allows any port to dynamically communicate with any other port. Two connectivity attributes are defined to restrict this any-to-any capability for external ports: Block and Prohibit. Block is a port connectivity attribute that prevents all communication through a port. Prohibit is the port connectivity attribute that prohibits or allows dynamic communication between ports when a port is not blocked. Each port has a vector specifying its Prohibit attribute with respect to each of the other ports in the switch. This attribute is always set symmetrically in that a pair of ports is either prohibited or allowed to communicate dynamically. Figure 62 shows how we select a configuration for editing. We highlight the configuration and click Edit. Figure 62 Selecting configuration The Port Connectivity table (shown in Figure 63 on page 52) displays the Port number (in physical-location format), Port Name (port address name), Block attribute, Prohibit attribute, and Area ID (port address, which is displayed in hexadecimal format) in fixed columns. The right side is a port matrix, which lists all ports by Area ID and identifies prohibited ports. Those columns are scrollable and swappable. Fabric Manager FICON 5.2 Quickstart 51

52 Figure 63 Port Connectivity Configuration table To create or edit CUP port connectivity configurations, display the CUP Port Connectivity Configuration list as shown in Figure 63. In this case, we have chosen to edit an existing configuration. The Create Port CUP Connectivity Configuration dialog displays all ports and port names on the selected switch. The Block column, Prohibit column, and prohibited ports matrix display as empty: Optional: Check the checkbox corresponding to a port that you want to block on the Block column. Repeat this step for all the ports that you want to block. Click the Block All checkbox to block all ports. Optional: Check the checkbox corresponding to a port that you want to prohibit on the Prohibit column. Repeat this step for all ports that you want to prohibit. Click the Prohibit All checkbox to prohibit all ports. The cells in the matrix are updated with X icons to identify prohibited ports. Optional: Click the individual cells corresponding to the combination of ports that you want to prohibit. You cannot prohibit a port to itself. 52 Fabric Manager FICON 5.2 Quickstart

53 Review your changes. A blue background in a cell indicates that its value has been modified. After you have finished making changes, you can do any of these actions: Click Activate to save the changes and make the configuration active immediately. Click Save to save the changes but not make the configuration active. Click Refresh to refresh the information from the switch. Click Cancel to cancel all changes without saving. Click Save As to save the configuration to a new configuration file. When you click Save As, a dialog displays allowing you to type a file name and description for the configuration file. In Figure 64, we show the matrix with the selections that we have made. Figure 64 Port Connectivity Configuration matrix Activating CUP port connectivity When you activate a saved CUP port connectivity configuration on the switch, the preceding configuration (that is to say the one that is currently active) is overwritten. To activate a saved CUP port connectivity configuration, display the CUP Port Connectivity Configuration list, click to select the saved configuration from the list, and click Activate. Figure 65 on page 54 shows how we select the IPL CUP Port Connectivity Configuration and activate it. Fabric Manager FICON 5.2 Quickstart 53