CA2410932C - Hardware-enforced loop-level hard zoning for fibre channel switch fabric - Google Patents
Hardware-enforced loop-level hard zoning for fibre channel switch fabric Download PDFInfo
- Publication number
- CA2410932C CA2410932C CA2410932A CA2410932A CA2410932C CA 2410932 C CA2410932 C CA 2410932C CA 2410932 A CA2410932 A CA 2410932A CA 2410932 A CA2410932 A CA 2410932A CA 2410932 C CA2410932 C CA 2410932C
- Authority
- CA
- Canada
- Prior art keywords
- port
- destination
- frame
- fabric
- fibre channel
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/02—Details
- H04L12/22—Arrangements for preventing the taking of data from a data transmission channel without authorisation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/35—Switches specially adapted for specific applications
- H04L49/356—Switches specially adapted for specific applications for storage area networks
- H04L49/357—Fibre channel switches
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/30—Peripheral units, e.g. input or output ports
- H04L49/3009—Header conversion, routing tables or routing tags
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/35—Switches specially adapted for specific applications
- H04L49/351—Switches specially adapted for specific applications for local area network [LAN], e.g. Ethernet switches
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/40—Constructional details, e.g. power supply, mechanical construction or backplane
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10—TECHNICAL SUBJECTS COVERED BY FORMER USPC
- Y10S—TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10S707/00—Data processing: database and file management or data structures
- Y10S707/99931—Database or file accessing
- Y10S707/99939—Privileged access
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Small-Scale Networks (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Electronic Switches (AREA)
- Switches With Compound Operations (AREA)
- Switches Operated By Changes In Physical Conditions (AREA)
- Near-Field Transmission Systems (AREA)
Abstract
Hardware-enforced zoning is provided in Fibre Channel switches to protect against breaching of assigned zones in a switch network which can occur with software-based zoning techniques. The invention provides logic for performing a hardware-based validation of the Source ID S_ID of frames both at the point where the frame enters the Fibre Channel fabric, and at the point where the frame leaves the fabric. The S_ID is verified against an inclusion list or table of allowable S_IDs, which can be unique for each fabric port. The invention provides a way to increase the range of sources an inclusion table can express, by implementing wild cards, on an entry-by entry basis. If the S_ID is valid, it will enter the fabric and route normally. If invalid, the frame will not be routed but will be disposed of by the fabric according the FC rules. This prevents incorrect S_IDs from breaching the table-driven zoning at the point where frames exit the fabric, to prevent unauthorized access to devices connected to the switch network.
Description
HARDWARE-ENFORCED LOOP-LEVEL HARD ZONING
FOR FIBRE CHANNEL SWITCH FABRIC
Field of the Invention This invention pertains generally to the field of high performance switching, and in particular to improvements in Fibre Channel switching to provide the establishment of zones for permitted access to connected devices, with hardware-enforcement of the zoning.
Background of the Prior Art The Fibre Channel standard has been established to provide for high performance switching solutions for computing and data handling systems.
Examples of applications where the high speed and high bandwidth of Fibre Channel switches may be used to advantage include interconnecting computers and high-performance storage devices, interconnecting computers in multiple-computer operating environments, and anywhere multiple high-speed data interconnections must be established between designated nodes or groups of nodes in data handling networks.
The Fibre Channel standard, ANSI X3.T11, broadly defines classes and standards of function and performance, but does not dictate the implementation technologies to be used in providing these functions. A particular design of a switch to implement Fibre Channel functions is referred to as the 'fabric' of the switch. As this invention is directed to improvements in Fibre Channel switches, the description of the invention herein uses terminology and other defined terms from the field of Fibre Channel (referred to by the notation "FC"below) switches, and the FC standard may be consulted for definitions.
For data integrity and security reasons, it is necessary in some networks to make certain that certain hosts or devices have controlled access. For example, certain hosts may be allowed access to only certain storage devices, and vice versa. This requirement means that certain channels or groups of channels to which the affected hosts or devices are attached must be isolated from communication to or from other channels or groups of channels. Zoning techniques are used in prior art systems to define zones of addresses that will be considered valid for various sources or destinations connected to a switch.
Soft Zoning: The Problem A problem with Fibre Channel zoning as it presently exists is that it is software-enforced zoning, often referred to as soft zoning. In soft zoning, devices connected to N Ports and NL Ports of the FC fabric login to the fabric and make queries of the Name Server to determine which of the remote devices this device can communicate with, along with their FC addresses (D IDs). The Name Server defines and enforces the zones by listing in the login response the set of devices (by D ID) that are in the login requester's zone or zones. In this manner, devices honor zones by using only those D IDs given out by the Name Server.
However, this works only if all devices follow the rules, and there are no hardware failures. Soft zoning can be breached in the following ways.
~ Zones can be breached inadvertently by HBA software errors that generate incorrect D IDs.
~ Zones can be breached by hardware failures, where the D ID is corrupted somewhere between the source device and the destination device.
~ Zones can be breached deliberately by ill-mannered but non-malicious HBAs, such as those that walk through all D ms to discover where other HBAs are attached.
~ Zones can be breached maliciously by HBAs where the intent is to disrupt a system.
Summary of the Invention The present invention solves the problems discussed which are inherent with soft zoning systems by providing hardware-enforced zoning, also referred to herein as hard zoning. Hard zoning prevents breaching of assigned zoning by the accidental or intentional soft zoning problems discussed above, therby improving system data integrity and security.
FOR FIBRE CHANNEL SWITCH FABRIC
Field of the Invention This invention pertains generally to the field of high performance switching, and in particular to improvements in Fibre Channel switching to provide the establishment of zones for permitted access to connected devices, with hardware-enforcement of the zoning.
Background of the Prior Art The Fibre Channel standard has been established to provide for high performance switching solutions for computing and data handling systems.
Examples of applications where the high speed and high bandwidth of Fibre Channel switches may be used to advantage include interconnecting computers and high-performance storage devices, interconnecting computers in multiple-computer operating environments, and anywhere multiple high-speed data interconnections must be established between designated nodes or groups of nodes in data handling networks.
The Fibre Channel standard, ANSI X3.T11, broadly defines classes and standards of function and performance, but does not dictate the implementation technologies to be used in providing these functions. A particular design of a switch to implement Fibre Channel functions is referred to as the 'fabric' of the switch. As this invention is directed to improvements in Fibre Channel switches, the description of the invention herein uses terminology and other defined terms from the field of Fibre Channel (referred to by the notation "FC"below) switches, and the FC standard may be consulted for definitions.
For data integrity and security reasons, it is necessary in some networks to make certain that certain hosts or devices have controlled access. For example, certain hosts may be allowed access to only certain storage devices, and vice versa. This requirement means that certain channels or groups of channels to which the affected hosts or devices are attached must be isolated from communication to or from other channels or groups of channels. Zoning techniques are used in prior art systems to define zones of addresses that will be considered valid for various sources or destinations connected to a switch.
Soft Zoning: The Problem A problem with Fibre Channel zoning as it presently exists is that it is software-enforced zoning, often referred to as soft zoning. In soft zoning, devices connected to N Ports and NL Ports of the FC fabric login to the fabric and make queries of the Name Server to determine which of the remote devices this device can communicate with, along with their FC addresses (D IDs). The Name Server defines and enforces the zones by listing in the login response the set of devices (by D ID) that are in the login requester's zone or zones. In this manner, devices honor zones by using only those D IDs given out by the Name Server.
However, this works only if all devices follow the rules, and there are no hardware failures. Soft zoning can be breached in the following ways.
~ Zones can be breached inadvertently by HBA software errors that generate incorrect D IDs.
~ Zones can be breached by hardware failures, where the D ID is corrupted somewhere between the source device and the destination device.
~ Zones can be breached deliberately by ill-mannered but non-malicious HBAs, such as those that walk through all D ms to discover where other HBAs are attached.
~ Zones can be breached maliciously by HBAs where the intent is to disrupt a system.
Summary of the Invention The present invention solves the problems discussed which are inherent with soft zoning systems by providing hardware-enforced zoning, also referred to herein as hard zoning. Hard zoning prevents breaching of assigned zoning by the accidental or intentional soft zoning problems discussed above, therby improving system data integrity and security.
Hard zoning solves the soft zoning problems by using a hardware check of the frame's Source ID (S_ID) both at the point the frame enters the fabric, and at the point the frame leaves the fabric.
As shown in Fig. 1, according to the invention, the frame S ID is validated at the point the frame enters the fabric (at an F Port or FL Port, but not an E Port) to prevent incorrect S IDs from breaching the table-driven zoning at the point where frames exit the fabric. If the S ID is valid, it will enter the fabric and route normally. If invalid, the frame will not be routed but will be disposed of by the fabric according to FC rules.
The frame S m is validated at the point the frame exits the fabric (at an F Port or FL Port, but not an E Port), to insure that the frame, based on the S ID, is part of the zone or zones that the attached N Port or NL Port belongs to. Frame S IDs are compared against a list of S IDs that are valid for that port, where the size of the list is implementation-dependent, and where each entry defines a source that is allowed to transmit frames to this destination. If the S ID matches an entry in the list, it is routed out of the fabric to the destination.
If the S ID does not match any entry in the list, the frame is not passed to the destination, but is disposed of by the fabric according to FC rules.
This method works both for fabric clouds containing homogenous switch devices connected together by E Ports, and clouds containing heterogeneous switch devices connected together by E Ports, providing all switch devices use S m-based hard zoning in the manner described above.
The method also partially works when some heterogeneous devices are equipped with S ID hard zoning and others are not. In this case, the devices so equipped are offered full hard zoning protection except from frames entering the fabric from devices not so equipped, whose S ID is incorrect.
The method also works when in devices so equipped, some fabric ports are deliberately excluded from hard zoning protection, producing a deliberate half duplex hard zoning case. This can be done to work around the limitations of the Hard Zoning S ID Inclusion List, which has a finite range.
The hard zoning methods and switches of the present invention provide a number of advantageous features, which include the following:
As shown in Fig. 1, according to the invention, the frame S ID is validated at the point the frame enters the fabric (at an F Port or FL Port, but not an E Port) to prevent incorrect S IDs from breaching the table-driven zoning at the point where frames exit the fabric. If the S ID is valid, it will enter the fabric and route normally. If invalid, the frame will not be routed but will be disposed of by the fabric according to FC rules.
The frame S m is validated at the point the frame exits the fabric (at an F Port or FL Port, but not an E Port), to insure that the frame, based on the S ID, is part of the zone or zones that the attached N Port or NL Port belongs to. Frame S IDs are compared against a list of S IDs that are valid for that port, where the size of the list is implementation-dependent, and where each entry defines a source that is allowed to transmit frames to this destination. If the S ID matches an entry in the list, it is routed out of the fabric to the destination.
If the S ID does not match any entry in the list, the frame is not passed to the destination, but is disposed of by the fabric according to FC rules.
This method works both for fabric clouds containing homogenous switch devices connected together by E Ports, and clouds containing heterogeneous switch devices connected together by E Ports, providing all switch devices use S m-based hard zoning in the manner described above.
The method also partially works when some heterogeneous devices are equipped with S ID hard zoning and others are not. In this case, the devices so equipped are offered full hard zoning protection except from frames entering the fabric from devices not so equipped, whose S ID is incorrect.
The method also works when in devices so equipped, some fabric ports are deliberately excluded from hard zoning protection, producing a deliberate half duplex hard zoning case. This can be done to work around the limitations of the Hard Zoning S ID Inclusion List, which has a finite range.
The hard zoning methods and switches of the present invention provide a number of advantageous features, which include the following:
~ The methods and techniques of the present invention provides a form of hard zoning in a switch fabric that is performed by hardware verification of frame S IDs against an inclusion list of allowable S IDs, before the frame is allowed to exit the fabric ~ The invention allows multiple overlapping hard zones for any destination (N Port or NL Port) across the largest of FC fabrics. The S TD
inclusion list is based on 24-bit addresses, allowing zones to be comprised of any nodes within the entire Fibre Channel 16,777,216 address space.
~ The invention allows multiple overlapping hard zones to be implemented at the finest FC addressing granularity, which is down to the loop device, both at the frame source and the frame destination, where each of the 126 possible nodes on a loop can express unique zone characteristics.
~ The invention accomplishes hard zoning at a fabric destination port (F Port or FL Port) by an Inclusion Table, unique to each fabric port, of legal S ID values. The Inclusion Table is used by hardware to pass legal frames, and bar illegal frames. This mechanism guards against intentional and un-intentional zone boundary violations.
~ The invention implements the Inclusion Table as a programmable hardware table, implemented as a CAM, containing multiple entries, each entry containing a 24-bit S ID value, along with various comparison controls. A single entry typically represents a single source, such as an N Port attached to an F Port, or an NL Port attached to an FL Port.
~ The invention provides a way to increase the range of sources an Inclusion Table can express, by implementing wild cards, on an entry-by entry basis, which can disable the comparison of the Port value, or the Port and Area values, of the S ID. A single entry can then express all Ports within an Area, or all Ports and Areas within a Domain.
~ The invention allows the flexibility of ranges to increase, by implementing exceptions to a range. A single entry defines the range, and one or more entries define exceptions to the range.
inclusion list is based on 24-bit addresses, allowing zones to be comprised of any nodes within the entire Fibre Channel 16,777,216 address space.
~ The invention allows multiple overlapping hard zones to be implemented at the finest FC addressing granularity, which is down to the loop device, both at the frame source and the frame destination, where each of the 126 possible nodes on a loop can express unique zone characteristics.
~ The invention accomplishes hard zoning at a fabric destination port (F Port or FL Port) by an Inclusion Table, unique to each fabric port, of legal S ID values. The Inclusion Table is used by hardware to pass legal frames, and bar illegal frames. This mechanism guards against intentional and un-intentional zone boundary violations.
~ The invention implements the Inclusion Table as a programmable hardware table, implemented as a CAM, containing multiple entries, each entry containing a 24-bit S ID value, along with various comparison controls. A single entry typically represents a single source, such as an N Port attached to an F Port, or an NL Port attached to an FL Port.
~ The invention provides a way to increase the range of sources an Inclusion Table can express, by implementing wild cards, on an entry-by entry basis, which can disable the comparison of the Port value, or the Port and Area values, of the S ID. A single entry can then express all Ports within an Area, or all Ports and Areas within a Domain.
~ The invention allows the flexibility of ranges to increase, by implementing exceptions to a range. A single entry defines the range, and one or more entries define exceptions to the range.
~ The invention prevents zone breaching via false S ms, by implementing S m validation against the ports native m as frames enter the fabric.
Valid S IDs route normally, invalid S IDs are not routed.
~ The invention allows an F Port and its attached N Port to belong to as many zones as the S m inclusion list allows.
~ The invention allows multiple zones per loop, and overlapping zones on a loop. The number of zones supported on a loop is variable (n), is at least 2, and may be as high as requirements allow. Any loop device (based on Port or AL PA) can belong to 1 to n zones.
~ The invention's restrictions on the total number of zones on an F Port, or the total number of zones on a loop, does not place restrictions on the total number of zones in a fabric.
~ The invention works across fabrics comprising a single switch element (Domain), fabrics comprising multiple homogeneous switches connected together by E Ports, and across fabrics comprising heterogeneous switches connected together by E Ports.
~ The invention allows certain frame types to be unaffected by zoning.
Frames with FC Well-Known S IDs, and any frame sourced by the fabric itself, are excluded from zoning, i.e., they will always route.
~ The invention allows known "ill-mannered" S IDs to be recognized in hardware, allowing a different disposition for these frames, such as immediate tossing rather than being processed as an exception by the fabric manager.
~ The invention applies both to duplex zoning, where bidirectional traffic hard zoning is enforced on both ends, and half duplex zoning where hard zoning is enforced on one end but not the other. Half duplex zoning can solve limitations of the S ID Inclusion Table for some topologies, and is a requirement when a fabric cloud contains multiple switch types, where some employ hard zoning and others do not.
Brief Description of the Drawing Fig. 1 is a symbolic representation of a FC fabric cloud, showing S ID
validation points according to one aspect of the invention;
Valid S IDs route normally, invalid S IDs are not routed.
~ The invention allows an F Port and its attached N Port to belong to as many zones as the S m inclusion list allows.
~ The invention allows multiple zones per loop, and overlapping zones on a loop. The number of zones supported on a loop is variable (n), is at least 2, and may be as high as requirements allow. Any loop device (based on Port or AL PA) can belong to 1 to n zones.
~ The invention's restrictions on the total number of zones on an F Port, or the total number of zones on a loop, does not place restrictions on the total number of zones in a fabric.
~ The invention works across fabrics comprising a single switch element (Domain), fabrics comprising multiple homogeneous switches connected together by E Ports, and across fabrics comprising heterogeneous switches connected together by E Ports.
~ The invention allows certain frame types to be unaffected by zoning.
Frames with FC Well-Known S IDs, and any frame sourced by the fabric itself, are excluded from zoning, i.e., they will always route.
~ The invention allows known "ill-mannered" S IDs to be recognized in hardware, allowing a different disposition for these frames, such as immediate tossing rather than being processed as an exception by the fabric manager.
~ The invention applies both to duplex zoning, where bidirectional traffic hard zoning is enforced on both ends, and half duplex zoning where hard zoning is enforced on one end but not the other. Half duplex zoning can solve limitations of the S ID Inclusion Table for some topologies, and is a requirement when a fabric cloud contains multiple switch types, where some employ hard zoning and others do not.
Brief Description of the Drawing Fig. 1 is a symbolic representation of a FC fabric cloud, showing S ID
validation points according to one aspect of the invention;
Fig. 2 is a block diagram of a portion of a fabric showing source port S ID validation according to one aspect of the invention;
Fig. 3 is a block diagram of a portion of a fabric showing destination port S ID validation according to one aspect of the invention;
Fig. 4 is a diagram of a SIL (Source S ID Inclusion List) entry which may be used in the validation of Fig. 3;
Fig. 5 is a block diagram of a portion of a fabric showing S ID compare according to one aspect of the invention;
Fig. 6 is a block diagram of a portion of a fabric showing SIL entry compare according to one aspect of the invention;
Fig. 7 is a diagram showing the Source Zone Mask format;
Fig. 8 is a diagram showing the Destination Zone Mask format;
Fig. 9 is a block diagram of the Hard Zoning State according to one aspect of the invention;
Fig. 10 is a diagram of an example (Example A) of the use of the invention in connecting multiple hosts to multiple storage devices, with hard zoning;
Fig. 11 is a diagram of an example (Example B) of the use the technique of wild carding, in comlecting multiple hosts to multiple storage devices with hard zoning; and Fig. 12 is a diagram of an example (Example C) of the use the technique of wild carding with exceptions, in connecting multiple hosts to multiple storage devices with hard zoning.
Detailed Description of the Preferred Embodiments The overall operation of S'ID validation is discussed above with reference to Fig. 1. Detailed operation is described below with reference to the Figures and tables.
Source Fabric Port S ID Validation Fig. 1 shows the technique for source fabric port S ID validation. This ensures that incoming frame S ID values are legal, in order that the Hard Zoning mechanism will be effective. This feature requires an enable/disable control, because it should be enabled only on F Ports and FL Ports, but not on E Ports.
The Native ID register (1) is resident to the fabric port logic, and is typically written by the fabric manager (15) to whatever ID has been chosen for the port, but may be hard-wired into the logic in a simpler design with greater operating restrictions. The Native ID is the Domain and Area of the F Port or FL Port. The Enable Hard Zoning FF (2) is also resident to the fabric port logic and written by the fabric manager (15), which enables the feature on F Ports and FL Ports, but disables it on E Ports.
The incoming frame (3) is parsed and the S ID contents (bits 23:0) of frame word 2 are presented to this circuitry. The frame S ID Domain and Area (5), bits 23-S of frame word 2, are compared against the Native ID Register (1) Domain and Area (6) in comparator (11). Match/mismatch is fed to gate (14).
If there is a miscompare, and Enable Hard Zoning (2) is active, then gate (10) specifies an invalid frame S ID. In this case, the frame is not routed normally (it will never reach the intended destination), but is typically forwarded to the fabric manager for processing according to Fibre Channel rules for switches. This typically means that a Class 2 frame that fails the S ID test spawns a response bacl~ to the sender with reason code, and that a Class 3 frame that fails the S ID test is tossed.
If there is no miscompare in the frame S ID, or if Enable Hard Zoning (2) is inactive, then gate (10) specifies that the frame will route normally, which means it will route to the fabric destination port specified by the frame D
ID.
This feature ensures that frames entering the fabric are not forwarded if the S 117 is illegal in any way.
Destination Fabric Port S ID Validation Destination fabric port S ID validation, described with reference to Fig.
3, ensures that outgoing frames are legal to send to the attached device(s).
This feature requires an enable/disable control, because it should be enabled only on F Ports and FL Ports, but not on E Ports.
Issues with linear tables.
Ideally, S ID hard zoning would be performed in each host bus adapter (HBA) attached to the fabric. Each HBA would have its own unique zoning table. However, FC standards demand that zoning functions, hard and soft, be contained in the fabric.
A linear inclusion table would seem to be the most straightforward.
However, to work for any address in the FC addressing range requires a very large table. For an F Port, it would have an entry for every possible FC
source address, which results in a depth of 256 Domains * 256 Areas * 256 Ports =
16,777,216 table entries/port. If an FL Port, the table has to also represent up to 126 loop devices, each of which may belong to different zones, which would require a unique linear inclusion table for each. The total number of inclusion table entries for an FL Port would then be 256*256*256*126 = 2,113,929,216 table entries/port.
Shorter linear zone tables can be used, where a limited set of addresses, typically starting at the value Domain 1/Area 0, Port 0, and increasing sequentially up to the maximum table size implemented, can be economical.
However, these tables cannot express any FC address and so greatly limits the fabrics that can be handled. For example, if the table had 512 entries, it could express all addresses in Domains 0x01 and 0x02, but none in Domain 0x03 through OxEF.
The method described here utilizes a random table of 24-but S IDs, designed as CAM (Content Addressable Memory) where a frame S ID can be compared against all CAM entries simultaneously seeping a comparison, or inclusion. Since the entries are 24-bit, the CAM can represent any FC address, but is limited to representing a subset of FC addresses far less than the FC
maximum. For example, it could be expected that the CAM could economically hold 16-256 addresses, but could be less or more depending on the application and availability of resources.
The method has a single CAM per fabric port transmitter, even when the destination is an FL Port, and so must work with as many as 126 loop destinations. For this reason, the CAM provides a source zone mask for each S H7 entry, which is compared against a destination zone mask contained in a separate lookup table.
Fig. 3 is a block diagram of a portion of a fabric showing destination port S ID validation according to one aspect of the invention;
Fig. 4 is a diagram of a SIL (Source S ID Inclusion List) entry which may be used in the validation of Fig. 3;
Fig. 5 is a block diagram of a portion of a fabric showing S ID compare according to one aspect of the invention;
Fig. 6 is a block diagram of a portion of a fabric showing SIL entry compare according to one aspect of the invention;
Fig. 7 is a diagram showing the Source Zone Mask format;
Fig. 8 is a diagram showing the Destination Zone Mask format;
Fig. 9 is a block diagram of the Hard Zoning State according to one aspect of the invention;
Fig. 10 is a diagram of an example (Example A) of the use of the invention in connecting multiple hosts to multiple storage devices, with hard zoning;
Fig. 11 is a diagram of an example (Example B) of the use the technique of wild carding, in comlecting multiple hosts to multiple storage devices with hard zoning; and Fig. 12 is a diagram of an example (Example C) of the use the technique of wild carding with exceptions, in connecting multiple hosts to multiple storage devices with hard zoning.
Detailed Description of the Preferred Embodiments The overall operation of S'ID validation is discussed above with reference to Fig. 1. Detailed operation is described below with reference to the Figures and tables.
Source Fabric Port S ID Validation Fig. 1 shows the technique for source fabric port S ID validation. This ensures that incoming frame S ID values are legal, in order that the Hard Zoning mechanism will be effective. This feature requires an enable/disable control, because it should be enabled only on F Ports and FL Ports, but not on E Ports.
The Native ID register (1) is resident to the fabric port logic, and is typically written by the fabric manager (15) to whatever ID has been chosen for the port, but may be hard-wired into the logic in a simpler design with greater operating restrictions. The Native ID is the Domain and Area of the F Port or FL Port. The Enable Hard Zoning FF (2) is also resident to the fabric port logic and written by the fabric manager (15), which enables the feature on F Ports and FL Ports, but disables it on E Ports.
The incoming frame (3) is parsed and the S ID contents (bits 23:0) of frame word 2 are presented to this circuitry. The frame S ID Domain and Area (5), bits 23-S of frame word 2, are compared against the Native ID Register (1) Domain and Area (6) in comparator (11). Match/mismatch is fed to gate (14).
If there is a miscompare, and Enable Hard Zoning (2) is active, then gate (10) specifies an invalid frame S ID. In this case, the frame is not routed normally (it will never reach the intended destination), but is typically forwarded to the fabric manager for processing according to Fibre Channel rules for switches. This typically means that a Class 2 frame that fails the S ID test spawns a response bacl~ to the sender with reason code, and that a Class 3 frame that fails the S ID test is tossed.
If there is no miscompare in the frame S ID, or if Enable Hard Zoning (2) is inactive, then gate (10) specifies that the frame will route normally, which means it will route to the fabric destination port specified by the frame D
ID.
This feature ensures that frames entering the fabric are not forwarded if the S 117 is illegal in any way.
Destination Fabric Port S ID Validation Destination fabric port S ID validation, described with reference to Fig.
3, ensures that outgoing frames are legal to send to the attached device(s).
This feature requires an enable/disable control, because it should be enabled only on F Ports and FL Ports, but not on E Ports.
Issues with linear tables.
Ideally, S ID hard zoning would be performed in each host bus adapter (HBA) attached to the fabric. Each HBA would have its own unique zoning table. However, FC standards demand that zoning functions, hard and soft, be contained in the fabric.
A linear inclusion table would seem to be the most straightforward.
However, to work for any address in the FC addressing range requires a very large table. For an F Port, it would have an entry for every possible FC
source address, which results in a depth of 256 Domains * 256 Areas * 256 Ports =
16,777,216 table entries/port. If an FL Port, the table has to also represent up to 126 loop devices, each of which may belong to different zones, which would require a unique linear inclusion table for each. The total number of inclusion table entries for an FL Port would then be 256*256*256*126 = 2,113,929,216 table entries/port.
Shorter linear zone tables can be used, where a limited set of addresses, typically starting at the value Domain 1/Area 0, Port 0, and increasing sequentially up to the maximum table size implemented, can be economical.
However, these tables cannot express any FC address and so greatly limits the fabrics that can be handled. For example, if the table had 512 entries, it could express all addresses in Domains 0x01 and 0x02, but none in Domain 0x03 through OxEF.
The method described here utilizes a random table of 24-but S IDs, designed as CAM (Content Addressable Memory) where a frame S ID can be compared against all CAM entries simultaneously seeping a comparison, or inclusion. Since the entries are 24-bit, the CAM can represent any FC address, but is limited to representing a subset of FC addresses far less than the FC
maximum. For example, it could be expected that the CAM could economically hold 16-256 addresses, but could be less or more depending on the application and availability of resources.
The method has a single CAM per fabric port transmitter, even when the destination is an FL Port, and so must work with as many as 126 loop destinations. For this reason, the CAM provides a source zone mask for each S H7 entry, which is compared against a destination zone mask contained in a separate lookup table.
There is a single destination zone mask table per fabric port transmitter, each entry representing a loop destination, or AL PD, and which typically has an entry for every one of the 126 legal AL PDs.
CAM-Based Inclusion Table.
This uses the S ID Inclusion List (SIL), which describes which sources are allowed to send to this port, and if the destination is a loop, what zones each source belongs to.
It also uses the AL PD Zone List (AZL), used only if the destination is a loop, which describes what zones a destination AL PA belongs to.
The S 1D Inclusion List (SIL).
SIL (31) is a prograrmnable list of 24-bit S IDs deemed by the fabric manager to belong to the same zones as the port in question, where each entry also has a 2-bit Compare Mask and a Source Zone Mask. SIL is written by the fabric manager (32) based on zone information. SIL (31) can be any size, but typically would contain as many entries as is economically feasible, to allow as many sources as possible, and to cover as many topologies as possible. SIL
(31) provides S ID compare information (33) to S ID Compare (34) and the source zone mask (41) to the Source Zone Mask Mux (42).
The Sil (31) entry format is shown in Fig. 4.
"Source S ID" is 24 bits, and defines a legal source S ID, if the "Compare Mask" value is not 00. Any S ID within the FC address range of 0x0 - FFFFFF can be expressed.
"Source Zone Mask" is a bit mask of variable size, which defines which zone or zones the source belongs to. See Zone Mask explanation below.
"Compare Mask" defines how the compare against the frame S ID is to take place 00 = Slot not valid. No compare is possible against this entry.
O1 = No mask. Domain/Area/Port are compared [see note 1 below 10 = Mask Port. Domain/Area are compared [see note 2 below]
11 = Mask Area and Port. Domain is compared [see note 3 below]
[note 1 ] The entry represents exactly 1 source.
[note 2] The entry could represent 126 sources.
CAM-Based Inclusion Table.
This uses the S ID Inclusion List (SIL), which describes which sources are allowed to send to this port, and if the destination is a loop, what zones each source belongs to.
It also uses the AL PD Zone List (AZL), used only if the destination is a loop, which describes what zones a destination AL PA belongs to.
The S 1D Inclusion List (SIL).
SIL (31) is a prograrmnable list of 24-bit S IDs deemed by the fabric manager to belong to the same zones as the port in question, where each entry also has a 2-bit Compare Mask and a Source Zone Mask. SIL is written by the fabric manager (32) based on zone information. SIL (31) can be any size, but typically would contain as many entries as is economically feasible, to allow as many sources as possible, and to cover as many topologies as possible. SIL
(31) provides S ID compare information (33) to S ID Compare (34) and the source zone mask (41) to the Source Zone Mask Mux (42).
The Sil (31) entry format is shown in Fig. 4.
"Source S ID" is 24 bits, and defines a legal source S ID, if the "Compare Mask" value is not 00. Any S ID within the FC address range of 0x0 - FFFFFF can be expressed.
"Source Zone Mask" is a bit mask of variable size, which defines which zone or zones the source belongs to. See Zone Mask explanation below.
"Compare Mask" defines how the compare against the frame S ID is to take place 00 = Slot not valid. No compare is possible against this entry.
O1 = No mask. Domain/Area/Port are compared [see note 1 below 10 = Mask Port. Domain/Area are compared [see note 2 below]
11 = Mask Area and Port. Domain is compared [see note 3 below]
[note 1 ] The entry represents exactly 1 source.
[note 2] The entry could represent 126 sources.
[note 3] The entry could represent 256 * 126 = 32,256 sources.
S ID Compare.
S ID Compare (34) (see Fig. 5) is used to compare a frames' S ID
simultaneously to all entries in SIL (31) and present the results to the Hard Zoning State Machine (47). Each SIL (31) entry is compared against the frames S ID (23:0) (37), using the S ID value and Compare Mask of the SIL (31) entry (33). When a match is made, S ID Compare (34) encodes the selected entry number into a value (43) that controls the Source Zone Mask Mux (42). The Hit (45) and Multiple Hit (46) status is shipped to. the hard Zoning State Machine (47) for processing.
S ID compare (34) distills the Hit/not status from every SIL entry compare as described above into a No Hit, Hit, or Multiple Hit status for the frame being processed. It also encodes the entry number of the hit into a binary value for use in the Source Zone Mask Mux.
There exists an autonomous compare circuit for every SIL entry, as shown in Fig. 6. The Hit/Not Hit output feeds the Distiller (see Fig. 5).
Distiller The Distiller processes the results of SIL entry compares.
A Miss occurs when neither Hit nor Multiple Hit occurs. This causes the frame to be rejected.
A Hit occurs if a single entry compares. This is the first step in causing the frame to be accepted, the second being the SIL/AZL zone mask compare.
A Multiple Hit occurs if two or more entries compare. This causes the frame to be rejected. This is the way exceptions to ranges is implemented, and it also covers programming errors.
Entry Number is used on a Hit, to be a mux select for Source Zone Mask Mux.
Source Zone Mask Mux The Source Zone Mask Mux (42) produces the zone mask associated with the source S ID that matched the frame S ID. The mux select (43) is produced by S ID Compare (34) which is the encoded value of the SIL (31) entry that matched the frame S ID. The Source Zone Mask Mux output (44) is given to the Hard Zoning State Machine (47) which will compare it against the destination zone mask (40).
The source zone mask can contain any number of bits, depending on how many zones a loop is designed to handle. For example, a 4-bit zone mask implies that a loop can have up to 4 zones, and an 8-bit mask allows 8 zones.
The size of the source zone mask in SIL (31) must be identical to the size of the destination zone mask in AZL (38).
The AL_PD Zone List (AZL) AZL (38) (Fig. 3) is a 126-entry programmable table, one entry for every legal AL PA, that contains the zone mask for each destination loop port. The frame AL PD (36) provides the address to AZL (38), which produces the destination zone mask (40), which is given to the Hard Zoning State Machine (47) which will compare it against the source zone mask (44). AZL is written by the fabric manager (39) based on zone information. In order that the loop not be restricted in the choice of assignable AL PAs, it is desirable for AZL to have 126 entries, one for each legal AL PA. Fewer entries are possible if restricting the AL PA range is acceptable.
The destination zone mask can contain any nwnber of bits, depending on how many zones a loop is designed to handle. For example, a 4-bit zone mask implies that a loop can have up to 4 zones, and an 8-bit mask allows 8 zones.
the size of the destination zone mask in AZL (38) must be identical to the size of the source zone mask in STL (31).
Hard Zonin Enable The Hard Zoning Enable (53)(Fig. 3) is a storage element programmed to enable or disable hard zoning on the port, and is written by the fabric manager (54) based on zoning and topology information. If hard zoning is employed in the fabric cloud, this will be set active on F Ports and FL Ports, and inactive on E Ports.
The state of Hard Zoning Enable (52) is fed to the Hard Zoning State Machine (47) to condition the function. Hard Zoning Enable (52) is unique to the port, and is the same storage element that enables/disables S ID
validation on incoming frames.
The Hard Zoning State Machine The Haxd Zoning State Machine (47) (Fig. 9) determines the disposition of all frames attempting to exit the fabric at a particular port.
~ If Hard Zoning is disabled;
- All frames pass this function and, in lieu of other fabric functions, are forwarded out of the fabric to the destination node.
~ If Hard Zoning is enabled;
- If the frame S ID is in the range of OxFxxxxx - FFFFFF, or if the frame originated in the switch box processor complex, hard zoning is ignored and the frame is routed normally.
- If the port is an F Port, only the S ID compare is required. In this case, zone masks axe logically irrelevant, but all zone masks in the SIL and all zone masks in AZL are set to some value (hex FF for example) that guarantees a zone mask compare in all cases.
Note that the design could be implemented where an F Port could disable the zone mask compare to avoid having to program the zone masks.
- If the port is an FL Port, the compare is the same, but the zone masks are now relevant and must be programmed according to the actual zones in use.
- If there is a hit in SIL, but the SIL zone mask = 00, the frame is invalid. This is a deliberate way to reject known bad sources.
- If there is a multiple hit in SIL, the frame is invalid. This implements the Exception To A Range function.
The Source Zone Mask (62) is provided by the Source Zone Mask Mux (42). The Destination Zone Mask (63) is provided by AZL (38). A bit-wise compare is made between the tvVO masks in AND gates (66), all of which are ORed together in gate (67), which is active if any bit pair is set, and inactive if no bit pairs are set.
Function (68) is active if all source zone mask bits are zero. This is the test for a known bad S ID that has been tagged in this way to insure its immediate tossing.
S ID Hit (60) and S ID Multiple Hit (61) are from S ID Compare (34).
Hard Zone Enable (65) is from the storage element of the same name (52). The translation for S ID = OxFxxxxx + Frame Source = Fabric Manager (64) is made locally.
AND gate (69) commands the unconditional toss of frames whose source zone mask = 0.
AND gate (70) commands that a frame is valid because it passes the general hard zoning test.
AND gate (71 ) cormnands the general frame valid.
Example A:
Multiple Hosts On F Ports Connected to Multiple Storage Devices on FL Ports The diagram in Fig. 10 depicts two hosts attached to a switch that is the access to their storage. Hard zoning is set up so that Host A can only access disks in zone A, and Host B can only access disks in zone B. Host A and Host B
can also access each other, and Host A and Host B share access to some disks.
Zone masks have bit 0 assigned to zone A and bit 1 assigned to zone B.
The programmable values for each fabric port is as follows.
Port 01,00 (Domain O1, Area 00): Host A
Table 1: Example A SIL Contents CompareDomain Area Port SIL Zone Mask Value Value Value Comment ~y (bin) (hex) (hex) (hex) En hex) 0 02 O1 03 xx FF Host B
1 Ol O1 Ol 04 O1 Loop x, alga =
04 (belongs in zone A) 2 O1 O1 Ol OS 03 Loop x~ alpa =
OS (belongs in zones A) & B) 3 O1 O1 02 03 O1 Loop y, alga =
03 (belongs in zone B) Table 2: Example A AZL Contents AZL Entry (hex) Dest Zone Mask (hex)Cornrnent All FF
Port 01,01 (Domain 01, Area O1): Loop X
Table 3: Example A SIL Contents CompareDomain Area Port SIL Zone Mask Value Value Value Comment En (bin) (hex) (hex) (hex) he ) 0 02 O1 00 xx O1 Host A
(belongs to zone A) 1 02 O1 03 xx 02 Host B
(belongs to zone B) Table 4: Example A AZL Contents AZL Entry (hex) Dest Zone Mask Comment (hex) 04 O1 belongs to zone A
OS 03 belongs to zone A and B
06 02 belongs to zone B
Others 00 Port 01,02 Domain Ol, Area 02, : Loop Y
Table 5: Example A SIL Contents CompareDomain Area Poi SIL Zone Mask Value Value Value Comment En (bin) (hex) (hex) (hex) M
x) 0 02 O1 00 xx O1 Host A
(belongs to zone A) 1 02 O1 03 xx 02 Host B
(belongs to zone B) Table 6: Example A AZL Contents AZL Entry (hex) Dest Zone Mask Comment (hex) O1 02 belongs to zone B
02 02 belongs to zone B
03 Ol belongs to zone A
Others 00 Port 01,03 (Domain Ol, Area = 03, : Host B
Table 7: Example A SIL Contents CompareDomain Area Port S
e SIL Mask Value Value Value Zone Comment ~y (bin) (hex) (hex) (hex) En hex) 0 02 O1 00 xx FF Host A
1 O1 O1 O1 06 02 loop x, alpa =
06 (belongs to zone B) 2 O1 O1 O1 OS 03 loop x, alga =
OS (belongs to zone A and B) 3 O1 O1 02 02 02 loop y, alpa =
02 (belongs to zone B) 4 O1 O1 02 O1 02 loop y, alpa =
O1 (belongs to zone B) Table 8: Example A AZL Contents AZL Entry (hex) Dest Zone Mask (hex)Comment All FF
Configured as described above, the desired hard zoning for Example A, Fig. 10 is acheived.
Example B: Wild Carding The example in Fig. 11 depicts how a single wild-carded SIL entry can represent all devices in a Domain. This shows Host A's view of the hard zoning, where some of the other ports in the same Domain are in zone A, and all of the ports in the other Domain are part of zone A.
Port 01,03 (Domain O1, Area = 001: Host A
Table 9: Example B SIL Contents CompareDomain Area poi Source SI Mask Value Value Value Zone Cornrnent L
~ (bin) (hex) (hex) (hex) y En h x) 0 02 O1 O1 xx FF device on Domain 1, Area 1 1 02 O1 03 xx FF device on Domain 1, Area 3 2 03 02 xx xx FF all devices on Domain Table 10: Example B AZL Contents AZL Entry Dest Zone Mask Comment All FF
Configured as described above, the desired hard zoning for Example B, Fig. 11 is acheived. Note that this example shows how an entire Domain can be represented by one entry. This same method can be used to represent an entire Domain/Area with one entry, which allows all Ports to be represented with one entry.
Example C: Wild Carding with Exceptions The example in Fig. 12 depicts the same topology as for Example B but with an exception to a wild card. This shows Host A's view of the hard zoning, where some of the other ports in the Same Domain are in zone A, and most but not all of the ports in the other Domain are part of zone A.
Port O1, 03 (Domain O1, Area = 00 : Host A
Table 11: Example C SIL Contents CompareDomain Area poi Source Maslc Value Value Value Comment L
Ent (bin) (hex) (hex) (hex) Ma.slc (hex) 0 02 O1 Ol xx FF device on Domain 1, Area 1 1 02 O1 03 xx FF device on Domain l, Area 3 2 03 02 xx xx FF all devices on Domain 2 3 02 02 02 xx FF exception to Domain 2 (exception) Table 12: Example C AZL Contents AZL Entry Dest Zone Mask Comment All FF
Configured as described above, the desired hard zoning for Example C, Fig. 12 is acheived. Note that 4 entries represent 7 sources. Note also that this shows wild carding a Domain with a single entry, but uses additional entries for exceptions to that Domain. This can also be used to wild card a Domain/Area, which covers all Ports, but use additional entries for each Port exception to the Domain/Area.
It will be seen from the above description that the present invention provides improved FC switch techniques, by providing roubust hardware-enforced zoning for data integrity and security. While specific embodiments and techniques have been described, it will be appreciated that the invention is not limited to those specific embodiments, and that many variations are possible within the scope of the invention.
S ID Compare.
S ID Compare (34) (see Fig. 5) is used to compare a frames' S ID
simultaneously to all entries in SIL (31) and present the results to the Hard Zoning State Machine (47). Each SIL (31) entry is compared against the frames S ID (23:0) (37), using the S ID value and Compare Mask of the SIL (31) entry (33). When a match is made, S ID Compare (34) encodes the selected entry number into a value (43) that controls the Source Zone Mask Mux (42). The Hit (45) and Multiple Hit (46) status is shipped to. the hard Zoning State Machine (47) for processing.
S ID compare (34) distills the Hit/not status from every SIL entry compare as described above into a No Hit, Hit, or Multiple Hit status for the frame being processed. It also encodes the entry number of the hit into a binary value for use in the Source Zone Mask Mux.
There exists an autonomous compare circuit for every SIL entry, as shown in Fig. 6. The Hit/Not Hit output feeds the Distiller (see Fig. 5).
Distiller The Distiller processes the results of SIL entry compares.
A Miss occurs when neither Hit nor Multiple Hit occurs. This causes the frame to be rejected.
A Hit occurs if a single entry compares. This is the first step in causing the frame to be accepted, the second being the SIL/AZL zone mask compare.
A Multiple Hit occurs if two or more entries compare. This causes the frame to be rejected. This is the way exceptions to ranges is implemented, and it also covers programming errors.
Entry Number is used on a Hit, to be a mux select for Source Zone Mask Mux.
Source Zone Mask Mux The Source Zone Mask Mux (42) produces the zone mask associated with the source S ID that matched the frame S ID. The mux select (43) is produced by S ID Compare (34) which is the encoded value of the SIL (31) entry that matched the frame S ID. The Source Zone Mask Mux output (44) is given to the Hard Zoning State Machine (47) which will compare it against the destination zone mask (40).
The source zone mask can contain any number of bits, depending on how many zones a loop is designed to handle. For example, a 4-bit zone mask implies that a loop can have up to 4 zones, and an 8-bit mask allows 8 zones.
The size of the source zone mask in SIL (31) must be identical to the size of the destination zone mask in AZL (38).
The AL_PD Zone List (AZL) AZL (38) (Fig. 3) is a 126-entry programmable table, one entry for every legal AL PA, that contains the zone mask for each destination loop port. The frame AL PD (36) provides the address to AZL (38), which produces the destination zone mask (40), which is given to the Hard Zoning State Machine (47) which will compare it against the source zone mask (44). AZL is written by the fabric manager (39) based on zone information. In order that the loop not be restricted in the choice of assignable AL PAs, it is desirable for AZL to have 126 entries, one for each legal AL PA. Fewer entries are possible if restricting the AL PA range is acceptable.
The destination zone mask can contain any nwnber of bits, depending on how many zones a loop is designed to handle. For example, a 4-bit zone mask implies that a loop can have up to 4 zones, and an 8-bit mask allows 8 zones.
the size of the destination zone mask in AZL (38) must be identical to the size of the source zone mask in STL (31).
Hard Zonin Enable The Hard Zoning Enable (53)(Fig. 3) is a storage element programmed to enable or disable hard zoning on the port, and is written by the fabric manager (54) based on zoning and topology information. If hard zoning is employed in the fabric cloud, this will be set active on F Ports and FL Ports, and inactive on E Ports.
The state of Hard Zoning Enable (52) is fed to the Hard Zoning State Machine (47) to condition the function. Hard Zoning Enable (52) is unique to the port, and is the same storage element that enables/disables S ID
validation on incoming frames.
The Hard Zoning State Machine The Haxd Zoning State Machine (47) (Fig. 9) determines the disposition of all frames attempting to exit the fabric at a particular port.
~ If Hard Zoning is disabled;
- All frames pass this function and, in lieu of other fabric functions, are forwarded out of the fabric to the destination node.
~ If Hard Zoning is enabled;
- If the frame S ID is in the range of OxFxxxxx - FFFFFF, or if the frame originated in the switch box processor complex, hard zoning is ignored and the frame is routed normally.
- If the port is an F Port, only the S ID compare is required. In this case, zone masks axe logically irrelevant, but all zone masks in the SIL and all zone masks in AZL are set to some value (hex FF for example) that guarantees a zone mask compare in all cases.
Note that the design could be implemented where an F Port could disable the zone mask compare to avoid having to program the zone masks.
- If the port is an FL Port, the compare is the same, but the zone masks are now relevant and must be programmed according to the actual zones in use.
- If there is a hit in SIL, but the SIL zone mask = 00, the frame is invalid. This is a deliberate way to reject known bad sources.
- If there is a multiple hit in SIL, the frame is invalid. This implements the Exception To A Range function.
The Source Zone Mask (62) is provided by the Source Zone Mask Mux (42). The Destination Zone Mask (63) is provided by AZL (38). A bit-wise compare is made between the tvVO masks in AND gates (66), all of which are ORed together in gate (67), which is active if any bit pair is set, and inactive if no bit pairs are set.
Function (68) is active if all source zone mask bits are zero. This is the test for a known bad S ID that has been tagged in this way to insure its immediate tossing.
S ID Hit (60) and S ID Multiple Hit (61) are from S ID Compare (34).
Hard Zone Enable (65) is from the storage element of the same name (52). The translation for S ID = OxFxxxxx + Frame Source = Fabric Manager (64) is made locally.
AND gate (69) commands the unconditional toss of frames whose source zone mask = 0.
AND gate (70) commands that a frame is valid because it passes the general hard zoning test.
AND gate (71 ) cormnands the general frame valid.
Example A:
Multiple Hosts On F Ports Connected to Multiple Storage Devices on FL Ports The diagram in Fig. 10 depicts two hosts attached to a switch that is the access to their storage. Hard zoning is set up so that Host A can only access disks in zone A, and Host B can only access disks in zone B. Host A and Host B
can also access each other, and Host A and Host B share access to some disks.
Zone masks have bit 0 assigned to zone A and bit 1 assigned to zone B.
The programmable values for each fabric port is as follows.
Port 01,00 (Domain O1, Area 00): Host A
Table 1: Example A SIL Contents CompareDomain Area Port SIL Zone Mask Value Value Value Comment ~y (bin) (hex) (hex) (hex) En hex) 0 02 O1 03 xx FF Host B
1 Ol O1 Ol 04 O1 Loop x, alga =
04 (belongs in zone A) 2 O1 O1 Ol OS 03 Loop x~ alpa =
OS (belongs in zones A) & B) 3 O1 O1 02 03 O1 Loop y, alga =
03 (belongs in zone B) Table 2: Example A AZL Contents AZL Entry (hex) Dest Zone Mask (hex)Cornrnent All FF
Port 01,01 (Domain 01, Area O1): Loop X
Table 3: Example A SIL Contents CompareDomain Area Port SIL Zone Mask Value Value Value Comment En (bin) (hex) (hex) (hex) he ) 0 02 O1 00 xx O1 Host A
(belongs to zone A) 1 02 O1 03 xx 02 Host B
(belongs to zone B) Table 4: Example A AZL Contents AZL Entry (hex) Dest Zone Mask Comment (hex) 04 O1 belongs to zone A
OS 03 belongs to zone A and B
06 02 belongs to zone B
Others 00 Port 01,02 Domain Ol, Area 02, : Loop Y
Table 5: Example A SIL Contents CompareDomain Area Poi SIL Zone Mask Value Value Value Comment En (bin) (hex) (hex) (hex) M
x) 0 02 O1 00 xx O1 Host A
(belongs to zone A) 1 02 O1 03 xx 02 Host B
(belongs to zone B) Table 6: Example A AZL Contents AZL Entry (hex) Dest Zone Mask Comment (hex) O1 02 belongs to zone B
02 02 belongs to zone B
03 Ol belongs to zone A
Others 00 Port 01,03 (Domain Ol, Area = 03, : Host B
Table 7: Example A SIL Contents CompareDomain Area Port S
e SIL Mask Value Value Value Zone Comment ~y (bin) (hex) (hex) (hex) En hex) 0 02 O1 00 xx FF Host A
1 O1 O1 O1 06 02 loop x, alpa =
06 (belongs to zone B) 2 O1 O1 O1 OS 03 loop x, alga =
OS (belongs to zone A and B) 3 O1 O1 02 02 02 loop y, alpa =
02 (belongs to zone B) 4 O1 O1 02 O1 02 loop y, alpa =
O1 (belongs to zone B) Table 8: Example A AZL Contents AZL Entry (hex) Dest Zone Mask (hex)Comment All FF
Configured as described above, the desired hard zoning for Example A, Fig. 10 is acheived.
Example B: Wild Carding The example in Fig. 11 depicts how a single wild-carded SIL entry can represent all devices in a Domain. This shows Host A's view of the hard zoning, where some of the other ports in the same Domain are in zone A, and all of the ports in the other Domain are part of zone A.
Port 01,03 (Domain O1, Area = 001: Host A
Table 9: Example B SIL Contents CompareDomain Area poi Source SI Mask Value Value Value Zone Cornrnent L
~ (bin) (hex) (hex) (hex) y En h x) 0 02 O1 O1 xx FF device on Domain 1, Area 1 1 02 O1 03 xx FF device on Domain 1, Area 3 2 03 02 xx xx FF all devices on Domain Table 10: Example B AZL Contents AZL Entry Dest Zone Mask Comment All FF
Configured as described above, the desired hard zoning for Example B, Fig. 11 is acheived. Note that this example shows how an entire Domain can be represented by one entry. This same method can be used to represent an entire Domain/Area with one entry, which allows all Ports to be represented with one entry.
Example C: Wild Carding with Exceptions The example in Fig. 12 depicts the same topology as for Example B but with an exception to a wild card. This shows Host A's view of the hard zoning, where some of the other ports in the Same Domain are in zone A, and most but not all of the ports in the other Domain are part of zone A.
Port O1, 03 (Domain O1, Area = 00 : Host A
Table 11: Example C SIL Contents CompareDomain Area poi Source Maslc Value Value Value Comment L
Ent (bin) (hex) (hex) (hex) Ma.slc (hex) 0 02 O1 Ol xx FF device on Domain 1, Area 1 1 02 O1 03 xx FF device on Domain l, Area 3 2 03 02 xx xx FF all devices on Domain 2 3 02 02 02 xx FF exception to Domain 2 (exception) Table 12: Example C AZL Contents AZL Entry Dest Zone Mask Comment All FF
Configured as described above, the desired hard zoning for Example C, Fig. 12 is acheived. Note that 4 entries represent 7 sources. Note also that this shows wild carding a Domain with a single entry, but uses additional entries for exceptions to that Domain. This can also be used to wild card a Domain/Area, which covers all Ports, but use additional entries for each Port exception to the Domain/Area.
It will be seen from the above description that the present invention provides improved FC switch techniques, by providing roubust hardware-enforced zoning for data integrity and security. While specific embodiments and techniques have been described, it will be appreciated that the invention is not limited to those specific embodiments, and that many variations are possible within the scope of the invention.
Claims (12)
1. A method of hardware-enforced zoning protection for loop-level addresses in Fibre Channel switching, comprising:
receiving a frame at a port of a Fibre Channel fabric;
comparing a Source ID (S_ID) of the frame to a native ID of the port, and based on the comparison, routing a valid frame to its destination F Port or FL Port ;
at the destination port, comparing the frame's S_ID to an inclusion list of sources permitted under the zoning to transmit to the destination port and for loop-level addresses, comparing the zone of the destination and the zone of the source;
and for valid frames, transmitting the frame through the destination port to the attached device or loop of devices.
receiving a frame at a port of a Fibre Channel fabric;
comparing a Source ID (S_ID) of the frame to a native ID of the port, and based on the comparison, routing a valid frame to its destination F Port or FL Port ;
at the destination port, comparing the frame's S_ID to an inclusion list of sources permitted under the zoning to transmit to the destination port and for loop-level addresses, comparing the zone of the destination and the zone of the source;
and for valid frames, transmitting the frame through the destination port to the attached device or loop of devices.
2. A method according to claim 1 wherein the step of comparing the frame S_ID
to an inclusion list includes simultaneous comparison of S_IDs using a content addressable memory associated with the destination port.
to an inclusion list includes simultaneous comparison of S_IDs using a content addressable memory associated with the destination port.
3. A method according to claim 1 wherein there are multiple zones per loop attached to the destination port in the comparison of source and destination zones.
4. A method according to claim 1 wherein there are multiple overlapping zones per loop attached to the destination port in the comparison of source and destination zones.
5. A method according to claim 1 further comprising expressing wild card designations in the inclusion table to disable the comparison of Fibre Channel Port value or Port and Area value.
6. A method according to claim 1 wherein the inclusion list may have an entry defining a range of S_ID values, and additional entries defining exceptions to the range, and wherein the comparison of permitted S_IDs is based on the range and exceptions.
7. A Fibre Channel switch, comprising:
a port connectable as a source port to receive frames;
an S_ID validator associated with the source port and operable to compare a frame S_ID to a native ID or the source port when used as a F Port or FL Port, and operative to route valid frames through a switch fabric;
a port receiving a frame routed through the fabric as a destination F Port or FL
Port having a unique inclusion table of valid S_IDs and zones for devices and loop devices attached to the port according to defined zoning; and a destination port S_ID validator operably associated with the destination port to compare S_ID and zones of frames routed to it through the fabric against the inclusion table and to transmit only frames with valid sources and zones to the devices and loop devices attached to the port.
a port connectable as a source port to receive frames;
an S_ID validator associated with the source port and operable to compare a frame S_ID to a native ID or the source port when used as a F Port or FL Port, and operative to route valid frames through a switch fabric;
a port receiving a frame routed through the fabric as a destination F Port or FL
Port having a unique inclusion table of valid S_IDs and zones for devices and loop devices attached to the port according to defined zoning; and a destination port S_ID validator operably associated with the destination port to compare S_ID and zones of frames routed to it through the fabric against the inclusion table and to transmit only frames with valid sources and zones to the devices and loop devices attached to the port.
8. A Fibre Channel switch according to claim 7 wherein the destination port S_ID
validator includes a content addressable memory operative to simultaneously compare the frame S ID to entries in the inclusion table.
validator includes a content addressable memory operative to simultaneously compare the frame S ID to entries in the inclusion table.
9. A Fibre Channel switch according to claim 7 wherein the defined zoning includes multiple zones per loop attached to the destination port.
10. A Fibre Channel switch according to claim 7 wherein the defined zoning includes multiple overlapping zones per loop attached to the destination port.
11. A Fibre Channel switch according to claim 7 wherein the inclusion table can express wild card designations and wherein the destination port validator is operable in response thereto to disable the comparison of Fibre Channel Port value or Port and Area value.
12. A Fibre Channel switch according to claim 7 wherein the inclusion table can express a designation defining a range of S_ID values and additional entries defining exceptions to the range, and wherein the destination port validator is operable in response thereto to accept the range but not the exceptions.
Applications Claiming Priority (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US20941300P | 2000-06-05 | 2000-06-05 | |
| US60/209,413 | 2000-06-05 | ||
| PCT/US2001/018159 WO2001095566A2 (en) | 2000-06-05 | 2001-06-05 | Hardware-enforced loop-level hard zoning for fibre channel switch fabric |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CA2410932A1 CA2410932A1 (en) | 2001-12-13 |
| CA2410932C true CA2410932C (en) | 2010-04-13 |
Family
ID=22778655
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA2410932A Expired - Fee Related CA2410932C (en) | 2000-06-05 | 2001-06-05 | Hardware-enforced loop-level hard zoning for fibre channel switch fabric |
Country Status (9)
| Country | Link |
|---|---|
| US (2) | US7248580B2 (en) |
| EP (1) | EP1290837B1 (en) |
| JP (1) | JP4741039B2 (en) |
| KR (1) | KR100670084B1 (en) |
| AT (1) | ATE376735T1 (en) |
| AU (1) | AU2001275252A1 (en) |
| CA (1) | CA2410932C (en) |
| DE (1) | DE60131079T2 (en) |
| WO (1) | WO2001095566A2 (en) |
Families Citing this family (47)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6697359B1 (en) * | 1999-07-02 | 2004-02-24 | Ancor Communications, Inc. | High performance switch fabric element and switch systems |
| EP1238486B1 (en) * | 1999-12-10 | 2008-10-15 | Qlogic Switch Products, Inc. | Method and apparatus for credit-based flow control in Fibre Channel systems |
| JP4741039B2 (en) * | 2000-06-05 | 2011-08-03 | クロジック スイッチ プロダクツ， インコーポレイテッド | Hardware-enhanced loop-level hard zoning for Fiber Channel switch fabric |
| US7978695B2 (en) * | 2000-06-05 | 2011-07-12 | Qlogic Switch Products, Inc. | Hardware-enforced loop and NPIV hard zoning for fibre channel switch fabric |
| US20030055932A1 (en) * | 2001-09-19 | 2003-03-20 | Dell Products L.P. | System and method for configuring a storage area network |
| US20030140128A1 (en) * | 2002-01-18 | 2003-07-24 | Dell Products L.P. | System and method for validating a network |
| US7154886B2 (en) * | 2002-07-22 | 2006-12-26 | Qlogic Corporation | Method and system for primary blade selection in a multi-module fiber channel switch |
| US7230929B2 (en) * | 2002-07-22 | 2007-06-12 | Qlogic, Corporation | Method and system for dynamically assigning domain identification in a multi-module fibre channel switch |
| US7397768B1 (en) | 2002-09-11 | 2008-07-08 | Qlogic, Corporation | Zone management in a multi-module fibre channel switch |
| US6886141B1 (en) | 2002-10-07 | 2005-04-26 | Qlogic Corporation | Method and system for reducing congestion in computer networks |
| US7152132B2 (en) * | 2003-07-16 | 2006-12-19 | Qlogic Corporation | Method and apparatus for improving buffer utilization in communication networks |
| US7406092B2 (en) | 2003-07-21 | 2008-07-29 | Qlogic, Corporation | Programmable pseudo virtual lanes for fibre channel systems |
| US7894348B2 (en) | 2003-07-21 | 2011-02-22 | Qlogic, Corporation | Method and system for congestion control in a fibre channel switch |
| US7525983B2 (en) * | 2003-07-21 | 2009-04-28 | Qlogic, Corporation | Method and system for selecting virtual lanes in fibre channel switches |
| US7477655B2 (en) * | 2003-07-21 | 2009-01-13 | Qlogic, Corporation | Method and system for power control of fibre channel switches |
| US7466700B2 (en) * | 2003-07-21 | 2008-12-16 | Qlogic, Corporation | LUN based hard zoning in fibre channel switches |
| US7447224B2 (en) * | 2003-07-21 | 2008-11-04 | Qlogic, Corporation | Method and system for routing fibre channel frames |
| US7684401B2 (en) | 2003-07-21 | 2010-03-23 | Qlogic, Corporation | Method and system for using extended fabric features with fibre channel switch elements |
| US7573909B2 (en) * | 2003-07-21 | 2009-08-11 | Qlogic, Corporation | Method and system for programmable data dependant network routing |
| US7430175B2 (en) | 2003-07-21 | 2008-09-30 | Qlogic, Corporation | Method and system for managing traffic in fibre channel systems |
| US7558281B2 (en) * | 2003-07-21 | 2009-07-07 | Qlogic, Corporation | Method and system for configuring fibre channel ports |
| US7646767B2 (en) | 2003-07-21 | 2010-01-12 | Qlogic, Corporation | Method and system for programmable data dependant network routing |
| US7580354B2 (en) * | 2003-07-21 | 2009-08-25 | Qlogic, Corporation | Multi-speed cut through operation in fibre channel switches |
| US7792115B2 (en) | 2003-07-21 | 2010-09-07 | Qlogic, Corporation | Method and system for routing and filtering network data packets in fibre channel systems |
| US7420982B2 (en) | 2003-07-21 | 2008-09-02 | Qlogic, Corporation | Method and system for keeping a fibre channel arbitrated loop open during frame gaps |
| JP4210922B2 (en) * | 2003-10-27 | 2009-01-21 | ソニー株式会社 | Imaging apparatus and method |
| US7103504B1 (en) | 2003-11-21 | 2006-09-05 | Qlogic Corporation | Method and system for monitoring events in storage area networks |
| US7930377B2 (en) | 2004-04-23 | 2011-04-19 | Qlogic, Corporation | Method and system for using boot servers in networks |
| US7340167B2 (en) * | 2004-04-23 | 2008-03-04 | Qlogic, Corporation | Fibre channel transparent switch for mixed switch fabrics |
| US7669190B2 (en) | 2004-05-18 | 2010-02-23 | Qlogic, Corporation | Method and system for efficiently recording processor events in host bus adapters |
| US8295299B2 (en) | 2004-10-01 | 2012-10-23 | Qlogic, Corporation | High speed fibre channel switch element |
| US7676611B2 (en) | 2004-10-01 | 2010-03-09 | Qlogic, Corporation | Method and system for processing out of orders frames |
| US8335231B2 (en) * | 2005-04-08 | 2012-12-18 | Cisco Technology, Inc. | Hardware based zoning in fibre channel networks |
| US8464238B1 (en) | 2006-01-31 | 2013-06-11 | Qlogic, Corporation | Method and system for managing storage area networks |
| US20070220124A1 (en) * | 2006-03-16 | 2007-09-20 | Dell Products L.P. | System and method for automatically creating and enabling zones in a network |
| US7770208B2 (en) * | 2006-03-28 | 2010-08-03 | International Business Machines Corporation | Computer-implemented method, apparatus, and computer program product for securing node port access in a switched-fabric storage area network |
| US7769842B2 (en) * | 2006-08-08 | 2010-08-03 | Endl Texas, Llc | Storage management unit to configure zoning, LUN masking, access controls, or other storage area network parameters |
| US7613816B1 (en) | 2006-11-15 | 2009-11-03 | Qlogic, Corporation | Method and system for routing network information |
| US7769931B1 (en) * | 2007-02-15 | 2010-08-03 | Emc Corporation | Methods and systems for improved virtual data storage management |
| US8321908B2 (en) * | 2007-06-15 | 2012-11-27 | Cisco Technology, Inc. | Apparatus and method for applying network policy at a network device |
| US8031703B2 (en) * | 2008-08-14 | 2011-10-04 | Dell Products, Lp | System and method for dynamic maintenance of fabric subsets in a network |
| CN101626343B (en) * | 2009-08-05 | 2012-04-04 | 华为技术有限公司 | Method and apparatus for exchanging data packet, and communication device |
| US8958429B2 (en) | 2010-12-22 | 2015-02-17 | Juniper Networks, Inc. | Methods and apparatus for redundancy associated with a fibre channel over ethernet network |
| US8364852B1 (en) * | 2010-12-22 | 2013-01-29 | Juniper Networks, Inc. | Methods and apparatus to generate and update fibre channel firewall filter rules using address prefixes |
| US9893989B2 (en) | 2013-06-24 | 2018-02-13 | Hewlett Packard Enterprise Development Lp | Hard zoning corresponding to flow |
| US11100023B2 (en) * | 2017-09-28 | 2021-08-24 | Intel Corporation | System, apparatus and method for tunneling validated security information |
| US11922043B2 (en) * | 2021-06-08 | 2024-03-05 | EMC IP Holding Company LLC | Data migration between storage systems |
Family Cites Families (49)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US4162375A (en) | 1972-03-23 | 1979-07-24 | Siemens Aktiengesellschaft | Time-divison multiplex switching network with spatial switching stages |
| GB2074815B (en) | 1980-04-24 | 1984-06-27 | Plessey Co Ltd | Telecommunications switching network using digital switching modules |
| US4475192A (en) | 1982-02-16 | 1984-10-02 | At&T Bell Laboratories | Data packet flow control scheme for switching networks |
| US4546468A (en) | 1982-09-13 | 1985-10-08 | At&T Bell Laboratories | Switching network control circuit |
| US4569043A (en) | 1983-06-22 | 1986-02-04 | Gte Automatic Electric Inc. | Arrangement for interfacing the space stage to the time stages of a T-S-T digital switching system |
| US4725835A (en) | 1985-09-13 | 1988-02-16 | T-Bar Incorporated | Time multiplexed bus matrix switching system |
| US4821034A (en) | 1987-02-06 | 1989-04-11 | Ancor Communications, Inc. | Digital exchange switch element and network |
| US5144622A (en) | 1988-02-15 | 1992-09-01 | Hitachi, Ltd. | Network system |
| US5367520A (en) | 1992-11-25 | 1994-11-22 | Bell Communcations Research, Inc. | Method and system for routing cells in an ATM switch |
| JPH0758770A (en) * | 1993-08-12 | 1995-03-03 | Hitachi Cable Ltd | Multi-port repeater system |
| US5412653A (en) | 1993-10-15 | 1995-05-02 | International Business Machines Corporation | Dynamic switch cascading system |
| GB9401092D0 (en) | 1994-01-21 | 1994-03-16 | Newbridge Networks Corp | A network management system |
| GB9408574D0 (en) | 1994-04-29 | 1994-06-22 | Newbridge Networks Corp | Atm switching system |
| US5633867A (en) | 1994-07-01 | 1997-05-27 | Digital Equipment Corporation | Local memory buffers management for an ATM adapter implementing credit based flow control |
| US5598541A (en) | 1994-10-24 | 1997-01-28 | Lsi Logic Corporation | Node loop port communication interface super core for fibre channel |
| US5687172A (en) | 1994-12-30 | 1997-11-11 | Lucent Technologies Inc. | Terabit per second distribution network |
| US5528591A (en) | 1995-01-31 | 1996-06-18 | Mitsubishi Electric Research Laboratories, Inc. | End-to-end credit-based flow control system in a digital communication network |
| US5748612A (en) | 1995-08-10 | 1998-05-05 | Mcdata Corporation | Method and apparatus for implementing virtual circuits in a fibre channel system |
| US6047323A (en) | 1995-10-19 | 2000-04-04 | Hewlett-Packard Company | Creation and migration of distributed streams in clusters of networked computers |
| US5610745A (en) | 1995-10-26 | 1997-03-11 | Hewlett-Packard Co. | Method and apparatus for tracking buffer availability |
| JPH09247176A (en) | 1996-03-11 | 1997-09-19 | Hitachi Ltd | Asynchronous transfer mode exchange system |
| KR100194813B1 (en) | 1996-12-05 | 1999-06-15 | 정선종 | Packet Switching Device with Multichannel / Multicast Switching Function and Packet Switching System Using the Same |
| US6188690B1 (en) | 1996-12-12 | 2001-02-13 | Pmc-Sierra, Inc. | Method and apparatus for high speed, scalable communication system |
| JP3156623B2 (en) | 1997-01-31 | 2001-04-16 | 日本電気株式会社 | Fiber channel fabric |
| US6014383A (en) | 1997-02-10 | 2000-01-11 | Compaq Computer Corporation | System and method for controlling multiple initiators in a fibre channel environment |
| US6185203B1 (en) * | 1997-02-18 | 2001-02-06 | Vixel Corporation | Fibre channel switching fabric |
| US6118776A (en) * | 1997-02-18 | 2000-09-12 | Vixel Corporation | Methods and apparatus for fiber channel interconnection of private loop devices |
| US6160813A (en) | 1997-03-21 | 2000-12-12 | Brocade Communications Systems, Inc. | Fibre channel switching system and method |
| US5825748A (en) | 1997-04-08 | 1998-10-20 | International Business Machines Corporation | Credit-based flow control checking and correction system |
| US5987028A (en) | 1997-05-12 | 1999-11-16 | Industrial Technology Research Insitute | Multiple channel ATM switch |
| US6081512A (en) | 1997-06-30 | 2000-06-27 | Sun Microsystems, Inc. | Spanning tree support in a high performance network device |
| US6324181B1 (en) | 1998-04-16 | 2001-11-27 | 3Com Corporation | Fibre channel switched arbitrated loop |
| US6647019B1 (en) | 1998-04-29 | 2003-11-11 | Pmc-Sierra, Inc. | Packet-switch system |
| US6289386B1 (en) | 1998-05-11 | 2001-09-11 | Lsi Logic Corporation | Implementation of a divide algorithm for buffer credit calculation in a high speed serial channel |
| US6411599B1 (en) | 1998-05-29 | 2002-06-25 | International Business Machines Corporation | Fault tolerant switching architecture |
| US6330236B1 (en) | 1998-06-11 | 2001-12-11 | Synchrodyne Networks, Inc. | Packet switching method with time-based routing |
| US7756986B2 (en) * | 1998-06-30 | 2010-07-13 | Emc Corporation | Method and apparatus for providing data management for a storage system coupled to a network |
| US7165152B2 (en) * | 1998-06-30 | 2007-01-16 | Emc Corporation | Method and apparatus for managing access to storage devices in a storage system with access control |
| US6885664B2 (en) | 1998-07-22 | 2005-04-26 | Synchrodyne Networks, Inc. | Distributed switching system and method with time-based routing |
| US6597691B1 (en) | 1998-09-01 | 2003-07-22 | Ancor Communications, Inc. | High performance switching |
| JP2000134258A (en) * | 1998-10-22 | 2000-05-12 | Chokosoku Network Computer Gijutsu Kenkyusho:Kk | Route control system in connection setting type network |
| US6765919B1 (en) * | 1998-10-23 | 2004-07-20 | Brocade Communications Systems, Inc. | Method and system for creating and implementing zones within a fibre channel system |
| US6424658B1 (en) | 1999-01-29 | 2002-07-23 | Neomagic Corp. | Store-and-forward network switch using an embedded DRAM |
| US6308220B1 (en) | 1999-01-29 | 2001-10-23 | Neomagic Corp. | Circulating parallel-search engine with random inputs for network routing table stored in a wide embedded DRAM |
| US6697359B1 (en) | 1999-07-02 | 2004-02-24 | Ancor Communications, Inc. | High performance switch fabric element and switch systems |
| EP1238486B1 (en) * | 1999-12-10 | 2008-10-15 | Qlogic Switch Products, Inc. | Method and apparatus for credit-based flow control in Fibre Channel systems |
| US6484173B1 (en) * | 2000-02-07 | 2002-11-19 | Emc Corporation | Controlling access to a storage device |
| US7978695B2 (en) * | 2000-06-05 | 2011-07-12 | Qlogic Switch Products, Inc. | Hardware-enforced loop and NPIV hard zoning for fibre channel switch fabric |
| JP4741039B2 (en) * | 2000-06-05 | 2011-08-03 | クロジック スイッチ プロダクツ， インコーポレイテッド | Hardware-enhanced loop-level hard zoning for Fiber Channel switch fabric |
-
2001
- 2001-06-05 JP JP2002502983A patent/JP4741039B2/en not_active Expired - Fee Related
- 2001-06-05 CA CA2410932A patent/CA2410932C/en not_active Expired - Fee Related
- 2001-06-05 KR KR1020027016621A patent/KR100670084B1/en not_active IP Right Cessation
- 2001-06-05 AT AT01941941T patent/ATE376735T1/en not_active IP Right Cessation
- 2001-06-05 EP EP01941941A patent/EP1290837B1/en not_active Expired - Lifetime
- 2001-06-05 DE DE60131079T patent/DE60131079T2/en not_active Expired - Lifetime
- 2001-06-05 WO PCT/US2001/018159 patent/WO2001095566A2/en active IP Right Grant
- 2001-06-05 AU AU2001275252A patent/AU2001275252A1/en not_active Abandoned
-
2002
- 2002-12-05 US US10/310,653 patent/US7248580B2/en not_active Expired - Lifetime
-
2007
- 2007-06-20 US US11/765,724 patent/US7684398B2/en not_active Expired - Fee Related
Also Published As
| Publication number | Publication date |
|---|---|
| JP2004501565A (en) | 2004-01-15 |
| WO2001095566A2 (en) | 2001-12-13 |
| JP4741039B2 (en) | 2011-08-03 |
| KR20030036216A (en) | 2003-05-09 |
| US7684398B2 (en) | 2010-03-23 |
| EP1290837B1 (en) | 2007-10-24 |
| WO2001095566A3 (en) | 2002-06-13 |
| EP1290837A2 (en) | 2003-03-12 |
| AU2001275252A1 (en) | 2001-12-17 |
| DE60131079D1 (en) | 2007-12-06 |
| KR100670084B1 (en) | 2007-01-17 |
| US7248580B2 (en) | 2007-07-24 |
| US20080002687A1 (en) | 2008-01-03 |
| ATE376735T1 (en) | 2007-11-15 |
| US20030179748A1 (en) | 2003-09-25 |
| CA2410932A1 (en) | 2001-12-13 |
| DE60131079T2 (en) | 2008-08-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA2410932C (en) | Hardware-enforced loop-level hard zoning for fibre channel switch fabric | |
| US7978695B2 (en) | Hardware-enforced loop and NPIV hard zoning for fibre channel switch fabric | |
| US10476794B2 (en) | Efficient caching of TCAM rules in RAM | |
| US6377577B1 (en) | Access control list processing in hardware | |
| US9860254B2 (en) | Method and apparatus for providing network security using role-based access control | |
| US8181258B2 (en) | Access control list constructed as a tree of matching tables | |
| US7873038B2 (en) | Packet processing | |
| US6490276B1 (en) | Stackable switch port collapse mechanism | |
| Kent | US Department of Defense Security Options for the Internet Protocol | |
| US20110010769A1 (en) | Preventing Spoofing | |
| KR100789504B1 (en) | Method of communications and communication network intrusion protection methods and intrusion attempt detection system | |
| WO1998040992A2 (en) | Methods and apparatus for controlling access to information | |
| EP1419625A1 (en) | Virtual egress packet classification at ingress | |
| US8873555B1 (en) | Privilege-based access admission table | |
| Cisco | Configuring IP Security Options | |
| Cisco | Configuring IP Security Options | |
| Cisco | Configuring IP Security Options | |
| Cisco | Configuring IP Security Options | |
| KR20030080412A (en) | method of preventing intrusion from an exterior network and interior network | |
| KR100590891B1 (en) | Apparatus and method for optimizing lookup memory in routing system | |
| Kent | RFC1108: US Department of Defense Security Options for the Internet Protocol | |
| Tongaonkar | Efficient techniques for fast packet classification | |
| Bruniges | A security related architecture for a TNB supporting confidentiality and integrity based policies |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| EEER | Examination request | ||
| MKLA | Lapsed |
Effective date: 20170605 |