Hardware-enforced loop-level hard zoning for fibre channel switch fabric

• US 20030179748A1
• Filed: 12/05/2002
• Published: 09/25/2003
• Est. Priority Date: 06/05/2000
• Status: Active Grant

• Current Assignee: Cavium, LLC (Marvell Technology Group Limited)
• Original Assignee: Qlogic Switch Products Incorporated (Marvell Technology Group Limited)
• Inventors: Dropps, Frank R., George, William R.
• Granted Patent: US 7,248,580 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 49/357 Fibre channel switches
• CPC Class Codes: H04L 49/40 Constructional details, e.g. power supply, mechanical construction or backplane
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Hardware-enforced zoning is provided in Fibre Channel switches to protect against breaching of assigned zones in a switch network which can occur with software-based zoning techniques. The invention provides logic for performing a hardware-based validation of the Source ID S_ID of frames both at the point where the frame enters the Fibre Channel fabric, and at the point where the frame leaves the fabric. The S_ID is verified against an inclusion list or table of allowable S_IDs, which can be unique for each fabric port. The invention provides a way to increase the range of sources an inclusion table can express, by implementing wild cards, on an entry-by entry basis. If the S_ID is valid, it will enter the fabric and route normally. If invalid, the frame will not be routed but will be disposed of by the fabric according to FC rules. This prevents incorrect S_IDs from breaching the table-driven zoning at the point where frames exit the fabric, to prevent unauthorized access to devices connected to the switch network.

Claims

1. A method of hard-zoning protection for loop-level addresses in Fibre Channel switching, comprising:

receiving a frame at a port of a Fibre Channel fabric;

comparing the S_ID of the frame to the native ID of the port, and based on the comparison, routing a valid frame to its destination F_Port or FL_Port;

at the destination port, comparing the frame'"'"'s S_ID to an includion list of sources permitted under the zoning to transmit to the destination port and for loop-level addresses, comparing the zone of the destination and the zone of the source;

for valid frames, transmitting the frame through the destination port to the attached device or loop of devices.

2. A method according to claim 1 wherein the step of comparing the frame S_ID to an inclusion list includes simultaneous comparison of S_IDs using a content addressable memory associated with the destination port.

3. A method according to claim 1 wherein there are multiple zones per loop attached to the destination port in the comparison of source and destination zones.

4. A method according to claim 1 wherein there are multiple overlapping zones per loop attached to the destination port in the comparison of source and destination zones.

5. A method according to claim 1 wherein the inclusion list can express wild card designations to disable the comparison of Fibre Channel Port value or Port and Area value.

6. A method according to claim 1 wherein the inclusion list may have an entry defining a range of S_ID values, and additional entries defining exceptions to the range, and wherein the comparison of permitted S_IDs is based on the range and exceptions.

7. A Fibre Channel switch, comprising:

a port connectable as a source port to receive frames;

an S_ID validator associated with the source port and operable to compare the frame S_ID to the native ID or the source port when used as a F_Port or FL_Port, and operative to route valid frames through the switch fabric;

a port receiving a frame routed through the fabric as a destination F_Port or FL_Port having a unique inclusion table of valid S_IDs and zones for devices and loop devices attached to the port according to defined zoning;

a destination port S_ID validator operably associated with the destination port to compare S_ID and zones of frames routed to it through the fabric against the inclusion list and to transmit only frames with valid sources and zones to the devices and loop devices attached to the port.

8. A Fibre Channel switch according to claim 7 wherein the destination port S_ID validator includes a content addressable memory operative to simultaneously compare the frame S_ID to entries in inclusion table.

9. A Fibre Channel switch according to claim 7 wherein the defined zoning includes multiple zones per loop attached to the destination port.

10. A Fibre Channel switch according to claim 7 wherein the defined zoning includes multiple overlapping zones per loop attached to the destination port.

11. A Fibre Channel switch according to claim 7 wherein the inclusion table can express wild card designations and wherein the destination port validator is operable in response thereto to disable the comparison of Fibre Channel Port value or Port and Area value.

12. A Fibre Channel switch according to claim 7 wherein the inclusion table can express a designation defining a range of S_ID values and additional entries defining exceptions to the range, and wherein the destination port validator is operable in response thereto accept the range but not the exceptions.