Brocade: User Management on optical switches

In the Fabric OS (FOS) operating system of Brocade switches, user account management is performed using the "userConfig" command, which supports the following roles for the chassis and logical fabrics (LF):
admin - full access to all commands;
user - read-only, minimal privileges;
switchadmin - switch management, but not zoning;
zoneadmin - zoning management;
fabricadmin - fabric service management;
basicswitchadmin - limited switch management;
operator - extended rights (port management, but not configuration);
securityadmin - security policy management.

For example, to create an account with read-only privileges, the role "user" is used.
For a more detailed view of a role, run:
roleconfig --show <role>


To view user accounts, use the following commands:

Show all users:
userconfig --show -a
Show a specific user:
userconfig --show <username>
Show users with a specific role:
userconfig --show -r <role>


To create a new user:

userconfig --add <username> -r <LF_role> -l <LF_ID_list> [-h <home_LF>] [-c <chassis_role>] [-p <password>] [-d <description>]

Example of creating a read-only user "monitor":
userconfig --add monitor -l 1-128 -h 128 -r user -c user -p 'mypassword' -d "Monitoring account"

where
-r user — role inside logical fabrics (read-only);
-l 1-128 — access to all LFs from 1 to 128;
-h 128 — home LF (defaults to FID 128);
-c user — chassis-level role (also read-only);
-p — password;
-d — account description.

Important: for read-only access, be sure to specify "-c user" and "-r user". Without "-c user" the user may not have access to the global configuration.


To modify parameters of an existing user, use the "userconfig --change" command, which allows changing the role, LF list, home LF, lock status, description, and password:

userconfig --change <username> [-l <LF_list> -r <LF_role>] [-h <home_LF>] [-c <chassis_role>] [-e yes|no] [-x] [-u] [-d <description>] [-at <HH:MM-HH:MM>]

Example of changing the role of user "monitor" to admin:
userconfig --change monitor -l 1-128 -h 128 -r admin -c admin

Example of changing a user's description:
userconfig --change monitor -d "New description"

Example of setting the home LF to 10:
userconfig --change monitor -h 10

Example of unlocking an account (after several failed attempts):
userconfig --change monitor -u

Force a user to change their password at next login:
userconfig --change monitor -x

Example of disabling an account (without deletion):
userconfig --change monitor -e no

Example of enabling an account:
userconfig --change monitor -e yes

Change password (interactively):
passwd monitor

Example of setting a time‑based access restriction (from 9:00 to 18:00):
userconfig --change monitor -at 09:00-18:00

Example of removing a time‑based access restriction:
userconfig --change monitor -at 00:00-00:00


To manage access to logical fabrics:

To add access to additional LFs, use the command:
userconfig --addlf <username> -l <LF_list> -r <LF_role> [-h <home_LF>] [-c <chassis_role>]

Example of adding access to LF 10 with the user role for user "monitor":
userconfig --addlf monitor -l 10 -r user

To remove access to specific LFs:
userconfig --deletelf <username> -l <LF_list>

Example of removing access to LF 10:
userconfig --deletelf monitor -l 10


To delete a user, use the "userconfig --delete" command:

userconfig --delete <username>

Example of deleting a user:
userconfig --delete monitor


To diagnose login problems, check the audit logs:

auditdump --show | grep -i <username>

Note: executing the commands --add, --change, --delete, --addlf, --deletelf requires administrator privileges (having the admin or securityadmin role).

Brocade: Access to the switch web management console does not work after Fabric OS upgrade

If, after updating the Fabric OS firmware, there is no access to the switch’s web management console and a certificate error appears in the browser, you must perform the following steps:

1. Check the availability of a certificate for HTTPs access to the switch:
seccertmgmt show -cert https

2. If necessary, generate a new one:
seccertmgmt generate -cert https -type rsa -keysize 2048 -hash sha256 -years 20

3. Check encryption protocol settings:
seccryptocfg --show

4. You can set the settings as follows if there is a problem with the web browser:

seccryptocfg --replace -type https -cipher 'ECDSA:ECDH:RSA:AES:3DES:!RSAPSK:!DHEPSK:!PSK:!DSS:!AESCCM8:!AESCCM:!ARIAGCM:!CAMELLIA:!CHACHA20:!SEED:!RC4'

5. Check if the current settings match the default security template:
seccryptocfg --verify default_generic

6. If necessary, apply a security template:
seccryptocfg --apply default_generic

The full list of security templates can be viewed with the command:
seccryptocfg --lstemplates

Brocade: Setting up email alerts

For Brocade optical switches, email alerts are configured as follows:

1. Specify the addresses to which notifications should be sent:
mapsconfig --emailcfg -address myemail1@mycompany.com,myemail2@mycompany.com -from myswitch@mycompany.com

2. To view the notification configuration, use the command:
mapsconfig --show

3. Enabling or disabling additional trigger rules and actions can be done as follows:
mapsconfig --actions email,fpin

4. To generate a test email message, use:
mapsconfig --testmail

5. Sometimes you may need to pause the monitoring of a specific port or other node:
mapsconfig --config pause -type port -members 34

6. To continue monitoring the paused node, run:
mapsconfig --config restart -type port -members 34

7. To reset all alert settings to factory settings, do the following:
mapsconfig --purge -force

Brocade: Configuring ports to work over long distances

When spacing switches over distances exceeding 5 km, it is necessary to configure the operation of E-ports in the "Long-Distance" mode. To do this, use the "portcfglongdistance" command:

portcfglongdistance [slot/]port distance_level vc_translation_link_init -distance desired_distance

where distance_level is the "Long-Distance" mode of operation, canbe:
L0 (default normal mode with limits of 5 km for 2G, 2 km for 4G, 1 km for 8G and above);
LE (extended mode for distances of 5-10 km, does not require an additional license);
LD (dynamic mode, calculates the number of buffer credits based on self-made measurements of the line length);
LS (static mode - the switch calculates the number of buffer credits from the distance value set by the user).
vc_translation_link_init - "fill words", when set to IDLE(0) mode, the link uses IDLE fill words. When set to ARB (1), FF is used to reduce electrical noise in copper equipment.
desired_distance - distance between switches in kilometers.

For example, set "Long-Distance" on port 11 in static mode with the fill word ARB and an estimated distance of 60 km:

portcfglongdistance 11 LS 1 -distance 60

Using the "portbuffercalc" command, we can pre-calculate how many buffer credits will be needed on our equipment. Using the input data from the previous example, we calculate for a speed of 32G:

portbuffercalc 11 -speed 32 -distance 60 -framesize 2048
966 buffers required for 60km at 32G and framesize of 2048bytes

Also, for correct operation, it may be necessary to change the following parameters through the "configure" interactive command in the "disabled" state of the switch:
R_A_TOV - Resource Allocation Time Out Value (default 10000) can be from E_D_TOV*2 to 120000;
E_D_TOV - Error Detect Time Out Value (default 2000) can be from 1000 to R_A_TOV/2;
WAN_TOV - Wide-Area Network TimeOut Value (default 0) can be from 0 to R_A_TOV/4;
MAX_HOPS - Maximum number of hops in the region before a BPDU is discarded (default 7) can be from 7 to 19.

Brocade: Peer Zone

Unlike classical zoning, the Peer zone includes principal members (targets - most often these are array ports) and peer members (initiators - ports of servers that work with LUNs).

The following rules apply in the Peer zone:
1. Peer members can only communicate with principal members within this zone.
2. Principal members cannot communicate with other principal members within this zone.

Working with the Peer zone on the command line:

1. Create a zone:
zonecreate --peerzone Name -principal "Principal_Members" -members "Peer_Members"

2. Adding new devices to the zone:
zoneadd --peerzone Name -members "Peer_Members"

3. Replacing devices in the zone:
zoneobjectreplace "Peer_Member1" "Peer_Member2"

4. Removing devices from the zone:
zoneremove --peerzone Name -members "Peer_Members"

5. Deleting a zone:
zonedelete Name

6. View:
zoneshow --peerzone all

zoneshow --peerzone all -pattern test*
View zones using wildcard filter (show all zones starting with "test").

Brocade: Zoning setup

A new Brocade optical switch has a default zone enabled. If it is disabled with the
"defzone --noaccess" command, then it will be necessary to fine-tune the zones for the safe operation of initiators with targets.

Working with aliases:

1. Creating an alias (alias):
alicreate "name", "member[; member...]"
Members can be ports or WWN addresses.

2. Adding a new member:
aliad "name", "member[; member...]"

3. Removing a member:
aliremove "name", "member[; member...]"

4. Removing an alias:
alidelete "name"

5.View:
alishow "server*"
Show aliases with name starting with "server".

alishow --ic "server*"
With ignoring the case of characters in the name.

6. Saving configuration after alias settings:
cfgsave

Working with zones:

1. Create a zone:
zonecreate "name", "member[; member...]"
Members can be aliases, ports, or WWN addresses.

2. Adding new members to the zone:
zoneadd "name", "member[; member...]"

3. Removing members from the zone:
zoneremove "name", "member[; member ...]"

4. Deleting a zone:
zonedelete "name"

5. View zone configuration:
zoneshow "server*"
Show zones with a name beginning with "server".

zoneshow --ic "server*"
With ignoring the case of characters in the name.

6. Saving configuration after zone settings:
cfgsave

Working with zone configurations:

1. Create a configuration:
cfgcreate "name", "member[; member ...]"
Only zones can be members of a configuration.

2. Adding zones to the configuration:
cfgadd "name", "member[; member ...]"

3. Removing zones from the configuration:
cfgremove "name", "member[; member ...]"

4. Deleting a configuration:
cfgdelete "name"

5. Saving the configuration:
cfgsave

6. Configuration activation:
cfgenable "name"

7. View:
cfgshow

cfgshow "Test*"
Show configurations with a name starting with "Test".

cfgshow --ic "Test*"
With ignoring the case of characters in the name.

cfgactvshow
Show the currently active configuration.

8. Deactivation of the current working configuration:
cfgdisable

Completely clear the entire zoning configuration:

cfgclear -f

Brocade: Setting up a periodic backup of the configuration of an optical switch using the SCP protocol

To perform the task of creating periodic backups of switch configurations, we will use a host with an installed SSH server. 

Let's go through the following steps:

1. For the convenience of connecting via SSH using a script, install the "sshpass" utility.

2. Let's create a user in the server OS, which will have the rights to connect via the SCP protocol and write to the required directory of the configuration file.

3. Create a script, for example "brocade.sh", and add commands for backing up optical switches in the following form:

sshpass -p Switch_Pass ssh Switch_Address -l Switch_User configupload -all -p scp -P 22 -cra Server_Address,Server_User,config-o-rez-$(date -I).txt,Server_Pass;exit

where Switch_Address - optical switch address;
Switch_User - optical switch user;
Switch_Pass - optical switch user's password;
Server_Address - SSH server address;
Server_User - user to connect to the server via SSH;
Server_Pass - SSH server user's password.

4. Add to the task scheduler ("cron") the execution of this script with the necessary periodicity. For example, to run on the first Monday of every month at 7 am:

0 7 1-7 * 1 /path/to/brocade.sh

 

Brocade: Creating and configuring FICON virtual switch

The default switch cannot change type to FICON switch, so you need to enable and use the virtual factory. Before configuring, make sure that all switches that will be in the same fabric have the same Fabric OS firmware version.

To create a FICON-type switch, go through the following steps:

1. Check if the virtual factory is enabled: "fosconfig --show". If not, then enable the command: "fosconfig --enable vf". 

2. Create a switch with the command: "lscfg --create FabricID -ficon".

3. Change context to the created switch: "setcontext FabricID".

4. Use the "aptpolicy" command to check the current setting of the Routing Policy. If necessary, we switch to the Device Based Routing Policy mode with the "aptpolicy 2" command.

5. It is recommended to enable Lossless Dynamic Load Sharing with the command:
"dlsset --enable -lossless".

6. It is also recommended to set In-Order Delivery with the command: "iodset".

7. Change the switch name with the command: "switchname NewName".

8. Execute "configure" to change some parameters:
- set the required DomainID of the switch;
- Disable Device Probing is recommended to be set to one.
Change other parameters only if necessary.

9. Now you need to transfer the ports to the logical switch with the command:
"lscfg --config FabricID -port n1-n2".

10. Bind addresses to physical ports of the switch with the command
"portaddress --bind PortNumber PortAddress" (you can specify a range of ports, then the next port in turn will be assigned an address increased by one). For example, set the address 0x2800 for the physical port 40: "portaddress --bind 40 0x2800". You can unbind to ports with the command: "portaddress --unbind PortNumber". To view the current bindings, run: "portaddress --show". Before performing any action with bindings, make sure that the ports are in a disabled state.

11. For the switch to work correctly, you need to create an SCC policy and add the WWNs of the switches in the same factory to it. This can be done with the command:
"secpolicycreate SCC_POLICY "*"" or specify the WWN of each switch separately:
"secpolicycreate SCC_POLICY "WWN1;WWN2;WWN3"".

12. Set the switch and ports to the enabled state with the "switchenable" and
"portenable FirstPortNumber-EndPortNumber" commands.

13. Save policy settings: "secpolicysave".

14. Activate the policy: "secpolicyactivate".

15. Use the "fabricprincipal" command to set the Principal Switch role selection priority. For example, to specify the highest priority, run: "fabricprincipal --enable -p 0x01".

16. By default, the connection speed on the ports is set automatically, for manual settings, you can use the "portcfgspeed" command.

17. If the distance between fabric switches exceeds 10km, reconfigure your uplink ports accordingly using the "portcfglongdistance" command. 

18. Run the "defzone --noaccess" command to disable the default zone, and then configure the factory's own zones. After the changes have been made, save the configuration with the command: "cfgsave".

19. Clear statistics on ports: "statsclear".

20. We execute several commands to check the operation of the switch:
"switchshow" - make sure that the switch is online;
"ficonshow rnid" - check if FICON devices are registered
("ficonshow rnid port PortNumber" - for a specific port);
"ficonshow lirr" - make sure FICON host channels are registered to listen for communication incidents.

Brocade: Optical switch Firmware update

Steps to update:

1. We place the files of the new firmware in the target directory on the server with access via one of the protocols: FTP, SFTP, SCP or HTTP.

2. Check the installed firmware version and backup version: "firmwareshow".

3. Run the firmware update with the "firmwaredownload" command.

4. Specify the name or address of the server where the firmware is located.

5. Specify the username to connect to the server with the firmware.

6. Specify the path to the directory with the firmware (this folder should contain such scripts as "install" and "install_verify").

7. Specify the protocol used for downloading files.

8. Specify the password for the remote server.

9. Next, confirm the license agreement.

10. After a preliminary check, in the absence of significant errors, we confirm the start of the switch firmware update.

11. While the update is in progress, you can connect with another SSH session and use the "firmwaredownloadstatus" and "firmwareshow" commands to monitor the status of the process.

12. After the main memory partition is flashed, the switch will reboot and continue updating the backup memory partition.

13. At the end of the firmware update, the "firmwaredownloadstatus" command will start to display the message "Firmwaredownload command has completed successfully. Use firmwareshow to verify the firmware versions.".

14. At your discretion, you can start checking the firmware image with the "firmwarecheck" command.

Brocade: Setting up IP addresses for a logical switch (IPFC)

In addition to setting the IP address on the switch chassis, you can also set your own IP for the logical switch (IPFC). After connecting to this address, you will immediately be taken to the desired context. IP must be selected from the subnet where the address of the chassis itself is located. IPv6 is not supported.

To set the address, do:
ipaddrset -ls FID --add 192.168.2.1/24
where FID - fabric ID.

Removing an address:
ipaddrset -ls FID --delete

Viewing addresses:
ipaddrshow

Brocade: How to remove the warning banner "ATTENTION It is recommended that you change the default passwords for all the switch accounts..." when logging into the switch

This banner can be displayed using the "bannershow" command.
To change or remove it, run "bannerset", then change the text if needed, or just type "." and press "Enter" - the banner will no longer appear.

Brocade: How to login to the switch with "root" account via CLI

By default, the "root" user on the switch is disabled and can only be accessed through the terminal console. To log in via SSH you will need:

1. Enable user account:
userconfig --change root -e yes

2. Check the status of the "root" user:
userconfig --show root

3. Check the access level with the command:
rootaccess --show

4. If the received value is "consoleonly" or "none", run:
rootaccess --set all

5. Connect to the switch via SSH using the "root" user (usually the default password is "fibranne"). The first time you log in, you will be asked to change your password.

After updating to FOS 9.1.0 access to user "root" will be removed!

Brocade: Configuring Principal Switch role priority

When changes occur in the SAN network fabric, the "Principal" switch is re-elected. The result usually depends on the WWN of the switches and on the priority set. By default, for all new switches, it is equal to the value: 0xFE. The rest of the switches in the fabric set themselves the "Subordinate" role.

To set your priority, run:

fabricprincipal --enable -p 0x01

The value of priorities can be as follows:
0x00 - not used, reserved;
0x01 - highest priority;
0x02 - this value should not be used either, it is generated by the switch to initiate a factory rebuild;
0x03 - 0xFE - range to be used for setting priorities (the larger the value, the lower the priority);
0xFF - with this value, the switch will become the "Principal" switch last, even the default settings have a higher priority.

To view information use:

fabricshow
fabricprincipal --show

Disable priority mode (return priority value to "0xFE"):

fabricprincipal --disable

Re-election of the "Principal" switch in the factory usually occurs in cases of turning off the current main switch, connecting a new switch to the factory, disconnecting and connecting ISL (Inter-Switch Link) ports. Disabling (switchdisable) and enabling (switchenable) a switch with the "Subordinate" role usually does not lead to a factory rebuild, but to force this process, use:

fabricprincipal -f

Brocade: Managing trunking connections

First you need to make sure that the "Trunking" license is installed, using the command:
license --show

Enable/disable the ability to use a trunk on a port:
portcfgtrunkport slot/port [1 or 0]

Enable/disable the ability to use a trunk on all switch ports:
switchcfgtrunk [1 or 0]

Viewing information on trunks:
trunkshow
trunkshow -swname (adds information about neighbor switch names)
trunkshow -perf (adds trunk utilization information)

Configuring a port for long distance operation:
portcfglongdistance slot/port Distance_Level VC_Trans_Link_Init -distance n
where Distance_Level:
L0 - normal;
LE - <= 10km;
LD - auto;
LS - static;

and VC_Trans_Link_Init:
0 - IDLE;
1 - Arbitary;

distance - distance in kilometers (n not less than 10)

Brocade: Setup Logical Switch

Enable or disable Virtual Fabrics mode:
fosconfig --enable vf
fosconfig --disable vf
fosconfig --show

Creation:
lscfg --create fabricID [-base | -ficon]
where the absence of parameters is a logical switch, base - a base switch, ficon - with FICON protocol support.

Forwarding ports to the switch:
lscfg --config fabricID -port n1-n2

Change FabicID:
lscfg --change fabricID -newfid newFID

Removal:
lscfg --delete fabricID
Before deleting, you must transfer all ports to other logical switches.

View information:
lscfg --show
and
lscfg --show -n

Brocade: Configuring Domain ID

By default, in a new switch, Domain ID = 1. Before inclusion in the SAN, you must set a unique value in the range of 1...239 so that it does not overlap with the numbers of other switches in the network.
If the switch was not powered on before connecting to the fabric, and the default Domain ID is already in use, then the ID for the new switch is reset to a unique value.
If the switch was connected to the factory after power-up, and the default Domain ID is already in use, the factory is segmented.

To configure, run:

1. switchDisable
2. Run "configure" and confirm the start of the configuration.
3. When the wizard prompts you to specify a Domain, enter the desired value from 1 to 239.
4. To interrupt the wizard and not configure other settings, press Ctrl+D.
5. switchEnable

Run "fabricshow" to check the settings.

Brocade: Configuring NTP

To setup time on a Brocade (Gen7) optical switch, use the console and follow these steps:

1. Run "tsclockserver" to determine the current NTP server setting.

2. To configure NTP servers, do the following:
tsclockserver "ip_or_dns_name1;ip_or_dns_name2"

3. Time zone setting:
tsTimeZone --interactive
Next, follow the wizard, choosing desired zone.

4. We overload the switch with the "reboot" command.

5. Check current time with the "date" command.

You can also use date "MMDDhhmmYY" to manually set the desired date,
where  mm - minutes;
            hh - hours;
            DD - day;
            MM - month;
            YY - year.