Cisco.com

You can access the most current Cisco documentation at this URL: http://www.cisco.com/techsupport
Preface Documentation Feedback
You can access the Cisco website at this URL: http://www.cisco.com You can access international Cisco websites at this URL: http://www.cisco.com/public/countries_languages.shtml
Product Documentation DVD
Cisco documentation and additional literature are available in the Product Documentation DVD package, which may have shipped with your product. The Product Documentation DVD is updated regularly and may be more current than printed documentation. The Product Documentation DVD is a comprehensive library of technical product documentation on portable media. The DVD enables you to access multiple versions of hardware and software installation, configuration, and command guides for Cisco products and to view technical documentation in HTML. With the DVD, you have access to the same documentation that is found on the Cisco website without being connected to the Internet. Certain products also have.pdf versions of the documentation available. The Product Documentation DVD is available as a single unit or as a subscription. Registered Cisco.com users (Cisco direct customers) can order a Product Documentation DVD (product number DOC-DOCDVD=) from the Ordering tool or Cisco Marketplace. Cisco Ordering tool: http://www.cisco.com/en/US/partner/ordering/ Cisco Marketplace: http://www.cisco.com/go/marketplace/

Ordering Documentation

Beginning June 30, 2005, registered Cisco.com users may order Cisco documentation at the Product Documentation Store in the Cisco Marketplace at this URL: http://www.cisco.com/go/marketplace/ Cisco will continue to support documentation orders using the Ordering tool:
Registered Cisco.com users (Cisco direct customers) can order documentation from the Ordering tool: http://www.cisco.com/en/US/partner/ordering/ Instructions for ordering documentation using the Ordering tool are at this URL: http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 553-NETS (6387).

Documentation Feedback

You can rate and provide feedback about Cisco technical documents by completing the online feedback form that appears with the technical documents on Cisco.com.
Preface Cisco Product Security Overview
You can send comments about Cisco documentation to mdsfeedback-doc@cisco.com. You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address: Cisco Systems Attn: Customer Document Ordering 170 West Tasman Drive San Jose, CA 95134-9883 We appreciate your comments.

Cisco Product Security Overview
Cisco provides a free online Security Vulnerability Policy portal at this URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html From this site, you can perform these tasks:
Report security vulnerabilities in Cisco products. Obtain assistance with security incidents that involve Cisco products. Register to receive security information from Cisco.
A current list of security advisories and notices for Cisco products is available at this URL: http://www.cisco.com/go/psirt If you prefer to see advisories and notices as they are updated in real time, you can access a Product Security Incident Response Team Really Simple Syndication (PSIRT RSS) feed from this URL: http://www.cisco.com/en/US/products/products_psirt_rss_feed.html
Reporting Security Problems in Cisco Products
Cisco is committed to delivering secure products. We test our products internally before we release them, and we strive to correct all vulnerabilities quickly. If you think that you might have identified a vulnerability in a Cisco product, contact PSIRT:
Emergencies security-alert@cisco.com An emergency is either a condition in which a system is under active attack or a condition for which a severe and urgent security vulnerability should be reported. All other conditions are considered nonemergencies.
Nonemergencies psirt@cisco.com 228-408 525-6532
In an emergency, you can also reach PSIRT by telephone:
We encourage you to use Pretty Good Privacy (PGP) or a compatible product to encrypt any sensitive information that you send to Cisco. PSIRT can work from encrypted information that is compatible with PGP versions 2.x through 8.x.
Preface Obtaining Technical Assistance
Never use a revoked or an expired encryption key. The correct public key to use in your correspondence with PSIRT is the one linked in the Contact Summary section of the Security Vulnerability Policy page at this URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.htm The link on this page has the current PGP key ID in use.

Chapter 1

Before You Begin About the CLI Command Modes
Switches in the Cisco MDS 9000 Family have two main command modesuser EXEC mode and configuration mode. The commands available to you depend on the mode you are in. To obtain a list of available commands in either mode, type a question mark (?) at the system prompt. Table 1-1 lists and describes the two commonly used modes, how to enter the modes, and the resulting system prompts. The system prompt helps you identify which mode you are in and hence, which commands are available to you.
Table 1-1 Frequently Used Switch Command Modes

Mode EXEC

Description of Use

How to Access

Prompt

switch#

Enables you to temporarily change At the switch prompt, enter the required terminal settings, perform basic tests, and EXEC mode command. display system information.
Changes made in this mode are generally not saved across system resets. From EXEC mode, enter the config terminal command.

switch(config)#

Configuration mode
Enables you to configure features that affect the system as a whole.
Changes made in this mode are saved across system resets if you save your configuration.
You can abbreviate commands and keywords by entering just enough characters to make the command unique from other commands. For example, you can abbreviate the config terminal command to conf t.
Understanding CLI Command Hierarchy
The CLI commands are organized hierarchically, with commands that perform similar functions grouped under the same level. For example, all commands that display information about the system, configuration, or hardware are grouped under the show command, and all commands that allow you to configure the switch are grouped under the config terminal command. To execute a command, you enter the command by starting at the top level of the hierarchy. For example, to configure a Fibre Channel interface, use the config terminal command. Once you are in configuration mode, issue the interface command. When you are in the interface submode, you can query the available commands there.
Chapter 1 Understanding CLI Command Hierarchy
The following example shows how to query the available commands in the interface submode:
switch# config t Enter configuration commands, one per line. End with CNTL/Z. switch(config)# interface fc1/1 switch(config-if)# ? Interface configuration commands: channel-group Add to/remove from a port-channel exit Exit from this submode fcdomain Enter the interface submode fspf To configure FSPF related parameters no Negate a command or set its defaults shutdown Enable/disable an interface switchport Configure switchport parameters

EXEC Mode Options

When you start a session on the switch, you begin in EXEC mode. Based on the role or group to which you belong, you have access to limited commands or to all commands. From EXEC mode, you can enter configuration mode. Most of the EXEC commands are one-time commands, such as show commands, which display the current configuration status. Here is a list of EXEC mode commands:
switch# ? Exec Commands: attach Connect to a specific linecard callhome Callhome commands cd Change current directory clear Reset functions clock Manage the system clock config Enter configuration mode copy Copy from one file to another debug Debugging functions delete Remove files dir Directory listing for files discover Discover information exit Exit from the EXEC fcping Ping an N-Port fctrace Trace the route for an N-Port. find Find a file below the current directory format Format disks install Upgrade software load Load system image mkdir Create new directory move Move files no Disable debugging functions ping Send echo messages purge Deletes unused data pwd View current directory reload Reboot the entire box rmdir Remove existing directory run-script Run shell scripts send Send message to all the open sessions setup Run the basic SETUP command facility show Show running system information sleep Sleep for the specified number of seconds system System management commands tail Display the last part of a file telnet Telnet to another system terminal Set terminal line parameters test Test command traceroute Trace route to destination
Before You Begin Understanding CLI Command Hierarchy
undebug write zone Disable Debugging functions (See also debug) Write current configuration Execute Zone Server commands

Configuration Mode

In configuration mode, you can make changes to the existing configuration. When you save the configuration, these commands are preserved across switch reboots. Once you are in configuration mode, you can enter interface configuration mode, zone configuration mode, and a variety of protocol-specific modes. Configuration mode is the starting point for all configuration commands. When you are in configuration mode, the switch expects configuration commands from the user. The following example shows output from the config terminal command:

Figure 2-1 Cisco MDS 9500 Series Supervisor-1 Module
Console port MGMT 10/100 Ethernet port (with integrated link and activity LEDs)
Cisco MDS 9500 Series Supervisor-2 Module

Figure 2-2

140573
Status, System, Active, and Pwr Mgmt LEDs MGMT 10/100/1000 Ethernet port (with integrated Link and Activity LEDs)

154318

Chapter 2
Initial Switch Configuration Connecting the Console Port
Figure 2-3 Connecting the Console Cable to a Cisco MDS 9200 Series Switch

EM S ST AT U

MGMT 10/100 COM1

MDS 9216i

Connecting the Console Cable to a Cisco MDS 9100 Series Switch

Figure 2-4

140572

CONSOLE

140571
Chapter 2 Connecting the 10/100 Ethernet Management Port
Connecting the Console Port to a PC
You can connect the console port to a PC serial port for local administrative access to the Andiamo 9500 switch.
The PC must support VT100 terminal emulation. The terminal emulation softwarefrequently a PC application such as HyperTerminal Plusmakes communication between the Andiamo 9500 switch and your PC possible during setup and configuration. To connect the console port to a PC, follow these steps:

Step 1

Configure the baud rate and character format of the PC terminal emulation program to match the following management port default characteristics:
9600 baud 8 data bits 1 stop bit No parity
On Cisco terminal servers, issue the following commands starting in EXEC mode:
switch# config t switch(config)# no flush-at-activation switch(config)# exit switch# copy running-config startup-config
This configuration ensures that the MDS switch does not receive random characters that might cause it to hang.

Step 2 Step 3

Connect the supplied RJ-45 to DB-9 female adapter or RJ-45 to DB-25 female adapter (depending on your PC connection) to the PC serial port. Connect one end of the supplied console cable (a rollover RJ-45 to RJ-45 cable) to the console port. (See Figure 2-4.) Connect the other end to the RJ-45 to DB-9 (or RJ-45 to DB-25) adapter at the PC serial port.
If you are using a Cisco MDS 9500 Series switch that has multiple supervisor modules, connect the console port to the active supervisor. The active supervisor is the module with the green Active LED.
Connecting the 10/100 Ethernet Management Port
The autosensing 10/100 Ethernet management port is located on the left side of the front panel (labeled 10/100 MGMT), to the right of the Console port (see Figure 2-1, Figure 2-4, and Figure 2-4). This port is used for out-of-band management of the Cisco MDS 9000 Family switches.

Step 3

If the switch boots to the loader> or switch(boot) prompts, contact your storage vendor support organization for technical assistance.
After powering on the switch, you see the following output:
Chapter 2 Using the Switch Setup Utility
General Software Firmbase[r] SMM Kernel 1.1.1002 Aug General Software, Inc. Firmbase initialized. 00000589K Low Memory Passed 01042304K Ext Memory Passed Wait.. General Software Pentium III Embedded BIOS 2000 (tm) Revision 1.1.(0) (C) 2002 General Software, Inc.ware, Inc. Pentium III-1.1-6E69-AA6E +------------------------------------------------------------------------------+ | System BIOS Configuration, (C) 2002 General Software, Inc. | +---------------------------------------+--------------------------------------+ | System CPU : Pentium III | Low Memory : 630KB | | Coprocessor : Enabled | Extended Memory : 1018MB | | Embedded BIOS Date : 10/24/03 | ROM Shadowing : Enabled | +---------------------------------------+--------------------------------------+ Loader Loading stage1.5. Loader loading, please wait. Auto booting bootflash:/m9500-sf1ek9-kickstart-mz.2.1.1a.bin bootflash:/m9500-s f1ek9-mz.2.1.1a.bin. Booting kickstart image: bootflash:/m9500-sf1ek9-kickstart-mz.2.1.1a.bin.Image verification OK Starting kernel. INIT: version 2.78 booting Checking all filesystems.. done. Loading system software Uncompressing system image: bootflash:/m9500-sf1ek9-mz.2.1.1a.bin CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC INIT: Entering runlevel: 2003 22:19:14 Copyright (C) 2002

Step 4

Make sure you enter the password you wish to assign for the admin user name.
---- System Admin Account Setup ---Enter the password for "admin":
If a password is trivial (short, easy-to-decipher), your password configuration is rejected. Be sure to configure a strong password. Passwords are case-sensitive. You must explicitly configure a password that meets the requirements listed in the Configuring User Accounts section in the Cisco MDS 9000 Family CLI Configuration Guide.
If you are running the switch setup utility for the first-time, it starts automatically. If this is not the first-time configuration, you are required to enter setup at the system prompt.

If you do not wish to answer a previously configured question, or if you wish to skip answers to any questions, press Enter. If a default answer is not available (for example, the switch name), the switch uses what was previously configured and skips to the next question.

Step 5

Enter yes to enter the setup mode.
This setup utility will guide you through the basic configuration of the system. Setup configures only enough connectivity for management of the system.
Initial Switch Configuration Using the Switch Setup Utility
*Note: setup is mainly used for configuring the system initially, when no configuration is present. So setup always assumes system defaults and not the current system configuration values. Press Enter at anytime to skip a dialog. Use ctrl-c at anytime to skip the remaining dialogs. Would you like to enter the basic configuration dialog (yes/no): yes
The switch setup utility guides you through the basic configuration process. Press Ctrl-C at any prompt to end the configuration process.

Step 6

Enter no (no is the default) to not create any additional accounts.
Create another login account (yes/no) [n]: no

Step 7

Enter no (no is the default) to not configure any read-only SNMP community strings.
Configure read-only SNMP community string (yes/no) [n]: no

Step 8

Enter no (no is the default) to not configure any read-write SNMP community strings.
Configure read-write SNMP community string (yes/no) [n]: no

Step 9

Enter a name for the switch.
The switch name is limited to 32 alphanumeric characters. The default is switch.
Enter the switch name: switch_name

Step 10

Enter yes (yes is the default) to configure the out-of-band management configuration.
Continue with Out-of-band (mgmt0) management configuration? (yes/no) [y]: yes
Enter the IP address for the mgmt0 interface.
Mgmt0 IP address : mgmt_IP_address
Enter the netmask for the mgmt0 interface in the xxx.xxx.xxx.xxx format.
Mgmt0 IP netmask : xxx.xxx.xxx.xxx

Step 11

Enter yes (yes is the default) to configure the default gateway (recommended).
Configure the default-gateway: (yes/no) [y]: yes
Enter the default gateway IP address.
IP address of the default-gateway: default_gateway

Step 12

Enter no (no is the default) to configure advanced IP options such as in-band management, static routes, default network, DNS, and domain name.
Configure Advanced IP options (yes/no)? [n]: no

Step 13

Enter yes (yes is the default) to enable Telnet service.

switch(config-vsan-db)# no vsan 2 loadbalancing src-dst-id switch(config-vsan-db)# switch(config-vsan-db)# vsan 2 loadbalancing src-dst-ox-id switch(config-vsan-db)#

Chapter 3

Configuring VSANs and Interfaces Creating VSANs

Command

switch(config-vsan-db)# vsan 2 suspend switch(config-vsan-db)# switch(config-vsan-db)# no vsan 2 suspend vs.-config-vsan-db#
Purpose Suspends the selected VSAN. Negates the suspend command issued in the previous step. Returns you to EXEC mode.
switch(config-vsan-db)# end switch#
See Appendix A, Configuring Static Domain IDs and Persistent FC IDs, for details.

Warning

HP-UX and AIX are two operating systems that utilize the FC ID in the device path to the storage. For the switch to always assign the same FC ID to a device, persistent FC IDs and static Domain ID must be configured for the VSAN.
Assigning VSAN Membership
To assign VSAN membership, follow these steps: Command
Step 1 Step 2 Step 3 Step 4 Step 5 Step 6
switch# config t switch(config)# vsan database switch(config-vsan-db)# switch(config-vsan-db)# vsan 2 switch(config-vsan-db)# switch(config-vsan-db)# vsan 2 interface fc1/8 switch(config-vsan-db)# switch(config-vsan-db)# vsan 7 switch(config-vsan-db)# switch(config-vsan-db)# vsan 7 interface fc1/8 switch(config-vsan-db)#
Purpose Enters configuration mode. Configures the database for a VSAN. Creates a VSAN with the specified ID (2) if that VSAN does not exist already. Assigns the membership of the fc1/8 interface to the specified VSAN (VSAN 2). Creates another VSAN with the specified ID (7) if that VSAN does not exist already. Updates the membership information of the interface to reflect the changed VSAN.
Displaying VSAN Information
The show vsan command is invoked from the EXEC mode and displays the VSAN configurations. Table 3-1 lists the show commands and the information they display.
Table 3-1 show interface Commands

show Command

show vsan show vsan 100 show vsan usage show vsan 100 membership
Description Displays information for all VSANs. Displays information for a specific VSAN. Displays information on VSAN usage. Displays VSAN membership information for a specified VSAN.
Chapter 3 Configuring Interfaces
Table 3-1 show interface Commands (continued)
show vsan membership show vsan membership interface fc1/1
Description Displays static membership information for all VSANs. Displays static membership information for a specified interface.

Configuring Interfaces

A switch's main function is to relay frames from one data link to another. To do that, the characteristics of the interfaces through which the frames are sent and received must be defined. The configured interfaces can be Fibre Channel interfaces, the management interface (mgmt0), or VSAN interfaces.

switch# config t switch(config)# zone name Zone1 vsan 3 switch(config-zone)# switch(config-zone)# member <type> <value> pWWN example: sswitch(config-zone)# member pwwn 10:00:00:23:45:67:89:ab Fabric pWWN example: switch(config-zone)# member fwwn 10:01:10:01:10:ab:cd:ef FC ID example: switch(config-zone)# member fcid 0xce00d1 FC alias example: switch(config-zone)# member fcalias Payroll Domain ID example: switch(config-zone)# member domain-id 2 portnumber 23 FC alias example: switch(config-zone)# member ipaddress 10.15.0.0 255.255.0.0 Local sWWN interface example: switch(config-zone)# member interface fc 2/1 Remote sWWN interface example: switch(config-zone)# member interface fc2/1 swwn 20:00:00:05:30:00:4a:de Domain ID interface example: switch(config-zone)# member interface fc2/1 domain-id 25
Purpose Enters configuration mode. Configures a zone called Zone 1 for the VSAN called vsan3. Configures a member for the specified zone (Zone1) based on the type (pWWN, fabric pWWN, FC ID, FC alias, domain ID, IP address, or interface) and value specified.
Use a relevant display command (for example, show interface or show flogi database) to obtain the required value in hex format.
Interface-based zoning only works with Cisco MDS 9000 Family switches. Interface-based zoning does not work if interop mode is configured in that VSAN.
Use the show wwn switch command to retrieve the sWWN. If you do not provide a sWWN, the software automatically uses the local sWWN. You can assign an alias name and configure an alias member using either the FC ID, fabric port WWN (fWWN), or pWWN values.

Chapter 4

Configuring Zones and Zone Sets Creating Zone Sets
As of Cisco MDS SAN-OS Release 1.3(4), the Cisco SAN-OS software supports a maximum of 2048 aliases per VSAN.

Configuring an Alias

To create an alias using the fcalias command, follow these steps: Command
switch# config t switch(config)# fcalias name AliasSample vsan 3 switch-config-fcalias# switch-config-fcalias# member fcid 0x222222
Purpose Enters configuration mode. Configures an alias name (AliasSample). Configures alias members based on the specified FC ID type and value (0x222222). Configures alias members based on the specified port WWN type and value (pWWN 10:00:00:23:45:67:89:ab). Configures alias members based on the specified fWWN type and value (fWWN 10:01:10:01:10:ab:cd:ef).
switch-config-fcalias# member pwwn 10:00:00:23:45:67:89:ab
switch-config-fcalias# member fwwn 10:01:10:01:10:ab:cd:ef

Multiple members can be specified on multiple lines.

Creating Zone Sets

A zone set consists of one or more zones. A zone can be a member of more than one zone set and consists of multiple zone members. Members in a zone can access each other; members in different zones cannot access each other. Devices can belong to more than one zone. A zone set can be activated or deactivated as a single entity across all switches in the fabric. Only one zone set can be activated at any time. If zoning is not activated, all devices are members of the default zone. If zoning is activated, any device that is not in an active zone (a zone that is part of an active zone set) is a member of the default zone. Zoning can be administered from any switch in the fabric. When you activate a zone (from any switch), all switches in the fabric receive the active zone set. Additionally, full zone sets are distributed to all switches in the fabric, if this feature is enabled in the source switch.
Zone sets are configured with the names of the member zones. If the zone set is in a configured VSAN, you must also specify the VSAN.
Chapter 4 Creating Zone Sets
To create a zone set to include several zones, follow these steps: Command
switch# config t switch(config)# zoneset name Zoneset1 vsan 3 switch(config-zoneset)#
Purpose Enters configuration mode. Configures a zone set called Zoneset1.
To activate a zone set, you must first create the zone and a zone set.
switch(config-zoneset)# member Zone1
Adds Zone1 as a member of the specified zone set (Zoneset1).
If the specified zone name was not previously configured, this command will return the Zone not present error message.
switch(config-zoneset)# zone name InlineZone1 switch(config-zoneset-zone)#
Adds a zone (InlineZone1) to the specified zone set (Zoneset1).
Execute this step only if you need to create a zone from a zone set prompt.
switch(config-zoneset-zone)# member fcid 0x111112 switch(config-zoneset-zone)#
Adds a new member (FC ID 0x111112) to the newly created zone (InlineZone1).
Execute this step only if you need to add a member to a zone from a zone set prompt.
After creating a zone set and activating it make sure you save the configuration file. See Appendix B, Configuration Files, for details about copying and saving configuration files.

Activating a Zone Set

Changes to a zone set do not take effect to a full zone set until you activate it. To activate a zone set, follow these steps: Command
switch# config t switch(config)# switch(config)# zoneset activate name Zoneset1 vsan 3 switch(config)# no zoneset activate name Zoneset1 vsan 3
Purpose Enters configuration mode. Activates the specified zone set. Deactivates the specified zone set
You do not have to issue the copy running-config startup-config command to store the active zone set. However, you need to issue the copy running-config startup-config command to explicitly store full zone sets. It is not available across switch resets.
Configuring Zones and Zone Sets Whats Next?
Displaying Zone Information
You can view any zone information by using the show command. If you request information for a specific object (for example, a specific zone, zone set, VSAN, alias, or even a keyword like brief or active), only information for the specified object is displayed. If you do not request specific information, all available information is displayed. Table 4-1 lists the show commands and the information they display.
Table 4-1 show zone and show zoneset Commands
show zone show zone vsan 1 show zoneset vsan 1 show zoneset vsan 2-3
Description Displays zone information for all VSANs. Displays zone information for a specific VSAN. Displays information for the configured zone set. Displays configured zone set information for a range of VSANs. Displays members of a zone. Displays fcalias configuration. Displays membership status. Displays zone statistics. Displays read-only zoning statistics. Displays active zone sets. Displays brief descriptions of zone sets. Displays active zones. Displays zone status. Displays zone statistics. Displays the interface-based zones.
show zone name Zone1 show fcalias vsan 1 show zone member pwwn 21:00:00:20:37:9c:48:e5 show zone statistics show zone statistics read-only-zoning show zoneset active show zoneset brief show zone active show zone status show zone show running

Whats Next?

After completing the procedures in this book, your Cisco MDS 9000 Family switch can provide the basic, minimal Fibre Channel services necessary to enable hosts to access their storage. Beyond this, you will want to set up security, management, and monitoring for your network. These tasks are beyond the scope of this document. However, the following tasks should be performed to leverage the full abilities of the MDS switch. Security

2-9 3-4 A-1 3-3

static domain IDs and persistent FC IDs
netmask address mgmt0 interfaces configuring modules verifying status
advanced IP options default gateway
default switch port interface
network connections preparing

default zone policy

2-8 2-7 2-6 2-6 2-8
ending the configuration entering the setup mode first-time configuration full zone set distribution host ID
mgmt0 IP address NTP server

2-7 2-7 2-7

steps for configuring (figure) zone sets displaying information overview

4-3 2-7 4-5

out-of-band management SNMP community SSH service telnet service user accounts creating additional

2-7 2-7

switch port trunk mode
TE ports interface modes TL ports configuring

3-5 3-4 3-4

VSAN interfaces configuring
VSAN membership assigning interface members VSANs configuring overview

?? to 3-4 3-3 3-3

displaying information
VSANs and interfaces steps for configuring (figure)
zones displaying information overview

4-2 4-5

zones and zone sets