Finding Fibre Channel over TCP/IP (FCIP) Entities Using Service Location Protocol version 2 (SLPv2)
updated by
- rfc-7146 — Securing Block Storage Protocols over IP: RFC 3723 Requirements Update for IPsec v3
Extracted elements (22)
SLPv2 authentication is made optional for FCIP because IP storage services authenticate at the protocol level after discovery, making a second authentication layer in SLP redundant in most deployments.
The abstract service type 'service:fcip' is introduced to provide an extensible namespace for future FCIP-related SLP service types, rather than registering only the concrete entity type.
A DNS hostname combined with the well-known IANA FCIP port number is recommended in the service URL to ensure correct operation with NAT/NAPT devices.
An English ('en') localization of SLP template attributes not marked as literal MUST be registered; other localizations MAY be registered.
IPsec SHOULD be implemented for SLPv2 as specified in RFC 3723, including ESP with a non-null transform to provide both authentication and confidentiality.
SLPv2 authentication is OPTIONAL to implement and use for IP storage services, because those services have their own authentication capabilities once located.
The use of a Directory Agent (DA) is RECOMMENDED for SLPv2 operations in an FCIP environment.
Three countermeasures against denial-of-service attacks via false discovery information MUST be implemented: IP address range limits, DNS domain limits, and a negative authentication cache.
When false discovery information poses a significant risk, IPsec SAs SHOULD be used for FCIP traffic to ensure that FCIP traffic only flows between endpoints that have participated in IKE authentication.
The abstract service type 'service:fcip' (template version 0.1) is defined to encapsulate all FCIP-related services, providing a top-level service type for future extension.
The concrete service type 'service:fcip:entity' (template version 0.1) is used to register individual FCIP Entity addresses for discovery. A device with multiple FCIP Entities must register each endpoint separately.
The 'fcip-discovery-domain' attribute is a mandatory multi-valued string listing the FCIP discovery domain name(s) to which the FCIP Entity belongs.
The FCIP Discovery Domain specifies which FCIP Entities are allowed to discover each other within the bounds of an SLPv2 scope. An entity may belong to multiple discovery domains, expressed as a comma-separated list in the fcip-discovery-domain attribute.
The FCIP Entity is the principal FCIP interface point to the IP network. Each FCIP Entity contains an FCIP Control and Services Module that interfaces to an SLPv2 Service Agent (SA) and User Agent (UA).
The 'fcip-entity-name' attribute is an opaque field identifying the FCIP Entity: for a switch-resident VE_Port/B_Access, it is the Fibre Channel Switch Name; otherwise it is the Fibre Channel Node Name of the associated Nx_Port.
The 'mgmt-entity' attribute is an optional multi-valued string listing URLs for management interfaces (SNMP, web-based, or telnet) of the FCIP Entity.
The 'transports' attribute is a mandatory multi-valued string listing supported transport protocols; currently only 'tcp' is defined, reflecting that FCIP is supported over TCP only.
Two SLP service type templates ('service:fcip' and 'service:fcip:entity') are to be registered in the IANA 'SVRLOC Templates' registry as described in RFC 2609.
SLP Directory Agents may run on hosts that do not implement IPsec, since standard SLP has no such requirement, creating a gap in the security perimeter for the discovery plane.
SLPv2 does not provide confidentiality and does not authenticate zero-result responses. Once an FCIP Entity is discovered, authentication and authorization are delegated to the FCIP protocol itself.
Without SLPv2 security, an attacker can distribute false discovery information to impersonate an FCIP endpoint; IPsec/IKE authentication prevents false endpoints from exchanging actual FCIP traffic since they lack the required keying material.
The service URL for 'service:fcip:entity' uses a hostport syntax: host (DNS hostname or IPv4 dotted-decimal) optionally followed by ':' and a decimal port number, e.g., 'service:fcip:entity://host.example.com' or 'service:fcip:entity://192.0.2.0:4000'.