MIB for Fibre-Channel Security Protocols (FC-SP)
Extracted elements (27)
Egress Traffic Selectors on active SAs (t11FcSpSaTSelNegOutTable) include a numerically-lowest-wins precedence value in the INDEX because multiple selectors may match an egress frame. Ingress Traffic Selectors on active SAs (t11FcSpSaTSelNegInTable) use an arbitrary integer index because the SA is identified by the SPI in the frame and precedence is irrelevant for that lookup path.
Rate control is applied only to t11FcSpSaNotifyAuthFailure (a data-plane event that could fire for every ingress frame), while all other notifications are control-plane events triggered by operator actions and need no throttling. After the first failure on an SA, subsequent failures within a configurable time window are suppressed; authentication failures are still counted even when notifications are suppressed.
T11FcSpHashCalculationStatus provides a three-state (stale/correct/calculate) mechanism for deferring Policy Object hash recalculation. Because multiple fields may need to be changed atomically before a valid hash can be computed, this avoids redundant cryptographic computation after each individual field change; the operator writes 'calculate' once after all edits are complete.
Three Switch roles (Server, Autonomous, Client) exist to address the O(n²) or O(n×m) scaling problem of Switch Connectivity Objects for n Switches and m Nodes. Server Switches hold all Fabric-wide objects; Autonomous Switches hold only their own connectivity object; Client Switches hold only the subset needed for their operation, relying on a client-server protocol to retrieve additional Zoning information on demand.
When InterfaceIndexOrZero and Fabric Index appear together in an INDEX clause, the interface index is listed first. This ordering simplifies management queries that retrieve information about multiple Fabrics connected to the same physical port, allowing the table to be walked by interface without specifying a Fabric.
FC-SP Zoning is defined as a variant of the Enhanced Zoning model from FC-SW-4 and FC-GS-5 specifically to preserve backward compatibility. The T11-FC-SP-ZONING-MIB augments existing T11-FC-ZONE-SERVER-MIB tables (RFC 4936) rather than replacing them, keeping Zoning management and enforcement completely independent from other FC-SP policy management.
For Policy Object Names that are exclusively IP address ranges, this document uses the IETF-standard InetAddressType/InetAddress TCs (RFC 4001) as a 3-tuple rather than the native FC-SP TLV encoding. For names that may be other types, the T11FcSpPolicyNameType/T11FcSpPolicyName pair is used, with IP ranges encoded as concatenated low+high address bytes in the T11FcSpPolicyName value.
When RADIUS is used as the external server for DH-CHAP response verification, t11FcSpAuServerProtocol takes the value t11FcSpAuServerProtocolRadius. In this case, RADIUS server configuration is expected to be available from the RADIUS-AUTH-CLIENT-MIB (RFC 4668) radiusAuthServerExtTable; this document deliberately defines no duplicate RADIUS server objects.
FCAP requires entities to support at least four Root Certificates against which received certificates can be validated. Support for certificate chains containing more than one certificate is optional. Entities must be able to access a Certificate Revocation List (CRL) for each configured Root Certificate if one is available from the CA; certificates on the CRL are considered invalid.
Security Associations in FC-SP are unidirectional but always exist as an SA pair of the same type in opposite directions. Each SA in the SADB includes the SPI (carried in transmitted frames to identify the SA to the receiver), a Sequence Number counter, and the negotiated transform parameters.
Each FC-SP entity maintains a Security Association Database (SADB) containing active SAs and Traffic Selectors. Each SA entry includes an SPI (Security Parameters Index carried in transmitted frames), a Sequence Number counter, and transform parameters (encryption algorithm, integrity algorithm, mode, keys). Traffic Selector entries are ordered by precedence and indicate either bypass/drop or protection/verification actions.
FC-SP defines four Authentication Protocols: DH-CHAP (secret-based, using Diffie-Hellman Challenge Handshake with RADIUS/Diameter/TACACS external server option), FCAP (certificate-based, using X.509 public-private key pairs), FCPAP (password-based), and IKEv2-AUTH (a subset of IKEv2 performing both authentication and SA management). Each supports mutual authentication with optional shared key establishment.
FC-SP defines six types of Policy Objects: Policy Summary Object (list of pointers with cryptographic hashes to other active objects), Switch Membership List, Node Membership List, IP Management List (which IP hosts may manage the Fabric), per-Switch Connectivity Objects, and extensible Attribute Objects. When FC-SP is active, each Fabric has exactly one of each list object and zero or more connectivity/attribute objects.
The T11-FC-SP-AUTHENTICATION-MIB module (mib-2 176) defines t11FcSpAuEntityTable (FC-SP-capable entities indexed by fcmInstanceIndex, entity WWN, and FabricIndex), t11FcSpAuIfStatTable (per-interface authentication statistics), t11FcSpAuRejectTable (volatile log of recently rejected AUTH transactions), and two notifications for sent and received AUTH rejections.
The T11-FC-SP-POLICY-MIB module provides five functional parts: read-only active Policy Objects per Fabric, read-write Activate/Deactivate Operations (with operation status), read-create Non-Active Policy Objects (for staging changes before activation), statistics for Security Policy Servers, and notifications for policy activation/deactivation success or failure.
The T11-FC-SP-SA-MIB module manages Security Associations established via FC-SP. It provides tables for SA proposals (t11FcSpSaPropTable, t11FcSpSaTSelPropTable, t11FcSpSaTransTable), drop/bypass Traffic Selectors (t11FcSpSaTSelDrByTable), active bidirectional SA pairs (t11FcSpSaPairTable), negotiated Traffic Selectors for ingress and egress (t11FcSpSaTSelNegInTable, t11FcSpSaTSelNegOutTable), and SPI-based reverse lookup (t11FcSpSaTSelSpiTable).
The T11-FC-SP-TC-MIB (mib-2 175) defines Textual Conventions and Object Identities used across all FC-SP MIB modules, including OIDs for cryptographic algorithms (ENCR_NULL, AES-CBC, AES-CTR, AES-GCM, 3DES, ENCR_NULL_AUTH_AES_GMAC; AUTH_HMAC_MD5_96/128, AUTH_HMAC_SHA1_96/160), and TCs for DH groups (1024–8192 bit), hash functions (MD5, SHA-1), and signature functions (RSA-SHA1).
Five MIB modules are assigned OIDs under the mib-2 arc: T11-FC-SP-TC-MIB at mib-2 175 and T11-FC-SP-AUTHENTICATION-MIB at mib-2 176 (and three additional modules for zoning, policy, and SA management). These OID assignments constitute the IANA registration actions for this document.
The T11-FC-SP-AUTHENTICATION-MIB contains read-write objects including notification enable flags, default SA lifetime (t11FcSpAuDefaultLifetime, default 8 hours), and reject table size. Unauthorized modification could suppress security notifications or weaken authentication policy; these objects SHOULD be protected using SNMPv3 with both authentication and privacy.
The T11-FC-SP-POLICY-MIB contains read-create objects for non-active Policy Objects that define which Switches, Nodes, and IP management hosts are permitted in the Fabric. Unauthorized modification could allow unauthorized entities to join the Fabric or gain management access; this is among the most sensitive data in the MIB suite and MUST be protected via SNMPv3 with authentication and privacy.
The T11-FC-SP-SA-MIB contains read-write objects governing SA negotiation proposals (acceptable transforms and DH groups) and notification rate-control parameters. Unauthorized weakening of acceptable transform sets could cause entities to negotiate weaker SAs; the document recommends SNMPv3 with authentication and privacy for all five FC-SP MIB modules.
The T11-FC-SP-ZONING-MIB contains read-write objects that extend zone server configuration. Unauthorized changes to FC-SP Zoning could allow unauthorized connectivity between Nodes that should be isolated. The Zoning Check Protocol that replaces the Zone Merge Protocol includes hash-based integrity protection of Zoning information.
T11FcRoutingControl is a 1-octet OCTET STRING representing the R_CTL field of an FC-2 frame, containing routing and information bits categorizing frame function. For CT_Authentication, the information field contains '02'h for Request CT_IUs and '03'h for Response CT_IUs. Used in combination with T11FcSpType to identify link-layer services.
T11FcSpiIndex is an Unsigned32 (0..4294967295) representing the Security Parameter Index (SPI) carried in the SPI field of ESP_Header-protected FC-2 frames or in the SAID field of CT_Authentication-protected CT_IUs. It uniquely identifies the Security Association on which a frame is being transmitted.
T11FcSpPolicyHashFormat is a 4-byte OCTET STRING identifying the hash function used to summarize a Policy Object: SHA-1 is '00000001'h (20-byte output) and SHA-256 is '00000002'h (32-byte output). Every instance of this TC must be paired with a corresponding T11FcSpPolicyHashValue object (OCTET STRING, SIZE 0..64).
T11FcSpPolicyName is an OCTET STRING (SIZE 1..64) representing a Policy Object name whose format is governed by a paired T11FcSpPolicyNameType object. For ipv6AddressRange the value is 32 bytes (two IPv6 addresses, low first); for ipv4AddressRange 8 bytes (two IPv4 addresses); for wildcard/restrictedWildcard the value is '0000000000000000'h.
T11FcSpType is a 2-octet OCTET STRING encoding the frame type identifier: for FC-2 frames the first octet is zero and the second contains the TYPE value; for CT_IUs the first octet is GS_Type and the second is GS_Subtype. Comparison is done numerically as (256 × 1st-octet) + 2nd-octet.