Violation detection and isolation of endpoint devices in soft zoning environment
Systems and methods for handling soft zoning violations comprise assigning a first target device and an endpoint device that is coupled to a switch port of a Fibre Channel (FC) switch to a zone(s). In embodiments, in response to the endpoint device logging into the FC switch, sampled traffic that originates at the endpoint device and ingresses at the switch port may be obtained. In response to determining that the sampled traffic comprises a second traffic that is intended for a second target device that has not been assigned to the zone(s), some action to restrict the second traffic may be performed such as to restrict the non-assigned traffic and prevent devices from sending potentially harmful traffic to other devices that are not assigned to a same zone.
1. A computer-implemented method for handling soft zoning violations, the method comprising:
assigning a first target device and an endpoint device that is coupled to a switch port of a Fibre Channel (FC) switch to one or more zones in a soft zoning environment;
in response to the endpoint device logging into the FC switch, obtaining sampled traffic that originates at the endpoint device and ingresses at the switch port;
obtaining from the sampled traffic a source identifier associated with the endpoint device and a destination identifier associated with a target device; and
using the source identifier and the destination identifier to determine that the sampled traffic comprises a second traffic that is intended for a second target device that has not been assigned to the one or more zones, performing one or more actions to restrict the second traffic.
2. The computer-implemented method of claim 1 , wherein the step of obtaining the sampled traffic comprises monitoring one or more ports of the endpoint device.
3. The computer-implemented method of claim 1 , wherein the one or more actions comprise configuring access control list (ACL) entries such as to deny permission to one or more ports of the endpoint device to access the second target device.
4. The computer-implemented method of claim 1 , wherein the one or more actions comprise shutting down one or more ports of the endpoint device that sent at least some of the second traffic.
5. The computer-implemented method of claim 4 , further comprising, in response to a condition, reactivating the one or more ports of the endpoint device that sent at least some of the second traffic.
6. The computer-implemented method of claim 5 , wherein the condition comprises at least one of a condition associated with the second traffic or a waiting period.
7. The computer-implemented method of claim 1 , wherein the step of performing one or more actions to restrict the second traffic comprises shutting down an interface through the endpoint device logged into the FC switch.
8. A Fibre Channel (FC) system for handling soft zoning violations, the system comprising:
an FC switch comprising;
a processor coupled to the FC switch; and
a non-transitory computer-readable medium comprising instructions that, when executed by the processor, cause steps to be performed, the steps comprising:
assigning a first target device and an endpoint device that is coupled to a switch port of the Fibre Channel (FC) switch to one or more zones in a soft zoning environment;
in response to the endpoint device logging into the FC switch, obtaining sampled traffic that originates at the endpoint device and ingresses at the switch port;
obtaining from the sampled traffic a source identifier associated with the endpoint device and a destination identifier associated with a target device;
using the source identifier and the destination identifier to determine that the sampled traffic comprises a second traffic that is intended for a second target device that has not been assigned to the one or more zones; and
performing one or more actions to restrict the second traffic.
9. The FC system of claim 8 , wherein the FC switch instructs a device coupled to the endpoint device to cause the endpoint device to shut down one or more ports of the endpoint device that sent at least some of the second traffic.
10. The FC system of claim 9 , wherein the FC switch, in response to one of a condition associated with the second traffic or a waiting period, causes the one or more ports of the endpoint device that sent at least some of the second traffic to be reactivated.
11. The FC system of claim 8 , wherein the first and second target devices are storage devices.
12. The FC system of claim 8 , wherein the processor configures an access control list (ACL) such as to deny permission to one or more ports of the endpoint device to access the second target device.
13. The FC system of claim 8 , wherein the FC switch monitors one or more ports of the endpoint device to obtain the sampled traffic.
14. The FC system of claim 8 , wherein the step of performing one or more actions to restrict the second traffic comprises causing a shut down of the switch port through which the endpoint device interfaces with the FC switch.
15. A non-transitory computer-readable medium or media comprising one or more sequences of instructions which, when executed by at least one processor, causes steps to be performed comprising:
assigning a first target device and an endpoint device that is coupled to a switch port of a Fibre Channel (FC) switch to one or more zones in a soft zoning environment;
in response to the endpoint device logging into the FC switch, obtaining sampled traffic that originates at the endpoint device and ingresses at the switch port;
obtaining from the sampled traffic a source identifier associated with the endpoint device and a destination identifier associated with a target device; and
using the source identifier and the destination identifier to determine that the sampled traffic comprises a second traffic that is intended for a second target device that has not been assigned to the one or more zones, performing one or more actions to restrict the second traffic.
16. The non-transitory computer-readable medium or media of claim 15 , wherein the step of obtaining the sampled traffic comprises monitoring one or more ports of the endpoint device.
17. The non-transitory computer-readable medium or media of claim 15 , wherein the one or more actions comprise configuring access control list (ACL) entries such as to deny permission to one or more ports of the endpoint device to access the second target device.
18. The non-transitory computer-readable medium or media of claim 15 , wherein the one or more actions comprise shutting down one or more ports of the endpoint device that sent at least some of the second traffic.
19. The non-transitory computer-readable medium or media of claim 18 , further comprising, in response to a condition, reactivating the one or more ports of the endpoint device that sent at least some of the second traffic.
20. The non-transitory computer-readable medium or media of claim 19 , wherein the condition comprises at least one of a condition associated with the second traffic or a waiting period.