Apparatus and method for applying network policy at a network device
This document discusses, among other things, applying network policy at a network device. In an example embodiment fiber channel hard zoning information may be received that indicates whether a fiber channel frame is permitted to be communicated between two fiber channel ports. Some example embodiments include identifying a media access control address associated with the fiber channel ports. An example embodiment may include generating one or more access control entries based on the fiber channel identifications of the fiber channel ports and the zoning information. The access control entries may be distributed to an Ethernet port to be inserted into an existing access control list and used to enforce a zoning policy upon fiber channel over Ethernet frames.
1. A method comprising:
receiving fibre channel zoning information that indicates whether a fibre channel frame is permitted to be communicated between a first port including a first fibre channel identification and a second port including a second fibre channel identification;
identifying a media access control address associated with the first fibre channel identification, and a further media access control address associated with the second fibre channel identification;
generating one or more access control entries based on the media access control address, the further media access control address and the fiber channel zoning information; and
distributing the one or more access control entries to be enforced upon a fibre channel over an Ethernet frame.
2. The method of claim 1 , wherein the receiving of the fibre channel zoning information includes receiving fibre channel zoning information pushed from a network device connected to a fibre channel fabric.
3. The method of claim 1 , wherein the first fibre channel identification is associated with a first virtual port instantiated on a first fibre channel over an Ethernet enabled device and the second fibre channel identification is associated with a second virtual port instantiated on a second fibre channel over another Ethernet enabled device, wherein a connection between the first and second virtual ports forms a virtual link.
4. The method of claim 1 , wherein the identifying of the media access control address includes accessing a data structure associating the media access control address with the first fibre channel identification, and the identifying of the further media access control address includes accessing the data structure, which associates the further media access control address with the second fibre channel identification.
5. The method of claim 4 , wherein the identifying of the media access control address includes accessing a data structure to locate the first fibre channel identification embedded within the media access control address, and the identifying of the further media access control address includes accessing the data structure to locate the second fibre channel identification embedded within the further media access control address.
6. The method of claim 5 , wherein a portion of a predetermined number of bits defining each of the media access control addresses includes a specific bit sequence, wherein a first remaining portion of the predetermined number of bits defining the media access control address includes the first fibre channel identification and a second remaining portion of the predetermined number of bits defining the further media access control address includes the second fibre channel identification.
7. The method of claim 1 , wherein the distributing of the one or more access control entries includes distributing the one or more access control entries to an Ethernet port via a transmission medium compatible with an Ethernet protocol.
8. A system comprising:
a network device including a physical interface to be communicatively coupled to a network, the network device further including a mapping hardware module having one or more processors configured to
receive via the physical interface, fibre channel zoning information that indicates whether a fibre channel frame is permitted to be communicated, via the network, between a first port including a first fibre channel identification and a second port including a second fibre channel identification,
identify a media access control address associated with the first fibre channel identification, and a further media access control address associated with the second fibre channel identification,
generate one or more access control entries based on the media access control address, the further media access control address and the fiber channel zoning information, and
distribute the one or more access control entries to be enforced upon a fibre channel over an Ethernet frame that is communicated via the network.
9. The system of claim 8 , further comprising:
a database, and
wherein the mapping hardware module is configured to access the database to associate the media access control address with the first fibre channel identification, and to associate the further media access control address with the second fibre channel identification.