Strategies for Data Protection - Brocade

SAN Securitytained at the segment level, and other fabric switches continue normaloperations. Denial of service attempts are restricted and not allowedto impact the entire storage network.SAN Routing products may support multi-vendor interoperability andbe extensible over any distance. For mission-critical data applicationssuch as disaster recovery, SAN Routing ensures that the underlyingtransport aligns with the customer's requirement for continuous, nondisruptivestorage operation.Virtual FabricsLarge data centers often support a wide variety of storage applicationsfor different business units such as manufacturing, sales, marketing,engineering, and human resources. While it is possible to deploy aseparate physical fabric for each business unit, this solution adds significantcosts, reduces storage utilization and adds ongoingadministrative overhead. Storage administrators may thereforeattempt to reduce costs by running multiple storage applicationsacross a larger unified SAN.In order to segregate storage traffic over a single large fabric and prevent,for example, sales applications from disrupting engineeringapplications, some means is needed to isolate the fabric resourcessupporting each application. For Fibre Channel SANs, this functionalityis provided by virtual fabric protocols. Frames for a specific applicationare tagged with identifiers that enable that application data to traverseits own path through the fabric. Consequently a large SAN switch withhundreds of ports can host multiple virtual fabrics (or virtual SANs).Similar to inter-fabric routing, disruptions or broadcast storms in onevirtual fabric are not allowed to propagate to other virtual fabrics.Security for IP SAN Transport via IEEE StandardsFor iSCSI and other IP-based storage protocols, conventional Ethernetstandards can be implemented to safeguard storage data transport.IEEE 802.1Q virtual LAN (VLAN) tagging, for example, can be used tocreate over 4,000 virtual LANs to separate traffic flows and ensurethat only members of the same VLAN can communicate. Like virtualfabrics in Fibre Channel, this mechanism enables multiple storageapplications to share the same infrastructure while gaining the protectionof segregated data streams. Access control lists (ACLs) commonlysupported in gigabit Ethernet switches and IP routers can be used torestrict access to only designated network devices.Strategies for Data Protection 29