Skip to main content

Learn about ONTAP support for FC-SP-3 security

Contributors netapp-aherbin
PDFs

Beginning with ONTAP 9.20.1, ONTAP supports Fibre Channel Security Protocol 3 (FC-SP-3) authentication and encryption for Broadcom secure host bus adapters (HBAs) on certain ONTAP systems. FC-SP-3 provides hardware-level encryption and device authentication to help protect data in flight between FC and NVMe/FC hosts and ONTAP storage systems against interception, tampering, and unauthorized access, while maintaining performance and aligning with T11 FC security standards.

The following Broadcom secure HBAs support FC-SP-3:

  • Target cards: LPe38104

  • Initiator cards: LPe38102 (64G), LPe37102 (32G)

Use the NetApp Hardware Universe to verify if your specific ONTAP system supports the required HBAs.

You can also use the fcp adapter show -fields transport-security-supported command to verify whether your HBA supports FC-SP-3. The transport-security-supported field is true when FC-SP-3 is supported.

Enable FC-SP-3 support

If your configuration supports FC-SP-3, you can enable it when you create or modify a network interface (LIF) by setting the -fc-transport-security option to mandatory or preferred. Set the option to mandatory to prevent hosts that do not support FC-SP-3 from accessing the storage system. Set the option to preferred to have ONTAP attempt an FC-SP-3 connection while still allowing host access if FC-SP-3 cannot be established.