> # Port Security Versus Fabric Binding

> Port security and fabric binding are two independent features that can be configured to complement each other. Table 38-1 compares the two features.

> Table 38-1 Fabric Binding and Port Security Comparison
> Fabric Binding | Port Security
> --- | ---
> Uses a set of sWWNs and a persistent domain ID. | Uses pWWNs and nWWNs or fWWNs and sWWNs.
> Binds the fabric at the switch level. | Binds devices at the interface level.
> Authorizes only the configured sWWN stored in the fabric binding database to participate in the fabric. | Allows a preconfigured set of Fibre Channel devices to logically connect to a SAN ports. The switch port, identified by a WWN or interface number, connects to a Fibre Channel device (a host or another switch), also identified by a WWN. By binding these two devices, you lock these two ports into a group (or list).
> Requires activation on a per VSAN basis. | Requires activation on a per VSAN basis.
> Allows specific user-defined switches that are allowed to connect to the fabric, regardless of the physical port to which the peer switch is connected. | Allows specific user-defined physical ports to which another device can connect.
> Does not learn about switches that are logging in. | Learns about switches or devices that are logging in if learning mode is enabled.
> Cannot be distributed by CFS and must be configured manually on each switch in the fabric. | Can be distributed by CFS.

> Port-level checking for xE ports is as follows:

> - The switch login uses both port security binding and fabric binding for a given VSAN.
> - Binding checks are performed on the port VSAN as follows:
> - E port security binding check on port VSAN
> - TE port security binding check on each allowed VSAN

> While port security complements fabric binding, they are independent features and can be enabled or disabled separately.

> Copyright 2010-2015, Cisco Systems, Inc. All rights reserved.