A storage administrator wants to ensure that only authenticated switches and end devices can join a Cisco MDS Fibre Channel fabric. The requirement is a challenge-response protocol that mutually authenticates devices using a shared secret before allowing fabric access, without relying solely on WWN-based lists. Which security mechanism should be configured?