{
  "slug": "lun-masking",
  "term": "LUN masking",
  "aliases": [
    "logical unit masking",
    "LU masking"
  ],
  "definition": "LUN masking controls which initiators may access selected logical units exposed by a storage system.",
  "note": "The storage system selects which logical units a host can access; Fibre Channel zoning separately governs fabric-port relationships. A reachable array port does not prove that the intended logical unit is presented. [cisco-masking]\n\nIn the cited initiator-group implementation, a group lists FC host WWPNs or iSCSI node names. Mapping a LUN to that group authorizes its members, which can include several hosts. This is a product-specific example, not a universal configuration interface. [ontap-igroups]\n\nAccess permission is not exclusive write ownership. The multi-host mapping example does not itself establish application locking or shared-file-system coordination; those are separate design obligations.",
  "status": "shipping",
  "advantages": [
    {
      "text": "Can expose selected logical units to selected host initiators.",
      "citationIds": [
        "cisco-masking"
      ]
    }
  ],
  "limitations": [
    {
      "text": "A mapping can authorize multiple hosts, so it must not be read as a single-writer guarantee.",
      "citationIds": [
        "ontap-igroups"
      ]
    }
  ],
  "related": [
    "fibre-channel-zoning",
    "san",
    "fibre-channel",
    "iscsi",
    "logical-unit-number",
    "initiator-target",
    "shared-disk-filesystem",
    "io-fencing"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "cisco-masking",
      "title": "Cisco: Enabling Cisco HyperFlex Systems to Coexist with Fibre Channel Shared Storage, Cisco MDS multilayer switches",
      "url": "https://www.cisco.com/c/en/us/products/collateral/hyperconverged-infrastructure/hyperflex-hx-series/hx-on-fibrechannel-wp.html",
      "accessed": "2026-11-03"
    },
    {
      "id": "ontap-igroups",
      "title": "NetApp ONTAP 9: Learn about ONTAP SAN igroups",
      "url": "https://docs.netapp.com/us-en/ontap/san-admin/igroups-concept.html",
      "accessed": "2026-11-03"
    }
  ],
  "updated": "2026-11-03",
  "provenance": [
    "Source-backed access-control explanation; no live array, security or failover test was performed.",
    "The separation of access permission from writer coordination is an engineering inference from the documented multi-host mapping, not a measured filesystem result.",
    "The initiator-group example is scoped to NetApp ONTAP 9. [ontap-igroups]"
  ]
}