hesela.devFibre Channel zoning
Fibre Channel zoning defines logical groups of ports in a Fibre Channel fabric and the permitted discovery or communication relationships between them.
Membership and enforcement are different questions. The cited 9.x fabric guide distinguishes Name Server filtering (soft zoning) from per-frame hardware checks (hard zoning). WWPN-based membership does not imply soft-only enforcement. In that implementation, exhaustion of hardware enforcement resources can cause a fallback to soft zoning. Check active policy and actual enforcement, not merely a configured zone name. [1]
Permission to communicate with an array port does not by itself select the logical units that array exposes to an initiator; array-side LUN masking is a separate layer. [2]
Zoning is an access-control policy, not proof of peer authentication or encrypted traffic. Authentication and security-association traffic protection are distinct parts of the architecture. DH-CHAP can even use a NULL DH algorithm: its name alone does not establish a Diffie-Hellman exchange. [4] [6]
In the cited 9.x security guide, auto-passive responds but does not initiate authentication; auto-active may continue with an unsupported peer, while on isolates that peer. Feature presence is not evidence of successful authentication. [5]
The cited fabric guide distinguishes the full editable zoneset from the active policy. Editing the full database does not enforce changes until reactivation. Activation persists the active zoneset automatically, whereas preserving the full database across reloads requires an explicit save. An active policy is therefore not evidence that the full editable database was saved; this is a source-based lifecycle distinction, not a restart experiment. [1]
Relations
- related
- Fibre Channel, SAN, LUN masking, Logical unit number (LUN), SCSI initiator and target, SAS zoning, World Wide Name (Fibre Channel)
Advantages
- Can restrict communication to intended fabric-port relationships. [1]
Limitations
- Name Server filtering alone is not equivalent to per-frame access enforcement. [1]
- Permission to reach an array port does not establish access to a particular logical unit. [2]
Citations
- Cisco MDS 9000 Series Fabric Configuration Guide, Release 9.x: Configuring and Managing Zones, Zone Enforcement and Zoning Types
- Cisco: Enabling Cisco HyperFlex Systems to Coexist with Fibre Channel Shared Storage, Cisco MDS multilayer switches
- Cisco Nexus 5000 NX-OS SAN Switching Configuration Guide: Overview, p. 3, LUN zoning
- Eric A. Hibbard. Storage Security: Fibre Channel Security. SNIA and FCIA, version 2.0, 14 February 2024, sections 3.2-3.3.1 and 4.2
- Cisco MDS 9000 Series Security Configuration Guide, Release 9.x: Configuring FC-SP and DHCHAP, About DHCHAP Authentication Modes
- RFC 5324 (September 2008), sections 3.4.1-3.4.3: authentication, security associations and fabric security policies
- Cisco MDS 9000 Series Fabric Configuration Guide, Release 9.x: Fabric Overview, Zoning support note
Sources & caveats
- Architectural source review, not a live fabric experiment or reconfiguration procedure. Enforcement descriptions are scoped to Cisco MDS 9.x; no universal default policy is asserted.
- This is Fibre Channel fabric access control, not SAS expander zoning or zoned-block-device write rules.
- LUN zoning is product- and release-specific. The Nexus 5000 example does not establish MDS support; the MDS 9.x overview says LUN zoning and read-only zones are unsupported from NX-OS 5.x onward. [3] [7]
- The 2024 SNIA/FCIA white paper is architectural guidance, not an empirical security study. No algorithm-strength recommendation, switch test or claim about universal defaults is made.