Cisco Systems MDS 9000 Zone Enforcement, The Default Zone

Send documentation comments to mdsfeedback-doc@cisco.com.

15-15

Cisco MDS 9000 Family Fabric Manager Configuration Guide

OL-6965-03, Cisco MDS SAN-OS Release 2.x

Chapter 15 Zone Configuration

Zone Set Creation

The selected object is deleted from the zone database.

Zone Enforcement

Zoning can be enforced in two ways: soft and hard. Each end device (N port or NL port) discovers other

devices in the fabric by querying the name server. When a device logs in to the name server, the name

server returns the list of other devices that can be accessed by the querying device. If an Nx port does

not know about the FC IDs of other devices outside its zone, it cannot access those devices.

In soft zoning, zoning restrictions are applied only during interaction between the name server and the

end device. If an end device somehow knows the FC ID of a device outside its zone, it can access that

device.

Hard zoning is enforced by the hardware on each frame sent by an Nx port. As frames enter the switch,

source-destination IDs are compared with permitted combinations to allow the frame at wirespeed. Hard

zoning is applied to all forms of zoning.

Note Hard zoning enforces zoning restrictions on every frame, and prevents unauthorized access.

Switches in the Cisco MDS 9000 Family support both hard and soft zoning.

Each member of a fabric (in effect a device attached to an Nx port) can belong to any zone. If a member

is not part of any active zone, it is considered to be part of the default zone. Therefore, if no zone set is

active in the fabric, all devices are considered to be in the default zone. Even though a member can

belong to multiple zones, a member that is part of the default zone cannot be part of any other zone. The

switch determines whether a port is a member of the default zone when the attached port comes up.

Note Unlike configured zones, default zone information is not distributed to the other switches in the fabric.

Traffic can either be permitted or denied among members of the default zone. This information is not

distributed to all switches; it must be configured in each switch.

Note When the switch is initialized for the first time, no zones are configured and all members are considered

to be part of the default zone. Members are not permitted to talk to each other.

Configure the default zone policy on each switch in the fabric. If you change the default zone policy on

one switch in a fabric, be sure to change it on all the other switches in the fabric.

Note The default settings for default zone configurations can be changed.