<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:48:06" />
    <title>Fibre Channel Zoning-Based Access Control </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1924;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1076024"> </a><h1 class="pTitle">
Fibre Channel Zoning-Based Access Control

</h1>
<a name="wp1076025"> </a><p class="pBody">
Cisco SAN-OS Release 3.x and NX-OS Release 4.1(1b) VSAN and zoning concepts have been extended 
to cover both Fibre Channel devices and iSCSI devices. Zoning is the standard access control mechanism 
for Fibre Channel devices, which is applied within the context of a VSAN. Fibre Channel zoning has 
been extended to support iSCSI devices, and this extension has the advantage of having a uniform, 
flexible access control mechanism across the whole SAN.

</p>
<a name="wp1076026"> </a><p class="pBody">
Common mechanisms for identifying members of a Fibre Channel zone are the following:

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1076027"> </a><li class="pSmartList1">Fibre Channel device pWWN.
</li>
<a name="wp1076028"> </a><li class="pSmartList1">Interface and switch WWN. Device connecting via that interface is within the zone.
</li>
</ul></div>
<a name="wp1076029"> </a><p class="pBody">
See the <span style="font-style: italic">Fabric Configuration Guide,Cisco DCNM for SAN </span>for details on Fibre Channel zoning.

</p>
<a name="wp1076030"> </a><p class="pBody">
In the case of iSCSI, multiple iSCSI devices may be connected behind an iSCSI interface. 
Interface-based zoning may not be useful because all the iSCSI devices behind the interface will 
automatically be within the same zone.

</p>
<a name="wp1076031"> </a><p class="pBody">
In transparent initiator mode (where one Fibre Channel virtual N port is created for each iSCSI host as 
described in the <a href="ciscsi010.html">&quot;Transparent Initiator Mode&quot; topic</a>), if an iSCSI host has static WWN mapping then the 
standard Fibre Channel device pWWN-based zoning membership mechanism can be used.

</p>
<a name="wp1076035"> </a><p class="pBody">
Zoning membership mechanism has been enhanced to add iSCSI devices to zones based on the 
following:

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1076036"> </a><li class="pSmartList1">IPv4 address/subnet mask
</li>
<a name="wp1076037"> </a><li class="pSmartList1">IPv6 address/prefix length
</li>
<a name="wp1076038"> </a><li class="pSmartList1">iSCSI qualified name (IQN)
</li>
<a name="wp1076039"> </a><li class="pSmartList1">Symbolic-node-name (IQN)
</li>
</ul></div>
<a name="wp1076041"> </a><p class="pBody">
For iSCSI hosts that do not have a static WWN mapping, the feature allows the IP address or iSCSI node 
name to be specified as zone members. Note that iSCSI hosts that have static WWN mapping can also 
use these features. IP address based zone membership allows multiple devices to be specified in one 
command by providing the subnet mask.

</p>
<a name="wp1076043"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> In proxy initiator mode, all iSCSI devices connecting to an IPS port gain access to the Fibre Channel 
fabric through a single virtual Fibre Channel N port. Zoning based on the iSCSI node name or IP address 
will not have any effect. If zoning based on pWWN is used, then all iSCSI devices connecting to that 
IPS port will be put in the same zone. To implement individual initiator access control in proxy initiator 
mode, configure an iSCSI ACL on the virtual target (see the <a href="ciscsi018.html">&quot;iSCSI-Based Access Control&quot; topic</a>).

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
