Zoning, in five short lessons.
An interactive micro-course on Fibre Channel zoning — what it controls, how to build a zone set, and what breaks when you get it wrong.
What zoning actually controls
Zoning is a fabric-side access-control list. It decides which initiators (HBAs) are allowed to log in to which targets (array ports). It is enforced by the Fibre Channel fabric — the switch's name server helps devices discover each other, but the access decision is the fabric's. Zoning is not LUN masking — see below.
Every HBA can reach every array port. A misbehaving host can see LUNs it should never touch, and fabric change notifications reach devices that don't need them. The exact default behaviour depends on the fabric's configured default-zone policy and the vendor.
Each HBA reaches only its assigned array ports. Predictable login behaviour, cleaner path counts, and the baseline every storage vendor's best-practice guide asks for.
Zoning vs LUN masking — a distinction worth remembering
Fabric-side. Controls whether an initiator may log in to a target port. Without zoning (or with permissive default-zone behaviour), the login succeeds and the host discovers the target.
Array-side. Controls which LUNs a logged-in initiator may see. A host can be zoned to an array port and still be masked away from every LUN on it.
Which control decides whether a host's HBA may log in to an array port?
Build a zone set — and watch access get denied
Three hosts, one switch, three array ports. Switch the active zone set, then click a host to run an access test. Allowed paths glow cyan; blocked paths stop at the switch and show a red ✕.
A single-switch fabric. The dashed grey lines are device links — host-to-switch and switch-to-array. (An ISL is an inter-switch link; this topology has only one switch, so there are no ISLs here.) The coloured overlays are the zones.
When a zone denies access, the host's login is rejected and the target simply doesn't appear in its discovery. Debugging becomes "why isn't this target showing up?" instead of a mysterious I/O failure. Clear zoning makes problems visible.
How many initiators (HBAs) should a zone normally contain?
WWN zoning vs port zoning
A zone member can be a device's WWN (its unique 64-bit address) or a domain,port tuple (a physical switch port). Same intent — very different operational cost when hardware moves.
Zone member: 20:00:00:25:B5:AA:00:01
Zone member: 1,3
When the HBA moves to a new switch port, the WWN-based zone follows the device. The port-based zone still points at the old port — the device is now unzoned and its login is denied.
Port zoning survives none of these: cable moves, HBA swaps, switch replacement. WWN zoning survives all of them. Use WWN zoning unless a specific workload or vendor requires otherwise.
You move an HBA to a different switch port. Which zone membership survives without re-zoning?
Troubleshooting — multipathing under a failed fabric
Two independent fabrics. The host has one HBA per fabric; the array has one target port per fabric. Each HBA is zoned to its corresponding array port. Break the Fabric A link and watch what happens to I/O.
Breaking Fabric A does not break the host's storage. The host's multipathing software detects the path loss and continues I/O over Fabric B. The zone on Fabric B was never touched — that's the point of two independent fabrics.
Zoning is per-fabric. A single zone set on a single switch is not redundancy. You need two fabrics, two HBAs, two array ports, and two independent zone sets. That's what keeps I/O alive when one fabric fails.
A short troubleshooting checklist
- 1Target missing from discovery? Check the zone first: is the initiator WWN in a zone with the target WWN? Is that zone in the active zone set?
- 2Zone set edited but nothing changed? Most fabrics require
a save and an activate step. Vendor commands differ — Brocade examples are
cfgsave/cfgenable; Cisco MDS uses a different workflow. - 3Fabric merge problems? Two switches with the same zone set name but different contents will conflict on merge. Keep zone set contents identical across fabrics with the same name.
- 4Path down? Check physical link, switch port state, and zone membership on that fabric. Multipathing should already have moved I/O to the surviving path.
Fabric A's link fails. The host still has I/O. Why?
Final challenge
Three short scenarios. Answer each to finish the course.
You need to add a new ESXi host to an existing zone set. What is the safest approach?
A host lost access to its LUNs after a switch port move. The zone members are 1,4. What is the likely cause?
Fabric A path goes down. The host still has I/O. Why?
Seven zoning practices for production SANs
1 · One initiator per zone
Multiple targets are fine. Multiple HBAs in one zone is the single most common zoning mistake.
2 · Zone by WWN
WWNs survive cable moves, HBA swaps, and switch replacement. Port zoning survives none of those.
3 · One active zone set per fabric
Same zone set name with different contents on two merging switches segments the fabric.
4 · Activate in a change window
Activating a zone set can fire RSCNs. Affected hosts re-scan their LUNs — do it when you can watch.
5 · Name zones for humans
Z_ESX01_VNX_SPA0 beats zone1 at 3 a.m.
6 · Save and enable
Most fabrics require a save and an activate. Vendor commands differ — verify the workflow for your switch family.
7 · Zoning ≠ LUN masking
Zoning decides login. LUN masking decides what the host sees. You need both.
+ Redundancy is per-fabric
Two fabrics, two HBAs, two array ports, two independent zone sets. That's what keeps I/O alive.
Ways it goes wrong
- ✕Everything in one zone. Equivalent to no zoning, but harder to troubleshoot. Every RSCN can reach every host that shares the zone.
- ✕Two HBAs in one zone. Initiators may gain visibility of each other. What they see of each other's LUNs still depends on array masking and host configuration.
- ✕Port zoning, then a switch replacement. Zone members point at ports that no longer exist. Rebuild with WWN members.
- ✕Forgetting to enable. You edited the defined config but never activated it. Nothing changed.
- ✕Assuming zoning = LUN masking. Zoning lets the host log in; the array decides what it sees.