Implementing Smart Zoning On IBM Cisco SANs

© 2003, IBM Advanced Technical Support Techdocs - Washington Systems Center Version 7/17/2013 http://w3.ibm.com/support/Techdocs

Implementing Cisco Smart Zoning Page 1 of 13

Implementing Smart Zoning On IBM Cisco SANs

What Is Smart Zoning Zoning on any SAN is used to limit what SAN devices can see other devices. This makes SANS easier to

administer and limits the impact on other devices if one device has issues. Traditional zoning best

practice for most SANs is to have 1 initiator (or host) per zone. Depending on the type of target, there

can be many targets in a zone with that host. For example a zone consisting of a backup server with

many tape devices is generally acceptable. A zone consisting of a host (initiator) and more than one IBM

SAN Volume Controller (SVC) cluster is not. There will eventually be problems if the different SVC

clusters are allowed to talk to each other.

Traditional zoning in this way has the potential to have so many zones that it becomes burdensome on

the administrators. In addition, using the backup server to tape device example, if there is a zone with

30 tape devices in it, traditional zoning means that there will now be all the additional entries in the ACL

list on the SAN that don’t need to be there. The tape devices generally don’t need to talk to all the

others. This takes up resources and can sometimes be harder to troubleshoot. We could prevent these

ACL entries by rezoning so that the host is zoned separately to each tape device, but now there are 30

zones for our backup server. The number of zones will add up quickly if there are multiple backup

servers.

Smart Zoning on a Cisco fabric fixes this by only allowing initiator to target connections within a zone.

So, for our backup server zone, the only entries in the ACL would be for the initiator (host) to each target

(tape) device. We can also add all the other backup servers to this zone and they won’t be able to talk

to any other initiator, since Smart Zoning only allows initiator to target communication. Assuming we

have 12 backup servers, we can collapse all 12 into a single zone with the tape drives. Smart Zoning will

prevent the 12 servers from talking to each other.

Figure 1.0 shows a zone with 3 hosts and 3 targets, before Smart Zoning. The connections in black are

the host to target connections. The connections in red are the initiator to initiator and target to target

connections. Figure 2.0 shows the same zone with Smart Zoning configured. The initiator-initiator and

target-target connections have been removed by the switch.



Figure 1.0 Zoning Without Smart Zoning

Figure 2.0 Zoning With Smart Zoning

Smart Zoning System Requirements Smart Zoning requires each switch in the fabric be upgraded to NX-OS version 5.2.6 or greater. If any

switch in the fabric can’t be upgraded to v5.2.6 then Smart Zoning can’t be used. The VSANs with Smart

Zoning enabled must be in default (Cisco) mode. Smart Zoning is not supported in VSANs where non-

Cisco switches are connected to the fabric, or where VSANs are configured for IVR into VSANs these

with 3rd party switches are connected.



Supported Smart Zoning Options The following table lists the options that are supported with Smart Zoning. It is possible, though not

recommended to do traditional zoning via WWNN. Smart Zoning does not support this.

Enabling Smart Zoning: Smart Zoning is enabled on a per-VSAN basis. The switch can be set so that any new VSANs created

have Smart Zoning enabled automatically, however existing VSANs need to have Smart Zoning enabled

manually. To enable Smart Zoning on a VSAN, where <vsan no> is a VSAN number

conf t

zone smart-zoning enable vsan <vsan no>

The following example shows the current zone status, then enables smart zoning on VSAN 1, then shows

current status to verify smart zoning is enabled

Example:

sc9134b(config)# show zone status vsan 1 VSAN: 1 default-zone: deny distribute: full Interop: default mode: basic merge-control: allow session: none hard-zoning: enabled broadcast: unsupported smart-zoning: disabled Default zone: qos: none broadcast: unsupported ronly: disabled Full Zoning Database : DB size: 10044 bytes Zonesets:2 Zones:84 Aliases: 0 Active Zoning Database : DB size: 1060 bytes Name: Zoneset_V2 Zonesets:1 Zones:13



Enable Smart Zoning sc9134b(config)# zone smart-zoning enable vsan sc9134b(config)# show zone status vsan 1 VSAN: 1 default-zone: deny distribute: full Interop: default mode: basic merge-control: allow session: none hard-zoning: enabled broadcast: unsupported smart-zoning: enabled Default zone: qos: none broadcast: unsupported ronly: disabled Full Zoning Database : DB size: 10044 bytes Zonesets:2 Zones:84 Aliases: Active Zoning Database : DB size: 1060 bytes Name: Zoneset_V2 Zonesets:1 Zones:13

To disable Smart Zoning use the `no zone smart-zoning enable vsan <vsan no> command

Converting Zones To Smart Zoning After Smart Zoning is enabled, existing zones must be converted to Smart Zoning. This section of the

document details converting zones and the steps to take to prepare. Automatic conversion can happen

at the zone, zoneset and VSAN level. Converting an entire VSAN applies smart zoning to the active and

inactive zonesets. Converting a zoneset applies Smart Zoning to all the zones within that zoneset and

converting a zone applies smart zoning to the members in that zone. Converting a zone is zone-specific

and will only be applied to that zone when the changes are activated.

Once the command is run to convert the VSAN, zoneset or zone to Smart-Zoning, the switch will

examine the device type for each zone member registered in the name server and will rewrite the ACL

table accordingly. So initiators will no longer be allowed to talk to other initiators in the same zone.

Targets will no longer be able to talk to other targets. If a device does not register its type properly with

the name server, there will be unexpected results when activating the zoneset subsequent to the

conversion. It is strongly recommended you follow the steps in the next section prior to converting a

VSAN, Zoneset or Zone to Smart Zoning.

Before You Convert To Smart Zoning

Before converting a VSAN, zoneset or zone, you should examine the name server datatabase to

determine which devices may not be registering device type properly. The command to do this is

`show fcns database` and an example command and output are provided.



Example show fcns database command

sc9134b(config)# show fcns database VSAN 1: -------------------------------------------------------------------------- FCID TYPE PWWN (VENDOR) FC4-TYPE:FEATURE -------------------------------------------------------------------------- 0x7e0000 N 50:05:07:68:01:10:40:03 (IBM) scsi-fcp:both 0x7e0100 N 50:05:07:68:01:40:40:03 (IBM) scsi-fcp:both 0x7e0200 N 50:05:07:68:01:10:40:2d (IBM) scsi-fcp:both 0x7e0300 N 50:05:07:68:01:40:40:2d (IBM) scsi-fcp:both 0x7e0400 N 50:05:07:68:01:10:40:df (IBM) scsi-fcp:both 0x7e0500 N 50:05:07:68:01:40:40:df (IBM) scsi-fcp:both 0x7e0600 N 50:05:07:68:01:10:40:24 (IBM) scsi-fcp:both 0x7e0700 N 50:05:07:68:01:40:40:24 (IBM) scsi-fcp:both 0x7e0900 N 21:00:00:e0:8b:08:37:3d (Qlogic) scsi-fcp:init 0x7e0c00 N 21:00:00:e0:8b:0f:64:47 (Qlogic) scsi-fcp:init 0x7e2300 N 20:05:00:a0:b8:29:9f:7b (SymBios) scsi-fcp:both 0x7e2500 N 20:25:00:a0:b8:32:54:d2 (SymBios) scsi-fcp:both 0x7e2600 N 20:14:00:a0:b8:32:54:d2 (SymBios) scsi-fcp:both 0x7e2700 N 20:04:00:a0:b8:29:9f:7b (SymBios) scsi-fcp:both 0x7e2f00 N 50:05:07:63:03:10:40:6b (IBM) scsi-fcp fcsb2-ch-cu 0x7e3000 N 50:05:07:63:03:03:c0:6b (IBM) scsi-fcp fcsb2-ch-cu

In the above listing, the two devices in blue are registered as ‘init’ . For this fabric, converting to Smart

Zoning means that after the changes are activated, if those two devices are in the same zone they would

no longer be able to login to each other. The next listing shows some IBM SAN Volume Controller ports

ithat are incorrectly listed as ‘target’. If this fabric were converted, these SVC ports would not be able

to see each other or any target ports that might be their back-end storage. This could cause issues for

the SVC cluster both talking to other nodes in the cluster and talking to back-end storage. If the storage

ports are also listed as targets in the name server, the Smart Zoning conversion would prevent these SVC

nodes from talking to the storage.

Partial Name Server listing with SVC ports incorrectly listed

FCID TYPE PWWN (VENDOR) FC4-TYPE:FEATURE --------------------------------------------------------------------------

0x1fb686 N 50:05:07:68:01:10:65:a3 (IBM) scsi-fcp:target 0x1fb693 N 50:05:07:68:01:40:64:88 (IBM) scsi-fcp:target 0x1fb6b6 N 50:05:07:68:01:40:65:a3 (IBM) scsi-fcp:target 0x1ffa84 N 50:05:07:68:01:10:a8:b9 (IBM) scsi-fcp:target



Automatically Convert to Smart Zoning

The following table lists the commands to convert to Smart Zoning. The conversion can be done at the

VSAN, Zoneset or Zone level. After the command is run, the zoneset the change is made in must be

reactivated to apply the changes and generate the new ACL entries.

Commands To Convert To Smart Zoning

Convert a VSAN to Smart Zoning – this will convert all zones and zonesets in this VSAN, then activate a zoneset called Zoneset2 to apply the changes sc9134b(config)# conf t sc9134b(config)# zone convert smart-zoning vsan 1 sc9134b(config)# zoneset activate name Zoneset2 Convert a Zoneset called Zoneset2 to Smart Zoning then activate that zoneset. This will only convert this Zoneset to Smart Zoning. Other zonesets in this VSAN will be unchanged sc9134b(config)# conf t sc9134b(config)# zone convert smart-zoning zoneset name Zoneset2 vsan 1 sc9134b(config)# zoneset activate name Zoneset2 Convert a Zone to Smart Zoning, then activate the zoneset. This will only convert this zone to Smart Zoning. Other zones in this zoneset will be unchanged sc9134b(config)# conf t sc9134b(config)# zone convert smart-zoning zone name Host1_SVC vsan 1 sc9134b(config)# zoneset activate name Zoneset2

Manually Configuring Smart Zoning

Smart Zoning can be configured manually on individual zone members. This may not be practical as

changing devices manually only affects the zone the devices are changed in. Changes would have to be

made in each zone that device is a member of. The following table lists how to configure a device

manually. In this example we will be specifying the device by WWPN and configuring it for device type

of init. Other valid types are target or both. The device can also be specified by FCID (NPort ID), device-

alias or fc-alias



sc9134b(config)# conf t sc9134b(config)# zone name Port1_SVC vsan 1 sc9134b(config)# member 21:00:00:e0:8b:08:37:3d init

Verifying Changes After converting to Smart Zoning and activating the changes, you can verify Smart Zoning has taken

effect by examining the ACL listing. Unfortunately the show zoneset active listing only shows device

type for manually configured devices. The following table shows the same zone listing after automatic

conversion and then after a member was specified manually.

After zoning is converted automatically but before manually specifying a device type – no device types are listed sc9134b# show zoneset active VSAN1 …… zone name Port1_SVC vsan 1 * fcid 0x7e0c00 [pwwn 21:00:00:e0:8b:0f:64:47] * fcid 0x7e0000 [pwwn 50:05:07:68:01:10:40:03] * fcid 0x7e0600 [pwwn 50:05:07:68:01:10:40:24] * fcid 0x7e0200 [pwwn 50:05:07:68:01:10:40:2d] * fcid 0x7e0400 [pwwn 50:05:07:68:01:10:40:df] * fcid 0x7e0100 [pwwn 50:05:07:68:01:40:40:03] * fcid 0x7e0700 [pwwn 50:05:07:68:01:40:40:24] * fcid 0x7e0300 [pwwn 50:05:07:68:01:40:40:2d] * fcid 0x7e0500 [pwwn 50:05:07:68:01:40:40:df] * fcid 0x7e0900 [pwwn 21:00:00:e0:8b:08:37:3d] Manually specifying a device type – you can see the WWPN we configured above now is listed as initiator sc9134b# show zoneset active VSAN1 …… zone name Port1_SVC vsan 1 * fcid 0x7e0c00 [pwwn 21:00:00:e0:8b:0f:64:47] * fcid 0x7e0000 [pwwn 50:05:07:68:01:10:40:03] * fcid 0x7e0600 [pwwn 50:05:07:68:01:10:40:24] * fcid 0x7e0200 [pwwn 50:05:07:68:01:10:40:2d] * fcid 0x7e0400 [pwwn 50:05:07:68:01:10:40:df] * fcid 0x7e0100 [pwwn 50:05:07:68:01:40:40:03] * fcid 0x7e0700 [pwwn 50:05:07:68:01:40:40:24] * fcid 0x7e0300 [pwwn 50:05:07:68:01:40:40:2d] * fcid 0x7e0500 [pwwn 50:05:07:68:01:40:40:df] * fcid 0x7e0900 [pwwn 21:00:00:e0:8b:08:37:3d] init



We can verify the changes made by the automatic conversion by examining the ACL table. As an

example we will use the device with WWPN 21:00:00:e0:8b:08:37:3d to verify that the ACL listing is

correct. The ACL is listed by FCID, so we can either examine the active zoneset or the fcns database to

get the FCID for the WWPN we are interested in. In this case, the FCID is 0x7e0900. The command

`sc9134b# show zone internal rscn acl-table current vsan 1` will give us the full ACL listing for VSAN 1.

Since we know what device we are interested in, we can modify the command slightly to search for a

specific FCID. The pipe symbol and ‘in’ keyword tells the switch to search for FCID 7e0900 in the ACL

listing. The example is in the following table:

sc9134b# show zone internal rscn acl-table current vsan 1 | in 7e0900 fc1/1 0x7e0700 0x7e0900 rw no fc1/3 0x7e0600 0x7e0900 rw no fc1/7 0x7e0c00 0x7e0900 rw no fc1/8 0x7e0300 0x7e0900 rw no fc1/9 0x7e0100 0x7e0900 rw no fc1/11 0x7e0000 0x7e0900 rw no fc1/14 0x7e0200 0x7e0900 rw no fc1/15 0x7e0900 0x7e0000 rw no fc1/15 0x7e0900 0x7e0100 rw no fc1/15 0x7e0900 0x7e0200 rw no fc1/15 0x7e0900 0x7e0300 rw no fc1/15 0x7e0900 0x7e0400 rw no fc1/15 0x7e0900 0x7e0500 rw no fc1/15 0x7e0900 0x7e0600 rw no fc1/15 0x7e0900 0x7e0700 rw no fc1/15 0x7e0900 0x7e0c00 rw no fc1/17 0x7e0500 0x7e0900 rw no

fc1/19 0x7e0400 0x7e0900 rw no

Our initiator has been highlighted in blue. If you examine the table, you will see that FCID 0x7e0C00 is

not listed. Cross-checking that FCID against the show zoneset active output shows this is the other

initiator in the same zone. Since that FCID is not listed in this ACL listing, we can see that Smart Zoning

is working as it should. The two initiators can be in the same zone but will not be able to talk to each

other.

Configure individual zone members (takes effect on per-zone basis – this would need to be set

in each zone): first set context then configure zone member, this example uses pwwn, refer to

table above for other options:

1. conf t

2. zoneset name <zoneset name> zone name <zone name>

3. member pwwn <pwwn> [target][initiator][both]



Lab Testing Environment: 2 MDS 9134 switches with 8 SVC ports, 2 DS8000 ports, 4 DS4000?? Ports and 2 host

ports connected to each switch.

Zoning before Smart Zoning – we had to fix the zoning. Previous zoning was done with individual

storage ports zoned to individual SVC ports and individual SVC ports zoned to each other. There were

many 2-member zones. They were also switch port-based so that made it harder to figure out the

zoning. There are now 4 zones. One for DS8000 to SVC, 1 each for DS4000 Controller A and Controller

B ports to SVC and 1 for host to SVC.

zoneset name Zoneset_V2 vsan 1

zone name DS8000_SVC vsan 1

* fcid 0xef0200 [pwwn 50:05:07:68:01:20:40:24]

* fcid 0xef0400 [pwwn 50:05:07:68:01:20:40:03]

* fcid 0xef0600 [pwwn 50:05:07:68:01:20:40:2d]

* fcid 0xef0000 [pwwn 50:05:07:68:01:20:40:df]

* fcid 0xef0500 [pwwn 50:05:07:68:01:30:40:03]

* fcid 0xef0300 [pwwn 50:05:07:68:01:30:40:24]

* fcid 0xef0700 [pwwn 50:05:07:68:01:30:40:2d]

* fcid 0xef0100 [pwwn 50:05:07:68:01:30:40:df]

* fcid 0xef2c00 [pwwn 50:05:07:63:03:03:00:6b]

* fcid 0xef2d00 [pwwn 50:05:07:63:03:08:00:6b]

zone name DS4000_CtlrA_SVC vsan 1

* fcid 0xef0200 [pwwn 50:05:07:68:01:20:40:24]

* fcid 0xef0400 [pwwn 50:05:07:68:01:20:40:03]

* fcid 0xef0600 [pwwn 50:05:07:68:01:20:40:2d]

* fcid 0xef0000 [pwwn 50:05:07:68:01:20:40:df]

* fcid 0xef0500 [pwwn 50:05:07:68:01:30:40:03]



* fcid 0xef0300 [pwwn 50:05:07:68:01:30:40:24]

* fcid 0xef0700 [pwwn 50:05:07:68:01:30:40:2d]

* fcid 0xef0100 [pwwn 50:05:07:68:01:30:40:df]

* fcid 0xef2700 [pwwn 20:05:00:a0:b8:29:9f:7c]

* fcid 0xef2500 [pwwn 20:24:00:a0:b8:32:54:d2]

zone name DS4000_CtlrB_SVC vsan 1

* fcid 0xef0200 [pwwn 50:05:07:68:01:20:40:24]

* fcid 0xef0400 [pwwn 50:05:07:68:01:20:40:03]

* fcid 0xef0600 [pwwn 50:05:07:68:01:20:40:2d]

* fcid 0xef0000 [pwwn 50:05:07:68:01:20:40:df]

* fcid 0xef0500 [pwwn 50:05:07:68:01:30:40:03]

* fcid 0xef0300 [pwwn 50:05:07:68:01:30:40:24]

* fcid 0xef0700 [pwwn 50:05:07:68:01:30:40:2d]

* fcid 0xef0100 [pwwn 50:05:07:68:01:30:40:df]

* fcid 0xef2700 [pwwn 20:05:00:a0:b8:29:9f:7c]

* fcid 0xef2600 [pwwn 20:15:00:a0:b8:32:54:d2]

zone name Post1_SVC vsan 1

* fcid 0xef0200 [pwwn 50:05:07:68:01:20:40:24]

* fcid 0xef0400 [pwwn 50:05:07:68:01:20:40:03]

* fcid 0xef0600 [pwwn 50:05:07:68:01:20:40:2d]

* fcid 0xef0000 [pwwn 50:05:07:68:01:20:40:df]

* fcid 0xef0500 [pwwn 50:05:07:68:01:30:40:03]

* fcid 0xef0300 [pwwn 50:05:07:68:01:30:40:24]

* fcid 0xef0700 [pwwn 50:05:07:68:01:30:40:2d]

* fcid 0xef0100 [pwwn 50:05:07:68:01:30:40:df]



* fcid 0xef0c00 [pwwn 21:00:00:e0:8b:13:3b:41]

We first attempted to run the auto command on the zoneset to get Smart Zoning configured

automatically. However, this did not produce any effective changes in the ACL. Here is the name server

where you can see the SVC ports are registered as both, as are the DS4K ports. The ports in blue are the

ones that were changed as part of this exercise

sc9134a# show fcns database

VSAN 1:

--------------------------------------------------------------------------

FCID TYPE PWWN (VENDOR) FC4-TYPE:FEATURE

--------------------------------------------------------------------------

0xef0000 N 50:05:07:68:01:20:40:df (IBM) scsi-fcp:both

0xef0100 N 50:05:07:68:01:30:40:df (IBM) scsi-fcp:both

0xef0200 N 50:05:07:68:01:20:40:24 (IBM) scsi-fcp:both




0xef0600 N 50:05:07:68:01:20:40:2d (IBM) scsi-fcp:both

0xef0700 N 50:05:07:68:01:30:40:2d (IBM) scsi-fcp:both

0xef0800 N 21:01:00:e0:8b:28:37:3d (Qlogic) scsi-fcp:init

0xef0c00 N 21:00:00:e0:8b:13:3b:41 (Qlogic) scsi-fcp:init

0xef2100 N 20:04:00:a0:b8:29:9f:7c (SymBios) scsi-fcp:both

0xef2500 N 20:24:00:a0:b8:32:54:d2 (SymBios) scsi-fcp:both

0xef2600 N 20:15:00:a0:b8:32:54:d2 (SymBios) scsi-fcp:both

0xef2700 N 20:05:00:a0:b8:29:9f:7c (SymBios) scsi-fcp:both

0xef2c00 N 50:05:07:63:03:03:00:6b (IBM) scsi-fcp fcsb2-ch-cu

0xef2d00 N 50:05:07:63:03:08:00:6b (IBM) scsi-fcp fcsb2-ch-cu



Next we configured 2 of the SVC ports as target only in the host Zone:

member pwwn 50:05:07:68:01:30:40:2d target

member pwwn 50:05:07:68:01:30:40:df target

This had no effect on the ACL because the 2 SVC ports were listed as both in the zones for the

DS8K and DS4K ports. The new host zone looks like this. The host is listed as init because it was

changed when we rant the auto configure earlier.

zone name Post1_SVC vsan 1

* fcid 0xef0200 [pwwn 50:05:07:68:01:20:40:24]

* fcid 0xef0400 [pwwn 50:05:07:68:01:20:40:03]

* fcid 0xef0600 [pwwn 50:05:07:68:01:20:40:2d]

* fcid 0xef0000 [pwwn 50:05:07:68:01:20:40:df]

* fcid 0xef0500 [pwwn 50:05:07:68:01:30:40:03]

* fcid 0xef0300 [pwwn 50:05:07:68:01:30:40:24]

* fcid 0xef0700 [pwwn 50:05:07:68:01:30:40:2d] target

* fcid 0xef0100 [pwwn 50:05:07:68:01:30:40:df] target

* fcid 0xef0c00 [pwwn 21:00:00:e0:8b:13:3b:41] init

Next we configured the same 2 SVC ports as target only in the DS8000 to SVC zone and after

activation this did cause the SVC to generate a login excluded error on that controller. Now

those two SVC node ports are targets in this zone, they have been removed from the ACL for the

DS8000 ports where 0xef2C00 is FCID for one of the DS8K ports, 0xef0700 and 0xef0100 are the

SVC Ports:

show zone internal rscn acl-table current vsan 1 | in 2c00

fc1/1 0xef0300 0xef2c00 rw no

fc1/2 0xef2c00 0xef0000 rw no













And the updated zone after Smart Zoning: zone name DS8000_SVC vsan 1

* fcid 0xef0200 [pwwn 50:05:07:68:01:20:40:24]

* fcid 0xef0400 [pwwn 50:05:07:68:01:20:40:03]

* fcid 0xef0600 [pwwn 50:05:07:68:01:20:40:2d]

* fcid 0xef0000 [pwwn 50:05:07:68:01:20:40:df]

* fcid 0xef0500 [pwwn 50:05:07:68:01:30:40:03]

* fcid 0xef0300 [pwwn 50:05:07:68:01:30:40:24]

* fcid 0xef0700 [pwwn 50:05:07:68:01:30:40:2d] target

* fcid 0xef0100 [pwwn 50:05:07:68:01:30:40:df] target

* fcid 0xef2c00 [pwwn 50:05:07:63:03:03:00:6b] target

* fcid 0xef2d00 [pwwn 50:05:07:63:03:08:00:6b] target

Implementing Smart Zoning On IBM Cisco SANs

Documents