H3C Technologies H3C S10500 Series Switches - Manual (Page 83)

72
Configuring FC zones
Overview
The VSAN technology divides a physical SAN into multiple VSANs, which are separated from one
another, and provides more secure, reliable, and flexible services. A VSAN, however, cannot perform
access control over the servers and disk devices (or the N_Ports) connected to a fabric. N_Ports in the
same VSAN can access one another only if these N_Ports register name services. This creates data
security risks.
Zoning can solve the preceding problem by dividing a VSAN into zones and adding N_Ports or F_Ports
to different zones for different purposes. In this way, N_Ports in different zones are separated to
implement access control.
Adding an F_Port to a zone adds all N_Ports that log in through the F_Port to that zone.
Zoning mode
There are two zoning modes: basic zoning and enhanced zoning.
Table 4 shows the differences between the two zoning modes.
Table 4 Differences between basic zoning and enhanced zoning
Basic zoning Enhanced zoning
The default zone policy and hard zoning status are
not distributed during the zone distribution process.
You must manually configure these settings on all
switches to ensure consistency across the fabric.
The default zone policy and hard zoning status are
distributed throughout the fabric.
If a zone belongs to multiple zone sets, an instance of
the zone is created in each zone set.
Zone sets can reference a defined zone, which
reduces the payload of packets for zone merge or
distribution.
Merge rules are simple.
Merge rules are complex and are affected by the
merge control feature.
Zone database
To control access among N_Ports, you can divide N_Ports into different zones as needed, which form a
zone set. The same N_Ports can form multiple zone sets according to different zone division policies.
These zones and zone sets form a zone database.
Zone database structure
The zone database is organized into three levels (zone set, zone, and zone member).