Professional Documents
Culture Documents
QCG Zones PDF
QCG Zones PDF
c o m
C H A P T E R 4
Configuring Zones and Zone Sets
Before setting up zones and zone sets make sure you have configured VSANs and interfaces. See
Chapter 3, “Configuring VSANs and Interfaces.”
Zoning enables you to set up access control between storage devices or user groups. If you have
administrator privileges in your fabric, you can create zones to increase network security and to prevent
data loss or corruption.
Note Devices that do not belong to a zone follow the policy of the default zone.
Figure 4-1 describes the steps for configuring zones and zone sets. See Appendix B, “Configuration
Files,” for details on saving configuration files.
Create zones
Save Configuration
Se n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a ck - d o c @ c i s c o . c o m
Configuring Zones
Zones are configured within VSANs. The Logical tab displays the VSANs configured in the currently
discovered fabric. Note that zone information must always be identical for all the switches in the network
fabric.
To configure a zone and assign a zone name, follow these steps:
Command Purpose
Step 1 switch# config t Enters configuration mode.
Step 2 switch(config)# zone name Zone1 vsan 3 Configures a zone called Zone
switch(config-zone)# 1 for the VSAN called vsan3.
Step 3 switch(config-zone)# member <type> <value> Configures a member for the
pWWN example: specified zone (Zone1) based
sswitch(config-zone)# member pwwn 10:00:00:23:45:67:89:ab
Fabric pWWN example:
on the type (pWWN, fabric
switch(config-zone)# member fwwn 10:01:10:01:10:ab:cd:ef pWWN, FC ID, FC alias,
FC ID example: domain ID, IP address, or
switch(config-zone)# member fcid 0xce00d1 interface) and value specified.
FC alias example:
switch(config-zone)# member fcalias Payroll
Domain ID example:
switch(config-zone)# member domain-id 2 portnumber 23
FC alias example:
switch(config-zone)# member ipaddress 10.15.0.0 255.255.0.0
Local sWWN interface example:
switch(config-zone)# member interface fc 2/1
Remote sWWN interface example:
switch(config-zone)# member interface fc2/1 swwn
20:00:00:05:30:00:4a:de
Domain ID interface example:
switch(config-zone)# member interface fc2/1 domain-id 25
Tip Use a relevant display command (for example, show interface or show flogi database) to
obtain the required value in hex format.
Note Interface-based zoning only works with Cisco MDS 9000 Family switches. Interface-based zoning does
not work if interop mode is configured in that VSAN.
Tip Use the show wwn switch command to retrieve the sWWN. If you do not provide a sWWN, the software
automatically uses the local sWWN.
You can assign an alias name and configure an alias member using either the FC ID, fabric port WWN
(fWWN), or pWWN values.
Se n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a ck - d o c @ c i s c o . c o m
Tip As of Cisco MDS SAN-OS Release 1.3(4), the Cisco SAN-OS software supports a maximum of 2048
aliases per VSAN.
Configuring an Alias
To create an alias using the fcalias command, follow these steps:
Command Purpose
Step 1 switch# config t Enters configuration mode.
Step 2 switch(config)# fcalias name AliasSample vsan 3 Configures an alias name (AliasSample).
switch-config-fcalias#
Step 3 switch-config-fcalias# member fcid 0x222222 Configures alias members based on the
specified FC ID type and value (0x222222).
switch-config-fcalias# member pwwn Configures alias members based on the
10:00:00:23:45:67:89:ab specified port WWN type and value (pWWN
10:00:00:23:45:67:89:ab).
switch-config-fcalias# member fwwn Configures alias members based on the
10:01:10:01:10:ab:cd:ef specified fWWN type and value (fWWN
10:01:10:01:10:ab:cd:ef).
Note Multiple members can be specified on multiple lines.
Tip Zone sets are configured with the names of the member zones. If the zone set is in a configured VSAN,
you must also specify the VSAN.
Tip Zone sets are configured with the names of the member zones. If the zone set is in a configured VSAN,
you must also specify the VSAN.
Se n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a ck - d o c @ c i s c o . c o m
Command Purpose
Step 1 switch# config t Enters configuration mode.
Step 2 switch(config)# zoneset name Zoneset1 vsan 3 Configures a zone set called Zoneset1.
switch(config-zoneset)#
Tip To activate a zone set, you must first
create the zone and a zone set.
Step 3 switch(config-zoneset)# member Zone1 Adds Zone1 as a member of the specified zone set
(Zoneset1).
Tip If the specified zone name was not
previously configured, this command will
return the Zone not present error
message.
Step 4 switch(config-zoneset)# zone name Adds a zone (InlineZone1) to the specified zone
InlineZone1 set (Zoneset1).
switch(config-zoneset-zone)#
Tip Execute this step only if you need to
create a zone from a zone set prompt.
Step 5 switch(config-zoneset-zone)# member fcid Adds a new member (FC ID 0x111112) to the
0x111112 newly created zone (InlineZone1).
switch(config-zoneset-zone)#
Tip Execute this step only if you need to add
a member to a zone from a zone set
prompt.
After creating a zone set and activating it make sure you save the configuration file. See Appendix B,
“Configuration Files,” for details about copying and saving configuration files.
Command Purpose
Step 1 switch# config t Enters configuration mode.
switch(config)#
Step 2 switch(config)# zoneset activate name Zoneset1 vsan 3 Activates the specified zone set.
switch(config)# no zoneset activate name Zoneset1 vsan 3 Deactivates the specified zone set
Tip You do not have to issue the copy running-config startup-config command to store the active zone set.
However, you need to issue the copy running-config startup-config command to explicitly store full
zone sets. It is not available across switch resets.
Se n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a ck - d o c @ c i s c o . c o m
What’s Next?
After completing the procedures in this book, your Cisco MDS 9000 Family switch can provide the
basic, minimal Fibre Channel services necessary to enable hosts to access their storage. Beyond this, you
will want to set up security, management, and monitoring for your network. These tasks are beyond the
scope of this document. However, the following tasks should be performed to leverage the full abilities
of the MDS switch.
Security
• Configure DNS servers.
• Enable SSH and disable Telnet.
• Create unique usernames for each user.
• Create and assign roles for users that do not require network administrative privileges.
• Configure TACACS+/Radius for centralized user management.
Se n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a ck - d o c @ c i s c o . c o m
Management
• Configure a syslog server.
• Configure time/date/timezone and additionally NTP.
• Configure schedules and jobs to regularly back up the configuration of the MDS switch.
• Configure device aliases.
Monitoring
• Configure Call Home.