Send documentation comments to mdsfeedback-doc@cisco.com
50-25
Cisco MDS 9000 Family Fabric Manager Configuration Guide
OL-17256-03, Cisco MDS NX-OS Release 4.x
Chapter 50 Configuring iSCSI
Configuring iSCSI
Fibre Channel Zoning-Based Access Control
Cisco SAN-OS and NX-OS 4.1(1b) VSAN and zoning concepts have been extended to cover both Fibre
Channel devices and iSCSI devices. Zoning is the standard access control mechanism for Fibre Channel
devices, which is applied within the context of a VSAN. Fibre Channel zoning has been extended to
support iSCSI devices, and this extension has the advantage of having a uniform, flexible access control
mechanism across the whole SAN.
Common mechanisms for identifying members of a Fibre Channel zone are the following (see
Chapter 30, “Configuring and Managing Zones” for details on Fibre Channel zoning):
• Fibre Channel device pWWN.
• Interface and switch WWN. Device connecting via that interface is within the zone.
In the case of iSCSI, behind an iSCSI interface multiple iSCSI devices may be connected.
Interface-based zoning may not be useful because all the iSCSI devices behind the interface will
automatically be within the same zone.
In transparent initiator mode (where one Fibre Channel virtual N port is created for each iSCSI host as
described in the
“Transparent Initiator Mode” section on page 50-15), if an iSCSI host has static WWN
mapping then the standard Fibre Channel device pWWN-based zoning membership mechanism can be
used.
Zoning membership mechanism has been enhanced to add iSCSI devices to zones based on the
following:
• IPv4 address/subnet mask
• IPv6 address/prefix length
• iSCSI qualified name (IQN)
• Symbolic-node-name (IQN)
For iSCSI hosts that do not have a static WWN mapping, the feature allows the IP address or iSCSI node
name to be specified as zone members. Note that iSCSI hosts that have static WWN mapping can also
use these features. IP address based zone membership allows multiple devices to be specified in one
command by providing the subnet mask.
Note In proxy initiator mode, all iSCSI devices connecting to an IPS port gain access to the Fibre Channel
fabric through a single virtual Fibre Channel N port. Thus, zoning based on the iSCSI node name or IP
address will not have any effect. If zoning based on pWWN is used, then all iSCSI devices connecting
to that IPS port will be put in the same zone. To implement individual initiator access control in proxy
initiator mode, configure an iSCSI ACL on the virtual target (see the
“iSCSI-Based Access Control”
section on page 50-26).
To add an iSCSI initiator to the zone database using Fabric Manager, follow these steps:
Step 1 Choose Zone > Edit Local Full Zone Database.
You see the Edit Local Zone Database dialog box shown in Figure 50-24.
To Next Page
Loading...
Need help?
General
