SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 3: SAN Basics for Security ProfessionalsWhy Are Zoning Terms Confusing?In the early days of switched fabrics, hardware-enforced zone memberswere assigned by the physical port on a switch to which thedevice was connected. This was defined using the switch domain ID(DID) and the port ID (PID) on the switch. Software-enforced zonemembers were assigned using the WWN of the device. In this case,the software enforcing the zoning rules is the SNS. For this reason,zoning using the WWN was sometimes called soft zoning and zoningusing the DID/PID was sometimes called hard zoning. One ofthe advantages of zoning by WWN was the flexibility of movingdevices to any other port within a fabric without incurring zoningchanges. On the other hand, zones defined with DID/PID would notrequire a zoning change when a faulty device was replaced by anew one with a different WWN. This was particularly useful for tapedrives which have a tendency to fail more frequently than otherdevices such as HBAs.In 2001, Brocade introduced a technology in the Bloom ASIC, whichenabled the ASIC to enforce zoning based on the device WWN, notonly the DID/PID. (Although “Bloom” was initially an internal codname, it is now used externally to identify this generation of ASIC.)Hardware-enforced zoning could now include member definitionsusing the WWN. This was a significant enhancement from a securityperspective. Although Brocade was the first to implement hardware-enforcedzoning, most FC switch vendors today enforce zoningthrough hardware.For example, with software-enforced zoning, some hosts may cachethe WWN of the devices in the zone with which it communicates. If astorage device is removed from the zone and placed in a differentzone, the host could still access the storage device even though it is nolonger in the same zone. If the WWN in the cache is removed eitherthrough a power cycle or cache timeout, the host would not be able toobtain the WWN from the SNS since it is now in a different zone. This iscomparable to unlisted telephone numbers. Even though a person deliststheir phone number, someone who knows their phone number canstill call them. If the caller loses the number, however, they would notbe able to get if from directory assistance.With hardware-enforced zoning in Brocade switches, although the hostmay cache the WWN, the ASIC will block access to the device if it is notin the same zone as the host. This is equivalent to using the call-block-30 Securing Fibre Channel Fabrics