Tip	Use the show wwn switch command to retrieve the sWWN. If you do not provide a sWWN, the software automatically uses the local sWWN.

The following examples show how to configure zone members:

switch(config)# zone name MyZone vsan 2

pWWN example:

switch(config-zone)# member pwwn 10:00:00:23:45:67:89:ab

Fabric pWWN example:

switch(config-zone)# member fwwn 10:01:10:01:10:ab:cd:ef

FC ID example:

switch(config-zone)# member fcid 0xce00d1

FC alias example:

switch(config-zone)# member fcalias Payroll

Domain ID example:

switch(config-zone)# member domain-id 2 portnumber 23

Show WWN example:

switch# show wwn switch

switch(config-zone)# member interface fc 2/1

switch(config-zone)# member interface fc 2/1 swwn 20:00:00:05:30:00:4a:de

switch(config-zone)# member interface fc 2/1 domain-id 25

The following example shows how to configure different types of member alias:

switch(config)# fcalias name AliasSample vsan 3

pWWN example:

switch(config-fcalias)# member pwwn 10:00:00:23:45:67:89:ab

fWWN example:

switch(config-fcalias)# member fwwn 10:01:10:01:10:ab:cd:ef

FC ID example:

switch(config-fcalias)# member fcid 0x222222

Domain ID example:

switch(config-fcalias)# member domain-id 2 portnumber 23

Device alias example:

switch(config-fcalias)# member device-alias devName

You can activate or deactivate an existing zone set.

Changes to a zone set do not take effect in a full zone set until you activate it.

Each member of a fabric (in effect a device attached to an Nx port) can belong to any zone. If a member is not part of any active zone, it is considered to be part of the default zone. Therefore, if no zone set is active in the fabric, all devices are considered to be in the default zone. Even though a member can belong to multiple zones, a member that is part of the default zone cannot be part of any other zone. The switch determines whether a port is a member of the default zone when the attached port comes up.

Note	Unlike configured zones, default zone information is not distributed to the other switches in the fabric.

Traffic can either be permitted or denied among members of the default zone. This information is not distributed to all switches; it must be configured in each switch.

Note	When the switch is initialized for the first time, no zones are configured and all members are considered to be part of the default zone. Members are not permitted to communicate with each other.

Configure the default zone policy on each switch in the fabric. If you change the default zone policy on one switch in a fabric, be sure to change it on all the other switches in the fabric.

Note	The default settings for default zone configurations can be changed.

The default zone members are explicitly listed when the default policy is configured as permit or when a zone set is active. When the default policy is configured as deny, the members of this zone are not explicitly enumerated when you view the active zone set.

To permit or deny traffic to members in the default zone, perform this task:

You can assign an alias name and configure an alias member using the following values:

• pWWN—The WWN of the N port is in hex format (for example, 10:00:00:23:45:67:89:ab).
• fWWN—The WWN of the fabric port name is in hex format (for example, 10:00:00:23:45:67:89:ab).
• FC ID—The N port ID is in 0xhhhhhh format (for example, 0xce00d1).
• Domain ID—The domain ID is an integer from 1 to 239. A mandatory port number of a non-Cisco switch is required to complete this membership configuration.
• Interface—Interface-based zoning is similar to port-based zoning because the switch interface is used to configure the zone. You can specify a switch interface as a zone member for both local and remote switches. To specify a remote switch, enter the remote switch WWN (sWWN) or the domain ID in the particular VSAN.

Tip	The switch supports a maximum of 2048 aliases per VSAN.

You create an alias.

You can create a zone set to include several zones.

Zoning can be enforced in two ways: soft and hard. Each end device (N port) discovers other devices in the fabric by querying the name server. When a device logs in to the name server, the name server returns the list of other devices that can be accessed by the querying device. If an N port does not know about the FC IDs of other devices outside its zone, it cannot access those devices.

In soft zoning, zoning restrictions are applied only during interaction between the name server and the end device. If an end device somehow knows the FC ID of a device outside its zone, it can access that device.

Hard zoning is enforced by the hardware on each frame sent by an N port. As frames enter the switch, source-destination IDs are compared with permitted combinations to allow the frame at wire speed. Hard zoning is applied to all forms of zoning.

Note	Hard zoning enforces zoning restrictions on every frame, and prevents unauthorized access.

Cisco SAN switches support both hard and soft zoning.

All Cisco SAN switches distribute active zone sets when new E port links come up or when a new zone set is activated in a VSAN. The zone set distribution takes effect while sending merge requests to the adjacent switch or while activating a zone set.

You can enable full zone set and active zone set distribution to all switches on a per VSAN basis.

You can perform a one-time distribution of inactive, unmodified zone sets throughout the fabric.

Use the zoneset distribute vsan vsan-id command in EXEC mode to perform this distribution.

switch# zoneset distribute vsan 2

Zoneset distribution initiated. check zone status

This command only distributes the full zone set information, as it does not save the information to the startup configuration. You must explicitly enter the copy running-config startup-config command to save the full zone set information to the startup configuration.

Note	The one-time distribution of the full zone set is supported in interop 2 and interop 3 modes, and not in interop 1 mode.

Use the show zone status vsan vsan-id command to check the status of the one-time zone set distribution request.

switch# show zone status vsan 3

VSAN: 3 default-zone: permit distribute: active only Interop: 100

    mode:basic merge-control:allow 

    session:none

    hard-zoning:enabled

Default zone:

    qos:none broadcast:disabled ronly:disabled

Full Zoning Database :

    Zonesets:0  Zones:0 Aliases: 0

Active Zoning Database :

    Name: nozoneset  Zonesets:1  Zones:2

Status: Zoneset distribution completed at 04:01:06 Aug 28 2010

When two switches in a fabric are merged using a TE or E port, these TE and E ports may become isolated when the active zone set databases are different between the two switches or fabrics. When a TE port or an E port become isolated, you can recover that port from its isolated state using one of three options:

• Import the neighboring switch’s active zone set database and replace the current active zone set (see the figure below).
• Export the current database to the neighboring switch.
• Manually resolve the conflict by editing the full zone set, activating the corrected zone set, and then bringing up the link.

Figure 5. Importing and Exporting the Database

You can import or export the zone set information from or to an adjacent switch.

On Cisco SAN switches, you cannot edit an active zone set. However, you can copy an active zone set to create a new zone set that you can edit.

You can rename a zone, zone set, fcalias, or zone-attribute-group.

You can clone a zone, zone set, fcalias, or zone-attribute-group.

You can clear all configured information in the zone server database for the specified VSAN.

To clear the zone server database, use the following command:

switch# clear zone database vsan 2

Note	After entering a clear zone database command, you must explicitly enter the copy running-config startup-config to ensure that the running configuration is used when the switch reboots.

Note	Clearing a zone set only erases the full zone database, not the active zone database.

The following table lists the advantages of the enhanced zoning feature in all switches in the Cisco SAN switches.

You can change to the enhanced zoning mode from the basic mode.

Cisco SAN switches allow you to change from enhanced zoning to basic zoning to enable you to downgrade and upgrade to other Cisco NX-OS releases.

You can enable enhanced zoning in a VSAN.

By default, the enhanced zoning feature is disabled in all Cisco SAN switches.

Ypou can commit or discard changes to the zoning database in a VSAN.

Modifications to the zone database is done within a session. A session is created at the time of the first successful configuration command. On creation of a session, a copy of the zone database is created. Any changes done within the session are performed on this copy of the zoning database. These changes in the copy zoning database are not applied to the effective zoning database until you commit the changes. Once you apply the changes, the session is closed.

If the fabric is locked by another user and for some reason the lock is not cleared, you can force the operation and close the session. You must have permission (role) to clear the lock in this switch and perform the operation on the switch from where the session was originally created.

To release the session lock on the zoning database on the switches in a VSAN, use the no zone commit vsan command from the switch where the database was initially locked.

switch# configure terminal

switch(config)# no zone commit vsan 2

If session locks remain on remote switches after using the no zone commit vsan command, you can use the clear zone lock vsan command on the remote switches.

switch# clear zone lock vsan 2

Note	We recommend using the no zone commit vsan command first to release the session lock in the fabric. If that fails, use the clear zone lock vsan command on the remote switches where the session is still locked.

The merge method depends on the fabric-wide merge control setting:

• Restrict—If the two databases are not identical, the ISLs between the switches are isolated.
• Allow—The two databases are merged using the merge rules specified in the following table.

The merge process operates as follows:

• The software compares the protocol versions. If the protocol versions differ, the ISL is isolated.
• If the protocol versions are the same, then the zone policies are compared. If the zone policies differ, the ISL is isolated.
• If the zone merge options are the same, the comparison is implemented based on the merge control setting.
  • If the setting is restrict, the active zone set and the full zone set should be identical. Otherwise, the link is isolated.
  • If the setting is allow, the merge rules are used to perform the merge.

You can configure merge control policies.

You can permit or deny traffic in the default zone.

You can configure default settings for default zone policies and full zone distribution for new VSANs on the switch.

switch# show zone status vsan 2