思科UCS FC Zoning系统手册

1、 思科 UCS FC ZoningSoftware Functional SpecificationFibre Channel Zoning on the UCS Fabric InterconnectsTable of Contents TOC o 2-3 h z t Heading 1,1 HYPERLINK l _Toc490141957 1Problem Definition PAGEREF _Toc490141957 h 5 HYPERLINK l _Toc490141958 2Functional Description PAGEREF _Toc490141958 h 6 HYPE

2、RLINK l _Toc490141959 2.1Zoning Features PAGEREF _Toc490141959 h 6 HYPERLINK l _Toc490141960 2.2Features Not Supported PAGEREF _Toc490141960 h 7 HYPERLINK l _Toc490141961 2.3Supported Topologies PAGEREF _Toc490141961 h 8 HYPERLINK l _Toc490141962 2.3.1FC Switch Interoperability Matrix PAGEREF _Toc49

3、0141962 h 8 HYPERLINK l _Toc490141963 2.4Zoning Type PAGEREF _Toc490141963 h 8 HYPERLINK l _Toc490141964 2.5Initiator Groups PAGEREF _Toc490141964 h 9 HYPERLINK l _Toc490141965 2.6FC Storage Connection Policy PAGEREF _Toc490141965 h 9 HYPERLINK l _Toc490141966 2.7Zone Configuration PAGEREF _Toc49014

4、1966 h 10 HYPERLINK l _Toc490141967 2.7.1Zone Set Activation Triggers PAGEREF _Toc490141967 h 12 HYPERLINK l _Toc490141968 2.7.2Zone Configuration Triggers PAGEREF _Toc490141968 h 13 HYPERLINK l _Toc490141969 2.7.3Zone Set Configuration PAGEREF _Toc490141969 h 13 HYPERLINK l _Toc490141970 2.7.4Examp

5、le PAGEREF _Toc490141970 h 13 HYPERLINK l _Toc490141971 2.7.5Merge Failures PAGEREF _Toc490141971 h 14 HYPERLINK l _Toc490141972 2.7.6Smart Zoning PAGEREF _Toc490141972 h 14 HYPERLINK l _Toc490141973 2.7.7Zone Modes PAGEREF _Toc490141973 h 15 HYPERLINK l _Toc490141974 2.7.8Domain ID PAGEREF _Toc4901

6、41974 h 15 HYPERLINK l _Toc490141975 2.7.9Switch priority PAGEREF _Toc490141975 h 17 HYPERLINK l _Toc490141976 2.7.10Name of Active Zone Set PAGEREF _Toc490141976 h 17 HYPERLINK l _Toc490141977 2.7.11Compacting Zones PAGEREF _Toc490141977 h 17 HYPERLINK l _Toc490141978 2.7.12Device Aliasing PAGEREF

7、_Toc490141978 h 18 HYPERLINK l _Toc490141979 2.7.13Zoning and Pin Group PAGEREF _Toc490141979 h 18 HYPERLINK l _Toc490141980 2.7.14FC Default Parameters PAGEREF _Toc490141980 h 18 HYPERLINK l _Toc490141981 2.8Boot LUNs PAGEREF _Toc490141981 h 18 HYPERLINK l _Toc490141982 2.9Transition from FC switch

8、ing to EHM PAGEREF _Toc490141982 h 19 HYPERLINK l _Toc490141983 2.10FI Reboot PAGEREF _Toc490141983 h 19 HYPERLINK l _Toc490141984 2.11Default Zoning PAGEREF _Toc490141984 h 19 HYPERLINK l _Toc490141985 2.12Link Isolation and Recovery PAGEREF _Toc490141985 h 19 HYPERLINK l _Toc490141986 2.13FC Timer

9、s PAGEREF _Toc490141986 h 20 HYPERLINK l _Toc490141987 2.14Topology Considerations PAGEREF _Toc490141987 h 20 HYPERLINK l _Toc490141988 2.14.1Connecting UCS to upstream FC switches PAGEREF _Toc490141988 h 20 HYPERLINK l _Toc490141989 2.15Upgrading to Delmar PAGEREF _Toc490141989 h 22 HYPERLINK l _To

10、c490141990 2.16Downgrading to pre-Delmar PAGEREF _Toc490141990 h 22 HYPERLINK l _Toc490141991 2.17Export PAGEREF _Toc490141991 h 22 HYPERLINK l _Toc490141992 2.18Import and DB Restore PAGEREF _Toc490141992 h 22 HYPERLINK l _Toc490141993 2.19Limits PAGEREF _Toc490141993 h 23 HYPERLINK l _Toc490141994

11、 2.20Deleting Orphan UCSM Zones PAGEREF _Toc490141994 h 24 HYPERLINK l _Toc490141995 3DME Data Model PAGEREF _Toc490141995 h 24 HYPERLINK l _Toc490141996 3.1Fabric Data Model PAGEREF _Toc490141996 h 24 HYPERLINK l _Toc490141997 3.2SW Data Model PAGEREF _Toc490141997 h 28 HYPERLINK l _Toc490141998 4G

12、UI and CLI Changes PAGEREF _Toc490141998 h 29 HYPERLINK l _Toc490141999 4.1CLI Changes PAGEREF _Toc490141999 h 29 HYPERLINK l _Toc490142000 4.1.1VSAN PAGEREF _Toc490142000 h 29 HYPERLINK l _Toc490142001 4.1.2Initiator Group PAGEREF _Toc490142001 h 29 HYPERLINK l _Toc490142002 4.1.3Initiator Group Te

13、mplate PAGEREF _Toc490142002 h 30 HYPERLINK l _Toc490142003 4.1.4FC Storage Connection Policies PAGEREF _Toc490142003 h 31 HYPERLINK l _Toc490142004 4.1.5Zones PAGEREF _Toc490142004 h 31 HYPERLINK l _Toc490142005 4.1.6Global FC Zone Scheduling Policy PAGEREF _Toc490142005 h 33 HYPERLINK l _Toc490142

14、006 4.2GUI Changes PAGEREF _Toc490142006 h 34 HYPERLINK l _Toc490142007 4.2.1FC Zoning Policy PAGEREF _Toc490142007 h 34 HYPERLINK l _Toc490142008 4.2.2FC Storage Policy PAGEREF _Toc490142008 h 35 HYPERLINK l _Toc490142009 4.2.3vHBA Group PAGEREF _Toc490142009 h 35 HYPERLINK l _Toc490142010 4.2.4vHB

15、A Group Template PAGEREF _Toc490142010 h 36 HYPERLINK l _Toc490142011 4.2.5Create VSAN PAGEREF _Toc490142011 h 36 HYPERLINK l _Toc490142012 4.2.6Edit VSAN PAGEREF _Toc490142012 h 37 HYPERLINK l _Toc490142013 4.2.7Zone Display PAGEREF _Toc490142013 h 37 HYPERLINK l _Toc490142014 5Memory and Performan

16、ce Impact PAGEREF _Toc490142014 h 38 HYPERLINK l _Toc490142015 5.1Zone scalability PAGEREF _Toc490142015 h 38 HYPERLINK l _Toc490142016 6Testing Considerations PAGEREF _Toc490142016 h 38 HYPERLINK l _Toc490142017 6.1Supported Arrays PAGEREF _Toc490142017 h 40 HYPERLINK l _Toc490142018 7Security Cons

17、iderations PAGEREF _Toc490142018 h 40 HYPERLINK l _Toc490142019 8Packaging Considerations PAGEREF _Toc490142019 h 41 HYPERLINK l _Toc490142020 9End User Interface/User Experience PAGEREF _Toc490142020 h 41 HYPERLINK l _Toc490142021 10Configuration and Restrictions PAGEREF _Toc490142021 h 41 HYPERLIN

18、K l _Toc490142022 11References PAGEREF _Toc490142022 h 41 HYPERLINK l _Toc490142023 12Glossary PAGEREF _Toc490142023 h 41 HYPERLINK l _Toc490142024 13Attachments PAGEREF _Toc490142024 h 42 HYPERLINK l _Toc490142025 13.1PRD Requirements PAGEREF _Toc490142025 h 42 HYPERLINK l _Toc490142026 13.2Unsuppo

19、rted Features PAGEREF _Toc490142026 h 44 HYPERLINK l _Toc490142027 13.2.1FC Port Security PAGEREF _Toc490142027 h 44 HYPERLINK l _Toc490142028 13.2.2LUN Zoning PAGEREF _Toc490142028 h 44 HYPERLINK l _Toc490142029 13.2.3Initiator N_Port Zone Membership PAGEREF _Toc490142029 h 45 HYPERLINK l _Toc49014

20、2030 13.2.4Interop Mode PAGEREF _Toc490142030 h 45 HYPERLINK l _Toc490142031 13.2.5Enhanced Zoning PAGEREF _Toc490142031 h 45 HYPERLINK l _Toc490142032 13.2.6NPIV-Enabled Virtual Machines PAGEREF _Toc490142032 h 45 HYPERLINK l _Toc490142033 13.3Design Discussions PAGEREF _Toc490142033 h 45 HYPERLINK

21、 l _Toc490142034 13.3.1Questions PAGEREF _Toc490142034 h 45 HYPERLINK l _Toc490142035 13.3.2Zone Naming Conventions PAGEREF _Toc490142035 h 46 HYPERLINK l _Toc490142036 13.3.3Domain ID overlap PAGEREF _Toc490142036 h 47 HYPERLINK l _Toc490142037 13.3.4Enhanced Zoning PAGEREF _Toc490142037 h 48 HYPER

22、LINK l _Toc490142038 13.3.5FC Port Discovery PAGEREF _Toc490142038 h 48 HYPERLINK l _Toc490142039 13.4Zone Membership on the Nexus 5000 PAGEREF _Toc490142039 h 48 HYPERLINK l _Toc490142040 13.5Zone Distribution PAGEREF _Toc490142040 h 49 HYPERLINK l _Toc490142041 13.5.1Zoneset is defined on FC Switc

23、h and distributed to FI PAGEREF _Toc490142041 h 49 HYPERLINK l _Toc490142042 13.5.2Same Zoneset is defined on FI and FC Switch PAGEREF _Toc490142042 h 50 HYPERLINK l _Toc490142043 13.5.3Activation of ZoneSet with different names PAGEREF _Toc490142043 h 51 HYPERLINK l _Toc490142044 13.5.4Persistence

24、of Zone Set Definition PAGEREF _Toc490142044 h 51 HYPERLINK l _Toc490142045 13.5.5Activation of conflicting Zone Sets, then switches are connected PAGEREF _Toc490142045 h 51 HYPERLINK l _Toc490142046 13.6Review Action Items PAGEREF _Toc490142046 h 52Problem DefinitionSince the Balboa release, a UCS

25、Fabric Interconnect can be directly attached to FCoE or FC ports on a storage array.UCS FIUCS FIFC SwitchNexus 5000,MDSFC SwitchNexus 5000, MDSFC Storage PortFC PortFCoE Storage PortNon UCS serversThe Fabric Interconnect does not provide any FC zoning capabilities, so all LUNs on a particular VSAN a

26、re visible from all vHBAs connected to that VSAN, and all vHBAs can communicate with each other, which can pose security risks. The potential for any server on a VSAN to mount and access any LUN on the SAN can create several problems, most notably disk resource contention (lower performance) and dat

27、a corruption. In particular, FC performance degrades with open zoning (default permit all).Should, for example, a Windows-based host see a disk being utilized by a Linux host, the file structure would look foreign and may be viewed by the Windows system as being a corrupt Windows volume that is avai

28、lable and must be repaired. Once the Windows server writes its signature to that disk it will now look foreign to the original Linux server and data corruption will occur.In pre-Delmar versions, there are two complementary approaches to address these problems. The first method is to configure LUN ma

29、sking on the storage array and dedicate storage devices to specified servers. The second method is to introduce a 10G Ethernet or FC switch, configure FC zoning on the external switch and distribute the zoning information to the UCS Fabric Interconnects.However, both methods are operationally expens

30、ive because the server administrator must coordinate activities with the storage administrator every time a new server is deployed. Furthermore, WWNs can be dynamically assigned to Service Profiles, which would require LUN masking reconfiguration when WWNs are changed.This document describes FC Zoni

31、ng support on UCS. The following features will be introduced:Support FC zoning when UCS is configured in FC switching modeManage per VSAN zone membership based on abstract attributesSupport FC zoning when FI is/is not connected to upstream FC switchesDynamically update zone configuration when Servic

32、e Profiles are associated/disassociated, when storage ports are added/removed, when WWNs are changed or when Service Profile vHBA attributes are modifiedBy implementing zoning within a Fibre Channel network, Registered State Change Notifications (RSCNs) are isolated to the devices within the zone in

33、 which the state change happened. This causes fewer disruptions to devices within the fabric, especially to devices that have no reliance or are not in the proximity of the actual state change.It should be noted that zoning does not provide as much granularity as LUN masking. With zoning, it is not

34、possible to perform access control on a per-LUN basis. On the other hand, LUN masking does nothing to eliminate fabric-wide RSCN disruptions. Functional DescriptionPRD requirements are listed in section REF _Ref297889803 w h 13.1.Zoning FeaturesFC zoning will provide the following functionality:UCSM

35、-based FC zoning provisioning. FC zoning is provisioned using a simple binding between newly introduced Initiator Group and FC Storage Connection Policy. Actual zones and zone members are implicitly derived from these bindings.The UCSM API user does not need to create one zone per server vHBA and st

36、orage port, as is typically configured on a FC switchProvision FC zoning per VSANThe API user can enable zoning for one VSAN and disable zoning for another VSANBy default, FC zoning will be disabled (to maintain backward compatibility)If FC zoning is disabled on UCSM, the FI will not configure any z

37、ones, but will still accept active zone sets from peer FC switchesSupport Single Initiator Single Target (SIST) zoning and Single Initiator Multiple Targets (SIMT) Zoning can be set per Initiator Group to none, SIST, or SIMTIn SIST mode, UCSM will automatically create one zone for each (vHBA, storag

38、e port) pair. Each zone will have two membersIn SIMT mode, UCSM will automatically create one zone for each vHBAZoning will be supported in FC Switching mode only. In NPV mode, no zoning can be done on the FIUCSM automatically adds zone members for target N_Ports specified in a Service Profile boot

39、sequenceA user with storage privileges can control when FC zoning operations are performed: configuration (addition/removal/modification) of Zones and activation of Zone set will be either immediate, user acknowledged (default value) or scheduled. Immediate: Zone membership is automatically updated

40、when service profiles are configured, or when target ports are added/removed. User acknowledged: user can review zone changes and must acknowledge operation to trigger zoning configurationScheduled: zoning is scheduled“default zoning” feature will be deprecated.Interoperability will be tested with t

41、he Nexus 5000 and MDS switch.The diagram below shows a sample zoning configuration. Service Profile #1 is a member of zone B and D; Service Profile #2 is part of zone A and C. Each zone has a single initiator and single target.FC1/1FC1/2FC1/3Storage ArrayFC1/1WWN T1VSAN 4TargetsvHBA0WWPN I2VSAN 4UCS

42、 6100UCS Service Profile 2InitiatorsStorage ArrayFC1/2WWN T4VSAN 4Zone AvHBA0WWPN I1VSAN 4UCS Service Profile 1Zone BZone CZone DFeatures Not SupportedThe features below will NOT be supported in Delmar, although nothing in the current spec would prevent from incrementally adding these features in la

43、ter releases.Zoning for servers that are not managed by UCSM. Zoning for non-UCS servers must be configured on FC switches using external tools such as Fabric ManagerZoning for NPIV-enabled VMs, where a VM running on a UCS blade/rack has a virtual WWN and has access to RDM disks.UCSM will not allow

44、arbitrary zones to be configured. UCSM will support Single Initiator Single Target or Single Initiator Multiple Targets zones.It will not be possible to define zone membership using FC ID, sWWN, interface/port ID. Membership will be abstracted out in the UCSM modelLUN zoning not supported (MDS-speci

45、fic feature that will be deprecated). LUN masking must be configured to expose specific LUNs to specific vHBAsFC Port SecurityEnhanced zoning. The switch will be configured in basic zoningInterop mode. Interop mode will be disabledConfiguration of VSAN timersSupported TopologiesFC topologies listed

46、in the document below will still be supported. HYPERLINK /attachments/UCS%201.4%20Direct%20Connect%20Storage%203.3.pptx /attachments/UCS%201.4%20Direct%20Connect%20Storage%203.3.pptxThe topologies below will be supported:Direct connect with UCSM zoning and no upstream FC switchDirect connect with UC

47、SM zoning and upstream FC switchFC Switch Interoperability MatrixZoning will be qualified with the storage arrays and FC switches listed at the URLs below. HYPERLINK /en/US/docs/switches/datacenter/mds9000/interoperability/matrix/Matrix8.html /en/US/docs/switches/datacenter/mds9000/interoperability/

48、matrix/Matrix8.html HYPERLINK /en/US/docs/switches/datacenter/mds9000/interoperability/matrix/intmatrx.html /en/US/docs/switches/datacenter/mds9000/interoperability/matrix/intmatrx.html HYPERLINK /index.php/storage/1282-storage-interoperabilitycertifications-with-ucs /index.php/storage/1282-storage-

49、interoperabilitycertifications-with-ucsZoning TypeA Vsan MO has a new “zoning” property that references a zoning policy. The zoning policy is used to set the type of zoning configuration:ValueDescriptionnoneNo zoning is performed by UCSM. However, UCS will still accept zoning configuration from upst

50、ream switches.sistSingle Initiator Single Target zoning. Recommended unless number of zones is expected to grow beyond max supported zonesIf the vnicFcPolicy:storagePolicyOwner property is set to “management”, zoning will be done implicitly. i.e. the member vHBAs will be zoned with all known ports i

51、n the VSAN. This includes: All direct attach storage FC and FCoE ports in the VSANAll storage ports available through the FC naming serviceAll storage ports listed for boot LUNs in the boot sequenceIf the vnicFcPolicy:storagePolicyOwner property is set to “policy”, zoning is done based on all ports

52、specified in the FC Storage Policy. The member vHBAs are zoned with all ports specified in the FC Storage Policy.simtSingle Initiator Multiple Target zoning. Initiator GroupsFC Zoning feature only deals with Initiator Groups of type FC. An FC Initiator Group is conceptually similar to a vHBA templat

53、e, but it can encapsulate the configuration of multiple vHBAs. Initiator Group zoning type can be: 1) managed by UCSM (“management”) or 2) explicitly set by the API user (“policy”). A Initiator Group is contained under Service Profile or Org. (Note: Phase 1 only supports group under service profile)

54、A Initiator Group can contain a set of vHBAs (i.e. Initiators) names A Initiator Group can contain or can refer to an FC Storage Connection Policy by nameWith “management” ownership, all vHBAs (i.e. Initiators) in the group are zoned with the all target ports available in the FC name server under th

55、e VSAN specified on the initiator group.With “policy” ownership, no zoning will be done until the user sets the FC Storage Connection Policy on the initiator group.No Initiator group will be created by default.FC Storage Connection PolicyA FC Storage Connection Policy contains a collection of storag

56、e ports on storage arrays. A FC Storage Policy is contained under Org or Initiator Group.The user can manually specify target ports, either using target N_Port WWNs or by referencing FC/FCoE storage ports. (Note: Referencing Fc/FCoE ports is not supported in Phase 1)Both FCoE and FC storage ports ar

57、e supportedA FC Storage Policy can contain a target N_Port pWWN of a storage array directly or indirectly connected to the UCS FINo “default” Fc Storage will be created.The target storage array N_Ports can be identified using one of the following attributes:Target N_Port pWWN, i.e. the WWN of the ta

58、rget N_Port on the storage arrayThe user must manually enter the WWNThe user must keep track of any WWN modifications and update the zone membershipStorage FC or FCoE Interface, the FC interface connected to a target N_Port on a storage arrayThe WWN of the peer Target N_Port is automatically invento

59、ried from the FC Name ServerUCSM automatically updates the zone membership if the Storage FC interface is recabledWhen FCoE storage ports are configured on the FI, a VFC is always created for each physical port configured in FCoE mode. The peer port WWN will be available on the VFCFC1/1FC1/3Storage

60、ArrayFC1/10WWN T1VSAN 4UCS 6100Target N_Port WWNUCS Storage FC InterfaceZone ConfigurationThe actual FC zoning configuration is derived from 1) the FC Storage Policy and 2) the binding between Initiator Group and FC Storage Policy 3) the FC zoning type. The grouping method for zoning will be Single