The inherent dangers in relying solely on LUN masking

The inherent dangers in relying solely on LUN masking

On November 7, you wrote, when comparing LUN masking, that "smaller zones will isolate error traffic within that zone so it does not affect the servers and storage ports in other zones." Does this mean there is a danger with a SAN design relying heavily on LUN masking? We are some way into implementing a SAN with two fabrics across two locations with two Inrange directors in each location. There will be an increase in the number of hosts (say 50 for now) connected to five IBM ESSs. Most of the hosts are currently direct connected and we have just begun to connect them via the directors.

    Requires Free Membership to View

    Login

    When you register for SearchStorage.com, you’ll also receive targeted emails from my team of award-winning editorial writers. Our goal is to keep you informed on the hottest topics, the latest news and the biggest challenges you face as a storage professional today.

    Rich Castagna, Editorial Director

    By submitting your registration information to SearchStorage.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchStorage.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Yes, do not depend on LUN masking alone as any errors in the LUN masking may affect other nodes. Or, in a worst case, cause data corruption.

If you use LUN masking at the storage level along with zoning at the switch level, you afford yourself two levels of security. The LUN masking is done at the port level when multiple hosts are sharing a storage port over a fabric connection. Zoning is used to prevent access to certain storage ports at the fabric level. The smaller you make your zones the less error traffic gets passed from port to port in the fabric. The use of many smaller zones is preferable to the use of fewer larger zones in my humble opinion. Even though this may make management a bit harder, it makes larger fabrics operate better.

By the way, if you will be using storage from multiple vendors in your SAN, then it's a best practice "today", to zone out the different storage arrays. For instance, do not allocate storage to the same server from two different storage subsystems in the same fabric over two HBA adapters, as each storage array manufacturer will most likely ask you to use a different version of path management software.

Chris

Editor's note: Do you agree with this expert's response? If you have more to share, post it in one of our .bphAaR2qhqA^0@/searchstorage>discussion forums.


This was first published in December 2002