|
One of the benefits of a SAN-based storage environment is that all I/O is done over optical fiber. This dramatically decreases the chances of anyone "snooping" the cables and pulling data. There are two methods to zoning in a fabric environment, port zoning and WWN Zoning. Port zoning uses zones by physical ports, and is VERY secure. WWN (World Wide Name) zoning uses the name server in the switches to either allow or block access to particular WWNs in the fabric. WWN zoning is common due to the flexibility of being able to recable the fabric without having to redo the zone information. WWN zoning is less secure though, as the zone can be bypassed if someone knows the IEEE address of the adapter and does an access directly to the node.
There are also different methods of "LUN MASKING" in a SAN. Some methods use "agents" on the servers to block access to particular LUNs in an array. If an agent is not installed, or is set up improperly, then there is a chance of unsecured LUN access by that node. The other and most preferable method is to use firmware in the array itself to provide host access to particular LUNs by using the WWN of the host. The array will store an access list for host access in NVRAM and or memory.
The main thing to watch out for is mixed NT Unix environments in the same fabric. LUN security is paramount in mixed environments, as NT can "see" all unsecured LUNs and tries to write a signature on every disk. You can use zoning in the switches to zone out the different operating systems to avoid this. If you have a good SAN manager and the array does WWN based LUN security, this should not be an issue.
Now iSCSI is a totally different matter and security will be more important in an iSCSI environment, but that's a whole new subject for further discussion.
Chris
|
