Fibre Channel (FC) zoning is a foundational security and traffic management control in Enterprise Storage Area Networks (SAN). It isolates communication between specific host initiators (HBAs) and storage targets, preventing unauthorized devices from discovering or accessing sensitive LUNs across the SAN fabric.
While soft zoning (WWPN-based zoning) remains the most common method in modern SAN environments, hard zoning (port-based zoning) provides strict physical security by enforcing zone rules at the hardware ASIC level on Fibre Channel switch ports.
This guide explains how Brocade SAN switch hard zoning works, how to collect the required Domain ID and Port Index details, and how to configure hard zoning step-by-step using Brocade Fabric OS (FOS) CLI commands.
Soft Zoning vs Hard Zoning in Brocade SAN Switches
Before executing configuration commands on your Brocade switch, it is essential to understand how hard zoning differs from soft zoning in practice.
Soft Zoning (WWPN Zoning): Devices are identified by their 64-bit World Wide Port Name (WWPN). Soft zoning relies on the switch name server database. When a host logs in via the FLOGI and PLOGI process, the switch returns only the target devices allowed within its active zone. If a host physically moves to a different port on the switch, zoning rules remain intact because the WWPN does not change.
Hard Zoning (Port-Based Zoning): Devices are identified strictly by their physical location in the fabric using the format Domain_ID, Port_Index. Hard zoning enforces isolation directly inside the switch crossbar ASIC hardware routing logic.
Hard zoning locks access strictly to physical switch ports, offering hardware-level isolation regardless of WWPN changes.
Key Differences Between Hard and Soft Zoning
| Feature | Soft Zoning | Hard Zoning |
|---|---|---|
| Identifier | World Wide Port Name (WWPN) | Domain ID & Port Index (Domain,Port) |
| Enforcement Level | Name Server lookup filtering | ASIC hardware routing table |
| Cable/HBA Swaps | Survives HBA card replacement | Survives cable moves to new HBA on same port |
| Port Flexibility | High (plug into any port) | Low (locked to designated physical port) |
| Use Case | Standard Enterprise SANs | High-security isolated SAN environments |
For fabrics operating in NPV mode in Fibre Channel switches, soft zoning is typically preferred, whereas core standalone switches often support both models.
Prerequisites: Finding Domain ID and Port Index Numbers
To configure hard zoning, you need two pieces of physical fabric information for both the host HBA port and the storage array target port:
- Domain ID: The unique integer assigned to the Brocade switch inside the fabric.
- Port Index: The physical port index number on that specific switch where the device fiber cable connects.
You can discover this information from the Brocade command-line interface using the nodefind and fabricshow commands [1:00].
Step 1: Locate Device WWPN and Physical Port Assignment
Run the nodefind command followed by the WWPN of the host HBA or storage target:
switch:admin> nodefind 21:00:00:24:ff:45:1a:02The command output displays the physical switch connection details:
Node: 21:00:00:24:ff:45:1a:02
PID: 28a500
Domain ID: 40 (Hex: 28)
Port Index: 165
Port Symbol: "slot1 port5"In this example, the first two numbers of the PID or the explicit field confirm that the Domain ID is 40 and the Port Index is 165.
Step 2: Verify Switch Details with FabricShow
Next, run fabricshow to list all active switches in your Fibre Channel fabric:
switch:admin> fabricshowOutput overview:
Switch ID Domain Name IP Address Is Principal
-------------------------------------------------------
1: fffc28 40 "Switch_Core_1" 192.168.10.5 Yes
2: fffc8d 141 "Switch_Edge_A" 192.168.10.12 No
3: fffc8e 142 "Switch_Edge_B" 192.168.10.13 NoThis command verifies the IP address and host name of the switch governing Domain 40, 141, or 142. Official guidelines are documented in the Broadcom Brocade Fabric OS Zoning Documentation.
Step-by-Step Configuration Guide for Hard Zoning
Consider a standard SAN environment scenario:
- Host Initiator: Server1 HBA (Connected to Switch Domain
141, Port1) - Storage Target: HP Storage Array Controller Port (Connected to Switch Domain
142, Port2)
Follow these 5 steps to create and activate a hard zone on Brocade Fabric OS.
Step 1: Create FC Aliases using Domain ID and Port Index
Instead of passing WWPN strings to aliCreate, pass the Domain_ID, Port_Index tuple [3:35]:
# Create Host Alias
switch:admin> aliCreate "host1_sba1", "141,1"
# Create Storage Target Alias
switch:admin> aliCreate "storage_hp1", "142,2"Syntax Tip: Separate the Domain ID and Port Index with a comma (e.g., “141,1”). Multiple members within an alias command are separated by semicolons.
Step 2: Create the Hard Zone and Add FC Aliases
Use the zoneCreate command to create a zone object and include both aliases:
switch:admin> zoneCreate "Zone_Server1_HPStorage", "host1_sba1; storage_hp1"This command binds the host port on Domain 141, Port 1 directly to the storage target port on Domain 142, Port 2.
Step 3: Add the Zone to the Active Zoneset (Defined Configuration)
Add the newly created hard zone into your fabric’s active configuration file using cfgAdd:
switch:admin> cfgAdd "Active_SAN_CFG", "Zone_Server1_HPStorage"Always verify your active configuration name using cfgShow before running cfgAdd to avoid modifying the wrong configuration.
Step 4: Save the Fabric Configuration
Save the changes to non-volatile flash memory on the switch:
switch:admin> cfgSaveThe system will prompt you for confirmation:
You are about to save defined configuration changes.
Do you want to save (yes, y, no, n): [no] yType y and press Enter.
Step 5: Enable the Zone Configuration
Finally, activate the updated configuration across the entire SAN fabric:
switch:admin> cfgEnable "Active_SAN_CFG"Confirm the activation prompt by typing y. The switch will compile the new zoning database and distribute it to all member switches in the fabric.
Remember to repeat these exact steps on your secondary fabric (Fabric B) to maintain redundant pathing for high availability.
Brocade Hard Zoning CLI Cheat Sheet
Here is a quick reference table of all commands used during Brocade hard zoning configuration:
| Action | Brocade FOS CLI Command | Example Syntax |
|---|---|---|
| Find Port & Domain | nodefind [WWPN] |
nodefind 21:00:00:24:ff:45:1a:02 |
| List Switches | fabricshow |
fabricshow |
| Create Hard Alias | aliCreate "[Alias]", "[Domain,Port]" |
aliCreate "host1", "141,1" |
| Create Hard Zone | zoneCreate "[Zone]", "[Alias1; Alias2]" |
zoneCreate "z_host1", "host1; storage1" |
| Add to Config | cfgAdd "[Config]", "[Zone]" |
cfgAdd "PROD_CFG", "z_host1" |
| Save Config | cfgSave |
cfgSave |
| Enable Config | cfgEnable "[Config]" |
cfgEnable "PROD_CFG" |
Key Takeaways
- Physical Port Binding: Hard zoning relies on
Domain_ID, Port_Indexinstead of 64-bit WWPNs. - Hardware ASIC Isolation: Enforces security rules directly at the switch crossbar routing hardware level.
- Discovery Commands: Use
nodefindandfabricshowto identify switch domain IDs and port index numbers. - 5-Step Workflow:
aliCreate→zoneCreate→cfgAdd→cfgSave→cfgEnable. - Dual Fabric Consistency: Always execute hard zoning on both Fabric A and Fabric B switches for full SAN redundancy.
Frequently Asked Questions (FAQ)
What happens if I move a host cable to a different port during hard zoning?
If you move the cable to a different port on the switch, connectivity to the storage array will drop immediately. Hard zoning locks access strictly to the physical port index configured in the zone alias.
Can I mix WWPN aliases and hard port aliases in the same Brocade zone?
Yes, Brocade Fabric OS allows mixed zones containing both WWPN-based members and Domain,Port members. However, keeping zoning strategies consistent across a fabric is recommended for easier troubleshooting.
How do I remove a hard zone from the Brocade switch configuration?
To remove a hard zone, remove it from the active config using cfgRemove "Active_CFG", "Zone_Name", delete the zone with zoneDelete "Zone_Name", remove the aliases with aliDelete "Alias_Name", and finish with cfgSave and cfgEnable.
Watch the full video walkthrough on YouTube: How To Create Hard Zoning In Brocade SAN Switch by san&nasTechie.
