How do I configure LUN masking and zoning on a SAN?

Configuring LUN masking and zoning on a Storage Area Network (SAN) secures and optimizes storage access. Here are the steps.

---

1. Prerequisites

• Administrative access to your SAN fabric (via the SAN switch management interface) and storage array management tools.
• Know the Host Bus Adapter (HBA) World Wide Names (WWNs) or iSCSI Qualified Names (IQNs) for the servers that need storage access.
• Identify the LUNs and which servers require access to them.

---

2. Zoning on the SAN Switch

Zoning controls which devices can communicate on the fabric. Configure it on the SAN switches.

Steps to Configure Zoning:

1. Log in to the SAN switch management interface (web, CLI, or GUI — Brocade, Cisco MDS, etc.).
2. Create a zone in the zoning configuration. Assign the WWNs or port identifiers of the storage array (target) and the server’s HBA (initiator).
   Example (Brocade CLI):
   zonecreate "ZoneName", "WWN1;WWN2"
3. Add the zone to a zone set (a collection of zones activated together).
   Example (Brocade CLI):
   zonesetadd "ZoneSetName", "ZoneName"
4. Activate the zone set to apply changes.
   Example (Brocade CLI):
   zonesetactivate "ZoneSetName"
5. Verify the configuration.
   Example (Brocade CLI):
   cfgshow

---

3. LUN Masking on the Storage Array

LUN masking ensures only specific servers access particular LUNs.

Steps to Configure LUN Masking:

1. Log in to the storage array management interface (Dell EMC Unisphere, NetApp ONTAP, HPE Nimble, etc.).
2. Locate the LUNs you want to mask. Identify the WWN or IQN of the server’s HBA.
3. If the array requires it, create a storage group to bundle LUNs for easier management.
4. Map the LUNs to the host initiator. This restricts visibility to the specified server.
5. Set access permissions — read/write or read-only — as needed.
6. Save and apply the configuration.
7. On the server, rescan the HBA or iSCSI initiator to confirm the assigned LUNs appear.

---

4. Test and Validate

• On the server: Rescan the HBA or iSCSI initiator and verify the correct LUNs are visible.
• On the SAN: Check fabric connectivity to confirm zoning works.
• On the storage array: Verify LUN masking restricts access as expected.

---

5. Best Practices

• Use single-initiator zoning (one initiator, one target per zone) to simplify troubleshooting and reduce blast radius.
• Document all WWNs, zones, and LUN mappings for auditing and disaster recovery.
• Monitor the SAN fabric and storage array for unauthorized access or performance issues.
• Use redundant paths and multipathing software (VMware NMP, Microsoft MPIO) for availability and fault tolerance.