iSNS and zoning

[jp.raghavendra@sun.com]

>


In looking at iSNS draft, I get the impression that the zoning service 
as currently defined is a poor mimicking of its Fibre Channel counter
part. In FC fabric, the switch has several mechanisms to prevent an
N/NL_Port from unauthorised/unintended accesses, since it is part of
the access path. However, with iSNS, which could be a stand alone name
server, I'm having hard time understanding how this storage name server
could enforce the claims made in the draft, such as:

a)
	> 3.1.3    Network Zoning Service

	> .... snip ....
    	> The Network Zoning Service implements the functionality to support
    	> grouping of iSNS client devices into domains for administrative and
    	> access control purposes.
	> .... 

b)
	> 4.3      Zone Object
	>
	> .... snip ....
    	> Zoning is a security and management mechanism used to partition
    	> storage resources.  Zoning prevents initiators from potentially
	> logging in to every possible target during device discovery.
	> ....

iSNS as currently defined is only a repository of information of the so
called zones. It has no way to prevent an authorised rogue iSCSI initiator
from setting up a TCP connection with an iSCSI target. The best place to
implement security and access control is the iSCSI target itself.


-JP