FC zoning Windows server into configuration when there are ESXi hosts present

[jim33boy]

Hello,

We have a FC SAN using 2 brocade switches/fabrics. Currently we have 10 ESXi hosts using FC SAN.

The ESXi hosts HBA ports and SAN controller ports are zoned together and we serve datastores via the provisioned LUNs after mapping the LUNs to the hosts.

I now must connect a single Windows host to the SAN temporarily.

I am worried about creating a zone containing the windows HBA ports and the SAN HBA ports for fear of the Windows host being able to access the ESXi LUNs.

I am quite sure things will be fine as long as I do not explicitly map the ESXi datastore LUNs to the Windows host.

Am I correct here in my assumption that unless I explicitly map the ESXi datastore LUNs to the newly added Windows host, the Windows host will not be able to harm the ESXi LUNS?

To be clear, there is no automatic mapping group for new LUNs, we control it explicitly.

Thank you

[daphnissov · Accepted solution]

Yes, if your Windows host is not zoned to "see" the same LUNs being presented to ESXi hosts you're fine. VMFS is cluster aware whereas Windows doesn't understand that.

[jim33boy]

Thanks for the confirmation, much appreciated.

[daphnissov]

Just to give a little more detail here since I forgot to include it earlier. Windows seeing a LUN formatted as VMFS isn't in and of itself a problem, it's only when it tries to do something with it that can be catastrophic. By default, automount is turned on for Windows in which case it will try to mount any new disk it sees. This can damage the filesystem and for that reason presenting it should be avoided. However, there are cases where this is not only *not* harmful but actually required. An example being backup software (which will disable automount) that has the capability of reading and extracting data from VMFS. If this doesn't apply to you or you aren't sure, err on the side of caution and simply do not zone it in.