A university VSAN has an active zoneset. Two devices that do not share any zone can still read and write to each other. The default-zone policy on the switches is permit. What is allowing that traffic?
Select an answer to reveal the explanation.
Short Explanation
The velvet rope only works if you keep everyone else in the lobby. Devices that sit in no active zone fall into the default zone, and default-zone permit lets those unzoned devices talk to each other.
Full Explanation
When a zoneset is active, a device that is not a member of any zone in it is a default-zone member. The default policy is deny, so those members cannot talk. This fabric was set to permit, so the two unzoned devices are allowed to communicate even though no configured zone contains both of them. A VSAN enforces one active zoneset. A second activation replaces the first. It is not merged in beside it for unzoned pairs. The name server records who logged in. An FCNS entry is not a permit to talk to every other logged-in device. Enhanced device-alias mode stores alias names in tools such as zones. It does not disable the active zoneset. Caveat: the default-zone policy is configured on each switch and is not distributed with the zoneset, so one switch left at permit keeps a hole the others do not have. Operational check: set default-zone to deny on every switch in the VSAN, then confirm the unzoned pair can no longer talk while a zoned pair still can. After you set deny, a device that still needs to talk has to be put in a real zone and that zoneset has to be activated again. Deny does not invent that zone for you.