New routing strategies help storage area networks grow up.

IT storage administrators face growing pressure to control costs and increase capabilities of storage area networks (SANs). As SANs become more complex and more tightly integrated with network applications and other SANs, organizations seek ways to consolidate multiple SAN "islands" into a more cost-effective architecture. But how can a technology designed to operate in isolation be adapted into a scalable, integrated system? How can SANs be opened up to allow more consolidation and flexibility while still maintaining the tight security and high availability of a closed, isolated network?

New SAN routing technologies can provide the answers. Emerging strategies for fabric virtualization, virtual fabric trunking and interfabric routing can lead to more scalable and cost-effective SANs while preserving the essential security and availability of traditional SAN architectures.

The Trouble with Traditional SANs

To understand why SAN technology is changing, it is important to recognize how it evolved. Unlike Internet Protocol (IP)-based local-area networks (LANs), SANs--and the Fibre Channel transport on which they're built--are designed primarily around the concept of ensuring availability. To provide maximum control and reliability, storage administrators historically built SANs as completely isolated networks, in which each application or user group had its own physical SAN fabric.

There were good reasons for taking this approach. As some storage administrators learned the hard way, when an organization uses a single multiswitch fabric for multiple SAN applications, any disruption in one part of the fabric can impair the entire network. For example, in a multisite SAN, a configuration problem at a secondary disaster recovery location can actually render the production site inoperable as well. Storage administrators also believed that by keeping SANs isolated, they could more closely manage and monitor each fabric.

New demands on storage networks are pushing the limits of these traditional architectures. As business applications, user groups and locations become more tightly integrated, SAN islands no longer reflect the ways these networks are actually used. For example, a storage array originally deployed for a single application at one site may now need to support several applications and remote offices. Without some means of limited interfabric communication, organizations may have to duplicate storage arrays and switches--at substantial cost.

Port and connectivity costs have also become a serious concern. Despite the fact that most SAN islands connect only a small number of end points, many SAN switches offer 16 or 32 ports. This means organizations pay a premium for ports that go unused. Also, maintaining segregated SAN islands between remote sites has traditionally meant maintaining multiple site-to-site connections--and paying recurring fees for each link, regardless of the actual bandwidth it uses. And when separate data protection solutions (backup, restore and disaster recovery) are also duplicated on each SAN fabric, the overall costs are that much greater.

As these issues come to the forefront, storage administrators face growing pressure to make SANs more "LAN-like" while somehow preserving their fundamental advantages of security and availability. Enter virtual fabric technologies.

Fabric Virtualization

IT administrators have used virtual LANs (VLANs) for years to segment a common physical IP network into multiple logical networks. More recently, this model has been applied in the SAN realm in the form of virtual SANs (VSANs). Instead of relying on separate physical SAN fabrics for different applications or user groups, storage administrators can segment a single common fabric into multiple, logically isolated fabrics. Developed by Cisco Systems in 2002, VSANs are now accepted and standardized by the ANSI T11 Fibre Channel group.

The ability to logically segment a common physical infrastructure offers several advantages, not least of which is that the benefits of traditional SAN architectures are preserved. With logically separated SAN fabrics, a disruption in one virtual fabric remains isolated to that fabric. A configuration error, for example, only affects the VSAN on which it occurs, even though other VSANs share the same physical infrastructure. Different VSANs can still use different transport technologies and operating systems. Administrators can still apply statistical analysis, troubleshooting and security and encryption services on a perfabric (per-VSAN) basis.

However, using VSANs, storage administrators no longer need separate pairs of switches for each SAN connection. Instead, they can use common SAN switching infrastructure to support multiple fabrics, use all the available ports on each switch and provision services with the exact number of ports required. In short, VSANs allow administrators to support more fabrics with less hardware, reducing the total cost of the network.

[FIGURE 1 OMITTED]

Fabric virtualization also simplifies SAN administration. New fabrics can be created through a simple configuration change instead of by physically adding or removing equipment, with the attendant costs and risks of disruption. With most VSAN implementations, administrators can provision virtual fabrics through a centralized Web-based interface and grow and shrink virtual fabrics dynamically, as needed. VSAN technology can even be used to streamline the introduction of new SAN services. For example, administrators can create VSANs to serve as isolated staging areas for new fabrics before fully deploying them into production.

Virtual Fabric Trunking

Fabric virtualization isn't only about breaking a common physical fabric apart. With VSAN trunking strategies, storage administrators can also consolidate previously separated physical inter-switch links (ISLs) over a single shared connection or set of connections. For example, if a data center has three traditional SAN switches supporting five VSANs, that implementation requires three ISLs for each VSAN, or 15 total links. With virtual fabric trunking, each switch can share a single connection, consolidating all five VSANs over three physical links.

However, the real savings of VSAN trunking is realized in site-to-site connections. Imagine a business wide-area network (WAN) with a primary data center and a secondary location in another city. The business uses three SANs--one to support real-time data replication for a disaster recovery system, one to support data backup to a tape library at the secondary site each evening and one to support intermittent host-to-remote-disk services. With traditional SAN architectures, the business maintains separate site-to-site connections for each service and is charged as if all three links carried traffic 24 hours a day, even though the tape backup and host-to-remote-disk connections are used only intermittently.

With VSAN trunking, the three separate site-to-site links can use a single shared connection with a single monthly fee. See Figure 1.

Each virtual fabric link still operates independently and can even support different transport services. And, just as in an IP WAN, the organization can apply quality-of-service (QoS) techniques to prioritize data traffic for each fabric and more efficiently utilize the shared resource.

Virtual Fabric Routing

The final piece of the fabric virtualization puzzle is interfabric routing, which Cisco calls inter-VSAN routing, or IVR. IVR provides limited cross-fabric connectivity, allowing storage administrators to route specified services or share designated endpoints among SANs, without merging the fabrics. Basically, IVR brings "Layer 3 switching" intelligence to the SAN realm--an essential prerequisite for SAN implementations that share common resources among multiple fabrics, user groups and locations. See figure 2.

[FIGURE 2 OMITTED]

With IVR, logically isolated VSAN fabrics can share a common, centralized tape library or disk array without exposing one fabric to potential problems in a neighboring fabric. IVR also binds together a complex array of different SAN technologies into a manageable enterprise system (for example, in an organization integrating SAN fabrics from several vendors after an acquisition). IVR services can operate independent of switch vendors, operating systems, or transport technologies. More sophisticated IVR services even include network address translation (NAT), so storage administrators can selectively link SAN islands without worrying about overlapping domain addresses in each fabric.

Securing the SAN

As organizations integrate previously isolated SAN architectures and expand storage services outside the traditional "locked-down" data center, the need for strong SAN security becomes more acute. With VLAN strategies, organizations can continue to rely on the proven security solutions they have used for years in both SAN and LAN environments.

Virtual fabrics support the same fabric, switch and ISL authentication and encryption services as physically isolated SAN fabrics. Newer SAN solutions can offer even more sophisticated security services, such as role-based access control. For example, a SAN administrator can have read-only access for an organization's online transaction processing (OLTP) VSAN, but read-write access for the data warehousing VSAN. The new SAN solutions also provide full support for RADIUS and TACACS+ authentication and authorization services, allowing administrators to easily incorporate SANs into overarching network security solutions and centralize security management for the entire network.

Making the Leap to the Modern SAN

While storage administrators have had good reasons for provisioning SANs as isolated islands, more and more businesses agree that it's time for SANs to grow up--to become more scalable, flexible, cost-effective systems.

Today, there are several methods for providing fabric virtualization and virtual fabric routing. Some strategies incorporate physical solutions (such as partitioning line cards or deploying dedicated appliances) to perform VSAN routing and trunking services. Others integrate SAN virtualization, routing and trunking capabilities within the fabric itself to provide an extremely granular, streamlined solution. Whichever approach storage administrators choose, they can expect that as businesses grow and evolve, VSAN strategies will become an essential component of any SAN architecture.

Lincoln Dale is a technical marketing engineer for the storage technology group at Cisco Systems, Inc., San Jose, CA

www.cisco.com