Reactive hard zoning in storage environments

Abstract

Presented herein are systems and methods for reactive hard zoning. In one or more embodiments, a monitoring and visibility services (MVS) controller receives zoning information from a centralized discovery controller and also receives data traffic flow information from traffic samplers that continuously monitor network traffic flows (e.g., using SFLOW) in the network. Responsive to the MVS detecting a violating data traffic flow (i.e., zoning configuration does not allow a host to access a storage port), an enforcement engine of the MVS may cause one or more actions to be taken relative to the detected violation. An action may comprise adding a networking configuration (e.g., ACL or disable (a.k.a., fence) the interface on the switch that the host is attached to) to deny that communication, flagging the communication, etc. The network configuration may be reset to a default policy either automatically (e.g., timeout) or manually via administrative configuration.