Cisco MDS and Storage Switching — the specialised technology that keeps a data centre's storage network from collapsing under its own weight. For the 350-601 exam, you need to understand not just that these switches exist, but how to configure their unique features and why they behave differently from the Ethernet switches you might already know.
Jump to a section
A simple way to picture Cisco MDS and Storage Switching
Meet Priya, the shipping dock manager at a massive online retailer's warehouse. Her job is to ensure that every single package leaving the building arrives at exactly the right truck, without any mix-ups, delays, or lost boxes. She doesn't care what's inside the boxes—she only cares that they get to the correct truck at the precise moment that truck is ready to leave. If a package goes to the wrong truck, a customer gets the wrong order. If a truck leaves without a package, a customer gets nothing. If two packages from two different packing stations try to get onto the same truck at the same time, everything jams up. Priya uses a detailed loading schedule and a team of loaders who each specialise in different truck bays. The loaders wear colour-coded vests so she can see at a glance which bay they're servicing. They don't touch the packages until she gives the all-clear. She also has a strict rule: no package can leave the dock unless she has confirmed that the truck's driver has signed for it. This system, while invisible to the customer, guarantees that billions of pounds of merchandise move smoothly every day. The Cisco MDS switch does for a data centre's storage traffic exactly what Priya does for her warehouse: it guarantees that each chunk of data reaches the correct storage device, in the correct order, without loss or corruption, even when thousands of servers are demanding access at the same instant.
A Cisco MDS switch is a Fibre Channel (FC) switch designed specifically to connect servers to storage arrays in a SAN (Storage Area Network). Unlike a regular Ethernet switch that moves general data packets, an MDS switch deals exclusively with block-level storage traffic. Block-level storage means the raw chunks of data that form a hard drive or SSD—not whole files like a Word document, but the individual 512-byte or 4KB blocks that make up that document.
To understand why the MDS exists, you have to remember the old way: Direct Attached Storage (DAS). In a DAS setup, each server has its own internal hard drives or directly plugged-in storage shelves. If Server A runs out of space, you cannot borrow space from Server B without physically moving drives. It is wasteful and inflexible. A SAN solves this by putting all the storage on a dedicated network, separate from the regular Local Area Network (LAN). Any server can access any storage device over this fabric, as long as the fabric is properly configured.
The Fibre Channel protocol was designed from the ground up for storage. Unlike TCP/IP, which includes extensive error checking and retransmission, Fibre Channel assumes the physical link is near-perfect and optimises for speed and low latency. It uses a credit-based flow control system called Buffer-to-Buffer Credits (BB_Credits). Each port on an MDS switch has a pool of credits. Before a sending device can transmit a frame, it must have a credit from the receiving port. If the receiver is busy, it withholds credits, which forces the sender to wait. This prevents overwhelming the receiver and eliminates packet drops—something that would cause a storage operation to fail and potentially corrupt data.
Cisco MDS switches run NX-OS, which is the same operating system used on Cisco Nexus switches, but with additional storage-specific features. On the 350-601 exam, you will see questions about VSANs (Virtual SANs) which partition a single physical fabric into multiple isolated logical fabrics. This is like having several separate shipping docks inside one warehouse, each with its own rules and destinations. You also need to understand zones. A zone is a subset of devices within a VSAN that are allowed to communicate with each other. Zones prevent servers from seeing storage they shouldn't access. They function like access control lists but are enforced at the Fibre Channel level.
Another critical concept is the Fibre Channel ID (FCID). Every device connected to the fabric gets a unique 24-bit address assigned dynamically when it logs in. The MDS switch manages this login process and maintains a table mapping FCIDs to World Wide Names (WWNs), which are the globally unique identifiers burned into each Fibre Channel interface, much like a MAC address on Ethernet.
MDS switches also support FCoE (Fibre Channel over Ethernet), which encapsulates Fibre Channel frames inside Ethernet frames so they can travel over a converged network. This requires special data centre Ethernet features like priority flow control and enhanced transmission selection to ensure storage traffic is not dropped. The exam tests your ability to configure FCoE and understand its dependencies.
Finally, you must understand port types. MDS switches have different port modes:
E_Port (Expansion Port): connects one MDS switch to another to form the fabric.
F_Port (Fabric Port): connects to a server (initiator) or storage device (target).
NP_Port (Proxy Port): used in NPV (N_Port Virtualisation) mode, where a downstream switch connects upstream to a director-class switch.
TE_Port (Trunking Expansion Port): carries multiple VSANs over a single physical link.
These port types determine how traffic flows and directly influence the topology you design. A switch operating in NPV mode does not participate in fabric services; it simply passes traffic to an upstream core switch. This is common in edge-access topologies to reduce the number of domain IDs in use.
The exam expects you to know the configuration commands for VSANs, zones, and port types. You will need to interpret show outputs to diagnose why a zone is not working or why a port is stuck in a non-operational state.
Physical cabling and port identification
Connect the server HBAs and storage array controllers to the MDS switch ports using appropriate fibre optic cables. Identify each port's interface name (e.g., fc1/1) and verify link status with show interface brief. This step is the foundation; a bad cable simulates a configuration error.
Initial switch configuration and VSAN creation
Configure the management IP, hostname, and enable required features like zone and vsan. Create VSANs using the command vsan database and vsan create. Assign ports to VSANs. This logically separates different traffic types, such as production and backup.
Create zones and add members using WWPNs
Enter zone configuration mode and use zone create <name> vsan <number> to define a zone. Add members via zone member pwwn <wwpn>. Only devices whose WWPNs are listed in a zone can communicate. Use show zone to verify members.
Create a zoneset and activate it
Group your zones into a zoneset using zoneset create <name> vsan <number>. Then activate the zoneset with zoneset activate name <name> vsan <number>. Only active zonesets enforce traffic flow. Use show zoneset active vsan <number> to confirm.
Verification and troubleshooting
Run show fcns database to confirm all devices have logged in with FCIDs. Check interface states—look for 'up' on F_Ports and E_Ports. If a zone is not working, verify that the correct zoneset is active and that the device WWPNs match exactly. Use debug zone or enhanced logging for complex issues.
Consider a medium-sized financial services company that runs a customer-facing trading application. The application is supported by a cluster of 16 application servers and two enterprise-grade all-flash storage arrays. The current setup uses direct-attached storage on each server, but the storage team is exhausted. One array has 5TB free while the other is 95% full, and rebalancing requires physically moving disks. They decide to deploy a SAN using two Cisco MDS 9148S switches.
The first step for the IT professional is physical installation. They rack the MDS switches, power them on, and connect the management ports to the out-of-band management network. Then they cable each server's Fibre Channel host bus adapter (HBA) to one of the MDS switches. The HBAs have two ports each, so each server connects to both switches for redundancy. Similarly, the storage arrays each have two Fibre Channel controllers, and each controller cable connects to both MDS switches. This creates a fully redundant fabric: if one switch fails, every server can still reach every storage controller through the other switch.
Next, the IT pro logs into the console and runs the initial configuration. They assign IP addresses to the management interfaces and enable the switches with a license. Then they create two VSANs:
VSAN 10 for production traffic
VSAN 20 for backup traffic
This separation ensures that a massive backup job does not interfere with transaction latency. On each VSAN, they then create zones. For example, in VSAN 10, they create a zone called "prod_web_tier" that includes the WWPNs (World Wide Port Names) of the application servers and the production LUNs on the storage arrays. They create another zone called "prod_db_tier" for database servers and their dedicated LUNs. Servers in the web tier zone cannot see the database LUNs, and vice versa.
After zoning, they configure the port types. The ports connected to servers are set as F_Ports. The ports connecting the two MDS switches together are set as E_Ports. They enable trunking on the inter-switch links so that both VSANs can traverse the same cable.
Now comes the validation step. The IT pro uses the command show fcns database to verify that all devices are logged into the fabric and have received FCIDs. They run show zone to confirm the zones contain the correct members. They then test communication by having an application server issue a SCSI command to read a block from the storage array. If it succeeds, the SAN is functional.
A few weeks into production, a user reports that the database server cannot see its storage. The IT pro checks the port status. The port shows "errDisable" because a link-flap detected by the switch exceeded the error threshold. They clear the error with the command errdisable recovery cause all and re-enable the port. Then they inspect the fiber optic cable and find a damaged connector. They replace the cable, and the port comes up normally.
This scenario shows the day-to-day tasks: cabling, VSAN creation, zoning, port configuration, validation using show commands, and troubleshooting link issues. The IT pro relies heavily on understanding the concepts of WWPN, FCID, VSAN, and zone to resolve problems efficiently.
The 350-601 exam tests your knowledge of Cisco MDS switches under the broader category of Data Center Storage Networking. Expect multiple-choice questions, drag-and-drop ordering, and scenario-based questions where you must choose the correct configuration command sequence.
One heavily tested topic is VSANs. The exam will ask you to identify the maximum number of VSANs supported per switch (typically 256, with VSAN 1 being the default). A common trap is to confuse VSANs with VLANs. VSANs operate at the Fibre Channel layer and isolate traffic at the fabric level; VLANs operate on Ethernet and isolate broadcast domains. The exam may present a scenario where a customer wants to separate production from backup traffic and ask which feature to use. The correct answer is VSANs, not VLANs.
Another frequent area is zoning. You must know the difference between soft zoning and hard zoning:
Soft zoning: uses the name server to hide devices from each other. A device cannot see another device's entry in the name server, but it could still attempt to send frames. Soft zoning relies on the initiator's behaviour.
Hard zoning: enforced at the frame level by the switch's ASIC. Any frame from a source outside the zone is dropped immediately. Hard zoning is more secure.
The exam will ask you to identify which type provides true security. The answer is hard zoning. A trap question may describe soft zoning as "secure enough" but the correct exam answer always points to hard zoning.
Port channels on MDS are also tested. A port channel bundles multiple physical Fibre Channel links into one logical link for increased bandwidth and redundancy. You need to know that port channels are configured on MDS similarly to EtherChannels on Nexus, but with Fibre Channel-specific parameters. The exam may ask for the correct load-balancing method (source/destination FCID or source/destination WWN).
FCoE (Fibre Channel over Ethernet) appears on the exam. Key points to memorise:
FCoE requires a lossless Ethernet network. This is achieved using IEEE 802.1Qbb (Priority Flow Control, PFC) which pauses all traffic on a specific priority class when congestion occurs.
FCoE uses the same device identifiers as native Fibre Channel: WWNs and FCIDs.
The encapsulation adds an FCoE header between the Ethernet header and the Fibre Channel frame.
FCoE does not use IP, so it cannot be routed across traditional IP networks.
The exam loves to ask about compatibility. For instance, can you connect a Fibre Channel device directly to an FCoE-enabled port? No, because the device sends native Fibre Channel frames, not encapsulated frames. You need an FCoE forwarder (FCF) to bridge the two.
NPV (N_Port Virtualization) mode is another favourite. NPV mode allows an edge switch to connect to a core switch without consuming a domain ID. The exam will test which command enables NPV mode (feature npv) and what happens to the switch's domain ID when enabled (it becomes 0).
Troubleshooting questions often revolve around the show interface command output. You must recognise the meaning of different port states: up, down, errDisable, isolated, and looping. An isolated state typically means the switch has lost its connection to the principal switch in the fabric. A looping state means the same switch is receiving its own frames, indicating a topology issue.
Finally, memorise these specific commands:
zone create name <name> vsan <number>
zone member pwwn <wwpn>
zoneset activate name <name> vsan <number>
show zoneset active vsan <number>
show fcns database
feature npv
interface fc1/1 ; switchport mode F
Cisco MDS switches are purpose-built for Fibre Channel SANs and run a specialised version of NX-OS with storage-specific features like VSANs and zones.
A VSAN partitions a single physical fabric into multiple isolated logical fabrics, each with its own name server and zone database.
Zoning restricts which devices in a VSAN can communicate, with hard zoning being the only form that provides true security by dropping unauthorised frames at the hardware level.
Fibre Channel uses credit-based flow control (Buffer-to-Buffer Credits) to prevent frame drops, unlike TCP/IP which relies on retransmission.
NPV mode allows an edge switch to connect to a core switch without consuming a domain ID, reducing the total domain count in the fabric.
FCoE encapsulates Fibre Channel frames into Ethernet frames but requires a lossless Ethernet network enabled by Priority Flow Control (802.1Qbb).
These come up on the exam all the time. Here's how to tell them apart.
VSAN
Isolates Fibre Channel fabric services (name server, zone database, principal switch)
Defined at the Fibre Channel layer (FC-2)
Devices in different VSANs cannot communicate at all without inter-VSAN routing (IVR)
VLAN
Isolates Ethernet broadcast domains at Layer 2
Defined at the IEEE 802.1Q layer
Devices in different VLANs can communicate with a router (inter-VLAN routing)
Hard Zoning
Traffic filtering enforced by the switch ASIC at the frame level
Provides true security because unauthorised frames are dropped before reaching the target
Recommended for any environment requiring data isolation or compliance
Soft Zoning
Traffic filtering enforced via the fabric name server, not at the frame level
Does not prevent an initiator from sending frames to a target not in its zone if it knows the FCID
Considered insecure; mostly used for administration convenience in lab environments
E_Port
Used to connect one Fibre Channel switch to another switch
Carries fabric service information like principal switch election and domain ID distribution
Can be configured as TE_Port to carry multiple VSANs over a single link
F_Port
Used to connect end devices like servers and storage arrays to the switch
Does not propagate fabric service messages; devices just log in to get FCIDs
Cannot be configured for trunking; one F_Port only serves devices in a single VSAN
Fibre Channel (FC)
Native protocol with its own frame format and physical layer (FC-0 through FC-4)
Requires dedicated Fibre Channel ports on switches and HBAs
Uses credit-based flow control to guarantee lossless delivery
Fibre Channel over Ethernet (FCoE)
Encapsulates Fibre Channel frames inside Ethernet frames (no IP involved)
Runs over standard Ethernet ports but requires lossless Ethernet features (PFC, ETS)
Allows convergence of LAN and SAN traffic onto a single physical network
Mistake
Fibre Channel is just another name for fiber optic Ethernet.
Correct
Fibre Channel is a completely different protocol stack (FC-0 through FC-4) optimised for block storage, with its own addressing, flow control, and frame format. It runs on fiber optic cables but also supports copper twinax cables. Ethernet and TCP/IP are not involved.
Both use fiber optic cables and are switch-based, so beginners assume they are similar. The difference in the protocol layers is invisible until you look at the frame headers.
Mistake
A VSAN is the same as a VLAN, just for storage.
Correct
VSANs isolate Fibre Channel fabric services at Layer 2 of the Fibre Channel model, while VLANs isolate Ethernet broadcast domains. A VSAN has its own name server, zone database, and principal switch election. VLANs do not have the same concept of a principal switch or fabric services.
The word 'virtual' and the concept of isolation are identical, so people map VLAN to VSAN. The operational difference in fabric services is not obvious without deeper study.
Mistake
Zoning and VSANs achieve the same security result, so you only need one of them.
Correct
VSANs provide isolation at the fabric level (different VSANs cannot communicate at all), while zones restrict communication within a single VSAN. You use both: VSAN to separate different environments (e.g., prod vs dev), and zones to restrict which specific devices in a VSAN can talk to each other.
Both restrict communication, so it feels like duplication. The scope (fabric-wide vs intra-VSAN) is subtle but critical for exam scenarios.
Mistake
The show zoneset active command shows all configured zones in the switch.
Correct
It shows only the currently active zoneset for a given VSAN, which is the set of zones that are enforced. You can have multiple zonesets configured, but only one can be active per VSAN at a time.
The word 'active' is overlooked. Beginners think it means 'all zones that are configured and turned on,' but 'active' in this context refers to the zoneset that is currently applied, not the state of individual zones.
Mistake
NPV mode makes the switch smarter because it handles its own fabric services.
Correct
NPV mode makes the switch dumber. It stops participating in fabric services (like principal switch election) and simply forwards traffic to an upstream core switch. This reduces the number of domain IDs consumed and simplifies management.
The word 'virtualisation' sounds advanced, so beginners assume it adds intelligence. In fact, it offloads intelligence to the core.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
WWN (World Wide Name) is the general term for a globally unique identifier used in Fibre Channel. A WWPN (World Wide Port Name) is the WWN assigned to a specific port on a device. A single HBA might have two ports, each with its own WWPN, but the device may also have a WWNN (World Wide Node Name) for the whole card.
No, Fibre Channel interfaces do not use IP addresses. They use FCIDs (24-bit addresses) assigned dynamically during fabric login. Management interfaces (mgmt0) do have IP addresses so you can SSH or SNMP to the switch, but the data ports are pure FC.
Use the commands: configure terminal ; feature npv ; interface fc1/1 ; switchport mode NP. Then reload the switch. After reload, the switch no longer participates as a full fabric switch and requires an upstream core switch to provide fabric services.
The zone configuration might be correct, but the zoneset may not be activated, or the storage LUNs may not be masked/provisioned on the storage array side. Also check that both devices are in the same VSAN and that the port VSAN assignment matches.
No, not for native Fibre Channel. A Nexus switch can handle FCoE with the correct line cards and licenses, but it does not have native Fibre Channel ports. An MDS switch has dedicated Fibre Channel interfaces and runs the full Fibre Channel protocol stack natively.
An isolated state means the switch has successfully negotiated a link with the neighbour, but the port cannot participate in the fabric because it has lost connection to the principal switch (the switch elected as the master of the fabric). This often happens due to a VSAN mismatch, domain ID conflict, or a flapping inter-switch link.
You've finished Cisco MDS and Storage Switching. Continue through the 350-601 study guide to build a complete picture of the exam.
Done with this chapter?