Logical unit number masking

This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages) This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Logical unit number masking" – news · newspapers · books · scholar · JSTOR (June 2025) (Learn how and when to remove this message) This article includes a list of references, related reading, or external links, but its sources remain unclear because it lacks inline citations. Please help improve this article by introducing more precise citations. (June 2025) (Learn how and when to remove this message) (Learn how and when to remove this message)

In computer storage, logical unit number masking (LUN masking) is an authorization process that makes a logical unit number (LUN) available to some hosts and unavailable to other hosts.

LUN masking is a level of security that makes a LUN available to only selected hosts and unavailable to all others. This kind of security is done on the storage area network (SAN) level and is based on the host host adapter (HBA), i.e. you can give access of specific LUN on the SAN to specific host with specific HBA.

LUN masking is mainly implemented at the HBA level. The security benefits of LUN masking implemented at HBAs are limited, since with many HBAs it is possible to forge source addresses (WWNs/MACs/IPs) and compromise the access. Many storage controllers also support LUN masking. When LUN masking is implemented at the storage controller level, the controller itself enforces the access policies to the device and as a result it is more secure. However, it is mainly implemented not as a security measure per se, but rather as a protection against misbehaving servers which may corrupt disks belonging to other servers. For example, Windows servers attached to a SAN will, under some conditions, corrupt non-Windows (Unix, Linux, NetWare) volumes on the SAN by attempting to write Windows volume labels to them. By hiding the other LUNs from the Windows server, this can be prevented, since the Windows server does not even realize the other LUNs exist.

• Persistent binding

• LUN Masking Archived 2006-05-05 at the Wayback Machine
• LUN Masking and Zoning^[usurped]