Storage

Block, file and object: when each fits

How each access model behaves and which workloads it suits. Transports for block are in Storage networking. Object as a backup target, and object lock, are on Backup. Source for the object model: SNIA. Sources checked 5 Oct 2026.

Unified platforms. Many arrays now serve block, file and S3 from one system. That reduces the number of platforms to run, but the file and object features of a block-first array (or the reverse) are often narrower than a dedicated platform’s. Compare the features you need, not the protocol list.

Access model design / build / manage

Design

• Map each workload to block, file or object by access pattern and sharing need, not by what the current array happens to serve
• Decide which S3 features (versioning, object lock, lifecycle) the object store must support, and confirm them with the vendor

Build

• Create host groups, exports and buckets from a documented naming and ownership scheme
• Test multi-protocol permissions on shares served over both NFS and SMB

Manage

• Review capacity and growth per access model; object and file usually grow faster than block

Platform categories

Categories, not products. OEM portfolios increasingly span several categories under one brand, so classify each offer by its architecture. Products are in Market leaders. HCI is on HCI; parallel file systems for AI training are on AI Factory. Category descriptions are editorial. Sources checked 5 Oct 2026.

Rebuild traffic. On a dual-controller array, a drive rebuild happens behind the controllers and does not cross the host-facing network. On scale-out NAS, object stores and SDS, data is protected across nodes, so a node or drive loss puts rebuild and rebalance traffic on the network between nodes. Size that network for it.

Media. TLC flash for performance tiers, QLC flash for dense capacity flash, and HDD for bulk capacity. Vendors differ in how they handle QLC write endurance, so ask how the platform manages it.

Platform design / build / manage

Design

• Classify every shortlisted offer by category before comparing prices or features
• For scale-out and SDS, design the node-to-node network with the storage team, not after it

Build

• Run the vendor’s pre-install checks and record firmware and software versions as the baseline

Manage

• Track controller or node utilisation against the headroom you planned, and plan the upgrade before it runs out

Data services

The services that decide usable capacity, recovery points and data protection on the primary platform. Immutable copies, backup and DR runbooks are on Backup; key custody is on Security: Key management and admin access policy on Security: Identity. Sources: Dell PowerStore Gen 2 spec sheet, NIST FIPS 140-3, OASIS KMIP. Sources checked 5 Oct 2026.

Snapshots and clones

Whether a platform implements snapshots as redirect-on-write or copy-on-write is a vendor detail. The buyer questions are the snapshot count per volume and per system, the schedule and retention limits, the performance cost with many snapshots, and how quickly a clone can be presented to another host. A snapshot lives on the same system as its source, so it is not a backup. Immutable snapshots and the recovery vault are on Backup.

Array replication

Take distance and latency limits for synchronous and metro modes from the vendor’s documentation for the exact release; this page gives no number. Replication bandwidth from RPO is on Backup: Replication bandwidth and DR runbooks on Backup: Runbooks; the inter-site link is on Network: DCI.

Data reduction and usable capacity

OEM “effective” capacity is usable capacity multiplied by an assumed reduction ratio. Dell’s PowerStore Gen 2 sheet, for example, quotes effective capacity at an assumed 5:1 average and says actual results vary (Dell spec sheet). Vendor data-reduction guarantees exist but carry conditions; read them before you count on them. A sizing method that does not depend on the ratio:

1. Start from usable capacity after RAID or erasure coding and spares.
2. Add the growth the plan assumes over the platform’s life.
3. Add the snapshot reserve.
4. Apply data reduction last, at 1:1 or at a ratio measured with the vendor’s sizing tool on your own data, and treat anything above that as headroom.

Encryption and keys

Data at rest is encrypted by self-encrypting drives (SEDs) or by the controller. Ask for FIPS 140-3 validation; NIST published FIPS 140-3 on 22 Mar 2019 to supersede 140-2, and it defines four security levels (NIST). Keys are held on the array or in an external key manager reached over OASIS KMIP (OASIS KMIP). An external KMS must be reachable at boot and must survive a site loss, which makes it a DR dependency. In-flight encryption is per transport: TLS for NVMe/TCP, IPsec or MACsec for IP storage generally, and FC-specific encryption on FC (Protocols). Key custody and admin access are on Security; KMS recovery in a DR is on Backup.

Tiering

Tiering moves cold data from performance media to cheaper media, inside the array (TLC to QLC or HDD) or out to an object tier, on premises or in a cloud. Check the recall latency from the lower tier, whether the policy is per volume or per block, and, for cloud tiers, egress terms. A tiered copy is not a backup.

Data services design / build / manage

Design

• Size usable capacity with the four-step method above; do not buy on effective capacity
• Pick the replication mode per application from its RPO, and get distance limits from the vendor
• Decide where keys live and how the KMS is recovered in a DR

Build

• Set snapshot schedules and retention per application class
• Enable encryption before data is loaded; record the key manager configuration
• Test replication failover and failback for one application end to end

Manage

• Compare the measured reduction ratio with the sizing assumption every quarter
• Test snapshot restores and clone workflows on a schedule
• Review tiering policy and recall behaviour as workloads change

Storage networking

The network decisions for block storage: which transport, how hosts reach both paths, how access is controlled, and whether storage gets its own switches or shares the DC fabric. Shared definitions are not restated here. Oversubscription, ECMP and Clos design are on Network: Fabric design; MTU is on Network: MTU; VLAN/VNI and VRF are on Network: VNI/VRF design; lossless Ethernet mechanics are on Network: Lossless Ethernet; optics are on Network: Optics and the fiber plant on Racks. Host NICs and HBAs are on Compute: Server networking, HCI cluster traffic is on HCI: Cluster networking, and storage networks inside an AI cluster are on AI Factory. Sources: INCITS Fibre Channel TC chair (SNIA SDC 2024 and 2025), FCIA, NVM Express, IETF RFC 7143, SNIA ESF, VMware vSphere 8 documentation, IEEE 802.1Q-2022. FC generations, NVMe specifications and switch products change yearly. Sources checked 5–6 Oct 2026.

Protocol comparison

Arrays commonly offer several of these on the same front-end modules. Dell’s PowerStore Gen 2 sheet, for example, lists iSCSI, FC, NVMe/FC and NVMe/TCP (Dell spec sheet). The transport is therefore usually constrained by host OS, hypervisor and HBA/NIC support and by the skills you have, not by the array. Check the array’s and the hypervisor’s support matrices for the exact releases you run. The NVMe specifications are revised roughly yearly.

FC SAN: dual fabrics, zoning and NVMe/FC access

Two fabrics. Build fabric A and fabric B as physically separate SANs with no inter-switch links between them. Each host has at least one HBA port on each, each array controller has ports on each, and host multipathing (MPIO) spreads I/O and fails over between them. The INCITS FC chair’s material frames resiliency around this SAN A / SAN B model (SNIA SDC 2025).

Zoning. An FCIA panel (Broadcom, Cisco, HPE and Marvell speakers) describes three zone styles. Single-initiator zones (one host port plus its target ports) keep fabric state-change notifications (RSCNs) targeted, but the zone count grows with hosts and can hit the switch’s zone database limits. Peer zones make the array target port the principal and the hosts members; members reach the principal but not each other, giving single-initiator isolation with far fewer zones. Target-driven peer zones are peer zones created by the array itself. The panel calls switch-port-based zoning very restrictive, not supported by some array features, and not recommended (FCIA, Dec 2021). Zone on WWPN with aliases, and keep zones for tape separate from zones for disk.

Masking and NQNs. Zoning controls which ports can see each other; the array still maps volumes to host groups. For NVMe/FC the host NQN must also be allowed on the NVM subsystem. WWPN zoning and NQN access are set separately, and I/O fails if either is wrong. FC-GS-9 and FC-NVMe-3 add a name-server object so the fabric can see NQNs (SNIA SDC 2024).

Fabric notifications (FPIN). Marginal optics and cables, and congestion from lost credits, credit stalls or oversubscription, cause intermittent path problems that MPIO alone handles poorly. Fabric Performance Impact Notifications are extended link services that tell registered hosts a path is impaired, and congestion signals are link-level primitives; an FPIN-aware MPIO driver stops using the impaired path until it recovers. The standards (FC-LS-5, FC-FS-6, FC-SW-8) were complete in June 2024 (SNIA SDC 2024, SDC 2025).

Encryption in flight. FC-SP-3 updates FC security with CNSA 1 and 2 algorithms, removes MD5 and SHA-1, and adds an automatic in-flight encryption profile; the FC chair estimated completion in 2025 (SNIA SDC 2025). Check which switches and HBAs implement it.

FC speed generations

Source: the INCITS Fibre Channel TC chair’s roadmap table (SNIA SDC 2025); future dates are the committee’s estimates. Each speed is backward compatible with at least two earlier speeds. 128GFC requires FEC on every link and keeps LC connectors and the SFP+ form factor, with 100 m multimode (OM4/OM5) and 10 km single-mode variants (SDC 2024). 256GFC (project FC-PI-9) targets the same connector and form factor and backward compatibility with 128GFC and 64GFC. Vendors market 64GFC as Gen 7 and 128GFC as Gen 8. Optics reach and budgets are on Network: Optics.

IP SAN: iSCSI and NVMe/TCP

Both run over TCP on ordinary Ethernet and IP, so neither needs PFC or other lossless configuration, and both can be routed. NVMe/TCP maps NVMe queues and capsules directly onto TCP (NVM Express), where iSCSI carries SCSI commands. For a new IP SAN where hosts and array both support NVMe/TCP, it is the usual choice; iSCSI remains the broadest-supported option for older hosts and boot. The NVMe Boot Specification (rev 1.4, ratified 31 Jul 2026) defines how pre-OS firmware passes NVMe/TCP settings to the OS for boot from SAN (NVM Express).

Segmentation. Keep the storage data path unrouted, or inside one storage VRF, so it never crosses a stateful inter-zone firewall, perimeter or internal. Storage management interfaces are a separate, policed zone. If shared storage serves several zones, the storage VRF is a shared-services VRF, and each route leak into it is recorded as L3/L4-only in the inter-zone matrix (Network: Service insertion, Security: Policy model). CHAP, NQN authorization and TLS are not a substitute for that separation. VRF and VNI mechanics are on Network: VNI/VRF design.

MTU. IP storage is commonly run with jumbo frames end to end. Dell’s PowerStore guidance for NVMe/TCP gives 9000 on endpoints and 9216 on switches. The fabric MTU and VXLAN overhead are on Network: MTU. Set the same endpoint MTU on hosts and array ports, and test it with don’t-fragment pings on both paths before cutover.

Multipathing, not bonding

Storage ports use host multipathing over independent paths, not LACP or MLAG bonds. For IP storage, put the A path and the B path in separate subnets or VLANs, one host port on each, with array ports on both. Dell’s PowerStore guidance says switch ports facing Linux NVMe/TCP host ports should not be bonded and native multipathing should be used instead, and recommends at least two paths from each host to each array node; NetApp recommends two separate subnets for iSCSI multipathing (TR-3441).

This is a deliberate exception to general host dual-homing on the fabric (Network: Multihoming), not a contradiction. A host can bond its VM and management ports while keeping its storage ports unbonded and pinned one per path. On a converged fabric, map path A to one leaf of the pair and path B to the other; the two paths still share the spine and the change domain, which is the main argument for dedicated switches. If the leaf pair runs MLAG or vPC, those single-attached A and B ports are orphan ports, and what happens to them when the peer link fails depends on the NOS and its settings; check that a peer-link failure cannot take down both paths at once. Host NIC layout is on Compute: Server networking.

NVMe/TCP discovery and zoning

An NVMe-oF host learns which subsystems it can reach by connecting to a discovery controller. The original specifications left the first step implementation-specific, typically a per-host list of discovery addresses, which does not scale (SNIA ESF). Two technical proposals fix that, and both are ratified (NVM Express at SNIA SDC 2022):

• TP 8009: hosts find discovery controllers automatically over mDNS/DNS-SD.
• TP 8010: a Centralized Discovery Controller (CDC) that hosts and subsystems register with, plus a zoning model on the CDC (zone groups that say which hosts may reach which subsystems), modelled on FC fabric services.

CDC zoning is the IP-SAN equivalent of FC zoning; the array’s NQN-to-namespace mapping remains the second gate, as LUN masking is on FC. mDNS uses the link-local multicast addresses 224.0.0.251 and ff02::fb (RFC 6762), so automated discovery reaches only discovery controllers on the host’s own subnet. With A and B in separate subnets, discovery is per subnet anyway. On a routed fabric, give hosts the CDC address explicitly, put a CDC presence on each storage subnet, or use a vendor mDNS gateway or reflector.

NVMe/RoCE and lossless Ethernet

VMware’s vSphere 8 requirements for NVMe over RDMA (RoCE v2) include Ethernet switches that support a lossless network and RoCE v2-capable NICs, and say the lossless configuration is needed at both layer 2 and layer 3; flow control is by global pause or by Priority-based Flow Control (PFC) from DCB (vSphere 8 storage). PFC is defined in IEEE 802.1Q (Network: Lossless Ethernet).

NVMe/RoCE is normally deployed on lossless Ethernet. Some RDMA NICs offer modes intended to run without switch PFC; use one only if the array vendor supports it for storage. Do not use IEEE 802.3x global pause on shared ports: it pauses all traffic on the link, not just storage. With PFC, what that means for the fabric: one no-drop priority for storage RDMA on every hop between host and array, a consistent DSCP/CoS-to-queue mapping and buffer configuration on every switch, ECN marking set to act before PFC pauses, and a PFC watchdog. The PFC, ECN and DCQCN mechanics are on Network: Lossless Ethernet. Choose RoCE for storage only when the array, hypervisor or OS and NICs are validated for it and the team will run DCB. Prefer dedicated switches, or at least a separately configured class, over enabling PFC across a shared enterprise fabric for storage alone; otherwise NVMe/TCP is the IP default. RDMA for HCI cluster traffic is on HCI.

Dedicated vs converged

SNIA’s Ethernet Storage Forum describes four physical layouts for NVMe IP SANs: dedicated, air-gapped dual SAN switches (the FC model on Ethernet); LAN and SAN converged on the same switches; dedicated dual SAN fabrics at larger scale; and dedicated back-end switches (SNIA ESF). Native FC always runs on its own switches.

Oversubscription on storage paths. Target 1:1 wherever storage traffic crosses the spine; otherwise keep initiators and targets local to a leaf pair. VMware’s vSAN guidance says striving for 1:1 in a spine-leaf network gives the most consistent performance (VMware vSAN, May 2025), and the Arista/Pure NVMe-oF deployment paper builds on non-blocking leaf-spine designs without giving a ratio (Arista/Pure NVMe-oF). Treat storage as its own leaf role when you set ratios. The ratio formula and ECMP are on Network: Fabric design.

Rule of thumb. Converged NVMe/TCP or iSCSI on the DC fabric, with separate storage VLANs/VRF and A/B paths, suits most new builds without an FC estate. Keep or build a dual FC SAN where FC skills, HBAs and arrays are already in place or where a strict separate fault domain is required. Dedicated Ethernet storage switches make sense for RoCE, or when the storage team needs its own change window.

SAN switch vendors

FC switching comes from two vendors: Broadcom (Brocade) and Cisco (MDS). Server and storage OEMs resell or OEM their switches. No current public market-share figure is cited here; recent analyst data is paywalled. Ethernet switches for IP SAN are the DC switching vendors on Network: Switching leaders.

Storage networking design / build / manage

Design

• Pick the transport from the host OS, hypervisor, HBA/NIC and array support matrices for the releases you will run
• Decide dedicated vs converged before the fabric is built, and give storage its own leaf role and oversubscription target (Fabric design)
• Design two independent paths: FC fabrics A and B, or A/B subnets pinned to separate leaves
• Choose RoCE only with a written lossless plan (PFC priority, ECN, watchdog) and validated endpoints
• Set naming for WWPN aliases, NQNs, zones and host groups before the first host is connected

Build

• Zone on WWPN with single-initiator or peer zones; authorize host NQNs on the array; register hosts and subsystems with the CDC where used
• Keep storage ports unbonded; confirm the expected path count on every host
• Test end-to-end MTU with don’t-fragment pings on both paths
• Pull path A, then path B, under load, and confirm I/O continues
• Load HBA, NIC, driver and firmware versions from the interoperability matrices and record them

Manage

• Alert on any host with fewer than its expected paths
• Use FPIN with MPIO where supported; watch FC link errors, credit-stall and congestion counters
• For RoCE, track PFC pause time, ECN marks and drops on the storage class
• Remove stale zones, aliases and NQN entries when hosts are retired
• Re-check the interoperability matrices before every HBA, NIC, switch or array upgrade