SAN Fabric Login Rejected: 3 Quick Fixes That Actually Work

1. Zoning Mismatch (Most Common)

Nine times out of ten, when you see 'SAN Fabric Login Rejected' on a Brocade or Cisco switch, it's because the device trying to log in doesn't match the zone configuration. I had a client last month where their new server just wouldn't talk to the storage array. The error popped up every 30 seconds. Turned out someone set up a zone with the wrong WWN — a typo in the last four hex digits. Took me 10 minutes to find.

What happens: The switch checks the initiator's World Wide Name (WWN) against the zone database. If it doesn't find a match, it rejects the login. Simple as that.

How to fix it:

1. Log into the switch (SSH or console, doesn't matter).
2. Run zone --show -a (Brocade) or show zone (Cisco) to see all zones.
3. Find the zone that should include your device. Check the WWN against what's on the HBA or storage port.
4. If it's wrong, delete the zone and recreate it with the correct WWN. On Brocade: zonecreate "myzone", "10:00:00:00:c9:12:34:56; 50:06:0e:80:12:34:56:78".
5. Save and enable the zone config: cfgsave then cfgenable.

Pro tip: Use 'hard zoning' (WWN-based) instead of 'soft zoning' (port-based). Hard zoning sticks even if cables get moved. Soft zoning breaks when someone swaps a patch cable — and I've seen that happen more times than I can count.

2. Port Security or LUN Masking Conflict

Sometimes the switch itself isn't the problem. The storage array or HBA has its own security that blocks the login after the fabric accepts it. This shows up as 'login rejected' on the switch because the device goes offline after a failed LUN negotiation.

Real example: A hospital IT guy called me because their backup server couldn't see the SAN. The switch showed the server logged in fine. But every 15 minutes, the login dropped and reconnected. I checked the HBA config — someone had set 'port down timeout' to 30 seconds, but the storage array expected 60. Simple mismatch, big headache.

How to fix it:

• Check the HBA BIOS (usually QLogic or Emulex). Make sure 'Port Down Timeout' matches the storage array's setting. Common values: 30, 60, or 120 seconds.
• On the storage array, verify LUN masking. The initiator WWN must be in the correct host group. If not, add it.
• Use the switch's portloginshow command to see if the device logs in then goes offline. That pattern points to LUN masking, not zoning.

3. Hardware or Cable Issue (Rare But Real)

When zoning and security are fine but the error persists, it's almost always a bad SFP, damaged cable, or even a port that's stuck in 'no sync' mode. I saw this on a Dell PowerConnect SAN switch last year. Every port on the same ASIC failed logins. Solution? RMA the switch.

How to test:

1. Run sfpshow all (Brocade) to check SFP status. Look for 'Faulty' or 'Failed'. Replace any bad SFP.
2. Swap the cable with a known good one. Use optical power meters if you have one — but honestly, just swapping is faster in a pinch.
3. If it's a single port, disable and re-enable the port: portdisable then portenable .
4. Check for link stability: portstatshow . High CRC errors mean bad optics or cabling.

One more thing: If you've tried all this and still see the error, check the fabric OS version. Had a customer running FOS 7.1 that just hated a certain HBAs. Update to 7.2 fixed it. Sometimes firmware bugs cause login rejections that aren't real — the switch just doesn't like the device driver.

Quick-Reference Summary Table

Start with zoning — that's where you'll find the fix 9 times out of 10. If not, move to security settings. Hardware issues are last. And if nothing works, check for firmware bugs. You're welcome.