Access Control Logix (ACLX) gatekeeper mapping is required for initial device masking configuration on the VMAX via the Administration host and also required for the Control Station when using a NAS VG Gateway with the VMAX.
The Symmetrix configuration recommendation is to assign only the ACLX (Access Control Logix) gatekeeper volume to the Administration Host or Control Station.

In this example the ACLX volume is already mapped as LUN ff to the Director FA ports: 2g1,3g1 which are zoned to the Administration Host.
We need to MAP the ACLX Volume(003C) to the FA Ports 1f1,2f1,3f1,4f1 which will be used for the NAS Control Station. The ACLX device must be at LUN address 00E when mapping to the Control Station.

Mapping ACLX (volume 003C) Via UNISPHERE:

Firstly we navigate to the ACLX Volume 003C, choosing the MAP option and then proceed to select FA Ports 1f1,2f1,3f1,4f1

Configure ACLX as target and LUN 0E – this must be done for each FA Port


Next we choose the option to ‘Set Volume Status’ and configure as Write Disable


ACLX is now mapped to both our Administration Host and Control Station as Lun 0FF and 00E respectfully:

You can review the task of Mapping the LUN to the FA Ports by navigating to System->Job List:

Mapping ACLX (volume 003C) Via SYMCLI:
You can also use symcli to Map the ACLX volume as follows

symdev -sid 1151 list -aclx -v provides the symdev number and other detailed information for the ACLX volume

Map the ACLX volume to the specified director and port, with the specified FA LUN number:
symconfigure -sid xxx -cmd “map dev 003C to dir 1f:1 lun=00E;” commit
symconfigure -sid xxx -cmd “map dev 003C to dir 2f:1 lun=00E;” commit
symconfigure -sid xxx -cmd “map dev 003C to dir 3f:1 lun=00E;” commit
symconfigure -sid xxx -cmd “map dev 003C to dir 4f:1 lun=00E;” commit
symdev -sid xxx write_disable 003C -FA ALL

List all details for dev 003C including FA and DA mappings as well as disk group used:
symdev -sid xxx list -dev 003C -v

List the details for each FA port and ensure the ACLX is mapped to each:
symcfg -sid xxx -dir 1f -p 1 list -addr -avail
symcfg -sid xxx -dir 2f -p 1 list -addr -avail
symcfg -sid xxx -dir 3f -p 1 list -addr -avail
symcfg -sid xxx -dir 4f -p 1 list -addr -avail

List Connections via ACLX:

If you require to UNMAP the ACLX Volume from FA ports 1F1-4F1:
symconfigure -sid xxx -cmd “unmap dev 003C from dir 1f:1;” commit
symconfigure -sid xxx -cmd “unmap dev 003C from dir 2f:1;” commit
symconfigure -sid xxx -cmd “unmap dev 003C from dir 3f:1;” commit
symconfigure -sid xxx -cmd “unmap dev 003C from dir 4f:1;” commit

Unmap dev from all Directors:
symconfigure -sid xxx -cmd “unmap dev 003C from dir ALL:ALL;” commit


  1. Hi Dave, thanks for explaining about ACLX.

    On my VMAX, ACLX device is mapped to all FA ports and hence any new Solaris or Windows host connected to it is seeing a small device of ~3MB. VMWare hosts are not seeing it. All the online reading I did doesn’t say if it’s ok to unmap it and will the hosts behave well by doing so. Would you know?

  2. Thanks for the update.
    Looks like this has been changed from VMAX 3. This article says,

    VMAX3 Series:

    Note that the way the ACLX is configured to be seen in VMAX3 with HYPERMAX OS 5977 is different to previous VMAX arrays.

    You cannot map nor unmap the ACLX device.

    The ACLX attribute is enabled on the FA port as per normal which provides ACCESS LOGIX down that port, but there is also a new FA port attribute which is SHOW_ACLX_DEVICE which can be enabled using a Solutions Enabler command (see below), or in the bin file on the VMAX3 Management Module Control Station (MMCS). Refer to article 196671 VMAX3: Bin files created with HYPERMAX OS 5977.497.471 and 5977.498.472 do not have the SHOW ACLX flag enabled on any of the FA ports in the DirEdit section of the bin file for more information.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s