feat(san): add SAN runbooks, post-deployment tasks, and FC appendices

- Add 4 SAN deployment runbooks (AD + Local Identity, Portal + ARM Template)
  under phase-05/deployment-methods/san/
- Extend task-05-storage-configuration with SAN workload LUN configuration
  steps (rescan, initialize, CSV, Azure path registration)
- Extend task-09-post-deployment-verification with SAN storage health checks
- Add Appendix P: FC fabric zoning reference (Brocade + Cisco MDS examples)
- Add Appendix Q: FC maintenance procedures (firmware, port replacement,
  recurring schedule)
- Update appendices/index.mdx with FC/SAN section and rows P-Q

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: kristopherjturner

docs/implementation/04-cluster-deployment/phase-06-post-deployment/task-05-storage-configuration.mdx

@@ -34,6 +34,12 @@ import TabItem from '@theme/TabItem';
 
 **Status**: Active
 
+:::info Storage Topology
+This task covers **two storage topologies**:
+- **[Storage Spaces Direct (S2D)](#section-1--volume-sizing--yaml-verification)** — Sections 1–3 below
+- **[SAN Disaggregated](#san-workload-lun-configuration)** — jump to the SAN section at the bottom of this page
+:::
+
 ## Section 1 — Volume Sizing & YAML Verification
 
 :::warning This step should already be complete
@@ -985,6 +991,123 @@ The procedures in this task use the scripted methods shown in the tabs above. Ad
 | Azure CLI | PowerShell-based Azure CLI scripts for Azure resource operations |
 | Bash | Linux/macOS compatible shell scripts for pipeline environments |
 
+---
+
+## SAN Workload LUN Configuration
+
+*This section applies only to **SAN disaggregated deployments**. Skip if using Storage Spaces Direct — use Sections 1–3 above instead.*
+
+After the cluster deployment wizard completes, the infrastructure and performance history LUNs are already claimed by the cluster. This section covers adding workload LUNs as Cluster Shared Volumes.
+
+:::warning Workload LUNs only
+Do **not** initialize the infrastructure volume or performance history LUN — those were claimed by the deployment wizard. Only initialize and add LUNs designated for VM workload storage.
+:::
+
+### Step 1: Rescan and Identify Workload LUNs
+
+```powershell title="Rescan and list FC disks — run on a cluster node"
+Invoke-Command -ComputerName "<cluster-node>" -ScriptBlock {
+    Update-HostStorageCache
+    Get-Disk | Where-Object BusType -eq 'Fibre Channel' |
+        Select-Object Number, FriendlyName, Size, PartitionStyle, OperationalStatus |
+        Format-Table -AutoSize
+}
+```
+
+Identify the disk number(s) of workload LUNs with `PartitionStyle = RAW`.
+
+### Step 2: Initialize and Format Workload LUNs
+
+```powershell title="Initialize and format each workload LUN — run on a cluster node"
+# Replace <disk-number> with the number identified in Step 1
+$DiskNumber = <disk-number>
+$LabelName  = "WorkloadLUN01"   # Change per LUN
+
+Invoke-Command -ComputerName "<cluster-node>" -ArgumentList $DiskNumber, $LabelName -ScriptBlock {
+    param($disk, $label)
+    Initialize-Disk -Number $disk -PartitionStyle GPT -PassThru |
+        New-Partition -UseMaximumSize |
+        Format-Volume -FileSystem NTFS -NewFileSystemLabel $label -Confirm:$false
+}
+```
+
+### Step 3: Add Workload LUNs to Cluster and Create CSVs
+
+```powershell title="Add cluster disk and convert to CSV — run on a cluster node"
+Invoke-Command -ComputerName "<cluster-node>" -ScriptBlock {
+    # List available disks the cluster can claim
+    Get-ClusterAvailableDisk | Format-Table Name, Size
+
+    # Add each available disk as a cluster resource
+    Get-ClusterAvailableDisk | Add-ClusterDisk
+
+    # Convert each Physical Disk cluster resource to a CSV
+    Get-ClusterResource | Where-Object { $_.ResourceType -eq 'Physical Disk' } |
+        ForEach-Object { Add-ClusterSharedVolume -Name $_.Name }
+
+    # Verify CSVs are online
+    Get-ClusterSharedVolume | Select-Object Name, State,
+        @{N='Path'; E={ $_.SharedVolumeInfo.FriendlyVolumeName }}
+}
+```
+
+### Step 4: Register SAN Storage Paths in Azure
+
+After CSVs are online, register them as Azure storage paths. Follow the same procedure as [Section 3 (Storage Paths)](#section-3--storage-path-registration) above — the az CLI commands are topology-agnostic.
+
+```powershell title="Register SAN CSVs as Azure storage paths"
+$rg            = "rg-<customer>-azl-<region>-01"   # variables.yml: azure_platform.resource_groups.cluster.name
+$customLocation = "cl-<customer>"                   # variables.yml: compute.azure_local.custom_location
+
+$StoragePaths = @(
+    [PSCustomObject]@{
+        Name = "sp-<customer>-clus01-san-01"
+        Path = "C:\ClusterStorage\<csv-name>\VMs"
+    }
+)
+
+foreach ($sp in $StoragePaths) {
+    az stack-hci-vm storagepath create `
+        --resource-group $rg `
+        --custom-location $customLocation `
+        --name $sp.Name `
+        --path $sp.Path `
+        --output none
+    Write-Host "Registered: $($sp.Name)"
+}
+```
+
+### SAN Storage Validation
+
+```powershell title="Validate SAN storage state"
+Invoke-Command -ComputerName "<cluster-node>" -ScriptBlock {
+    # FC disk health
+    Get-PhysicalDisk | Where-Object BusType -eq 'Fibre Channel' |
+        Select-Object FriendlyName, HealthStatus, OperationalStatus, Size
+
+    # CSV volumes
+    Get-ClusterSharedVolume | Select-Object Name, State,
+        @{N='Path'; E={ $_.SharedVolumeInfo.FriendlyVolumeName }}
+
+    # MPIO path count
+    mpclaim -s -d
+}
+```
+
+**Expected:**
+
+| Check | Expected |
+|-------|----------|
+| FC disks `HealthStatus` | `Healthy` |
+| `Get-ClusterSharedVolume` State | `Online` for all workload volumes |
+| `mpclaim -s -d` path count | ≥2 per LUN (2 HBAs × 1 fabric minimum) |
+| Azure storage paths | `provisioningState = Succeeded` |
+
+**References:**
+- [Storage Architecture Planning](../../../planning/07-storage-planning.mdx)
+- [Microsoft Learn — Enable External Storage](https://learn.microsoft.com/en-us/azure/azure-local/deploy/enable-external-storage?view=azloc-2604)
+- [Appendix P — FC Fabric Configuration](../../appendices/appendix-p-fc-fabric.mdx)
+
 ## Navigation
 
 | Previous | Up | Next |

docs/implementation/04-cluster-deployment/phase-06-post-deployment/task-09-post-deployment-verification.mdx

@@ -70,8 +70,10 @@ Verify that all Phase 06 tasks completed successfully. This task must pass befor
 | 03 | Operator AD group in `Remote Management Users` on all nodes | Present |
 | 04 | `sshd` service running on all nodes | `Running` |
 | 04 | Port 22 reachable on all nodes | `TcpTestSucceeded : True` |
-| 05 | Storage pool health | `Healthy` |
+| 05 | Storage pool health (S2D) | `Healthy` |
 | 05 | CSV volumes mounted and online | Count matches design |
+| 05 | FC LUN health (SAN only) | `Healthy` for all FC disks |
+| 05 | MPIO path count (SAN only) | ≥2 paths per LUN |
 | 06 | VM images in Azure | Provisioning state `Succeeded` |
 | 07 | Logical networks in Azure | Provisioning state `Succeeded` |
 
@@ -121,9 +123,18 @@ Expected: `TcpTestSucceeded : True` for all nodes.
 
 #### Task 05 — Storage
 
+**S2D deployments:**
+
 1. In WAC → `iic-clus01` → **Storage** → **Volumes** — confirm all CSV volumes are **Healthy** and **Online**
 2. In Azure Portal → **Azure Local** → `iic-clus01` → **Storage paths** — confirm all show **Succeeded**
 
+**SAN deployments:**
+
+1. Verify FC disk health: `Get-PhysicalDisk | Where-Object BusType -eq 'Fibre Channel'` — all `HealthStatus = Healthy`
+2. Verify MPIO paths: `mpclaim -s -d` — ≥2 paths per workload LUN
+3. Confirm CSVs are `Online`: `Get-ClusterSharedVolume`
+4. In Azure Portal — confirm Azure storage paths show `Succeeded`
+
 #### Task 06 — VM Images
 
 In Azure Portal → **Azure Local** → `iic-clus01` → **VM images** — confirm all required images

docs/implementation/appendices/appendix-p-fc-fabric.mdx

@@ -0,0 +1,204 @@
+---
+title: "Appendix P — Fibre Channel Fabric Configuration"
+sidebar_label: "Appendix P: FC Fabric"
+sidebar_position: 16
+description: "Fibre Channel fabric configuration reference — Brocade and Cisco MDS zoning, alias creation, zoneset activation"
+category: "Reference"
+scope: "Fibre Channel fabric configuration for SAN disaggregated Azure Local deployments"
+purpose: "Reference for FC fabric zoning, aliases, and port channels for SAN deployments"
+author: "Azure Local Cloud"
+created: 2026-05-02
+updated: 2026-05-02
+version: "1.0.0"
+tags:
+  - azure-local
+  - fibre-channel
+  - san
+  - zoning
+  - brocade
+  - cisco-mds
+keywords:
+  - Fibre Channel
+  - FC zoning
+  - Brocade
+  - Cisco MDS
+  - WWPN
+  - alias
+  - zoneset
+status: "Active"
+---
+
+# Appendix P — Fibre Channel Fabric Configuration
+
+[![Reference](https://img.shields.io/badge/Type-Reference-green?style=flat-square)](./index.mdx)
+[![Azure](https://img.shields.io/badge/Platform-Azure_Local-0078D4?style=flat-square&logo=microsoftazure)](https://learn.microsoft.com/en-us/azure/azure-local/)
+
+> **DOCUMENT CATEGORY**: Reference
+> **SCOPE**: Fibre Channel fabric configuration
+> **PURPOSE**: Reference for FC fabric zoning, aliases, and port channels for SAN deployments
+> **MASTER REFERENCE**: [Microsoft Learn — Enable External Storage](https://learn.microsoft.com/en-us/azure/azure-local/deploy/enable-external-storage?view=azloc-2604)
+
+**Status**: Active
+
+This appendix covers FC fabric configuration for SAN disaggregated Azure Local deployments — alias creation, zone definition, zoneset activation, and post-zoning validation. Both Brocade FOS and Cisco MDS NX-OS examples are provided.
+
+---
+
+## Zoning Policy — Single-Initiator/Single-Target
+
+The Azure Local Cloud standard for FC zoning is **single-initiator/single-target**: each zone contains exactly one HBA port WWPN (initiator) and one SAN array port WWPN (target). This is the pattern recommended by Microsoft and eliminates the multi-initiator contention issues that arise when initiators share a zone.
+
+**Zone count formula:** For an N-node cluster with 2 HBAs per node and 2 independent fabrics, expect **2N zones per fabric**.
+
+| Cluster size | HBAs/node | Fabrics | Zones per fabric | Total zones |
+|---|---|---|---|---|
+| 2-node | 2 | 2 | 4 | 8 |
+| 4-node | 2 | 2 | 8 | 16 |
+| 8-node | 2 | 2 | 16 | 32 |
+
+:::tip Why single-initiator/single-target?
+When multiple initiators share a zone, a LUN reset or RSCN storm from one initiator disrupts all others in the zone. Single-initiator/single-target zones contain blast radius to one host port, which is critical for Azure Local storage resiliency.
+:::
+
+---
+
+## Naming Conventions
+
+Consistent naming makes zones auditable at a glance and simplifies troubleshooting. Apply these patterns across both fabrics.
+
+| Element | Pattern | Example |
+|---|---|---|
+| WWPN alias | `<site>-AZL-<nodeNN>-HBA<P>` | `NYC01-AZL-N01-HBA1` |
+| FC zone | `Z_<initiator>_<target>` | `Z_NYC01-AZL-N01-HBA1_ARRAY-CT0FC0` |
+| Zoneset | `<fabric>_PROD_active` | `FAB-A_PROD_active` |
+
+- `<site>` — a short 3–6 character site code (matches your naming standard, e.g. `NYC01`, `DAL02`)
+- `<nodeNN>` — zero-padded node number: `N01`, `N02`, etc.
+- `<HBA<P>` — HBA port number, 1-indexed: `HBA1`, `HBA2`
+- `<target>` — the array controller and port label as reported by the array vendor
+
+---
+
+## Brocade Fabric — Example Configuration
+
+The following commands target **Fabric A** of a 2-node cluster connecting to a dual-controller SAN array. Collect HBA WWPNs from Windows before beginning (see [Phase 03 Task 12](#cross-references)).
+
+```bash
+# Connect to Brocade switch
+ssh admin@brocade-fab-a.corp.azurelocal.cloud
+
+# Create aliases for HBA WWPNs (collected from Windows: Get-InitiatorPort)
+alicreate "NYC01-AZL-N01-HBA1", "10:00:00:90:fa:11:22:01"
+alicreate "NYC01-AZL-N01-HBA2", "10:00:00:90:fa:11:22:02"
+alicreate "NYC01-AZL-N02-HBA1", "10:00:00:90:fa:11:23:01"
+alicreate "NYC01-AZL-N02-HBA2", "10:00:00:90:fa:11:23:02"
+
+# Create aliases for SAN array target ports
+alicreate "ARRAY-CT0FC0", "52:4a:93:00:11:11:11:01"
+alicreate "ARRAY-CT1FC0", "52:4a:93:00:11:11:11:02"
+
+# Create single-initiator/single-target zones
+zonecreate "Z_NYC01-AZL-N01-HBA1_ARRAY-CT0FC0", "NYC01-AZL-N01-HBA1; ARRAY-CT0FC0"
+zonecreate "Z_NYC01-AZL-N01-HBA2_ARRAY-CT0FC0", "NYC01-AZL-N01-HBA2; ARRAY-CT0FC0"
+zonecreate "Z_NYC01-AZL-N02-HBA1_ARRAY-CT0FC0", "NYC01-AZL-N02-HBA1; ARRAY-CT0FC0"
+zonecreate "Z_NYC01-AZL-N02-HBA2_ARRAY-CT0FC0", "NYC01-AZL-N02-HBA2; ARRAY-CT0FC0"
+
+# Add zones to zoneset
+cfgcreate "FAB-A_PROD_active", "Z_NYC01-AZL-N01-HBA1_ARRAY-CT0FC0; Z_NYC01-AZL-N01-HBA2_ARRAY-CT0FC0; Z_NYC01-AZL-N02-HBA1_ARRAY-CT0FC0; Z_NYC01-AZL-N02-HBA2_ARRAY-CT0FC0"
+
+# Save and enable
+cfgsave
+cfgenable "FAB-A_PROD_active"
+```
+
+Repeat the same sequence on **Fabric B**, substituting the second-fabric port WWPNs for both the HBA aliases and the array target aliases, and naming the zoneset `FAB-B_PROD_active`.
+
+:::note Existing zonesets
+If a zoneset already exists on the switch, use `cfgadd` to add new members rather than `cfgcreate`. Verify with `cfgshow` before enabling.
+:::
+
+---
+
+## Cisco MDS Fabric — Example Configuration
+
+The following NX-OS commands configure **Fabric A** on a single VSAN. Adjust the VSAN ID to match your environment.
+
+```
+# Connect to MDS
+ssh admin@mds-fab-a.corp.azurelocal.cloud
+configure terminal
+
+# Create FC aliases (per VSAN)
+fcalias name NYC01-AZL-N01-HBA1 vsan 100
+  member pwwn 10:00:00:90:fa:11:22:01
+exit
+fcalias name ARRAY-CT0FC0 vsan 100
+  member pwwn 52:4a:93:00:11:11:11:01
+exit
+
+# Create zone
+zone name Z_NYC01-AZL-N01-HBA1_ARRAY-CT0FC0 vsan 100
+  member fcalias NYC01-AZL-N01-HBA1
+  member fcalias ARRAY-CT0FC0
+exit
+
+# Add to zoneset and activate
+zoneset name FAB-A_PROD_active vsan 100
+  member Z_NYC01-AZL-N01-HBA1_ARRAY-CT0FC0
+exit
+zoneset activate name FAB-A_PROD_active vsan 100
+copy running-config startup-config
+```
+
+Add additional `fcalias`, `zone`, and `zoneset member` blocks for each remaining initiator/target pair before activating the zoneset. Activate once, after all zones are added — each activation causes a fabric RSCN.
+
+:::warning Activate after all zones are defined
+On Cisco MDS, each `zoneset activate` triggers an RSCN across the VSAN. Define all zones for the fabric before activating to avoid multiple disruptions during initial configuration.
+:::
+
+---
+
+## Validation After Zoning
+
+Run the following on each cluster node after zoneset activation to confirm LUN visibility and MPIO path count.
+
+```powershell
+# Run on each cluster node
+Get-PhysicalDisk | Where-Object BusType -eq 'Fibre Channel' |
+    Select-Object FriendlyName, SerialNumber, OperationalStatus, Size
+mpclaim -s -d
+```
+
+**Expected results:**
+
+- Each LUN appears once per node with `OperationalStatus = OK`
+- Each LUN shows 2 or more MPIO paths (one per fabric)
+- `mpclaim -s -d` lists the LUN with paths in an `Active/Optimized` or `Active/Unoptimized` state per the array's preferred path policy
+
+If a LUN does not appear, verify: (1) the zone is active on both fabrics, (2) the correct WWPN was aliased — use `Get-InitiatorPort` on the node to re-confirm, (3) the LUN has been mapped to the host in the array management interface.
+
+---
+
+## References
+
+- [Microsoft Learn — Enable External Storage](https://learn.microsoft.com/en-us/azure/azure-local/deploy/enable-external-storage?view=azloc-2604)
+- [Microsoft Learn — FC pattern without backup](https://learn.microsoft.com/en-us/azure/azure-local/plan/fiber-channel-no-backup-disaggregated-pattern?view=azloc-2604)
+- [Microsoft Learn — FC pattern with backup](https://learn.microsoft.com/en-us/azure/azure-local/plan/fiber-channel-with-backup-disaggregated-pattern?view=azloc-2604)
+- [Appendix Q — FC Fabric Maintenance](./appendix-q-fc-maintenance.mdx)
+- [Appendix I — Dell Configuration](./appendix-i-dell-config.mdx)
+
+---
+
+## Cross-References {#cross-references}
+
+| Phase | Task | Link |
+|---|---|---|
+| Phase 03 | Task 12 — Install FC HBA Drivers | [task-12-install-fc-hba-drivers-conditional.mdx](../04-cluster-deployment/phase-03-os-configuration/task-12-install-fc-hba-drivers-conditional.mdx) |
+| Phase 03 | Task 13 — Configure MPIO & MSDSM | [task-13-configure-mpio-and-vendor-msdsm-conditional.mdx](../04-cluster-deployment/phase-03-os-configuration/task-13-configure-mpio-and-vendor-msdsm-conditional.mdx) |
+| Phase 03 | Task 14 — Verify LUN Presentation | [task-14-verify-san-lun-presentation-conditional.mdx](../04-cluster-deployment/phase-03-os-configuration/task-14-verify-san-lun-presentation-conditional.mdx) |
+| Phase 05 | SAN/AD Portal | [portal-instructions.mdx](../04-cluster-deployment/phase-05-cluster-deployment/deployment-methods/san/active-directory/portal-instructions.mdx) |
+| Phase 05 | SAN/AD ARM | [arm-template-instructions.mdx](../04-cluster-deployment/phase-05-cluster-deployment/deployment-methods/san/active-directory/arm-template-instructions.mdx) |
+| Phase 05 | SAN/LI Portal | [portal-instructions.mdx](../04-cluster-deployment/phase-05-cluster-deployment/deployment-methods/san/local-identity/portal-instructions.mdx) |
+| Phase 05 | SAN/LI ARM | [arm-template-instructions.mdx](../04-cluster-deployment/phase-05-cluster-deployment/deployment-methods/san/local-identity/arm-template-instructions.mdx) |
+| Phase 06 | Task 05 — Storage Configuration | [task-05-storage-configuration.mdx](../04-cluster-deployment/phase-06-post-deployment/task-05-storage-configuration.mdx) |
+| Planning | Storage Architecture Planning | [07-storage-planning.mdx](../../planning/07-storage-planning.mdx) |