An apparatus for forwarding a Fiber Channel over Ethernet, FCoE data frame into an Ethernet network, the apparatus comprising: a processor configured to: receive a data frame on an input port, wherein the data frame comprises a source address and a virtual local area network identifier, VID; associate the input port with an input port identifier, ID, that identifies the input port; obtain a first destination address and the VID; determine whether the first destination address and the VID matches an entry within a forwarding table; the apparatus being characterized in that the processor is further configured to: construct a key when the first destination address and VID matches the entry and the data frame is a FCoE frame, wherein the key comprises the source address, the VID, the input port ID, and a Zone ID that indicates a corresponding zone of where the data frame originated from; and forward the data frame as an outgoing data frame via an output port when the key matches a rule that permits forwarding the data frame. a processor configured to: receive a data frame on an input port, wherein the data frame comprises a source address and a virtual local area network identifier, VID; associate the input port with an input port identifier, ID, that identifies the input port; obtain a first destination address and the VID; determine whether the first destination address and the VID matches an entry within a forwarding table; the apparatus being characterized in that the processor is further configured to: construct a key when the first destination address and VID matches the entry and the data frame is a FCoE frame, wherein the key comprises the source address, the VID, the input port ID, and a Zone ID that indicates a corresponding zone of where the data frame originated from; and forward the data frame as an outgoing data frame via an output port when the key matches a rule that permits forwarding the data frame. receive a data frame on an input port, wherein the data frame comprises a source address and a virtual local area network identifier, VID; associate the input port with an input port identifier, ID, that identifies the input port; obtain a first destination address and the VID; determine whether the first destination address and the VID matches an entry within a forwarding table; the apparatus being characterized in that the processor is further configured to: construct a key when the first destination address and VID matches the entry and the data frame is a FCoE frame, wherein the key comprises the source address, the VID, the input port ID, and a Zone ID that indicates a corresponding zone of where the data frame originated from; and forward the data frame as an outgoing data frame via an output port when the key matches a rule that permits forwarding the data frame. construct a key when the first destination address and VID matches the entry and the data frame is a FCoE frame, wherein the key comprises the source address, the VID, the input port ID, and a Zone ID that indicates a corresponding zone of where the data frame originated from; and forward the data frame as an outgoing data frame via an output port when the key matches a rule that permits forwarding the data frame.