In an example embodiment, a new qualifier is added to members in a Fiber Channel zone to specify whether each member is a target or initiator and in another embodiment a time-range attribute is added to a zone in the zoneset. When the zoneset is applied the number of ACL entries that must be programmed is reduced from k×(k−1) entries to 2(k−1) entries for a zone with k members where k−1 members are of one type (e.g. initiators) and one of the members is of a different type (e.g., a tape device). The time-range attribute is enforced by zone server software and enhances security by, for example, limiting access to sensitive data to specified times. In another embodiment, an incremental zoneset activation protocol is implemented where a hash of a zoneset is created by a switch updating the zoneset and the hash and ID of the switch updating the zoneset are sent to all other switches in the fabric when the zoneset is propagated. The hash and switch ID are stored in persistent storage at all switches in the fabric. When a target zoneset is updated by a source switch only the incremental change is propagated to other switches in the fabric along with the hash and switch ID of the target zoneset. Each switch checks a received hash and switch ID against its stored hash and switch ID to assure that the stored local zoneset is the same as the target zoneset before applying the incremental change.