This read-write INTEGER selects whether the default zone on a VSAN behaves as permit(1) or deny(2); the source description for this particular object is empty, so its exact semantics should be read from the related enhanced-mode object czseGlobalDefaultZoneBehaviour and the zone table's default-zone documentation. Operationally, it governs whether devices not explicitly placed in any zone can still communicate on the VSAN. For example, an admin tightening fabric security would set this object to deny(2) so devices left out of all explicit zones cannot communicate by default.