diff --git a/include/spdk/nvmf.h b/include/spdk/nvmf.h
index 32eda8967..4cf3bd5f9 100644
--- a/include/spdk/nvmf.h
+++ b/include/spdk/nvmf.h
@@ -167,9 +167,12 @@ struct spdk_nvmf_subsystem *spdk_nvmf_create_subsystem(const char *nqn,
 void spdk_nvmf_delete_subsystem(struct spdk_nvmf_subsystem *subsystem);
 
 struct spdk_nvmf_subsystem *
-nvmf_find_subsystem(const char *subnqn, const char *hostnqn);
+nvmf_find_subsystem(const char *subnqn);
+
 bool spdk_nvmf_subsystem_exists(const char *subnqn);
 
+bool spdk_nvmf_subsystem_host_allowed(struct spdk_nvmf_subsystem *subsystem, const char *hostnqn);
+
 int
 spdk_nvmf_subsystem_add_listener(struct spdk_nvmf_subsystem *subsystem,
 				 char *trname, char *traddr, char *trsvcid);
diff --git a/lib/nvmf/request.c b/lib/nvmf/request.c
index 2c8ba4f83..e352948d1 100644
--- a/lib/nvmf/request.c
+++ b/lib/nvmf/request.c
@@ -215,14 +215,21 @@ nvmf_process_connect(struct spdk_nvmf_request *req)
 		INVALID_CONNECT_DATA(hostnqn);
 		return SPDK_NVMF_REQUEST_EXEC_STATUS_COMPLETE;
 	}
-	/* Look up the requested subsystem */
-	subsystem = nvmf_find_subsystem(data->subnqn, data->hostnqn);
+
+	subsystem = nvmf_find_subsystem(data->subnqn);
 	if (subsystem == NULL) {
 		SPDK_ERRLOG("Could not find subsystem '%s'\n", data->subnqn);
 		INVALID_CONNECT_DATA(subnqn);
 		return SPDK_NVMF_REQUEST_EXEC_STATUS_COMPLETE;
 	}
 
+	if (!spdk_nvmf_subsystem_host_allowed(subsystem, data->hostnqn)) {
+		SPDK_ERRLOG("Subsystem '%s' does not allow host '%s'\n", data->subnqn, data->hostnqn);
+		rsp->status.sct = SPDK_NVME_SCT_COMMAND_SPECIFIC;
+		rsp->status.sc = SPDK_NVMF_FABRIC_SC_INVALID_HOST;
+		return SPDK_NVMF_REQUEST_EXEC_STATUS_COMPLETE;
+	}
+
 	subsystem->connect_cb(subsystem->cb_ctx, req);
 
 	return SPDK_NVMF_REQUEST_EXEC_STATUS_ASYNCHRONOUS;
diff --git a/lib/nvmf/session.c b/lib/nvmf/session.c
index f147e35ac..e97b106b2 100644
--- a/lib/nvmf/session.c
+++ b/lib/nvmf/session.c
@@ -217,7 +217,7 @@ spdk_nvmf_session_connect(struct spdk_nvmf_conn *conn,
 	SPDK_TRACELOG(SPDK_TRACE_NVMF, "  subnqn: \"%s\"\n", data->subnqn);
 	SPDK_TRACELOG(SPDK_TRACE_NVMF, "  hostnqn: \"%s\"\n", data->hostnqn);
 
-	subsystem = nvmf_find_subsystem(data->subnqn, data->hostnqn);
+	subsystem = nvmf_find_subsystem(data->subnqn);
 	if (subsystem == NULL) {
 		SPDK_ERRLOG("Could not find subsystem '%s'\n", data->subnqn);
 		INVALID_CONNECT_DATA(subnqn);
diff --git a/lib/nvmf/subsystem.c b/lib/nvmf/subsystem.c
index 41ea4930a..e80b17e03 100644
--- a/lib/nvmf/subsystem.c
+++ b/lib/nvmf/subsystem.c
@@ -66,33 +66,46 @@ spdk_nvmf_subsystem_exists(const char *subnqn)
 }
 
 struct spdk_nvmf_subsystem *
-nvmf_find_subsystem(const char *subnqn, const char *hostnqn)
+nvmf_find_subsystem(const char *subnqn)
 {
 	struct spdk_nvmf_subsystem	*subsystem;
-	struct spdk_nvmf_host		*host;
 
-	if (!subnqn || !hostnqn) {
+	if (!subnqn) {
 		return NULL;
 	}
 
 	TAILQ_FOREACH(subsystem, &g_subsystems, entries) {
 		if (strcmp(subnqn, subsystem->subnqn) == 0) {
-			if (subsystem->num_hosts == 0) {
-				/* No hosts means any host can connect */
-				return subsystem;
-			}
-
-			TAILQ_FOREACH(host, &subsystem->hosts, link) {
-				if (strcmp(hostnqn, host->nqn) == 0) {
-					return subsystem;
-				}
-			}
+			return subsystem;
 		}
 	}
 
 	return NULL;
 }
 
+bool
+spdk_nvmf_subsystem_host_allowed(struct spdk_nvmf_subsystem *subsystem, const char *hostnqn)
+{
+	struct spdk_nvmf_host *host;
+
+	if (!hostnqn) {
+		return false;
+	}
+
+	if (subsystem->num_hosts == 0) {
+		/* No hosts means any host can connect */
+		return true;
+	}
+
+	TAILQ_FOREACH(host, &subsystem->hosts, link) {
+		if (strcmp(hostnqn, host->nqn) == 0) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
 void
 spdk_nvmf_subsystem_poll(struct spdk_nvmf_subsystem *subsystem)
 {
diff --git a/test/lib/nvmf/request/request_ut.c b/test/lib/nvmf/request/request_ut.c
index 5be9b4b1c..de898ce9b 100644
--- a/test/lib/nvmf/request/request_ut.c
+++ b/test/lib/nvmf/request/request_ut.c
@@ -124,11 +124,17 @@ spdk_format_discovery_log(struct spdk_nvmf_discovery_log_page *disc_log, uint32_
 }
 
 struct spdk_nvmf_subsystem *
-nvmf_find_subsystem(const char *subnqn, const char *hostnqn)
+nvmf_find_subsystem(const char *subnqn)
 {
 	return NULL;
 }
 
+bool
+spdk_nvmf_subsystem_host_allowed(struct spdk_nvmf_subsystem *subsystem, const char *hostnqn)
+{
+	return false;
+}
+
 static void
 test_nvmf_process_discovery_cmd(void)
 {
diff --git a/test/lib/nvmf/session/session_ut.c b/test/lib/nvmf/session/session_ut.c
index 956b5a441..4224dc2e7 100644
--- a/test/lib/nvmf/session/session_ut.c
+++ b/test/lib/nvmf/session/session_ut.c
@@ -45,7 +45,7 @@ SPDK_LOG_REGISTER_TRACE_FLAG("nvmf", SPDK_TRACE_NVMF)
 struct spdk_nvmf_globals g_nvmf_tgt;
 
 struct spdk_nvmf_subsystem *
-nvmf_find_subsystem(const char *subnqn, const char *hostnqn)
+nvmf_find_subsystem(const char *subnqn)
 {
 	return NULL;
 }
diff --git a/test/lib/nvmf/subsystem/subsystem_ut.c b/test/lib/nvmf/subsystem/subsystem_ut.c
index e7af5d7d7..1aebc5b02 100644
--- a/test/lib/nvmf/subsystem/subsystem_ut.c
+++ b/test/lib/nvmf/subsystem/subsystem_ut.c
@@ -126,10 +126,8 @@ nvmf_test_create_subsystem(void)
 static void
 nvmf_test_find_subsystem(void)
 {
-	CU_ASSERT_PTR_NULL(nvmf_find_subsystem(NULL, NULL));
-	CU_ASSERT_PTR_NULL(nvmf_find_subsystem("fake", NULL));
-	CU_ASSERT_PTR_NULL(nvmf_find_subsystem(NULL, "fake"));
-	CU_ASSERT_PTR_NULL(nvmf_find_subsystem("fake", "fake"));
+	CU_ASSERT_PTR_NULL(nvmf_find_subsystem(NULL));
+	CU_ASSERT_PTR_NULL(nvmf_find_subsystem("fake"));
 }
 
 int main(int argc, char **argv)