Understanding IPspaces

About IPspaces

An IPspace defines a distinct IP address space in which vfilers can participate. IP addresses defined for an IPspace are meaningful only within that IPspace. A distinct routing table is maintained for each IPspace. No cross-IPspace traffic is routed.

Guidelines for vfiler participation in an IPspace

The following guidelines apply to vfiler participation in an IPspace:

An IPspace can contain multiple vfilers; however, a vfiler can belong only to one IPspace.
All vfilers in an IPspace must have unique IP addresses; however, multiple vfilers can have the same IP address if they are in distinct IPspaces.

Typical application of IPspaces

Suppose an SSP needs to connect customers of company A and company B to a filer on its premises. The SSP creates two vfilers on the physical filer--one per customer--and provides a dedicated network path from one vfiler to A's network and from the other vfiler to B's network.

This deployment would work if both companies were using nonprivate IP address ranges; however, as shown in the following illustration, this is not the case.

Both companies use the private IP address subnet 10.0.0.0, thus causing the following problems:

The two vfilers on the filer at the SSP site have conflicting IP addresses if both companies decide to use the same IP address for their respective vfilers.
If the two companies agree on using different IP addresses for their vfilers, problems still arise: If any client in Company A's network has the same IP address as a client in Company B's network, packets destined for a client in A's address space might get routed to a client in B's address space, and vice versa.
Suppose the two companies decide to use mutually exclusive address spaces. (For example, Company A uses 10.0.0.0 with a network mask of 255.127.0.0 and Company B uses 10.128.0.0 with a network mask of 255.127.0.0.) The SSP needs to configure static routes on the filer to appropriately route traffic to A's and B's networks. This solution is neither scalable (because of static routes) nor secure (broadcast traffic is sent to all interfaces of the filer).

To alleviate these problems, two IPspaces are defined on the filer--one per vfiler. Because a distinct routing table is maintained for each IPspace and no cross-IPspace traffic is routed, the data for each company is securely routed to its respective network even if the two vfilers are configured in the 10.0.0.0 address space, as shown in the following illustration.

Additionally, the IP addresses referred to by the various configuration files, such as the /etc/hosts file, /etc/hosts.equiv file, and /etc/rc file, are relative to that IPspace. Therefore, the IPspaces allow the SSP to configure the same IP address for the configuration and authentication data for both vfilers, without conflict.

How interfaces participate in an IPspace

If the filer is licensed for vfilers, all its IP-addressable interfaces, including interfaces such as vifs and VLAN, belong to the default IPspace. The default IPspace exists automatically and cannot be destroyed.

When you create a new IPspace, you assign interfaces to the new IPspace from the default IPspace. An interface can belong only to one IPspace.

Routing in an IPspace

A distinct routing table is maintained for each IPspace. All vfilers participating in an IPspace share its routing table.

Incoming packets

All packets coming in through an interface are tagged with the IPspace identifier (ID) of the IPspace to which the interface belongs. The IP address of the interface and the IPspace ID are used to identify the vfiler for which the packet is intended.

Outgoing packets

All outgoing traffic uses the IPspace ID of the vfiler that is generating the traffic to determine the routing table to use. Data ONTAP ensures that packets generated by the vfilers of an IPspace are transmitted through the interfaces that belong to that IPspace.

Note
Broadcast packets are restricted to the vfilers within the destination IPspace.