Appendix A

Building secure networks on a storage system

The challenge

The various networking and vFiler unit capabilities available on the NetApp storage system can be used together to create a scalable, secure, and shared network without using a large number of physical network adapters. However, understanding how this network can be created can be challenging. This section uses an example to describe how to use vifs, VLANs, vFiler units, and IPspaces together to create such a network.

The need

Application Service Provider (ASP) A wants to build a highly available network architecture that can provide 32 separate, isolated customer networks using four dual port network adapters (e1a, e1b, e2a, e2b, e3a, e3c, e4a, e4b) on a storage system, StorageSystem1.

The answer

To achieve the above network configuration without additional physical infrastructure, the following need to be created:

1 single and 2 multimode vifs
32 VLANs
32 vFiler units, each binding to an IP address (from the sequence 10.10.1.1, 10.10.2.1, and so on), associated with a qtree in vol0 (/vol/vol0/cust1, vol/vol0/cust2, and so on)
32 IPspaces

To implement the above network configuration, perform the following steps.

Note
You must add the vif and VLAN commands to the /etc/rc file in order to make them persistent across reboots.

Step	Action
1	Enter the following commands to create two multimode vifs consisting of four ports each: vif create multi active1 e1a e2a e3a e4a vif create multi passive1 e1b e2b e3b e4b Note Make sure you also create multimode trunks on the switches to support the vifs.
2	Enter the following command to create a second-level vif consisting of the vifs you created in the previous step: vif create single failoverpair active1 passive1
3	Enter the following commands to create VLAN interfaces on the second-level vif called failoverpair: vlan create failoverpair customer1vlan vlan add failoverpair customer2vlan vlan add failoverpair customer3vlan Repeat the `vlan add` command until you have 32 VLAN interfaces.
4	Enter the following commands to create IPspaces--one per customer--and to assign them to the VLAN interfaces you created previously: ipspace create customer1ipspace customer1vlan ipspace create customer2ipspace customer2vlan Repeat the `ipspace create` command until you have created 32 IPspaces.
5	Enter the following commands to create vFiler units: `vfiler create cust1vfiler -s customer1ipspace -i 10.10.1.1 /vol/vol0/cust1` `vfiler create cust2vfiler -s customer2ipspace -i 10.10.2.1 /vol/vol0/cust2` Repeat the `vfiler create` command until you have created 32 vFiler units.