Understanding IPspaces

About IPspaces

An IPspace defines a distinct IP address space in which vFiler units can participate. IP addresses defined for an IPspace are meaningful only within that IPspace. A distinct routing table is maintained for each IPspace. No cross-IPspace traffic is routed.

Guidelines for vFiler unit participation in an IPspace

The following guidelines apply to vFiler unit participation in an IPspace:

An IPspace can contain multiple vFiler units, but a vFiler unit can belong only to one IPspace.
Each vFiler unit in an IPspace must have an IP address that is unique within that IPspace, but a vFiler unit in one IPspace can have the same IP address as a vFiler unit in a different IPspace.
Be careful when assigning IPspace to a vFiler unit because you cannot change the assignment without destroying the vFiler unit.
Each vFiler unit must have one IP address on the interface that leads to the default gateway of the assigned IPspace. This requirement ensures that the vFiler unit is reachable from within the IPspace.

Typical application of IPspaces

Suppose an SSP needs to connect customers of company A and company B to a storage system on its premises. The SSP creates two vFiler units on the physical storage system--one per customer--and provides a dedicated network path from one vFiler unit to company A's network and from the other vFiler unit to company B's network.

This deployment would work if both companies were using nonprivate IP address ranges; however, as shown in the following illustration, this is not the case.

Both companies use the private IP address subnet 10.0.0.0, thus causing the following problems:

The two vFiler units on the storage system at the SSP site have conflicting IP addresses if both companies decide to use the same IP address for their respective vFiler units.
If the two companies agree on using different IP addresses for their vFiler units, problems still arise: if any client in Company A's network has the same IP address as a client in Company B's network, packets destined for a client in A's address space might get routed to a client in B's address space, and vice versa.
Suppose the two companies decide to use mutually exclusive address spaces (for example, Company A uses 10.0.0.0 with a network mask of 255.128.0.0 and Company B uses 10.128.0.0 with a network mask of 255.128.0.0). The SSP needs to configure static routes on the storage system to route traffic appropriately to A's and B's networks. This solution is neither scalable (because of static routes) nor secure (broadcast traffic is sent to all interfaces of the storage system).

To alleviate these problems, two IPspaces are defined on the storage system--one per vFiler unit. Because a distinct routing table is maintained for each IPspace and no cross-IPspace traffic is routed, the data for each company is securely routed to its respective network even if the two vFiler units are configured in the 10.0.0.0 address space, as shown in the following illustration.

Additionally, the IP addresses referred to by the various configuration files, such as the /etc/hosts file, /etc/hosts.equiv file, and /etc/rc file, are relative to that IPspace. Therefore, the IPspaces allow the SSP to configure the same IP address for the configuration and authentication data for both vFiler units, without conflict.

How interfaces participate in an IPspace

If the storage system is licensed for vFiler units, all its IP-addressable interfaces, including interfaces such as vifs and VLAN, belong to the default IPspace. The default IPspace exists automatically and cannot be destroyed.

When you create a new IPspace, you assign interfaces to the new IPspace from the default IPspace. An interface can belong only to one IPspace.

Routing in an IPspace

A distinct routing table is maintained for each IPspace. All vFiler units participating in an IPspace share its routing table.

Incoming packets

All packets coming in through an interface are tagged with the IPspace identifier (ID) of the IPspace to which the interface belongs. The IP address of the interface and the IPspace ID are used to identify the vFiler unit for which the packet is intended.

Outgoing packets

All outgoing traffic uses the IPspace ID of the vFiler unit that is generating the traffic to determine the routing table to use. Data ONTAP ensures that packets generated by the vFiler units of an IPspace are transmitted through the interfaces that belong to that IPspace.

Note
Broadcast packets are restricted to the vFiler units within the destination IPspace.

Loopback interfaces in IPspaces

Each IPspace has a unique loopback interface assigned to it. The loopback traffic of each IPspace is completely isolated from the other IPspaces.