Hi everyone, I ran into something this past week that I wanted to share here so others don't have the same struggles I do.
Historically (and this goes WAAAAY back), there was one way to assign tenancy to inbound packets: adding a tenant to a network-interface. In newer software (circa 3.1), we gave administrators the ability to assign tenancy by neighborhood. By configuring a
member in a tenant, you can identify CIDR blocks within a neighborhood that are associated with that tenant. However, there was a strict order of precedence in these tenant configurations: if you assigned a tenant to an interface, it would treat anything arriving on that interface as belonging to the tenant -- no questions asked. Under the hood, 128T creates a source prefix of 0.0.0.0/0 for that interface within its "source tenant table." Configuring tenant members would not apply.
In 4.0, however, there was a behavior change. If you configure both interface tenancy
and members within that tenant, 128T will only add prefixes to the source tenant table for the prefix(es) you specify. All packets that arrive on the interface that are not from one of the specified prefixes will be dropped. (This is what bit me this past week, in case you were wondering.)
Interestingly, if you add a tenant to an interface, 128T will add prefixes for that tenant
and all of the children of that tenant for the prefixes defined in those tenants' members. This is a great addition to our software, as it lets you really lock down the interface to specific prefixes, and deny everything else.
The "source tenant table" governs all of this. To investigate the contents of the source tenant table, use the PCLI command "show tenant members". Here's a configuration example that may help illustrate some of these concepts:
tenant parent
name parent
exit
tenant child1.parent
name child1.parent
member LAN
neighborhood LAN
address 192.168.128.0/25
exit
exit
tenant child2.parent
name child2.parent
member LAN
neighborhood LAN
address 192.168.128.128/25
exit
exit
network-interface lan0
name lan0
global-id 1
description "LAN VLAN 0"
vlan 0
neighborhood LAN
name LAN
topology spoke
exit
tenant parent
inter-router-security internal
address 192.168.128.1
ip-address 192.168.128.1
prefix-length 24
exit
exitAnd here's the output of "show tenant members" for this configuration:
admin@hari.fox# show tenant members
Sat 2019-04-20 15:59:01 UTC
Node: hari
============ ========= ============== ================= ==================== ===============
Device I/F VLAN ID Network I/F Network I/F IP Source IP Prefix Tenant
============ ========= ============== ================= ==================== ===============
enp2s0 0 lan0 192.168.128.1 0.0.0.0/0 parent
enp2s0 0 lan0 192.168.128.1 192.168.128.0/25 child1.parent
enp2s0 0 lan0 192.168.128.1 192.168.128.128/25 child2.parent
kni254 0 controlKniIf 169.254.127.126 0.0.0.0/0 <global>
------------------------------
pt.
------------------------------