The 128T looks at the network-interface that the traffic arrives on. There are two options on the network interface to configure tenancy. The simplest way is to configure the 'tenant' option on the network-interface with the name of a valid tenant in the configuration. In this case, all traffic coming into that network-interface will be associated with that tenant.
The second option allows you to configure one or more tenants on an ingress interface based on the source IP prefix. This is done through the use of neighborhoods and membership in the tenant configuration. For example, if you wanted to assign traffic from source range 192.168.1.0/24 to tenant1 and traffic from source range 192.168.2.0/24 to tenant2, you could configure a neighborhood on the ingress interface like 'lanNeighborhood' and then configure your tenants as follows:
tenant tenant1
name tenant1 member lanNeighborhood
neighborhood lanNeighborhood
address 192.168.1.0/24
exit
exit tenant tenant2
name tenant2 member lanNeighborhood
neighborhood lanNeighborhood
address 192.168.2.0/24
exit
exit
If you apply a tenant to the network-interface, it will take precedence over the membership and all traffic will be associated with the tenant applied to the interface. There is one exception to that rule: if your tenants are hierarchical, you can apply the parent tenant (for example 'lan') on the network-interface and still be able to assign traffic to sub-tenants (say 'marketing.lan') via the membership method shown above.