Multi-Tenant Topology

Multi-Tenant Topology is the deployment in which multiple environments run in network spaces separate from each other on a single TR7 (a separate Route Table for each environment; interfaces, IP addresses, the default gateway, routes and firewall rules are defined per table; the vService address and the Backend Service are selected from the relevant table). Each customer, each environment or each security zone is published in its own network space and does not mix with the traffic of the others.

There is no need to set up a separate device for separate environments: the same TR7 serves, at the same time, environments that each have their own gateway and their own rule set. The other deployments in this section describe how an environment is connected to the network; Multi-Tenant Topology, on the other hand, describes how multiple environments sit side by side on the same device.

Route Table

Network space per environment

Each environment sits in a separate table with its own interfaces, addresses and routes

Separate Gateway

Per table

Each route table uses its own default gateway

Separate Rules

Firewall

Firewall rules are defined and applied per route table

Closed by Default

Traffic between tables

Tables are closed to each other; communication exists only when it is set up explicitly

Per Service

Table selection

The vService address and the Backend Service are selected from the route table they belong to

Single Device

Multiple environments

Environments are managed from a single interface; each runs in its own network space

Why Multi-Tenant?

Multiple environments in a single network space	With Multi-Tenant Topology
All environments share the same routing table and the same default gateway.	Each environment runs in its own route table, with its own default gateway.
Firewall rules accumulate in a single rule set.	Each environment's rules are defined in its own table and affect only that environment.
Separate devices are set up to separate environments.	Environments are kept in separate network spaces on the same device.
A network change in one environment can affect the others.	Interfaces, addresses and routes are specific to the table; a route or rule change in one table does not change the records of the other tables.

How Is It Separated?

At the network layer Route Table

A route table is created for each environment, and the interfaces belonging to that environment (physical interface, Bond, LACP or VLAN) are moved to this table. The interface's IP addresses and route definitions move to the same table together with the interface.

At the service layer vService and Backend Service

The vService listens on an address in the environment's route table; in the Backend Service form, the same environment's table is selected in the Route Table field. The connection to the server and the health check go out from that table.

At the security layer Firewall

Firewall rules are written per route table. Listening permits for published services are generated automatically in the table of the listening address; forwarded traffic is closed by default in each table.

The separation is not just a view or a label: each route table runs as a separate network space on the device and makes its own routing decision from its own table.

Highlights

Network space per environmentEach route table has its own interfaces, IP addresses, routes and firewall rules.

Default gateway per tableEach environment uses its own egress path; different gateways are defined side by side on the same device.

Tables closed to each otherTraffic in one table is not routed to another table on its own; when network-level communication is needed between two tables, a connection is set up with V-ETH(Peer) interfaces and restricted with firewall rules.

Health check from within the environmentHealth checks go out from the Backend Service's route table; each environment's servers are monitored from their own network.

Any deployment within an environmentEach environment is set up in its own table with One Arm, Two Arm or a deployment that preserves the client address; the environments do not need to use the same deployment.

Security layers on shared infrastructureBot/DDoS protection on HTTP and L7 TCP vServices, and WAF and AGS on HTTP vServices, are enabled per vService, independently of the environment.

Management network is kept separateThe device always comes with the DEFAULT route table, and management access is provided from the addresses in this table; carrying service traffic in separate tables is recommended.

Table-based network servicesDNS servers and L4 DDoS mitigation settings are configured per route table.

When Is It Preferred?

Multiple customers or units Multi-tenant

At service providers and organizations that use shared infrastructure, the applications of each customer or unit are published in their own network space; the separation is at the network level.

Test and production environments Environment separation

Test, pre-production and production environments are kept in separate tables on the same device; each environment's routes and firewall rules are managed in its own table.

Security zones Segmentation

Zones such as the DMZ, internal network and management network are placed in separate tables; each zone is managed with its own gateway and its own firewall rules.

Requirements of this deployment

• Interface per environment. An interface belongs to a single route table; a separate physical interface, Bond, LACP or VLAN interface is allocated for each environment.
• Gateway per table. For the environment to reach the outside or server networks, a default gateway or a route entry on the Routes tab is defined in its own table.
• Selection from the same table. An environment's vService address and Backend Services must be selected from that environment's route table. On HTTP and L7 TCP vServices, the form does not enforce this: if the listening address is selected from one table and the Backend Service from another table, the vService becomes a path between two environments.
• Network vService. A Network vService runs in a single route table; the vService address and Backend Services are in the same table.

Scope of the separation

The separation in this deployment is at the network level. User permissions are not restricted by route table, and device resources such as processor and memory are shared between tables; a vService's resource usage is limited with the QOS settings.

Related Pages

Route Tables

Creating route tables, the default gateway and table-based settings.

→

Add Interface

Defining VLAN, Bond, LACP and V-ETH(Peer) interfaces and assigning them to a table.

→

Firewall

Rule sets per route table and forwarding (FORWARD) rules.

→

Backend Services

The Backend Service's route table and source address selection.

→