The correct way to achieve complete network isolation for multi-tenancy in ONTAP is by using IPspaces. An IPspace is a logical container that creates a distinct IP network stack, including its own routing table, firewall policies, and set of network interfaces (LIFs). By creating one IPspace for tenant A and another for tenant B, all network traffic for each tenant, including data access and SnapMirror replication, is kept completely separate. This configuration allows for non-overlapping network administration and even permits the use of overlapping IP address ranges between tenants on the same physical cluster.

A. The customer must use different VLANs for the two tenants.

VLANs provide Layer 2 network segmentation but do not create separate routing tables. Both tenants would share the same Layer 3 routing domain, which does not provide the required isolation.

B. This setup can only work if tenant A and tenant B use a shared network infrastructure.

This is incorrect. The primary purpose of features like IPspaces is to enable tenants to use separate, isolated network infrastructures on a single shared storage system.

D. Each node can only communicate with tenant A or tenant B, but not with both at the same time.

This is false. A single ONTAP node can host LIFs belonging to multiple IPspaces, allowing it to serve traffic for multiple tenants concurrently and in isolation.

1. NetApp ONTAP 9 Network Management Guide

Section: "Managing IPspaces".

Reference Detail: The guide states

"An IPspace defines a distinct IP address space in which SVMs and their network interfaces (LIFs) reside. IPspaces enable you to have multiple tenants on a single ONTAP cluster with separate network domains for security and traffic isolation." This directly supports the use of IPspaces for the described multi-tenant scenario.

2. NetApp Technical Report TR-4583: "Secure Multi-tenancy IPspaces Design and Implementation Guide"

Section 2: "IPspaces Overview".

Reference Detail: "IPspaces are a feature of NetApp ONTAP software that enables a single NetApp ONTAP cluster to be virtualized into multiple

secure

isolated network containers... Each IPspace has its own unique routing table

which means that each IPspace can have its own default route and static routes." This confirms that IPspaces provide the necessary routing isolation that VLANs alone cannot.

3. NetApp ONTAP 9 Data Protection Power Guide

Section: "SnapMirror networking".

Reference Detail: The documentation confirms that SnapMirror relationships are established between SVMs. Since SVMs are contained within IPspaces

SnapMirror traffic will be isolated within the IPspace of the respective intercluster LIFs

fulfilling the customer's requirement for data protection traffic isolation.