Multi-Tenancy PBR/Service Graphs

[KatherineTran]

Hello!

I have been investigating into using service graphs in our environment where multiple tenants exist. In our case we have a test , preprod and prod environment which are completely isolated.

Our Fortigates use VDOMs for each environment. What I'd like to do is use service graphs for each tenant and PBR certain traffic and allow the rest to be line rate and ignore firewalls! But what I can't wrap my head around or easily test right now is if it would be supported with multiple tenants on the one interface arm to the firewall.

We are not using VMM integration and intend to use unmanaged service graph device configuration. We want to ideally use the same physical interface and use vlan encapsulation for each tenant/VDOM to direct traffic with service graph/PBR to the right place.

Am I overthinking this? I could not find many multi tenant examples like this. 

Thanks in advance,

KT

[abourges]

Hi Kathrine,

...we are currently looking at a very similar design and are not sure, if it's supported. Have you been successful in implementing this?

Thanks,

Andreas

[Marcel Zehnder]

Hi KT

This will work. Per Tenant you need to define one logical L4-L7 device using the same interface(s) but a different vlan-encapsulation.

/Marcel

[Sergiu.Daniluk]

One configuration option is exactly like @Marcel Zehnder mentioned: in each tenant define the service node with different encap over the same interface.

A second valid option would be to configure the node in one tenant with multiple vlans over the same interface and then export it to the other tenants.

Both options are perfectly ok. The difference is that first one is separating completely the tenants and their service graphs, while the second one gives you an option (if required in the future) to perform inter-vrf/inter-tenant PBR.

EDIT: both options described here: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-2491213.html#DesignforsharingL4L7appliances

Cheers,

Sergiu