Maybe I am overthinking this but I'm trying to figure out the recommended way to configure our 4431's to act as the "provider edge" for a small multi-tenant environment. I want to take a public /24 network (assigned by our provider and advertised through our public BGP AS) and assign each tenant a small subnet (/27 - /30 sizes depending on need) so they bring in their own firewall appliances or other collocated equipment and safely use our address space by isolating their address space from other tenants.
So far, the most logical approach seems to be VLAN subinterfaces and assigning each tenant a VLAN. The 4431 router would have one IP from each subnet and the tenant equipment would get the rest. It seems like it would be a very basic ISP type setup. This seems like it would make things like bandwidth management, NetFlow tracking, QoS, etc, easy because it is logically separated and isolated.
Now, to add a little more complexity to this, I would like to make the routers highly available. We have 2 x 4431's, each connecting to a separate ISP and we present our assigned IP networks using BGP. We have used HSRP in the past with a single /24 that was not subnetted, but for these smaller blocks I have been looking at GLBP because it doesn't seem to consume the extra IP addresses that HSRP requires since it appears to be a layer 2 technology. I assume this would work on subinterfaces?
Another option that came up was to just use a single interface with secondary IP addresses, but I like the layer 2 isolation that VLAN's provide to prevent the tenants from even accidentally overlapping network settings with another tenant. I've also seen mention of PPPoE and ATM, QinQ, and probably others, which is why I'm here asking what the recommended way is for a small environment like this given the hardware I have.
I guess one of my biggest concerns is around the number of subinterfaces supported and number of VLAN's supported. I can't find any information about the maximums for these routers.
