Forum Discussion

dragonflymr's avatar
dragonflymr
Icon for Cirrostratus rankCirrostratus
Mar 03, 2015

Route Domains, strict isolation and parent

Hi,

 

I wonder if my understanding (based on Working with Route Domains) of Strict Isolation (SI) and Parent settings is correct.

 

Scenario:

 

  1. RD0 - default in Common, SI enabled

     

  2. RD1 - (in Common) SI Enbled, Parent set to 0

     

  3. RD2 - (in Common) SI Enbled, Parent set to None

     

  4. VS created in RD0 (VIP), pool members from both RD0 and RD1 - traffic should be forwarded to both pool members because of Parent/Child relationship

     

  5. VS created in RD2 (VIP%2) - pool members from both RD0 and RD2 - traffic should not be forwarded to member from RD0 because there is no Parent/Child relationship

     

  6. VS created in RD1 (VIP%1) - pool members from both RD1 and RD2 - traffic should not be forwarded to member from RD2 because there is no Parent/Child relationship and SI is enabled, in case SI would be enabled on both RD1 and RD2 traffic should be forwarded to both pool members

     

Is above correct? If there is Parent/Child relationship SI setting can be enabled and still traffic will be routed between RDs?

 

Piotr

 

application delivery
design
LTM
security
TMOS

6 Replies

  • Brad_Parker's avatar
    Brad_Parker
    Icon for Cirrus rankCirrus
    Mar 03, 2015
    1. Yes
    2. Yes
    3. Yes, No. If you created a VIP in RD1 and have SI turned on only pool members in RD1 could be reached. If you turned off SI for both, then pool members in RD1 and RD2 could receive traffic.

    If there is a parent/child relationship and SI is enabled traffic can still pass between the two route domains. I believe routes in the child domain will take precedence over the parent if there is overlap.

     

    • dragonflymr's avatar
      dragonflymr
      Icon for Cirrostratus rankCirrostratus
      Mar 03, 2015
      Well, for 3. I just made mistake, should be " in case SI would be disabled on both RD1 and RD2", so I assume Yes, Yes :-) Thanks a lot for clarification. Piotr
  • Brad_Parker_139's avatar
    Brad_Parker_139
    Icon for Nacreous rankNacreous
    Mar 03, 2015
    1. Yes
    2. Yes
    3. Yes, No. If you created a VIP in RD1 and have SI turned on only pool members in RD1 could be reached. If you turned off SI for both, then pool members in RD1 and RD2 could receive traffic.

    If there is a parent/child relationship and SI is enabled traffic can still pass between the two route domains. I believe routes in the child domain will take precedence over the parent if there is overlap.

     

    • dragonflymr's avatar
      dragonflymr
      Icon for Cirrostratus rankCirrostratus
      Mar 03, 2015
      Well, for 3. I just made mistake, should be " in case SI would be disabled on both RD1 and RD2", so I assume Yes, Yes :-) Thanks a lot for clarification. Piotr