I85PREP
⌘ K
JNCIP-SEC study materials
JNCIP-SEC study resources

JNCIP-SEC: Logical Systems and Tenant Systems

JNCIP-SEC · Work through your exam, one topic at a time.

All guide sections

Logical Systems and Tenant Systems

Logical systems and tenant systems split one SRX into several independent security devices. The exam tests whether you can give two tenants overlapping address space, keep their policies and NAT separate, and move traffic between them deliberately.

Core rules

  • A logical system (LS) owns its own zones, address books, policies, NAT rule sets, IPsec SAs, routing instance and administrators. Configuration lives under set logical-systems LS1 security ....
  • Interfaces are attached inside the LS hierarchy, for example set logical-systems LS1 interfaces ge-0/0/1 unit 0 family inet address 192.168.10.1/24. An interface belongs to exactly one LS (or to the master); anything not moved stays with the master and is invisible to the tenant.
  • Commit is master-only: commit from the master commits every logical system, and a failure in one LS blocks the whole commit.
  • Inter-LS traffic uses logical tunnel interfaces: lt-0/0/0 unit 0 paired with peer-unit 1. Each end is placed in a zone inside its own LS, and the traffic must be permitted by the policy of each LS it traverses.
  • Resource limits (maximum policies, zones, sessions, address entries) are defined with system security-profile and applied per logical system, so one tenant cannot exhaust platform resources.
  • Tenant systems are the newer multi-tenancy container: each tenant is bound to its own routing instance and holds its own zones, policies and NAT, letting a vSRX or SRX behave as many virtual CPEs. Both models give overlapping addressing and per-tenant policy, but tenant systems scale further and are configured under set tenants <name>.

Worked example

Two customers both use 192.168.10.0/24. LS-A gets ge-0/0/1 with 192.168.10.1/24; LS-B gets ge-0/0/2 with the same address - no conflict, because each LS has its own routing table and source NAT pool. A shared service at 10.0.0.50 in the master is reachable only after an lt-0/0/0 pair exists, each end is zoned, and both LS-A and LS-B policies permit the flow.

Traps

  • Forgetting the interface assignment: the tenant sees no traffic and no logs.
  • Expecting one LS administrator to see another tenant's sessions.
  • Overlapping NAT pools that collide on the same external address.
  • Reaching another LS with a static route pointing at a physical interface instead of the lt- pair.