Hello

Our company just signed the deal on two Isilon Clusters, active plus replica/stby. Mainly used for CIFS/SMB and Legal Compliant archiving. I now started reading heavily into design considerations regarding access Zones and system partitioning and have a question which seems unanswered by the design and implementation guides.

Maybe some of you can shed some light

I think I understand the principles of SmartConnect/DNS Zones, IP Pools, Access Zones and Groupnets. Nothing too difficult here (actually quite cool and clever from an architectural perspective).

We are one Company, run one Network (heavily segmented/segregated for security reasons) and use only one AD with integrated DNS as authentication source. No need for Access Zone partitioning from this point of view, in theory.

What I would like to achieve from a security perspective though, is the following:

- Client A (Subnet/VLAN "A") can access Isilon Management via Firewall only.
- Client A (Subnet/VLAN "A") can access Isilon NFS Exports from within same Subnet/VLAN.
- Client A (Subnet/VLAN "A") can access Isilon CIFS Share 1 via Firewall only.
- Client B (Subnet/VLAN "B") can access Isilon CIFS Share 1 via Firewall only.
- Client C (Subnet/VLAN "C") can access Isilon CIFS Share 1 via Firewall only.
- Client C (Subnet/VLAN "C") can access Isilon CIFS Share 2 from within same Subnet/VLAN.

Please see the following image as a graphical representation.

 

This should be doable by the following high level config, right?

SmartConnect/DNS-Zone "management.isilon.mydomain.com" -> pool0 VLAN/subnet "Mgmt" -> Acess Zone "System" -> groupnet0
SmartConnect/DNS-Zone "nfs.isilon.mydomain.com" -> pool1 VLAN/subnet "A" -> Acess Zone "System" -> groupnet0
SmartConnect/DNS-Zone "cifs1.isilon.mydomain.com" -> pool2 VLAN/subnet "B" -> Access Zone "access1" -> groupnet0
SmartConnect/DNS-Zone "cifs2.isilon.mydomain.com" -> pool3 VLAN/subnet "C" -> Access Zone "access2" -> groupnet0

As long as basic/general IP routing is respected (specially from point of view Isilon) this "multitenant" like partitioning should also work from within one single Network with one single AD and integrated DNS environment. All from within groupnet0.

Is there an easier way of achieving this? My guess is no, since every access enumeration from a specific client/user against one specific access zone would always result in a list of "all" shares the current client/user has permission to within the specific access zone. So, shares that I want users to only be able to access through Firewall would be "exposed" in the local subnet. No hiding/exclusion possible.