ONTAP Network Architecture: IPspaces, Broadcast Domains, and LIFs

Understand ONTAP networking from ports and VLANs through broadcast domains, IPspaces, LIFs, failover groups, routing, designs, and troubleshooting.

Bottom-up model

Ports carry frames; VLAN ports add tags. A broadcast domain groups layer-2-reachable ports with common MTU inside an IPspace. A LIF supplies an IP identity and service policy on a home port; its failover group supplies alternatives. Routes are SVM/IPspace scoped.

cluster::> network port show
Node  Port IPspace Broadcast Domain Link MTU
node1 e0a  Default Default-1500     up   1500
node1 e0b  Default Backup-9000      up   9000
node2 e0a  Default Default-1500     up   1500
node2 e0b  Default Backup-9000      up   9000

Broadcast domains and VLANs

Domains constrain valid LIF placement/failover. Ports should share L2 reachability and MTU. VLANs let a physical link carry tagged networks; confirm switch configuration and version.

cluster::> network port broadcast-domain show
IPspace Broadcast Domain MTU  Port
Default Default-1500     1500 node1:e0a, node2:e0a
Default Backup-9000      9000 node1:e0b, node2:e0b
cluster::> network vlan create -node node1 -vlan-name e0a-120
cluster::> network vlan create -node node2 -vlan-name e0a-120

See network ports.

IPspaces

An IPspace isolates SVM networking, routes, broadcast domains, and overlapping addresses. Use it for hard multitenancy or overlapping customer subnets. Management isolation can justify one; do not add complexity when VLAN/routing separation suffices.

cluster::> network ipspace create -ipspace tenant_a
cluster::> network ipspace show
IPspace  Vserver List Broadcast Domains
Default  Cluster,svm1 Default-1500
Cluster  Cluster      Cluster
tenant_a -            -

An empty IPspace has no reachability; assign domains and SVMs through the documented workflow.

LIFs: role, home, and migration

Cluster, data, management, and intercluster LIFs serve distinct traffic. Current releases emphasize service policies; legacy views expose roles. Home is preferred placement; current is actual placement.

cluster::> network interface show -fields role,home-node,home-port,is-home,status-oper
vserver lif      role    home-node home-port is-home status-oper
Cluster cluster1 cluster node1     e0c       true    up
svm1    nfs1     data    node1     e0a       true    up
svm1    nfs2     data    node2     e0a       true    up

cluster::> network interface migrate -vserver svm1 -lif nfs1 \
  -destination-node node2 -destination-port e0a
cluster::> network interface show -vserver svm1 -lif nfs1 -fields current-node,current-port,is-home
vserver lif  current-node current-port is-home
svm1    nfs1 node2        e0a          false

Migration is planned movement; failover is policy recovery. Revert after maintenance using your release's command.

Failover groups and policies

The group is the allowed port set; the policy selects eligible targets. Choices vary with role/service policy and version.

cluster::> network interface failover-groups show
Vserver Group   Targets
svm1    data_fg node1:e0a, node2:e0a
cluster::> network interface show -vserver svm1 -fields failover-group,failover-policy
vserver lif  failover-group failover-policy
svm1    nfs1 data_fg        broadcast-domain-wide

Routes, cluster ports, and MTU

A default route is 0.0.0.0/0; specific prefixes win and metrics distinguish equivalent paths. Cluster LIFs are internal, not client LIFs. Jumbo MTU works only when every hop supports it; never change cluster interconnect MTU from a generic runbook.

cluster::> network route show -vserver svm1
Vserver Destination Gateway    Metric
svm1    0.0.0.0/0   192.0.2.1 20
cluster::> network route create -vserver svm1 -destination 203.0.113.0/24 \
  -gateway 192.0.2.254 -metric 10

cluster::> network interface show -role cluster
Vserver LIF      Status Address      Current Node Port
Cluster cluster1 up/up  169.254.1.11 node1        e0c
Cluster cluster2 up/up  169.254.1.12 node2        e0c
cluster::> network port show -fields link,mtu
node1 e0b up 9000
node2 e0b up 9000

Designs and troubleshooting

Pattern	Shape	Watch
Single SVM	LIFs distributed across nodes	Failover capacity
Multi-SVM	Dedicated IPspaces when isolation requires	Route ownership
Management VLAN	Restricted ports/routing	DNS, NTP, AutoSupport

cluster::> network interface show -fields status-oper,current-node,current-port
cluster::> network port show -fields link,health-status,mtu
cluster::> network interface failover-groups show
cluster::> network route show
cluster::> network arp active-entry show

For a down LIF check admin/oper state, port, VLAN, and domain. If failover fails, inspect group/policy. For ARP issues validate duplicate IPs, routes, switch learning, and end-to-end MTU. Field names vary; use CLI help.

Official sources

Network management and IPspaces
broadcast domains and IPspace create
LIF create, migrate, failover groups, and routes