Logical Systems and Tenant Systems Overview

Learn about the overview and the key differences between logical systems and tenant systems.

Junos OS enables you to partition a single security device into multiple logical devices, allowing each partition to operate independently and perform its own set of tasks. Junos OS provides two partitioning models:

Logical systems
Tenant systems

Logical systems enable you to partition a single device into multiple secure contexts that perform independent tasks. Each logical system has its own discrete administrative domain, logical interfaces, routing instances, security firewall and other security features. A logical system is used when more than one virtual router is required. For example, users with multiple connections to the external network that cannot coexist in the same virtual router.

Tenant system provides logical partitioning of the security devices into multiple domains similar to logical systems and provides high scalability. Tenant system is used when you need to separate departments, organization, or customers and each tenant system can be limited to one virtual router.

Differences Between Logical Systems and Tenant Systems

The main difference between a logical system and a tenant system is that a logical system supports advanced routing functionality using multiple routing instances. Tenant system supports only one routing instance, but supports the deployment of significantly more tenants per system.

Table 1 describes the key differences between logical systems and tenant systems.

Table 1: Differences Between Logical Systems and Tenant Systems
Functionality	Logical Systems	Tenant Systems
Feature support	Supports all routing features to provide optimal routing paths.	Supports routing features and high-scale security virtualization to isolate customer environments.
Rpd	Each logical system runs its own rpd to separate the resources on a device.	The primary logical system has a single rpd, which is shared by the tenant systems. Routing instances supported by this single rpd achieve the security resource separation on the firewall.
Routing instance	A default routing instance is automatically created for every logical system.	The virtual-router configured in a tenant system is passed as the default routing-instance to `ping`, `telnet`, `ssh`, `traceroute`, `show arp`, `clear arp`, `show ipv6 neighbors`, and `clear ipv6 neighbors` commands.
Logical interface configuration	The primary administrator assigns the logical interfaces, and the logical system administrator configures interface attributes.	A tenant system administrator cannot configure the logical interfaces. The primary administrator assigns the logical interfaces to the tenant system.