IT‑IS‑Networking
Technology › Security Architecture

Multi-Tenant Isolation

Six independently governed agencies on shared infrastructure, none able to reach, disrupt or inherit the regulatory exposure of any other.

Also known as Multi-VSYS, Virtual Systems, Tenant Isolation

Left to right is time. Each row is one of the 10 disciplines this one worked alongside, ordered so kindred disciplines sit next to each other rather than alphabetically — a landscape only means anything if neighboring rows belong together. Height is the work running in that domain in that year, weighted by what failure would have cost — life-safety ×3, a statutory obligation ×2.2, the estate itself ×1.5, an evaluation ×1. Every project declares which of those it was, so each ridge traces to an entry you can open and disagree with. Only the work that used this technology is counted, so what shows here is the company it kept rather than the record around it. Height and color are on the record-wide scale rather than this page’s own, so a modest estate draws a modest landscape and any two of these pages can be read against each other.

Architected the enterprise Palo Alto Networks firewall platform as a hard multi-tenant boundary between the city, the Clerk of Courts, the Public Defender, the public library system, the Sheriff’s Office and the municipal utility — each carrying its own virtual system, routing domain, DMZ and security policy on shared physical infrastructure and shared, diversely routed internet egress. One tenant extended across multiple counties.

The design goal was that no agency could reach, disrupt or inherit the regulatory exposure of any other, while each kept the autonomy its independently elected leadership required. Twenty-six revisions of the design document over its life.

Palo Alto Networks asked more than once to publish it as a vendor white paper. The answer was no every time. The architecture is public-safety facing, and a published diagram of how a sheriff’s office and a court system are isolated from one another is a gift to somebody.

Applied in

  • Multi-Property Gaming Group2024–2026Four properties for a regional casino group — security and segmentation, core refresh, wireless, surveillance separation and firewall consolidation.
  • Enterprise Multi-Tenant Firewall Architecture2020–2024Six independently governed agencies on shared infrastructure, none able to reach, disrupt or inherit the regulatory exposure of any other.
  • Clerk of the Court Filtering and DMZ Architecture2016–2023A separate filtering estate and demilitarized zone for an independently governed constitutional officer sharing City facilities.
  • Enterprise Web Filtering and Content Security2005–2023 · final platform decision scored 17 May 2023Eighteen years and five vendor generations, split two ways between a government workplace and a public library on the same infrastructure.
  • Fire & Rescue Mobile Gateway and SD-WAN Overlay2012–2023Three hundred apparatus turned into routed nodes on the enterprise network — dual carriers on private APNs, head-ends behind two providers, and a zero-trust overlay behind a firewall virtual system built for the fleet.
  • Enterprise Network Access Control2016–2022Seven years from vendor evaluation to a control that could quarantine a port anywhere in the city — and the federated exception handling that made enforcement survivable in a building shared with four other agencies.
  • Juniper Enterprise Security Suite2009 – 2021A security platform rather than a firewall — selected on an instrument written before anyone knew who would win, operated for twelve years, and retired in stages on a plan the same team wrote.
  • Republican National Convention — National Special Security EventJune – October 2020Critical Infrastructure Subcommittee for a national special security event relocated to the city eight weeks into planning — first-responder mobility, venue design, carrier redundancy, and federal sensors landed on a municipal estate.
  • Enterprise Firewall Policy and OperationsMay 2009 – March 2017Eight years running the rule base directly across two platform generations — every rule, change and upgrade — then handing it down to a dedicated post rather than holding it.
  • Courthouse Trial BroadcastDecember 2013 – January 2014A controlled pooled broadcast out of a courtroom for high-profile trials — four cameras, coax to fiber through four floors, and a request to block cellular data on one antenna node while leaving voice alone.
  • Internet Perimeter Firewall Replacement2006 – 2008An unsupported, undocumented Check Point estate replaced with firewall blades in the core — held as a stated performance objective, carried from written justification to floor-by-floor cutover, with no vendor producing a design at any point.

Career

Documents

See also

Also searched as

  • zero trust
  • ZTNA
  • microsegmentation
  • least privilege network

Compliance-driven isolation and per-tenant policy, designed under regulatory constraint before the vocabulary existed.