{"action":"reopened","issue":{"url":"https://api.github.com/repos/hashicorp/consul/issues/1871","repository_url":"https://api.github.com/repos/hashicorp/consul","labels_url":"https://api.github.com/repos/hashicorp/consul/issues/1871/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/consul/issues/1871/comments","events_url":"https://api.github.com/repos/hashicorp/consul/issues/1871/events","html_url":"https://github.com/hashicorp/consul/issues/1871","id":143115739,"number":1871,"title":"Question about WAN configurations with many partitions","user":{"login":"Amit-PivotalLabs","id":3108318,"avatar_url":"https://avatars.githubusercontent.com/u/3108318?v=3","gravatar_id":"","url":"https://api.github.com/users/Amit-PivotalLabs","html_url":"https://github.com/Amit-PivotalLabs","followers_url":"https://api.github.com/users/Amit-PivotalLabs/followers","following_url":"https://api.github.com/users/Amit-PivotalLabs/following{/other_user}","gists_url":"https://api.github.com/users/Amit-PivotalLabs/gists{/gist_id}","starred_url":"https://api.github.com/users/Amit-PivotalLabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Amit-PivotalLabs/subscriptions","organizations_url":"https://api.github.com/users/Amit-PivotalLabs/orgs","repos_url":"https://api.github.com/users/Amit-PivotalLabs/repos","events_url":"https://api.github.com/users/Amit-PivotalLabs/events{/privacy}","received_events_url":"https://api.github.com/users/Amit-PivotalLabs/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-03-24T00:43:04Z","updated_at":"2016-04-01T03:04:44Z","closed_at":null,"body":"Suppose I have n+1 deployments, each deployment forms a LAN DC consisting of a 3-server consul cluter, plus a bunch of other things colocated with consul agents.  1 deployment is a \"central\" deployment, and the other n are \"children\" deployments.  The requirement is that everything should obviously be able to resolve everything within its own DC.  In addition, the central DC should be able to resolve everything in every child DC, and each child DC must be able to resolve services in the central DC, but children do not need to be able to resolve addresses amongst one another.  Crucially, we have network ACLs set up so that none of the children deployments can have any traffic to/from any of the other children.\r\n\r\nWe think we can accomplish this by telling each child consul cluster to WAN join the central consul cluster.  Is there any risk in doing this, or if n is large, will the ACLs create a problem?  Do all the servers end up being part of a common WAN gossip pool where most things can't talk to most things?\r\n\r\nWe've tried this with n=2.  Everything worked as expected, except I assumed that from CHILD_DC_1 I would be able to `nslookup` service addresses in CHILD_DC_2, but just not ping those things.  However, the `nslookup` doesn't even work.  Is that okay/expected?  Or is it a sign that with large n, WAN gossip will break down and the central cluster won't be able to resolve things in the child deployment and/or the child clusters will not be able to resolve things in the central deployment?"}}