The trajectory of GPU infrastructure has moved firmly toward shared tenancy. A hyperscaler or cloud GPU provider cannot afford to dedicate an entire Spectrum-X SuperPOD to a single customer for every workload - the economics demand that multiple tenants coexist on the same physical fabric. But coexistence introduces four hard requirements that a flat, unpartitioned Ethernet network fundamentally cannot satisfy.
Routing isolation means that TenantA's training VMs must not receive routes belonging to TenantB's inference cluster. This is not a firewall problem - a firewall that sees cross-tenant routes can still be misconfigured. Isolation must be enforced at the routing layer so that the routes simply do not exist in the wrong VRF. Security isolation means that even a misconfigured host in TenantA should have no physical path to TenantB's traffic - the switch ASIC must enforce the boundary, not userspace software. Performance isolation means that TenantA's all-reduce traffic, which can generate synchronized multi-hundred-gigabit bursts at barrier points, must not degrade TenantB's inference latency. Finally, management isolation means that the operators managing TenantA's workload should not be able to observe or modify any aspect of TenantB's fabric state.
Spectrum-X is engineered to enforce all four properties simultaneously. The architecture distributes enforcement across three layers: BGP-EVPN handles routing isolation by scoping route advertisement to per-tenant VRFs, VXLAN encapsulation enforces security isolation by tagging every frame with a 24-bit VNI that the Spectrum-4 ASIC validates in hardware, and GBP (Group-Based Policy) microsegmentation provides fine-grained intra-tenant performance and security policy that the TCAM enforces at line rate.
In practice, a GPU cloud might operate three distinct tenant classes simultaneously. Bare-metal tenants receive dedicated DGX nodes attached to dedicated leaf switches; their VNIs are completely separate and the Spectrum-4 never bridges frames between them. Shared-GPU tenants using vGPU on a common DGX B200 are isolated via GBP EPGs within a shared VNI range, with policy contracts governing which EPGs may communicate. Inference tenants typically have lower bandwidth demands but strict latency SLAs and are placed in separate VRFs with ECN thresholds tuned for shorter queues. This chapter covers how to configure, verify, and troubleshoot all three patterns.