I see

because usually zoned datasets are not mounted in the global zone

With zadm, can I add more than one allowed-address?

Still wondering how I can give a branded zone more than one IP, like for example an IPv4 and IPv6? Can I use allowed-address multiple times?

how it works might depend on the brand of zone (and in the case of lx zones the distribution used)

aiui for an exclusive-network zone (when you'd use allowed-address) that configuration is just to tell the GZ what addresses are allowed out of that zone (so it could be a subnet or just left blank)

you configure the interfaces yourself inside the zone, however the brand configure/boot scripts might auto-configure the interfaces based on things like the allowed-address property

The allowed-addresses description in the zonecfg(8) manual page says if you want multiple addresses, use add net multiple times.

I see, but what is if I need more than one subnet?

can I give more than one in allowed-address?

the zonecfg(8) man page that rmustacc mentioned is quite good (I looked and missed the bit about multiple addresses earlier)

ok then I missed it too, I'll check it again :)

but in summary I think it's one address, network or hostname (with some limits) per allowed-address entry, and I think one allowed-address per `add net` block.

There's a large block of text under 'net: address, allowed-address, defrouter,...'

And this is ultimately all tying into the dladm allowed-ips settings, IIRC.