Shadow object rationale

Even though you will not intentionally tag a nonoverlapping, non-VRF IP address, it can still happen. (For example, the IP address might just happen to fall within the overlapping IP address range that is specified for an IP tag filter group.) The creation of a shadow IP object for this IP address, which earlier versions of satellite Domain Managers will import, ensures that the Domain Managers become aware of this IP address.

The IP Manager does not create shadow IP objects for tagged, overlapping, non-VRF IP addresses because earlier versions of satellite Domain Managers expect to import overlapping non-VRF IP addresses as DuplicateIP objects. Because DuplicateIP objects are not useful to the Domain Managers, the absence of shadow IP objects for tagged, overlapping, non-VRF IP addresses ensures that the Domain Managers do not become aware of these IP addresses.

So, from the perspective of earlier versions of satellite Domain Managers, the only shadow IP objects that make sense are the ones for tagged, nonoverlapping, non-VRF IP addresses.