L2 network resources include L2 networks and VXLAN pools.
An L2 network corresponds to a layer 2 broadcast domain. This L2 network
supports multiple network types, such as L2NoVlanNetwork, L2VlanNetwork,
VxlanNetwork, and HardwareVxlanNetwork.
L2NoVlanNetwork and L2VlanNetwork is a group that must be identical to the
configurations of compute node ports on the switch sides.
Both VXLAN Pool and VxlanNetwork with the software SDN type provide the
VxlanNetwork configurations. Before you use VxlanNetwork, create a VXLAN
pool first. Then, create VxlanNetwork by specifying or randomly choosing
VNIs.
Both VXLAN Pool and HardwareVxlanNetwork with the hardware SDN type provide
the HardwareVxlanNetwork configurations. Before you use
HardwareVxlanNetwork, create a VXLAN pool first. Then, create
HardwareVxlanNetwork by specifying or randomly choosing VNIs.
L3 Network Resources
An L3 network can serve as a sub-resource of the L2 network. Mainly based on the L2
network, the L3 network provides the network configurations for VM instances,
including the IP range, gateway, DNS, and network service.
L3 Network Architecture Model
The Cloud supports two L3 network architecture models: flat network and VPC
network.
Dedicated Networks
Dedicated networks include management networks and flow networks. Note that you
cannot create VM instances by using dedicated networks.
Route Resources
ZStack Cloud provides network services for VM instances by
using custom Linux VM instances to serve as routing devices. Related route resources
mainly include VPC vRouters, VPC HA groups, vRouter images, and vRouter
offerings.
SDN Controller
By adding SDN controllers, you can take over the SDN networks of hardware switches on
the Cloud to lower the network latency and improve the VXLAN network
performance.
Network Usage Procedure
You need to first create an L2 network, use the L2 network to create an L3 network,
and then use these networks to provide multiple network services.
Network Protocol
ZStack Cloud public network, flat network, and VPC network
support two network protocols: IPv4 and IPv6. You can create an IPv4 network, an
IPv6 network, or an IPv4+IPv6 network as needed.
L2 Network
What is L2 Network?
An L2 network is a layer 2 broadcast domain used for layer
2 isolation. Generally, L2 networks are identified by names of devices on the
physical network.
VLAN, VXLAN, and SDN can be used as an L2 network.
An L2 network is used to provide layer 2 isolation for an L3 network.
L2 Network Types
The following four types of L2 networks are supported:
L2NoVlanNetwork
You must specify the NIC name of the host.
The hosts in the cluster to which the L2 network is attached must
have NICs that share the same name.
When the data packets of VM instances flow out of the host NIC and
reach the physical switch, the data packets are not flagged with
VLAN tags. Note that the physical switch must be in VLAN Access
mode.
If you create an L2 network of the L2NoVlanNetwork type, a network
bridge is created based on the specified host NIC.
L2VlanNetwork
You must specify the host NIC name and VLAN ID. ZStack Cloud allows you to create virtual NICs and
virtual switches, and supports IEEE 802.1Q VLAN trunking.
The hosts in the cluster to which the L2 network is attached must
have NICs that share the same name.
When the data packets of VM instances flow out of the host NIC and
reach the physical switch, the data packets are tagged with the
specified VLAN ID.
If you create an L2 network of the L2VlanNetwork type, a VLAN device
is created based on the specified VLAN ID and then a network bridge
is created based on the VLAN device.
If you attach an L2 network of the L2NoVlanNetwork type and an L2
network of the L2VlanNetwork type or attach multiple L2 networks of
the L2VlanNetwork type to a cluster, the physical switch NIC must be
in Trunk mode. Besides, the VLAN ID in use must be contained in the
Trunk VLAN configurations.
VxlanNetwork
Virtual Extensible LAN (VXLAN) is an overlay technology that allows
for the creation of overlaying L2 networks. This technology can
support a maximum of 16 million logical networks.
VxlanNetwork is an implementation of the software-based VXLAN
technology.
If you create an L2 network of the VxlanNetwork type, you must
specify a software SDN-based VXLAN pool. The L2 network must
correspond to a VNI in the pool.
The VTEP IPs of the hosts in the cluster to which the L2 network of
the VxlanNetwork type is attached must belong to the specified VXLAN
pool.
When the data packets of VM instances flow out of the host, the host
encapsulates VXLAN messages to the data packets and then sends the
encapsulated data to the physical switch.
HardwareVxlanNetwork
Virtual Extensible LAN (VXLAN) is an overlay technology that allows
for the creation of overlaying L2 networks. This technology can
support a maximum of 16 million logical networks.
HardwareVxlanNetwork is a solution to the integration with
third-party hardware SDN.
If you create an L2 network of the HardwareVxlanNetwork type, you
must specify a hardware SDN-based VXLAN pool. The L2 network must
correspond to a VNI in the pool.
When the data packets of VM instances flow out of the host NICs and
reach the distributed virtual switches, the data packets are flagged
with the specified VLAN ID. The VLAN ID is mapped with VXLAN ID
based on the SDN controlled that you add to the Cloud.
Note:
For some OS, the NIC name in the ethX format will be changed after the
system reboots. In addition, the NIC sequence will also be randomly
changed. We recommend that you change the NIC name of each compute node
(especially for VM instances with multiple NICs) to a non-ethX format,
such as em01.
L2 Network | Cluster | L3 Network | VM Instance
The relationship between an L2 network and a cluster, an L3 network, a VM instance is
as follows:
If you attached an L2 network to a cluster whereas the L2 network was not
attached to a host, you could not add the host to the cluster.
If you did not attach an L2 network to a cluster and the L2 network was not
attached to a host, you could not attach the L2 network to the cluster.
If you attached an L2 network to a host whereas the corresponding L2 network
devices were inconsistently connected to other hosts in a cluster, note that
the VM IP that you created would not work properly.
If you delete an L2 network, the corresponding L3 networks and VM NICs that
are using these networks will also be deleted.
If you delete an L2 network, the VPC vRouter and vRouter offering that use
the L2 network will also be deleted.
If you delete an L2 public network, all network services that are using the
network, such as VPC vRouter, vRouter offering, VIP, EIP, port forwarding,
load balancing, IPsec tunnel, and Netflow will also be deleted.
You can create multiple L2 networks of the VxlanNetworks type by using a
VXLAN Pool of the Software SDN type. These L2 networks can be applied to
flat networks and VPC networks, respectively.
VM instances in an L2 network of the VxlanNetwork type cannot be accessed
through the Internet. To access these VM instances through the Internet, use
an EIP or port forwarding.
You can also create multiple L2 networks of the HardwareVxlanNetworks type
by using a VXLAN Pool of the Hardware SDN type. These L2 networks can
currently be applied to flat networks.
You can use an L2 network to create multiple L3 networks. However, we
recommend that unless necessary you do not create multiple L3 networks from
an L2 network. This may cause the DHCP services of these L3 networks unable
to work as expected.
You can use an L2 network of the HardwareVxlanNetwork type to create only
flat networks. In addition, an L2 network of the HardwareVxlanNetwork type
supports only flat network services.
If you use the Smart NIC network acceleration mode for an L2 network, you
can use the L2 network to create only IPv4 VPC networks and provide
corresponding network services.
Create an L2 Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > L2 Network. On the L2 Network page, click Create L2
Network. Then, the Create L2 Network page is
displayed.
The following lists the L2 networks that you can create:
Create an L2NoVlanNetwork.
Create a VxlanNetwork.
Create an L2VlanNetwork.
Create a HardwareVxlanNetwork.
Create an L2NoVlanNetwork
Set the following parameters:
Zone: By default, the current zone is displayed.
Name: Enter a name for the L2 network.
The name must be 1 to 128 characters in length and can
contain Chinese characters, letters, digits, spaces, hyphens (-), underscores
(_), periods (.), parenthesis (), colons (:), and plus signs (+) and cannot
begin or end with spaces.
Description: Optional. Enter a description for the L2
network.
Type: Select
L2NoVlanNetwork.
Cluster: Optional. Select the
cluster to be attached.
Note:
You can attach a cluster when you create an L2NoVlanNetwork or
after you create the L2 network.
If an L2 network is not attached to a cluster, you cannot use
the corresponding L3 networks to create VM instances.
Network
Acceleration Mode: You can use different technologies to
improve network performance of the L2 network, including Standard, SR-IOV,
and Smart NIC:
Standard: uses
Linux Bridge vSwitch, but applies no network acceleration
technology.
SR-IOV: applies
the SR-IOV technology to passthrough physical NICs to improve
network performance.
Note:
Before using the SR-IOV mode, we recommend that you
virtualize the physical NICs used by the L2 network via
SR-IOV.
After using the SR-IOV mode, the L3 networks that use
the L2 network also support SR-IOV network
acceleration.
Smart NIC: uses OVS-DPDK vSwitch and applies
the offload feature of a smart NIC, thereby improving the network
performance.
Note: This mode will take up 8GB hugepages of each
host in the cluster. Make sure that the host memory of the
cluster is sufficient.
NIC Name: Select or enter an NIC
name for the L2 network. For example, em01.
Note: You can only select or
enter an NIC name shared across all hosts in the cluster.
Figure 1. Create L2NoVlanNetwork
Create an L2VlanNetwork
Set the following parameters:
Zone: By default, the current zone is displayed.
Name: Enter a name for the L2 network.
The name must be 1 to 128 characters in length and can
contain Chinese characters, letters, digits, spaces, hyphens (-), underscores
(_), periods (.), parenthesis (), colons (:), and plus signs (+) and cannot
begin or end with spaces.
Description: Optional. Enter a description for the L2
network.
Type: Select
L2VlanNetwork.
Cluster: Optional. Select the
cluster to be attached.
Note:
You can attach a cluster when you create an L2NoVlanNetwork or
after you create the L2 network.
If an L2 network is not attached to a cluster, you cannot use
the corresponding L3 networks to create VM instances.
Network
Acceleration Mode: You can use different technologies to
improve network performance of the L2 network, including Standard, SR-IOV,
and Smart NIC:
Standard: uses
Linux Bridge vSwitch, but applies no network acceleration
technology.
SR-IOV: applies
the SR-IOV technology to passthrough physical NICs to improve
network performance.
Note:
Before using the SR-IOV mode, we recommend that you
virtualize the physical NICs used by the L2 network via
SR-IOV.
After using the SR-IOV mode, the L3 networks that use
the L2 network also support SR-IOV network
acceleration.
Smart NIC: uses OVS-DPDK vSwitch and applies
the offload feature of a smart NIC, thereby improving the network
performance.
Note: This mode will take up 8GB hugepages of each
host in the cluster. Make sure that the host memory of the
cluster is sufficient.
VLAN ID: Specify a VLAN ID that matches the actual
network configurations. Valid values: 1 to 4094.
NIC Name: Select or enter an NIC
name for the L2 network. For example, em01.
Note: You can only select or
enter an NIC name shared across all hosts in the cluster.
Figure 2. Create L2VlanNetwork
Create a VxlanNetwork
Set the following parameters:
Zone: By default, the current zone is displayed.
Name: Enter a name for the L2 network.
The name must be 1 to 128 characters in length and can
contain Chinese characters, letters, digits, spaces, hyphens (-), underscores
(_), periods (.), parenthesis (), colons (:), and plus signs (+) and cannot
begin or end with spaces.
Description: Optional. Enter a description for the L2
network.
Type: Select
VxlanNetwork.
Network Acceleration Mode: Only the Standard mode is
supported. This mode uses a Linux Bridge vSwitch but applies no network
acceleration technology.
VXLAN Pool: Select a VXLAN pool of the software SDN type.
Note:
Before you can create a VxlanNetwork, create a VXLAN pool of the
software SDN type.
VNI: Optional. Select a specified VNI in the VXLAN
pool.
If not specified, the Cloud allocates a VNI randomly.
Figure 3. Create VxlanNetwork
Create a HardwareVxlanNetwork
Set the following parameters:
Zone: By default, the current zone is displayed.
Name: Enter a name for the L2 network.
The name must be 1 to 128 characters in length and can
contain Chinese characters, letters, digits, spaces, hyphens (-), underscores
(_), periods (.), parenthesis (), colons (:), and plus signs (+) and cannot
begin or end with spaces.
Description: Optional. Enter a description for the L2
network.
Type: Select HardwareVxlanNetwork.
Network Acceleration Mode: Only the Standard mode is
supported. This mode uses a Linux Bridge vSwitch but applies no network
acceleration technology.
VXLAN Pool: Select a VXLAN pool of the hardware SDN type.
Note:
Before you can create a HardwareVxlanNetwork, create a VXLAN
pool of the hardware SDN type.
VNI: Optional. Select a specified VNI in the VXLAN
pool.
If not specified, the Cloud allocates a VNI randomly.
Figure 4. Create HardwareVxlanNetwork
Manage an L2 Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > L2 Network. Then, the L2 Network page is displayed. The
following tables list the actions that you can perform on an L2 network.
Action
Description
Create L2 Network
Create an L2NoVlanNetwork or L2VlanNetwork network.
Edit L2 Network
Edit the name and description of the L2 network.
Attach Cluster
Attach the L2 network to a cluster.
Detach Cluster
Detach the L2 network from a cluster.
Note: Detaching an L2
network from a cluster also detaches the corresponding VM NIC.
Please exercise caution.
Set Sharing Mode
Set the sharing mode of a resource. The
platform provides the following sharing modes:
Share Globally: Shares the resource to all projects and accounts.
Share to Specified Projects/Accounts: Shares the
resource with specified projects
and accounts.
Not Share: Revokes the resource from
projects and accounts to which the resource is
shared. If you set Sharing Mode to Not Share for a
resource, other projects and
accounts cannot use the resource.
Note:
If you change the Sharing Mode setting of a resource
from Share Globally to Share to Specified
Projects/Accounts, the resource is visible only to
the specified projects or
accounts the resource is shared to.
If the resource that you share to
projects orthe specified accounts has been
used by these projects or
accounts and then you change the Sharing Mode of the
resource, the change does not take effect on the projects or accounts. They can
reverse and use the resource until it is
released.
Delete L2 Network
Delete the L2 network.
Note: Deleting an L2 network also deletes
its L3 networks and associated VPC vRouters, and detaches the
corresponding VM NICs. Please exercise caution.
Action
Description
Create L2 Network
Create a VxlanNetwork network.
Edit L2 Network
Edit the name and description of the L2 network.
Set Sharing Mode
Set the sharing mode of a resource. The
platform provides the following sharing modes:
Share Globally: Shares the resource to all projects and accounts.
Share to Specified Projects/Accounts: Shares the
resource with specified projects
and accounts.
Not Share: Revokes the resource from
projects and accounts to which the resource is
shared. If you set Sharing Mode to Not Share for a
resource, other projects and
accounts cannot use the resource.
Note:
If you change the Sharing Mode setting of a resource
from Share Globally to Share to Specified
Projects/Accounts, the resource is visible only to
the specified projects or
accounts the resource is shared to.
If the resource that you share to
projects orthe specified accounts has been
used by these projects or
accounts and then you change the Sharing Mode of the
resource, the change does not take effect on the projects or accounts. They can
reverse and use the resource until it is
released.
Delete L2 Network
Delete the L2 network.
Note: Deleting an L2 network also deletes
its L3 networks and associated VPC vRouters, and detaches the
corresponding VM NICs. Please exercise caution.
Action
Description
Create L2 Network
Create HardwareVxlanNetwork network.
Edit L2 Network
Edit the name and description of the L2 network.
Delete L2 Network
Delete the L2 network.
Note: Deleting an L2 network also deletes
its L3 networks and associated VPC vRouters, and detaches the
corresponding VM NICs. Please exercise caution.
VXLAN Pool
What is VXLAN Pool?
VXLAN Pool: A VXLAN pool is a collection of VXLAN networks established
based on VXLAN Tunnel Endpoints (VTEPs). The VNI of each VXLAN network in a VXLAN
pool must be unique.
Before you can use a VXLAN network, create a VXLAN pool in advance.
A VXLAN pool is only a collection of VXLAN networks and cannot be used to create
L3 networks.
VXLAN pool supports two types of SDN: software SDN and hardware SDN.
Software SDN:
The VNI range of a software-SDN VXLAN pool can be
1-16777214.
Hosts in the cluster to which the software-SDN VXLAN pool is
attached must have an IP address as a VXLAN tunnel endpoint
(VTEP) in the specified CIDR.
Generally, a VTEP corresponds to a NIC IP of a compute
node within a cluster. On the Cloud, you can configure a
VTEP according to its CIDR. For example,
Assume that the NIC IP of a compute node is
10.12.0.8, the netmask is 255.0.0.0,
and the gateway is 10.0.0.1. Then, the CIDR
of the VTEP is 10.0.0.1/8.
Assume that the NIC IP of the compute node is
172.20.12.13, the netmask is
255.255.0.0, and the gateway is
172.20.0.1. Then, the CIDR of the VTEP is
172.20.0.1/16.
When a VXLAN pool is attached to a cluster, the IP
address that is associated to the VTEP will be checked
without checking physical L2 devices.
Hardware SDN:
Before you can create a hardware-SDN VXLAN pool, add an SDN
controller to the Cloud in advance.
The VNI range of a hardware-SDN VXLAN pool depends on the
distributed vSwitch to which an SDN controller corresponds.
The host NIC in the cluster to which the hardware-SDN VXLAN pool
is attached must connect to a switch managed by the SDN
controller.
If you use VCFC to configure hardware SDN, configure the mapping
between VLAN and VXLAN on VCFC in advance.
Create a VXLAN Pool
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > VXLAN Pool. On the VXLAN Pool page, click Create
VXLAN Pool. Then, the Create VXLAN Pool page is
displayed.
The following lists two types of VXLAN pools that you can create:
Create a software-SDN VXLAN pool
Create a hardware-SDN VXLAN pool
Create Software-SDN VXLAN Pool
On the displayed page, set the following parameters:
Zone: By default, the current zone is displayed.
Name: Enter a name for the VXLAN pool.The name must be 1 to 128 characters in length and can
contain Chinese characters, letters, digits, spaces, hyphens (-), underscores
(_), periods (.), parenthesis (), colons (:), and plus signs (+) and cannot
begin or end with spaces.
Description: Optional. Enter a description for the
VXLAN pool.
SDN Type: Select
Software.
VNI Range: Enter the start ID and end ID of VXLAN networks.
Note:
You can enter an ID that ranges from 1 to 16777214.
The end ID must be equal to or greater than the start ID.
The two VNI IDs 16777215 and 16777216 are reserved by the system
of this cloud platform.
Cluster: Optional. Attach the VXLAN pool to a cluster.
Note:
You can attach a VXLAN pool to a cluster when you create the
VXLAN pool or after the VXLAN pool is created.
When you attach the VXLAN pool to a cluster, IP addresses of the
compute nodes must be available in the cluster that correspond
to the VTEP CIDR block.
VTEP CIDR: Enter the corresponding VTEP CIDR
block.
Figure 5. Create Software-SDN VXLAN Pool
Create Hardware-SDN VXLAN Pool
On the displayed page, set the following parameters:
Zone: By default, the current zone is displayed.
Name: Enter a name for the VXLAN pool.The name must be 1 to 128 characters in length and can
contain Chinese characters, letters, digits, spaces, hyphens (-), underscores
(_), periods (.), parenthesis (), colons (:), and plus signs (+) and cannot
begin or end with spaces.
Description: Optional. Enter a description for the
VXLAN pool.
SDN Type: Select
Hardware.
SDN Controller: Select an SDN controller.
Note: You
need add an SDN controller to the cloud platform in advance.
VNI Range: Enter the start ID and end ID of
hardware-based VXLAN networks.
Note:
The end ID must be equal to or greater than the start ID.
The VNI range of a hardware-SDN VXLAN pool varies depending on
the virtual distributed switches associated with the SDN
controller.
Cluster: Optional. Attach the VXLAN pool to a
cluster.
Note: You can attach a cluster to a VXLAN pool when you create
the VXLAN pool or after the VXLAN pool is created.
NIC: Enter a host NIC.
Note: The host NICs in the
cluster attached to the VXLAN pool must be connected with the switches
managed by the SDN controller.
Figure 6. Create Hardware-SDN VXLAN Pool
Manage a VXLAN Pool
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > VXLAN Pool. Then, the VXLAN Pool page is displayed.
The following table lists the actions that you can perform on a VXLAN pool.
Action
Description
Create VXLAN Pool
Create a VXLAN pool.
Edit VXLAN Pool
Edit the name and description of the VXLAN pool.
Attach Cluster
Attach the VXLAN pool to a cluster.
Software-SDN VXLAN Pool: You need to specify a VTEP CIDR.
Make sure that the hosts in the cluster attached to the
software-SDN VXLAN pool have an IP address as the VTEP in
the specified CIDR.
Hardware-SDN VXLAN Pool: The host NICs in the cluster
attached to the VXLAN pool must be connected with the
switches managed by the SDN controller.
Detach Cluster
Detach the VXLAN pool from a cluster.
Set Sharing Mode
Set the sharing mode of a resource. The
platform provides the following sharing modes:
Share Globally: Shares the resource to all projects and accounts.
Share to Specified Projects/Accounts: Shares the
resource with specified projects
and accounts.
Not Share: Revokes the resource from
projects and accounts to which the resource is
shared. If you set Sharing Mode to Not Share for a
resource, other projects and
accounts cannot use the resource.
Note:
If you change the Sharing Mode setting of a resource
from Share Globally to Share to Specified
Projects/Accounts, the resource is visible only to
the specified projects or
accounts the resource is shared to.
If the resource that you share to
projects orthe specified accounts has been
used by these projects or
accounts and then you change the Sharing Mode of the
resource, the change does not take effect on the projects or accounts. They can
reverse and use the resource until it is
released.
VXLAN pools created by using hardware SDNs cannot be shared.
Delete VXLAN Pool
Deleting a VXLAN pool also deletes the VXLAN networks in the pool
and the associated L3 networks and VM NICs. Proceed with
caution.
L3 Network
An L3 network is a collection of network configurations for VM
instances, including the network range, gateway, DNS, and network services.
A network range includes an IP range (start IP and end IP), netmask, and
gateway. For example, you can specify the IP range from 172.20.12.2 to
172.20.12.255, set the netmask to 255.255.0.0, and set the
gateway to 172.20.0.1. In addition, you can use a CIDR to specify a
network range, such as 192.168.1.0/24.
DNS provides DNS resolution services used for configuring VM networks.
Concepts
Public network: Generally, a public network is a logical network that is
connected to the Internet. However, in an environment that has no access to the
Internet, you can also create a public network.
A public network can be used in the flat network environment to
create VM instances.
A public network can be used in the VPC network environment to
create VM instances that work with public networks.
Flat network: A flat network is connected to the network where the host
is located and has direct access to the Internet. VM instances in a flat network can
access public networks by using elastic IP addresses.
A flat network supports multiple network services, including DHCP,
User Data, EIP, security group, and port mirroring.
The network services provided by a flat network use the distributed
DHCP and the distributed EIP structure.
The DHCP service provided by a flat network also includes the DNS
feature.
The network model used in the wizard is a flat network.
The flat network architecture based on VxlanNetwork or
HardwareVxlanNetwork is supported.
VPC network: A VPC network is a private network where VM instances can
be created. A VM instance in a VPC network can access the Internet through a VPC
vRouter.
A VPC network provides the following network services: DHCP, User
Data, DNS, SNAT, route table, EIP, port forwarding, load balancing,
IPsec tunnel, security group, dynamic routing, multicast routing,
VPC firewall, port mirroring, and netflow.
The DHCP service of the VPC network uses DHCP by default.
VPC networks mainly use custom Linux VM instances as VPC vRouters to
provide network services.
Network services can act on multiple subnets of a VPC at the same
time, further improving network efficiencies.
Management network: A management network is used to manage physical resources
in the Cloud. For example, you can create a management network to manage access to
hosts, primary storages, backup storages, and VPC vRouters.
Note: When you create a VPC vRouter, you need an IP address
that can be interconnected between the management nodes of the
VPC vRouter. With this IP address, you can deploy an agent and
obtain messages returned by the agent.
Flow network: A flow network is a dedicated network for port mirror
transmission. You can use a flow network to transmit the mirrors of data packets of
NIC ports to the target ports. A flow network cannot be used for
other purposes, such as creating VM instances.
Specific network scenarios:
Storage network: A storage network is the network specified by the
shared storage. You can use a storage network to check the health
state of a VM instance. We recommend that you plan for an
independent storage network in advance to avoid potential
risks.
VDI network: When you create a cluster, you can specify CIDR for the
VDI network in the cluster. In the VDI scenario, the network
traffics generated by the protocol communication between the server
side and client side use the VDI network. If you do not make any
configuration to the VDI network, notice that the management network
will be used by default.
Migration network: When you create a cluster, you can specify CIDR
for the migration network in the cluster. The migration network is
used to migrate VM instances in the Cloud. If you do not make any
configuration to the migration network, notice that the management
network will be used for VM migrations.
Image synchronization network: An image synchronization network is
used to synchronize images among ImageStore backup storages in the
same management node.
If you deployed an independent network for synchronizing
images, you can specify CIDR for the image synchronization
network when you add an ImageStore backup storage.
If you do not make any configuration to the image
synchronization network, notice that the management network
will be used by default.
If you set an image synchronization network for both the
source ImageStore backup storage and target one, only the
image synchronization network in the target ImageStore
backup storage takes effect.
Data network: A data network is the network where data can transfer
between a compute node and a backup storage.
Using an independent data network can avoid network
congestion and improve the data transfer rate.
If you do not make any configuration to the data network,
notice that the management network will be used by
default.
Backup network: If you are using the Backup Service or the
Continuous Data Protection (CDP) service, in the local backup
scenario,both the data backup and recovery are implemented by using
the backup network.
If you deploy an independent network for local backups, you
can specify CIDR for the backup network when you add a local
backup server.
Using an independent backup network can avoid network
congestion and improve the data transfer rate.
If you do not make any configuration to the backup network,
notice that the management network will be used for local
backup by default.
Note:
The Backup Service and the CDP Service are separately
provided in a separate module. To use this feature, purchase
both the Base License and the Plus License. Note that a Base
License is required before you can install a Plus
License.
Considerations
When you create a VM instance, you can specify multiple L3 networks, including
flat networks, VPC networks, or a combination of flat networks and VPC
networks.
The Cloud supports multi-layer networks. In addition, the L2 networks of
multi-layer networks can intercommunicate. Therefore, you need to pay a special
attention to avoid the conflict of IP address spaces.
You can use an L2 network to create multiple L3 networks. However, we recommend
that unless necessary you do not create multiple L3 networks from an L2 network.
This may cause the DHCP services of these L3 networks unable to work as
expected.
The network services and features supported by an L3 network are related to the
network architecture model (flat network, VPC network) and the configured
network protocol version (IPv4, IPv6). If a network is configured with both IPv4
and IPv6 protocols, servers of these two protocol types are loaded at the same
time to provide corresponding services.
IPv4
IPv6
Flat network
Supported network services: DHCP, User Data, EIP,
security group, and port mirroring
Supported network services: DHCP, DNS, EIP, and security
group
VPC network
Supported network services: DHCP, User Data, DNS, SNAT,
route table, EIP, port forwarding, load balancing, IPsec
tunnel, security group, dynamic routing, multicast routing,
VPC firewall, port mirroring, and Netflow
Supported network services: DHCP, DNS, and security
group
Supported network service: VPC vRouter HA group
Supported network service: VPC vRouter HA group
If you use an L2 network of the HardwareVxlanNetwork type, the L3 network
created from the L2 network supports only flat network and corresponding network
services.
If you use the Smart NIC network acceleration mode for an L2 network, you can
use the L2 network to create only IPv4 VPC networks and provide corresponding
network services (excluding security group and port mirroring services).
DHCP: By default, the VPC network provides distributed DHCP services by using
the flat network service module.
DNS: A VPC vRouter can act as a DNS server to provide DNS services. The DNS
address in a VM instance is the IP address of the VPC vRouter. Note that the DNS
address that you set is forwarded by the VPC vRouter.
SNAT: A VPC vRouter can provide the source network address translation (SNAT)
services for VM instances. Then, the VM instances can directly access the
Internet by using SNAT.
Route table: You can manage and customize routes through route tables.
Security group: The security group service is provided by the security group
network service module. You can configure and manage firewalls for VM instances
by using iptables.
Elastic IP address (EIP): You can bind an EIP to a VPC network. Then, the public
network can interconnect with the private network of the VM instance.
Port forwarding: The port forwarding service allows a public IP address to
interconnect with the private IP address of a VM instance. To be more specific,
you can create port forwarding rules to allow external networks to reach
specific ports of your VM instances.
Load balancing: The load balancing service distributes your inbound traffics
from a public IP address to a group of backend VM instances. Then, this service
automatically checks and isolates the VM instances that are unavailable.
IPsec tunnel: The IPsec tunnel can be used to achieve interconnection between
different virtual private networks (VPNs).
Dynamic routing: The VPC vRouter supports the Open Shortest Path First (OSPF)
routing protocol, which is used to distribute routing information within a
single autonomous system.
Multicast routing: The VPC vRouter forwards the multicast information sent by
the multicast source to VM instances, achieving one-to-multi-point communication
in the transmission side and receiving side.
VPC firewall: The VPC firewall filters the south-north traffic on the VPC
vRouter ports, effectively protecting the VPC communication security and VPC
vRouter security.
Netflow: The Netflow service monitors and analyzes the inbound and outbound
traffics of the VPC vRouter NICs. Currently, the following two types of
data-flow output format are supported: Netflow V5 and Netflow V9.
Public Network
Create a Public Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > Public Network. On the Public Network page, click Create
Public Network. The Create Public Network page
appears.
The following lists the two public network creation scenarios:
Create an IPv4 public network
Create an IPv6 public network
Create IPv4 Public Network
On the displayed page, set the following parameters:
Name: Enter a name for the public network.
Description: Optional. Enter a description for the
public network.
L2 Network: Select an L2 network for the public
network.
Note:ZStack Cloud allows you to use
an L2 network to create multiple L3 networks. However, we recommend that
you do not use an L2 network to create multiple L3 networks if not for
specific business needs.
On the Select L2
Network page, two tabs are displayed:
Recommended: lists L2 networks in the
current zone that are not attached to an L3 network.
All: lists all L2 networks in the current
zone.
Network Address Type: Select IPv4.
Network Range Method: Select a method to add a
network range for the public network. You can select IP Range or CIDR.
If
you select IP Range, you need to set the following parameters:
Start IP: Set a start IP address for the
network range, for example, 172.20.108.100.
End IP: Set an end IP address for the
network range, for example, 172.20.108.200.
Netmask: Set a netmask for the network
range, for example, 255.255.0.0.
Gateway: Set a gateway for the network
range, for example, 172.20.0.1.
IP Allocation Policy: Optional. IP
addresses can be assigned according to the following three
allocation policies:
Random: The system randomly
assigns IP addresses from the network range.
Allocate in Order:
The system assigns all available IP addresses
from the network range in ascending order.
Released IP addresses are assigned in the next
allocation.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned first in the next
allocation.
Allocate in Cycle:
The system assigns available IP addresses to VM
instances from the network range in ascending
order. Released IP addresses are assigned when
currently available IP addresses are used up.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned after
192.168.0.120 is used.
DHCP Service: Choose
whether to enable the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP:
Optional. Set an IP address for the DHCP server, for
example, 172.20.108.10.
Note:
A DHCP IP is an IP address used by the DHCP
service to assign IP addresses to resources that
use this L3 network.
If you create an L3 network for the first time
with the DHCP service enabled, or if you add the
first network range to an L3 network with the DHCP
service enabled, you can customize the DHCP
IP.
If the L3 network has a DHCP IP, you cannot
customize the DHCP IP when you add a network
range.
The DHCP IP can be in or outside the added IP
range, but it must be an unoccupied IP address in
the CIDR block of the added IP range
The IP range determined by the start IP and
end IP cannot contain the link-local address
169.254.0.0/16.
If you select random as the IP allocation
policy and this field is left blank, the system
randomly assigns IP addresses from the added
network range.
If you select allocate in order/allocate in
cycle as the IP allocation policy and this field
is left blank, the system uses the start IP
address in the network range as the DHCP IP.
DNS: Add a DNS server
to provide domain name resolution services for the public
network. You can specify 223.5.5.5, 8.8.8.8, or
114.114.114.114.
Note: When you add an IP range for an IPv4 L3 network, note that:
The IP range cannot contain gateway IP addresses, broadcast
addresses, or network addresses.
The IP range of a private network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 7. Create IPv4 Public Network Using IP Range
If you select CIDR, you need to set the following
parameters:
CIDR: Set a CIDR block for the public
network, for example, 192.168.108.1/24.
Gateway: Set a gateway for the public
network, for example, 192.168.108.1.
Note:
We recommend that you use the first or last IP
address in the specified CIDR block as the
gateway.
If left blank, the first IP address in the specified
CIDR block is used as the gateway.
IP Allocation Policy: Optional. IP
addresses can be assigned according to the following three
allocation policies:
Random: The system randomly
assigns IP addresses from the network range.
Allocate in Order:
The system assigns all available IP addresses
from the network range in ascending order.
Released IP addresses are assigned in the next
allocation.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned first in the next
allocation.
Allocate in Cycle:
The system assigns available IP addresses to VM
instances from the network range in ascending
order. Released IP addresses are assigned when
currently available IP addresses are used up.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned after
192.168.0.120 is used.
DHCP Service: Choose whether to enable
the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP: Optional. Set an IP
address for the DHCP server, for example,
172.20.108.10.
Note:
A DHCP IP is an IP address used by the DHCP
service to assign IP addresses to resources that
use this L3 network.
If you create an L3 network for the first time
with the DHCP service enabled, or if you add the
first network range to an L3 network with the DHCP
service enabled, you can customize the DHCP
IP.
If the L3 network has a DHCP IP, you cannot
customize the DHCP IP when you add a network
range.
The DHCP IP can be in or outside the added IP
range, but it must be an unoccupied IP address in
the CIDR block of the added IP range
The IP range determined by the start IP and
end IP cannot contain the link-local address
169.254.0.0/16.
If you select random as the IP allocation
policy and this field is left blank, the system
randomly assigns IP addresses from the added
network range.
If you select allocate in order/allocate in
cycle as the IP allocation policy and this field
is left blank, the system uses the start IP
address in the network range as the DHCP IP.
DNS: Add a DNS server
to provide domain name resolution services for the public
network. You can specify 223.5.5.5, 8.8.8.8, or
114.114.114.114.
Note: When you add a CIDR block for an IPv4 L3 network, note that:
The CIDR block cannot contain the link-local address
169.254.0.0/16.
The CIDR block of a private network cannot overlap with the
IP range of a public network used to create a vRouter
offering or of a management network.
Figure 8. Create IPv4 Public Network Using CIDR Block
Create IPv6 Public Network
On the displayed page, set the following parameters:
Name: Enter a name for the public network.
Description: Optional. Enter a description for the
public network.
L2 Network: Select an L2 network for the public
network.
Note:ZStack Cloud allows you to use
an L2 network to create multiple L3 networks. However, we recommend that
you do not use an L2 network to create multiple L3 networks if not for
specific business needs.
On the Select L2
Network page, two tabs are displayed:
Recommended: lists L2 networks in the
current zone that are not attached to an L3 network.
All: lists all L2 networks in the current
zone.
Network Address Type: Select IPv6.
Network Range Method: Select a method to add a
network range for the public network. You can select IP Range or CIDR.
If
you select IP Range, you need to set the following parameters:
IP Configuration Mode: Select the IP
distribution mode:
Stateful-DHCP: The interface address and other
parameters are all configured through DHCP. The IP range
method supports stateful DHCP.
Start IP: Set a start IP address for the
network range, for example,
2000:910A:2222:5498:8475:1111:3900:2002.
End IP: Set an end IP address for the
network range, for example,
2000:910A:2222:5498:8475:1111:3900:2009.
Prefix Length: Set a prefix length for
the network range, for example, 64.
Note: The prefix length
ranges from 64 to 126. If you set a length smaller than 64,
VM creation may fail.
Gateway: Set a gateway for the network
range, for example,
2000:910A:2222:5498:8475:1111:3900:2001.
DHCP Service: Choose whether to enable
the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP: Optional. Set an IP
address for the DHCP server, for example,
2000:910A:2222:5498:8475:1111:3900:2006.
Note:
When you create an L3 network and enable the
DHCP service for the first time, or when you add
the first network range for an L3 network that has
the DHCP service enabled, you can specify an IP
address for the DHCP server.
If a DHCP IP is specified for an L3 network,
you cannot specify another DHCP IP when you add a
network range for the network.
The DHCP IP can be within or out of the added
IP range. However, the IP address must be within
the CIDR block to which the added IP range belongs
and must not be in use.
The IP range determined by the start IP and
end IP cannot contain the link-local address
fe80::/10.
If not specified, the system would randomly
specify a DHCP IP within the added IP range for
the DHCP server.
DNS: Add a DNS server
to provide domain name resolution services for the public
network. You can specify 240C::6644 or
240C::6666.
Note: When you add an IP range for an IPv6 L3 network, note that:
The IP range cannot contain gateway IP addresses.
The IP range determined by the start IP and end IP cannot
contain the link-local address fe80::/10.
The IP range of a private network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 9. Create IPv6 Public Network Using IP Range
If you select CIDR, you need to set the following parameters:
IP Configuration Mode: Select the IP
distribution mode:
Stateful-DHCP: The interface address and other
parameters are all configured through DHCP. The IP range
method supports stateful DHCP.
Stateless-DHCP: The interface address is automatically
derived from the route advertisement prefix and the
interface MAC address. Other parameters are configured
through DHCP.
SLAAC: The interface address is automatically derived
from the prefix of the route advertisement that also
contains other parameters.
CIDR: Set a CIDR block for the public
network, for example, 234E:2457:3D::/64.
DHCP Service: Choose
whether to enable the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP: Optional. Set an IP
address for the DHCP server, for example,
234E:2457:3D::F.
Note:
When you create an L3 network and enable the
DHCP service for the first time, or when you add
the first network range for an L3 network that has
the DHCP service enabled, you can specify an IP
address for the DHCP server.
If a DHCP IP is specified for an L3 network,
you cannot specify another DHCP IP when you add a
network range for the network.
The DHCP IP must be within the CIDR block and
must not be in use.
If not specified, the system would randomly
specify a DHCP IP within the added IP range for
the DHCP server.
The first IP address in the CIDR block is
predefined as the default gateway and cannot be
used as a DHCP server IP.
DNS: Add a DNS server
to provide domain name resolution services for the public
network. You can specify 240C::6644 or
240C::6666.
Note: When you add a CIDR block for an IPv6 L3 network, note that:
The first IP address in the CIDR block is used as the
default gateway.
The CIDR block cannot contain the link-local address
fe80::/10.
The IP range of a private network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 11. Create IPv6 Public Network Using CIDR Block
Considerations
Make sure that the network range of the public network is connected to the external
networks. Otherwise, VPC vRouters may not work as expected.
Manage a Public Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > Public Network. The Public Network page appears.
The following table lists the actions that you can perform on a public network.
Action
Description
Create Public Network
Create a public network.
Add DNS
Add an IPv4 or IPv6 DNS server address:
IPv4 address: 223.5.5.5, 8.8.8.8, or
114.114.114.114.
IPv6 address: 240C::6644 or 240C::6666.
Set Sharing Mode
Set the sharing mode of a public network. The platform provides
the following sharing modes:
Share Globally: shares a public network with all projects
and normal accounts that have the Tenant Management
license.
Share to Specified Projects/Accounts: shares a public
network with specified projects and normal accounts that
have the Tenant Management license.
Not Share: The public network is not shared with projects or
normal accounts and can be used only by the admin.
Note:
Modifying the sharing mode will also modify the
permissions on shared public networks.
Public networks that are used by projects or accounts
before a modification are not affected until the public
networks are released.
Delete Public Network
Delete a public network.
Note: Deleting a public network also
detaches the VM NICs that are using this network, and deletes
the corresponding vRouters, network services, and vRouter
offerings. Proceed with caution.
Flat Network
Create a Flat Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > Flat Network. On the Flat Network page, click Create
Flat Network. The Create Flat Network page
appears.
The following lists the three flat network creation scenarios:
Create an IPv4 flat network
Create an IPv6 flat network
Create a flat network disabled with IP Address Management
Create IPv4 Flat Network
On the displayed page, set the following parameters:
Name: Enter a name for the flat network.
Description: Optional. Enter a description for the
flat network.
L2 Network: Select an L2 network for the flat
network.
Note:ZStack Cloud allows you to use
an L2 network to create multiple L3 networks. However, we recommend that
you do not use an L2 network to create multiple L3 networks if not for
specific business needs.
On the Select L2
Network page, two tabs are displayed:
Recommended: lists L2 networks in the
current zone that are not attached to an L3 network.
All: lists all L2 networks in the current
zone.
IP Address Management: Choose whether to enable the
IP Address Management (IPAM) service for the L3 network. If you enable IPAM,
you can add network ranges to allocate IP addresses to resources on the L3
network. Enable IPAM here.
Network Address Type: Select IPv4.
Network Range Method: Select a method to add a
network range for the flat network. You can select IP Range or CIDR.
If
you select IP Range, you need to set the following parameters:
Start IP: Set a start IP address for the
network range, for example, 172.20.108.100.
End IP: Set an end IP address for the
network range, for example, 172.20.108.200.
Netmask: Set a netmask for the network
range, for example, 255.255.0.0.
Gateway: Set a gateway for the network
range, for example, 172.20.0.1.
IP Allocation Policy: Optional. IP
addresses can be assigned according to the following three
allocation policies:
Random: The system randomly
assigns IP addresses from the network range.
Allocate in Order:
The system assigns all available IP addresses
from the network range in ascending order.
Released IP addresses are assigned in the next
allocation.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned first in the next
allocation.
Allocate in Cycle:
The system assigns available IP addresses to VM
instances from the network range in ascending
order. Released IP addresses are assigned when
currently available IP addresses are used up.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned after
192.168.0.120 is used.
DHCP Service: Choose
whether to enable the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP:
Optional. Set an IP address for the DHCP server, for
example, 172.20.108.10.
Note:
A DHCP IP is an IP address used by the DHCP
service to assign IP addresses to resources that
use this L3 network.
If you create an L3 network for the first time
with the DHCP service enabled, or if you add the
first network range to an L3 network with the DHCP
service enabled, you can customize the DHCP
IP.
If the L3 network has a DHCP IP, you cannot
customize the DHCP IP when you add a network
range.
The DHCP IP can be in or outside the added IP
range, but it must be an unoccupied IP address in
the CIDR block of the added IP range
The IP range determined by the start IP and
end IP cannot contain the link-local address
169.254.0.0/16.
If you select random as the IP allocation
policy and this field is left blank, the system
randomly assigns IP addresses from the added
network range.
If you select allocate in order/allocate in
cycle as the IP allocation policy and this field
is left blank, the system uses the start IP
address in the network range as the DHCP IP.
DNS: Add a DNS server
to provide domain name resolution services for the flat network.
You can specify 223.5.5.5, 8.8.8.8, or
114.114.114.114.
Note: When you add an IP range for an IPv4 L3 network, note
that:
The IP range cannot contain gateway IP addresses, broadcast
addresses, or network addresses.
The IP range of a flat network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 13. Create IPv4 Flat Network Using IP Range
If you select CIDR, you need to set the following
parameters:
CIDR: Set a CIDR block for the flat
network, for example, 192.168.108.1/24.
Gateway: Set a gateway for the flat
network, for example, 192.168.108.1.
Note:
We recommend that you use the first or last IP
address in the specified CIDR block as the
gateway.
If left blank, the first IP address in the specified
CIDR block is used as the gateway.
IP Allocation Policy: Optional. IP
addresses can be assigned according to the following three
allocation policies:
Random: The system randomly
assigns IP addresses from the network range.
Allocate in Order:
The system assigns all available IP addresses
from the network range in ascending order.
Released IP addresses are assigned in the next
allocation.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned first in the next
allocation.
Allocate in Cycle:
The system assigns available IP addresses to VM
instances from the network range in ascending
order. Released IP addresses are assigned when
currently available IP addresses are used up.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned after
192.168.0.120 is used.
DHCP Service: Choose whether to enable
the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP: Optional. Set an IP
address for the DHCP server, for example,
172.20.108.10.
Note:
A DHCP IP is an IP address used by the DHCP
service to assign IP addresses to resources that
use this L3 network.
If you create an L3 network for the first time
with the DHCP service enabled, or if you add the
first network range to an L3 network with the DHCP
service enabled, you can customize the DHCP
IP.
If the L3 network has a DHCP IP, you cannot
customize the DHCP IP when you add a network
range.
The DHCP IP can be in or outside the added IP
range, but it must be an unoccupied IP address in
the CIDR block of the added IP range
The IP range determined by the start IP and
end IP cannot contain the link-local address
169.254.0.0/16.
If you select random as the IP allocation
policy and this field is left blank, the system
randomly assigns IP addresses from the added
network range.
If you select allocate in order/allocate in
cycle as the IP allocation policy and this field
is left blank, the system uses the start IP
address in the network range as the DHCP IP.
DNS: Add a DNS server
to provide domain name resolution services for the flat network.
You can specify 223.5.5.5, 8.8.8.8, or
114.114.114.114.
Note: When you add a CIDR block for an IPv4 L3 network, note
that:
The CIDR block cannot contain the link-local address
169.254.0.0/16.
The CIDR block of a flat network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 14. Create IPv4 Flat Network Using CIDR Block
Create IPv6 Flat Network
On the displayed page, set the following parameters:
Name: Enter a name for the flat network.
Description: Optional. Enter a description for the
flat network.
L2 Network: Select an L2 network for the flat
network.
Note:ZStack Cloud allows you to use
an L2 network to create multiple L3 networks. However, we recommend that
you do not use an L2 network to create multiple L3 networks if not for
specific business needs.
On the Select L2
Network page, two tabs are displayed:
Recommended: lists L2 networks in the
current zone that are not attached to an L3 network.
All: lists all L2 networks in the current
zone.
IP Address Management: Choose whether to enable the
IP Address Management (IPAM) service for the L3 network. If you enable IPAM,
you can add network ranges to allocate IP addresses to resources on the L3
network. Enable IPAM here.
Network Address Type: Select IPv6.
Network Range Method: Select a method to add a
network range for the flat network. You can select IP Range or CIDR.
If
you select IP Range, you need to set the following parameters:
IP Configuration Mode: Select the IP
distribution mode:
Stateful-DHCP: The interface address and other
parameters are all configured through DHCP. The IP range
method supports stateful DHCP.
Start IP: Set a start IP address for the
network range, for example,
2000:910A:2222:5498:8475:1111:3900:2002.
End IP: Set an end IP address for the
network range, for example,
2000:910A:2222:5498:8475:1111:3900:2009.
Prefix Length: Set a prefix length for
the network range, for example, 64.
Note: The prefix length
ranges from 64 to 126. If you set a length smaller than 64,
VM creation may fail.
Gateway: Set a gateway for the network
range, for example,
2000:910A:2222:5498:8475:1111:3900:2001.
DHCP Service: Choose whether to enable
the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP: Optional. Set an IP
address for the DHCP server, for example,
2000:910A:2222:5498:8475:1111:3900:2006.
Note:
When you create an L3 network and enable the
DHCP service for the first time, or when you add
the first network range for an L3 network that has
the DHCP service enabled, you can specify an IP
address for the DHCP server.
If a DHCP IP is specified for an L3 network,
you cannot specify another DHCP IP when you add a
network range for the network.
The DHCP IP can be within or out of the added
IP range. However, the IP address must be within
the CIDR block to which the added IP range belongs
and must not be in use.
The IP range determined by the start IP and
end IP cannot contain the link-local address
fe80::/10.
If not specified, the system would randomly
specify a DHCP IP within the added IP range for
the DHCP server.
DNS: Add a DNS server
to provide domain name resolution services for the public
network. You can specify 240C::6644 or
240C::6666.
Note: When you add an IP range for an IPv6 L3 network, note
that:
The IP range cannot contain gateway IP addresses.
The IP range determined by the start IP and end IP cannot
contain the link-local address fe80::/10.
The IP range of a flat network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 15. Create IPv6 Flat Network Using IP Range
If you select CIDR, you need to set the following
parameters:
IP Configuration Mode: Select the IP
distribution mode:
Stateful-DHCP: The interface address and other
parameters are all configured through DHCP. The IP range
method supports stateful DHCP.
Stateless-DHCP: The interface address is automatically
derived from the route advertisement prefix and the
interface Mac address. Other parameters are configured
through DHCP.
SLAAC: The interface address is automatically derived
from the prefix of the route advertisement that also
contains other parameters.
CIDR: Set a CIDR block for the flat
network, for example, 234E:2457:3D::/64.
DHCP Service: Choose whether to enable
the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP: Optional. Set an IP
address for the DHCP server, for example,
234E:2457:3D::F.
Note:
When you create an L3 network and enable the
DHCP service for the first time, or when you add
the first network range for an L3 network that has
the DHCP service enabled, you can specify an IP
address for the DHCP server.
If a DHCP IP is specified for an L3 network,
you cannot specify another DHCP IP when you add a
network range for the network.
The DHCP IP must be within the CIDR block and
must not be in use.
If not specified, the system would randomly
specify a DHCP IP within the added IP range for
the DHCP server.
The first IP address in the CIDR block is
predefined as the default gateway and cannot be
used as a DHCP server IP.
DNS: Add a DNS server
to provide domain name resolution services for the public
network. You can specify 240C::6644 or
240C::6666.
Note: When you add a CIDR block for an IPv6 L3 network, note
that:
The first IP address in the CIDR block is used as the
default gateway.
The CIDR block cannot contain the link-local address
fe80::/10.
The IP range of a flat network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 16. Create IPv6 Flat Network Using CIDR Block
Create an Flat Network Disabled with IP Address Management
On the displayed page, set the following parameters:
Name: Enter a name for the flat network.
Description: Optional. Enter a description for the
flat network.
L2 Network: Select an L2 network for the flat
network.
Note:ZStack Cloud allows you to use
an L2 network to create multiple L3 networks. However, we recommend that
you do not use an L2 network to create multiple L3 networks if not for
specific business needs.
On the Select L2
Network page, two tabs are displayed:
Recommended: lists L2 networks in the
current zone that are not attached to an L3 network.
All: lists all L2 networks in the current
zone.
IP Address Management: Choose whether to enable the
IP Address Management (IPAM) service for the L3 network. If you enable IPAM,
you can add network ranges to allocate IP addresses to resources on the L3
network. Disable IPAM here.
Note:
If you disable IPAM for an L3 network, you cannot add network
ranges, set IP allocation policy, or enable DHCP service for the
L3 network. The system does not allocate IP addresses for
resources on this network automatically. You can assign and
manage IP addresses by yourself.
You can disable IPAM only for flat networks.
DHCP Service: The DHCP service is disabled by default
after you disable IPAM and cannot be enabled.
DNS: Optional. Add a DNS server to provide the DNS
service for the L3 network.
Figure 17. Create Flat Network Disabled with IP Address Management
Manage a Flat Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > Flat Network. The Flat Network page appears.
The following table lists the actions that you can perform on a flat network.
Action
Description
Create Flat Network
Create a flat network.
Add DNS
Add an IPv4 or IPv6 DNS server address:
IPv4 address: 223.5.5.5, 8.8.8.8, or
114.114.114.114.
IPv6 address: 240C::6644 or 240C::6666.
Set Sharing Mode
Set the sharing mode of a flat network. The platform provides the
following sharing modes:
Share Globally: shares a flat network with all projects and
normal accounts that have the Tenant Management
license.
Share to Specified Projects/Accounts: shares a flat network
with specified projects and normal accounts that have the
Tenant Management license.
Not Share: The flat network is not shared with projects or
normal accounts and can be used only by the admin.
Note:
Modifying the sharing mode will also modify the
permissions on shared flat networks.
Flat networks that are used by projects or accounts
before a modification are not affected until the flat
networks are released.
Delete Flat Network
Delete a flat network.
Note: Deleting a flat network also detaches
the VM NICs that are using this network, and deletes the
corresponding vRouters, network services, and vRouter offerings.
Proceed with caution.
VPC Network
Create a VPC Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > VPC Network. On the VPC Network page, click Create
VPC Network. The Create VPC Network page
appears.
The following lists the two VPC network creation scenarios:
Create an IPv4 VPC network
Create an IPv6 VPC network
Create IPv4 VPC Network
On the displayed page, set the following parameters:
Name: Enter a name for the VPC network.
Description: Optional. Enter a description for the
VPC network.
L2 Network: Select an L2 network for the VPC
network.
Note:ZStack Cloud allows you to use
an L2 network to create multiple L3 networks. However, we recommend that
you do not use an L2 network to create multiple L3 networks if not for
specific business needs.
On the Select L2
Network page, two tabs are displayed:
Recommended: lists L2 networks in the
current zone that are not attached to an L3 network.
All: lists all L2 networks in the current
zone.
VPC vRouter: Optional. You can specify a VPC vRouter
when you create a VPC network or attach a VPC vRouter after you create the
VPC network.
Network Address Type: Select IPv4.
Network Range Method: Select a method to add a
network range for the VPC network. You can select IP Range or CIDR.
If you
select IP Range, you need to set the following parameters:
Start IP: Set a start IP address for the
network range, for example, 172.20.108.100.
End IP: Set an end IP address for the
network range, for example, 172.20.108.200.
Netmask: Set a netmask for the network
range, for example, 255.255.0.0.
Gateway: Set a gateway for the network
range, for example, 172.20.0.1.
IP Allocation Policy: Optional. IP
addresses can be assigned according to the following three
allocation policies:
Random: The system randomly
assigns IP addresses from the network range.
Allocate in Order:
The system assigns all available IP addresses
from the network range in ascending order.
Released IP addresses are assigned in the next
allocation.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned first in the next
allocation.
Allocate in Cycle:
The system assigns available IP addresses to VM
instances from the network range in ascending
order. Released IP addresses are assigned when
currently available IP addresses are used up.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned after
192.168.0.120 is used.
DHCP Service: Choose
whether to enable the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP:
Optional. Set an IP address for the DHCP server, for
example, 172.20.108.10.
Note:
A DHCP IP is an IP address used by the DHCP
service to assign IP addresses to resources that
use this L3 network.
If you create an L3 network for the first time
with the DHCP service enabled, or if you add the
first network range to an L3 network with the DHCP
service enabled, you can customize the DHCP
IP.
If the L3 network has a DHCP IP, you cannot
customize the DHCP IP when you add a network
range.
The DHCP IP can be in or outside the added IP
range, but it must be an unoccupied IP address in
the CIDR block of the added IP range
The IP range determined by the start IP and
end IP cannot contain the link-local address
169.254.0.0/16.
If you select random as the IP allocation
policy and this field is left blank, the system
randomly assigns IP addresses from the added
network range.
If you select allocate in order/allocate in
cycle as the IP allocation policy and this field
is left blank, the system uses the start IP
address in the network range as the DHCP IP.
DNS: Provide DNS services for an L3
network. If you do not specify a DNS address manually, the VPC
network uses its gateway address as the DNS address by default.
This DNS cannot be deleted and prohibits you from adding other
DNS after the creation.
Note: When you add an IP range for an IPv4 L3 network, note
that:
The IP range cannot contain gateway IP addresses, broadcast
addresses, or network addresses.
The IP range of a VPC network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 18. Create IPv4 VPC Network Using IP Range
If you select CIDR, you need to set the following
parameters:
CIDR: Set a CIDR block for the VPC
network, for example, 192.168.108.1/24.
Gateway: Set a gateway for the VPC
network, for example, 192.168.108.1.
Note:
We recommend that you use the first or last IP
address in the specified CIDR block as the
gateway.
If left blank, the first IP address in the specified
CIDR block is used as the gateway.
IP Allocation Policy: Optional. After the
DHCP service is enabled, IP addresses can be assigned according
to the following three allocation policies:
Random: The system randomly
assigns IP addresses from the network range.
Allocate in Order:
The system assigns all available IP addresses
from the network range in ascending order.
Released IP addresses are assigned in the next
allocation.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned first in the next
allocation.
Allocate in Cycle:
The system assigns available IP addresses to VM
instances from the network range in ascending
order. Released IP addresses are assigned when
currently available IP addresses are used up.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned after
192.168.0.120 is used.
DHCP Service: Choose
whether to enable the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP: Optional. Set an IP
address for the DHCP server, for example,
172.20.108.10.
Note:
A DHCP IP is an IP address used by the DHCP
service to assign IP addresses to resources that
use this L3 network.
If you create an L3 network for the first time
with the DHCP service enabled, or if you add the
first network range to an L3 network with the DHCP
service enabled, you can customize the DHCP
IP.
If the L3 network has a DHCP IP, you cannot
customize the DHCP IP when you add a network
range.
The DHCP IP can be in or outside the added IP
range, but it must be an unoccupied IP address in
the CIDR block of the added IP range
The IP range determined by the start IP and
end IP cannot contain the link-local address
169.254.0.0/16.
If you select random as the IP allocation
policy and this field is left blank, the system
randomly assigns IP addresses from the added
network range.
If you select allocate in order/allocate in
cycle as the IP allocation policy and this field
is left blank, the system uses the start IP
address in the network range as the DHCP IP.
DNS: Provide DNS services for an L3
network. If you do not specify a DNS address manually, theVPC
network uses its gateway address as the DNS address by default.
This DNS cannot be deleted and prohibits you from adding other
DNS after the creation.
Note: When you add a CIDR block for an IPv4 L3 network, note
that:
The CIDR block cannot contain the link-local address
169.254.0.0/16.
The CIDR block of a VPC network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 19. Create IPv4 VPC Network Using CIDR Block
Create IPv6 VPC Network
On the displayed page, set the following parameters:
Name: Enter a name for the VPC network.
Description: Optional. Enter a description for the
VPC network.
L2 Network: Select an L2 network for the VPC
network.
Note:ZStack Cloud allows you to use
an L2 network to create multiple L3 networks. However, we recommend that
you do not use an L2 network to create multiple L3 networks if not for
specific business needs.
On the Select L2
Network page, two tabs are displayed:
Recommended: lists L2 networks in the
current zone that are not attached to an L3 network.
All: lists all L2 networks in the current
zone.
VPC vRouter: Optional. You can specify a VPC vRouter
when you create a VPC network or attach a VPC vRouter to a created VPC
network.
Network Address Type: Select IPv6.
Network Range Method: Select a method to add a
network range for the VPC network. You can select IP Range or CIDR.
If you
select IP Range, you need to set the following parameters:
IP Configuration Mode: Select the IP
distribution mode:
Stateful-DHCP: The interface address and other
parameters are all configured through DHCP. The IP range
method supports stateful DHCP.
Start IP: Set a start IP address for the
network range, for example,
2000:910A:2222:5498:8475:1111:3900:2002.
End IP: Set an end IP address for the
network range, for example,
2000:910A:2222:5498:8475:1111:3900:2009.
Prefix Length: Set a prefix length for
the network range, for example, 64.
Note: The prefix length
ranges from 64 to 126. If you set a length smaller than 64,
VM creation may fail.
Gateway: Set a gateway for the network
range, for example,
2000:910A:2222:5498:8475:1111:3900:2001.
DHCP Service: Choose whether to enable
the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP: Optional. Set an IP
address for the DHCP server, for example,
2000:910A:2222:5498:8475:1111:3900:2006.
Note:
When you create an L3 network and enable the
DHCP service for the first time, or when you add
the first network range for an L3 network that has
the DHCP service enabled, you can specify an IP
address for the DHCP server.
If a DHCP IP is specified for an L3 network,
you cannot specify another DHCP IP when you add a
network range for the network.
The DHCP IP can be within or out of the added
IP range. However, the IP address must be within
the CIDR block to which the added IP range belongs
and must not be in use.
The IP range determined by the start IP and
end IP cannot contain the link-local address
fe80::/10.
If not specified, the system would randomly
specify a DHCP IP within the added IP range for
the DHCP server.
DNS: Provide DNS services for an L3
network. If you do not specify a DNS address manually, the VPC
network uses its gateway address as the DNS address by default.
This DNS cannot be deleted and prohibits you from adding other
DNS after the creation.
Note: When you add an IP range for an IPv6 L3 network, note
that:
The IP range cannot contain gateway IP addresses.
The IP range determined by the start IP and end IP cannot
contain the link-local address fe80::/10.
The IP range of a VPC network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 20. Create IPv6 VPC Network Using IP Range
If you select CIDR, you need to set the following
parameters:
IP Configuration Mode: Select the IP
distribution mode:
Stateful-DHCP: The interface address and other
parameters are all configured through DHCP. The IP range
method supports stateful DHCP.
Stateless-DHCP: The interface address is automatically
derived from the route advertisement prefix and the
interface Mac address. Other parameters are configured
through DHCP.
SLAAC: The interface address is automatically derived
from the prefix of the route advertisement that also
contains other parameters.
CIDR: Set a CIDR block for the VPC
network, for example, 234E:2457:3D::/64.
DHCP Service: Choose whether to enable
the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP: Optional. Set an IP
address for the DHCP server, for example,
234E:2457:3D::F.
Note:
When you create an L3 network and enable the
DHCP service for the first time, or when you add
the first network range for an L3 network that has
the DHCP service enabled, you can specify an IP
address for the DHCP server.
If a DHCP IP is specified for an L3 network,
you cannot specify another DHCP IP when you add a
network range for the network.
The DHCP IP must be within the CIDR block and
must not be in use.
If not specified, the system would randomly
specify a DHCP IP within the added IP range for
the DHCP server.
The first IP address in the CIDR block is
predefined as the default gateway and cannot be
used as a DHCP server IP.
DNS: Provide DNS services for an L3
network. If you do not specify a DNS address manually, the VPC
network uses its gateway address as the DNS address by default.
This DNS cannot be deleted and prohibits you from adding other
DNS after the creation.
Note: When you add a CIDR block for an IPv6 L3 network, note
that:
The first IP address in the CIDR block is used as the
default gateway.
The CIDR block cannot contain the link-local address
fe80::/10.
The IP range of a VPC network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 21. Create IPv6 VPC Network Using CIDR Block
Manage a VPC Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > VPC Network. The VPC Network page appears.
The following table lists the actions that you can perform on a VPC network.
Action
Description
Create VPC Network
Create a VPC network.
Set Sharing Mode
Set the sharing mode of a VPC network. The platform provides the
following sharing modes:
Share Globally: shares a VPC network with all projects and
normal accounts that have the Tenant Management
license.
Share to Specified Projects/Accounts: shares a VPC network
with specified projects and normal accounts that have the
Tenant Management license.
Not Share: The VPC network is not shared with projects or
normal accounts and can be used only by the admin.
Note:
Modifying the sharing mode will also modify the
permissions on shared VPC networks.
VPC networks that are used by projects or accounts
before a modification are not affected until the VPC
networks are released.
Attach VPC vRouter
Attach a VPC vRouter to the VPC network.
Detach VPC vRouter
Detach a VPC vRouter from the VPC network.
Delete VPC Network
Delete a VPC network.
Note: Deleting a VPC network also detaches
the VM NICs that are using this network.
Management Network
Create a Management Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > Dedicated Network > Management Network. On the Management Network page, click
Create Management Network. Then, the Create
Management Network page is displayed.
Create Management Network
On the displayed page, set the following parameters:
Name: Enter a name for the management network.
Description: Optional. Enter a description for the
management network.
L2 Network: Select an L2 network for the management
network.
Note:ZStack Cloud allows you to use
an L2 network to create multiple L3 networks. However, we recommend that
you do not use an L2 network to create multiple L3 networks if not for
specific business needs.
On the Select L2
Network page, two tabs are displayed:
Recommended: lists L2 networks in the
current zone that are not attached to an L3 network.
All: lists all L2 networks in the current
zone.
Network Range Method: Select a method to add a
network range for the management network. You can select IP Range or
CIDR.
If you select IP Range, you need to set the following
parameters:
Start IP: Set a start IP address for the
network range, for example, 172.20.108.100.
End IP: Set an end IP address for the
network range, for example, 172.20.108.200.
Netmask: Set a netmask for the network
range, for example, 255.255.0.0.
Gateway: Set a gateway for the network
range, for example, 172.20.0.1.
Note: When you add an IP range for an L3 network, note that:
The IP range cannot contain gateway IP addresses in the
format of xxx.xxx.xxx.1, broadcast addresses in the
format of xxx.xxx.xxx.255, or network addresses in
the format of xxx.xxx.xxx.0.
The IP range of a private network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 22. Create Management Network Using IP Range
If you select CIDR, you need to set the following
parameters:
CIDR: Set a CIDR block for the management
network, for example, 192.168.1.1/24.
Gateway: Set a gateway for the management
network, for example, 192.168.1.1.
Note:
We recommend that you use the first or last IP
address in the specified CIDR block as the
gateway.
If left blank, the first IP address in the specified
CIDR block is used as the gateway.
Note: When you add a CIDR block for an L3 network, note that:
The CIDR block cannot contain the link-local address
169.254.0.0/16.
The CIDR block of a private network cannot overlap with the
IP range of a public network used to create a vRouter
offering or of a management network.
Figure 23. Create Management Network Using CIDR Block
Considerations
Make sure that the network range of the public network is different from the network
range of the management network when you create a vRouter offering.
Manage a Management Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > Dedicated Network > Management Network. Then, the Management Network page is displayed.
The following table lists the actions that you can perform on a management network.
Action
Description
Create Management Network
Create a management network.
Delete Management Network
Delete a management network.
Note: Deleting a management network
also deletes the associated VPC vRouter.
Flow Network
Create a Flow Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > Dedicated Network > Flow Network. On the Flow Network page, click Create
Flow Network. Then, the Create Flow Network page is
displayed.
Create a Flow Network
On the displayed page, set the following parameters:
Name: Enter a name for the flow network.
Description: Optional. Enter a description for the
flow network.
L2 Network: Select an L2 network for the flow
network.
Note:ZStack Cloud allows you to use
an L2 network to create multiple L3 networks. However, we recommend that
you do not use an L2 network to create multiple L3 networks if not for
specific business needs.
On the Select L2
Network page, two tabs are displayed:
Recommended: lists L2 networks in the
current zone that are not attached to an L3 network.
All: lists all L2 networks in the current
zone.
Network Range Method: Select a method to add a
network range for the flow network. You can select IP Range or CIDR.
If
you select IP Range, you need to set the following parameters:
Start IP: Set a start IP address for the
network range, for example, 172.20.108.100.
End IP: Set an end IP address for the
network range, for example, 172.20.108.200.
Netmask: Set a netmask for the network
range, for example, 255.255.0.0.
Gateway: Set a gateway for the network
range, for example, 172.20.0.1.
Note: When you add an IP range for an L3 network, note that:
The IP range cannot contain gateway IP addresses in the
format of xxx.xxx.xxx.1, broadcast addresses in the
format of xxx.xxx.xxx.255, or network addresses in
the format of xxx.xxx.xxx.0.
The IP range of a private network cannot overlap with the IP
range of a public network used to create a vRouter offering
or of a management network.
Figure 24. Create Flow Network Using IP Range
If you select CIDR, you need to set the following
parameters:
CIDR: Set a CIDR block for the flow
network, for example, 192.168.1.1/24.
Gateway: Set a gateway for the flow
network, for example, 192.168.1.1.
Note:
We recommend that you use the first or last IP
address in the specified CIDR block as the
gateway.
If left blank, the first IP address in the specified
CIDR block is used as the gateway.
Note: When you add a CIDR block for an L3 network, note that:
The CIDR block cannot contain the link-local address
169.254.0.0/16.
The CIDR block of a private network cannot overlap with the
IP range of a public network used to create a vRouter
offering or of a management network.
Figure 25. Create Flow Network Using CIDR Block
Manage a Flow Network
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > Dedicated Network > Flow Network. Then, the Flow Network page is displayed.
The following table lists the actions that you can perform on a flow network.
Action
Description
Create Flow Network
Create a flow network.
Delete Flow Network
Delete a flow network.
Note: Deleting a flow network also deletes
the associated VPC vRouter.
VPC vRouter
What is VPC vRouter?
A VPC vRouter is a dedicated VM instance that provides
multiple network services.
Characteristics
A VPC vRouter can be used to provide network services such as virtual IP
address, elastic IP address, IPsec tunnel, port forwarding, load balancing,
and DHCP.
You can set multicast routing for VPC vRouters.
You can attach or detach a VPC network or public network to or from a VPC
vRouter as needed.
VPC vRouters have higher priorities to use resources than VM instances. If
the resource utilization of the host is so high that the resource
distribution must be prioritized, the resources are distributed first to VPC
vRouters, then to VM instances with High priorities, and then to VM
instances with Normal priorities. For example, if VPC vRouters and VM
instances are competing for CPU resources, the CPU resources are distributed
first to VPC vRouters.
Notice
Before you create a VPC vRouter, you need to create a public network,
management network, and VPC vRouter image required for a vRouter
offering.
A VPC vRouter is created from a vRouter offering with a public network and a
management network. The public network and management network defined in a
vRouter offering cannot be detached.
We recommend that a VPC vRouter has no more than 23 VPC networks and public
networks in total associated. Too many networks might lower the VPC vRouter
performance and affect the quality of related network services.
All network services in this Cloud share the bandwidth of the physical NIC.
Therefore, too many VIPs on a VPC vRouter might cause network performance
bottlenecks. We recommend that you reasonably plan the number of VIPs based
on actual bandwidth requirements.
Create a VPC vRouter
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > vRouter > VPC vRouter. On the VPC vRouter page, click Create
VPC vRouter. Then, the Create VPC vRouter page is
displayed.
On the displayed page, set the following parameters:
Name: Enter a name for the VPC vRouter.
Description: Optional. Enter a description for the VPC
vRouter.
vRouter Offering: Select a vRouter offering you created
before.
Note: A VPC vRouter created from a vRouter offering has a public
network and a management network.
Cluster: Optional. Specify a cluster for the host on
which the VPC vRouter is to be started.
Storage Allocation Policy: Specify how the Cloud
allocates a primary storage. The following two policies are supported:
System Allocation: The
Cloud allocates a primary storage according to the preconfigured
policy.
Custom: Select a primary storage as needed.
Primary
Storage: Select a primary storage for the VPC
vRouter.
Host: Optional. Select a host on which the VPC vRouter is
started.
Default IPv4/IPv6 Address: Optional. Specify a default IP
address for the VPC vRouter. If not specified, the Cloud allocates one
automatically.
Assign Management Network IP: Optional. Assign a
management network IP to the VPC vRouter.
Note: To assign a management network
IP, make sure that the management network used by the VPC vRouter is
separated from the public network the VPC vRouter uses. If the VPC vRouter
uses a same network both as its management network and public network, you
cannot assign a management network IP.
DNS: Optional. Set the DNS service for the VPC vRouter.
If not specified, 223.5.5.5 will be used.
Note:
You can set an IPv4 DNS or IPv6 DNS as needed. For example, you can
set the IPv4 DNS to 223.5.5.5 or IPv6 DNS to 240C::6644.
Services in the VPC vRouter can access the public network services
via DNS. You can also specify the other DNS address if
necessary.
For VM instances created by using a VPC network, the DNS is the
gateway of the VPC network. The VM traffics are forwarded by a VPC
vRouter.
CPU Pinning: Associate the
virtual CPUs (vCPUs) of a VPC vRouter with host pCPUs stringently and allow you
to allocate specific pCPUs for the VPC vRouter, thus improving VPC vRouter performances.
Note:
Pinning Format
In the left input box, set a vCPU range. In the right input
box, set a pCPU range. Range format: integer, hyphen(-), and
caret (^). Use commas to separate them.
The vCPU range depends on the vRouter offering attached to
the VPC vRouter.
The pCPU range depends on the pCPU quantity of the selected
cluster or host.
Example: In the left input box, enter 1. In the right input box,
enter 0-3,^2. This example indicates that vCPU 1 is stringently
associated with pCPU 0, pCPU 1, and pCPU 3, while ^ represents that
vCPU 2 is excluded.
Figure 26. Create VPC vRouter
Considerations
When you use a VPC vRouter, note the following:
VPC networks under different VPC vRouters are isolated from each other by
default at Layer 2.
The IP address segments of different VPC networks under the same VPC vRouter
cannot overlap. In addition, the gateways of any two VPC networks cannot be
the same.
Before an ordinary account can create a VPC vRouter, the admin needs to
share the vRouter offering. Otherwise, the ordinary account could not create
a VPC vRouter or VPC network.
Before you use a VPC vRouter to provide network services, make sure that the
VPC vRouter is in the running or connected state. If the VPC vRouter is in
other states, check whether exceptions occur on the related resources.
If a VM instance is using a VPC network, the VPC network could not be
detached from the VPC vRouter.
You can login to a VPC vRouter by using a password or SSH key:
SSH login using password: By default, SSH login by using a password
is disabled. To enable the login method, you can go to Global
Setting to modify the related setting.
Note: If you modify the
setting, reconnect the VPC vRouter to make the modification take
effect.
SSH login using key: The SSH key is stored in the path:
$ZSTACK_HOME/WEB-INF/classes/ansible/rsaKeys/id_rsa.
Manage a VPC vRouter
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > vRouter > VPC vRouter. Then, the VPC vRouter page appears.
The following table lists the actions that you can perform on a VPC vRouter.
Action
Description
Edit VPC vRouter
Edit the name and description of a VPC
vRouter.
Create VPC vRouter
Create a VPC vRouter.
Start VPC vRouter
Start a stopped VPC vRouter.
Stop VPC vRouter
Stop a running VPC vRouter.
Note: Stopping a VPC
vRouter also stops all network services of this VPC vRouter.
Proceed with caution.
Reboot VPC vRouter
Reboot a VPC vRouter.
Reconnect VPC vRouter
Reconnect a VPC vRouter.
Note: A VPC vRouter
automatically upgrades after the management node is upgraded and
rebooted.
Change Host
Migrate a VPC vRouter to another host, and hot
migration is supported.
This action changes only the host where the VPC vRouter runs
and does not change the primary storage.
In the LocalStorage scenarios, before you can hot migrate a
VPC vRouter, go to the Global Setting and set Change Host
Online on Local Storage to true.
We recommend that you perform this action during off-peak
hours.
Change Host and Primary Storage
Migrate a VPC vRouter to another host and primary
storage. After you change the primary storage, the host where the
VPC vRouter resides is changed based on the system policy.
You can hot migrate a VPC vRouter across different types of
primary storage, including LocalStorage↔SharedBlock,
LocalStorage↔NFS, and SharedBlock↔NFS.
You can hot migrate a VPC vRouter across primary storage of
the same type, including SharedBlock primary storage ↔
SharedBlock primary storage.
After you change the primary storage of a running VPC
vRouter, the snapshot of the VPC vRouter are not saved.
The network configurations of the cluster to which the
destination primary storage is attached need to satisfy the
network requirements of the VPC vRouter.
Before you hot migrate a VPC vRouter, detach all VF NICs
from the VPC vRouter.
Launch Console
Access a VPC vRouter through terminals.
Set Console Password
Allow you to set or cancel console password for a
VPC vRouter, and the setting takes effect after the VPC vRouter
reboots.
Set Cluster-Binding Policy
Choose whether to make the VPC vRouter bound to the cluster it is
residing on.
If set to true, the vRouter's cross-cluster migrations are
restricted. You can further define which migration
operations are restricted through the cluster setting
Resource Binding Policy.
Soft Binding: this policy makes the VPC vRouter be
migrated only among the current cluster if the
migration is triggered automatically by the HA or by
a host maintenance mode. Migrations that are
triggered manually are not limited by the cluster
scope, such as manual VM migrations (Change
Host).
Hard Binding: this policy makes the VPC vRouter
always run in the current cluster, and all
cross-cluster migrations are denied, including the
migrations triggered automatically and
manually.
If set to false, the VPC vRouter is not bound to the current
cluster and allows cross-cluster migrations that are either
triggered automatically, like triggered by the HA, or
manually.
Delete VPC vRouter
Delete a VPC vRouter.
Note: Deleting VPC vRouters
will cause the network services of relevant VM instances
unavailable. To resume the network service, you must re-create a
VPC vRouter, attach the VPC network used by the VM instances,
and then reboot the VM instances. Proceed with
caution.
VPC HA Group
What is VPC HA Group?
A VPC vRouter HA group consists of two VPC vRouters.
Either VPC vRouter can be a primary or secondary VPC vRouter for the group. If the
primary VPC vRouter does not work as expected, the VPC vRouter becomes the secondary
VPC vRouter in the group to ensure high availability of business.
Considerations
Modifying the following configurations of a VPC vRouter also modifies the
configurations of its peer VPC vRouter:
Attach or detach a network to or from a VPC vRouter.
Configure EIP, port forwarding, load balancing, IPsec, virtual IP QoS,
DNS, SNAT, dynamic routing, multicast routing, and distributed routing
for a VPC vRouter.
The restart, reconnect, delete, and launch console actions only take effect on
the target VPC vRouter.
When you can add a VPC vRouter to a VPC vRouter HA group, note that:
The management network and the public network attached to this VPC
vRouter must be deployed independently.
Before you add the VPC vRouter to a VPC vRouter HA group, stop the VPC
vRouter first.
VPC vRouters in a VPC vRouter HA group are displayed in the HA group details
page. They are not displayed in the list of VPC vRouter page.
Create a VPC vRouter HA Group
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > vRouter > VPC vRouter HA Group. On the VPC vRouter HA Group page, click
Create VPC vRouter HA Group. Then, the Create VPC
vRouter HA Group page is displayed.
On the displayed page, set the following parameters:
Name: Enter a name for the VPC vRouter HA group.
Description: Optional. Enter a description for the VPC
vRouter HA group.
Monitor IP: Set an IP address as the monitor IP address.
The monitor IP address determines the primary-secondary relationship between two
VPC vRouters in the HA group.
Note:
The monitor IP address must be a public IP address that can be
accessed by the primary and the secondary VPC vRouters in the HA
group.
The monitor IP address must be a steady, secure IP address.
VPC vRouter: Add a VPC vRouter by creating a new one or
importing an existing one. After you add a VPC vRouter to the HA group, the
Cloud automatically configures the peer vRouters with the same
configurations.
If you choose Create, set the following
parameters:
Name: Enter a name for the VPC vRouter.
Description: Optional. Enter a description
for the VPC vRouter.
Host: Optional. Select a host where the VPC
vRouter is located. You can select up to two hosts.
vRouter Offering: Select a vRouter offering
you created before.
Note:
Make sure that a vRouter offering is available before
you can create a VPC vRouter.
After you create a VPC vRouter successfully and the
primary-secondary relationship is determined, set the
DNS on the VPC vRouter HA group details page to ensure
that the VPC vRouters work properly.
Assign VIP: Optional. Specify a public IP
address as the virtual IP address (VIP) for the HA group. If not
specified, the Cloud allocates one automatically.
Assign Management Network IP: Optional.
Assign management network IPs to the VPC vRouters.
Note: To assign
management network IPs, make sure that the management network
used by the VPC vRouters are separated from the public network
the VPC vRouters use. If the VPC vRouters use a same network
both as their management network and public network, you cannot
assign management network IPs.
Figure 27. Create VPC vRouter HA Group by Creating New VPC vRouter
If you choose Import, set the following parameters:
Select VPC vRouter: Select an existing VPC vRouter.
Note:
The VPC vRouter to be imported must be stopped.
Importing an existing VPC vRouter also imports all
configurations of the VPC vRouter. In this case, the VPC
vRouter cannot be used independently. Please exercise
caution.
Only VPC vRouters with isolated public network and
system network can be added to an HA group.
Figure 28. Create VPC vRouter HA Group by Adding Existing VPC
vRouter
vRouter Image
What is vRouter Image?
A vRouter image encapsulates network services and can be
used to create VPC vRouters and load balancers. vRouter images can be categorized
into VPC vRouter images and load balancer (LB) images.
Characteristics
A VPC vRouter image encapsulates network services and can be used to create VPC
vRouters. However, a VPC vRouter image cannot be used to create VM instances.
An LB image encapsulates dedicated-performance load-balancing services and can be
used to create load balancer instances. However, an LB image cannot be used to
create VM instances. A load balancer instance is a custom VM instance dedicated to
providing load balancing services.
Add a vRouter Image
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > vRouter > vRouter Image. On the vRouter Image page, click Add
vRouter Image. Then, the Add vRouter Image page is
displayed.
The Cloud allows you to add two types of vRouter images: VPC vRouter images (KVM) and
dedicated-performance load balancer (LB) images (KVM).
Add a VPC vRouter Image (KVM)
Set the following parameters:
Name: Enter a name for the vRouter image.
Description: Optional. Enter a description for the
vRouter image.
Image Usage: Specify what the vRouter image is used
for. Here, select VPC vRouter.
CPU Architecture: Select a CPU architecture for the
vRouter image. VPC vRouters created from the vRouter image inherit this CPU
architecture.
Backup Storage: Select a backup storage to store the
vRouter image.
Image Path: Enter a URL or upload a local file.
URL: Enter the download URL of the vRouter
image.
ZStack Cloud provides you
with dedicated VPC vRouter images (KVM). You can download the
latest vRouter images from the official website.
Local File: Upload a vRouter image file that
can directly be accessed by the current browser.
Note:
You can upload the vRouter image to an ImageStore or
Ceph backup storage.
A local browser will serve as a transmission relay used
for uploading the vRouter image. Do not refresh or stop
the current browser, nor stop your management node.
Otherwise, you will fail to add the vRouter image.
Figure 29. Add VPC vRouter Image
Add a Dedicated-Performance LB Image (KVM)
Set the following parameters:
Name: Enter a name for the vRouter image.
Description: Optional. Enter a description for the
vRouter image.
Image Usage: Specify what the vRouter image is used
for. Here, select Dedicated-Performance LB.
CPU Architecture: Select a CPU architecture for the
vRouter image. LB instances created from the vRouter image inherit this CPU
architecture.
Backup Storage: Select a backup storage to store the
vRouter image.
Image Path: Enter a URL or upload a local file.
URL: Enter the download URL of the vRouter
image.
ZStack Cloud provides you
with dedicated-performance LB images (KVM). You can download the
latest vRouter images from the official website.
ImageStore backup storages support breakpoint resume. If
the connection is interrupted due to network
fluctuations and other reasons, the upload task will be
automatically suspended.
You can cancel, suspend, or continue the task by going
to Platform O&M > Message Log > Event Center > Operation Log > Current Task > Add vRouter Image > Actions.
Local File: Upload a vRouter image file that
can directly be accessed by the current browser.
Note:
You can upload the vRouter image to an ImageStore or
Ceph backup storage.
ImageStore backup storages support breakpoint resume. If
you refresh the browser, close the browser, or stop the
management node service, the task will be automatically
suspended. Otherwise, the upload task will fail.
You can cancel, suspend, or continue the task by going
to Platform O&M > Message Log > Event Center > Operation Log > Current Task > Add vRouter Image > Actions.
Figure 30. Add Dedicated-Performance LB Image
vRouter Offering
What is vRouter Offering?
A vRouter offering defines the number of vCPU cores,
memory size, image, management network, and public network configuration settings of
VPC vRouters. You can use a vRouter offering to create VPC vRouters that can provide
network services for public networks and VPC networks. You
can use a vRouter offering to create multiple VPC vRouters. These VPC vRouters share the
same public network and management network defined in the vRouter offering. The public
network and management network defined in the vRouter offering cannot be detached from
the VPC vRouters.
Create a vRouter Offering
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > vRouter > vRouter Offering. On the vRouter Offering page, click
Create vRouter Offering. Then, the Create vRouter
Offering page is displayed.
On the displayed page, set the following parameters:
Zone: By default, the current zone is displayed.
Name: Enter a name for the vRouter offering.
Description: Optional. Enter a description for the
vRouter offering.
CPU: Set the number of CPU cores for a
vRouter.
Note: Currently, a vRouter can have up to 240 CPU cores. In an
actual production environment, we recommend that you set more than 8 CPU
cores for a vRouter.
Memory: Set the memory size for a vRouter. Unit: MB, GB,
and TB. In an actual production environment, we recommend that the memory size
greater than 8 GB.
Image: Select a vRouter image you added
before.
Note: If
the L3 public network in the vRouter offering has a network range of the
IPv6 type, when you create a VPC vRouter, you must use the vRouter image of
version 3.10.0 or later.
Management Network: Select an L3 management network you
created before.
A management network is used by the management node to deploy and
configure resources such as hosts and VPC vRouters.
If a system network is used to manage physical resources, select the
system network as the management network.
If you use a public network to manage physical resources, select the
public network as the management network.
Public Network: Select a public network you created
before.
vRouters created from this vRouter offering can provide VPC network
services.
Figure 31. Create vRouter Offering
SDN Controller
What is SDN Controller?
An SDN controller is used to control network devices such
as switches. You can add an external SDN controller to the Cloud and use the
controller to control external switches and other network devices. By
adding an SDN controller, you can take over SDN networks of hardware switches to reduce
network latencies and improve VXLAN network performances.
Before you can add an SDN controller to the Cloud, you need to plan management
networks in advance, and complete the basic configurations of the SDN
controller.
Currently, the Cloud supports only the H3C VCFC SDN controller.
Note: If you use
VCFC to configure hardware SDN, configure the mapping between VLAN and VXLAN
on VCFC in advance.
Add an SDN Controller
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > SDN Device > SDN Controller. On the SDN Controller page, click Add
SDN Controller. Then, the Add SDN Controller page
is displayed.
On the displayed page, set the following parameters:
Name: Enter the name of the SDN controller.
The name must be 1 to 128 characters in length and can
contain Chinese characters, letters, digits, spaces, hyphens (-), underscores
(_), periods (.), parenthesis (), colons (:), and plus signs (+) and cannot
begin or end with spaces.
Description: Optional. Enter a description for the SDN
controller.
Manufacturer: Select the SDN controller manufacturer.
Currently, only H3C VCFC is supported.
IP Address: Enter the IP address of the SDN
controller.
User Name: Enter the user name of the SDN
controller.
Password: Enter the password of the SDN controller.
Virtual Distributed Switch UUID: Enter the UUID of the
virtual distributed switch.
Note:
You need to configure a virtual distributed switch on the SDN
controller in advance.
With this virtual distributed switch, an available VNI range of the
hardware SDN VXLAN Pool can be determined.
Note:
