The following lists the typical scenarios of a VPC network:
Practice of IPv4+IPv6 dual stack in VPC network.
Practice of multi-tenant isolation in VPC network.
Practice of multi-web server in VPC network.
Practice of multiple public network STS in VPC network.
Practice of address pool in VPC network.
IPv4+IPv6 Dual Stack
About this task
IPv4+IPv6 dual stack means that one NIC has both IPv4 and IPv6 addresses, combining
the advantages of IPv4 and IPv6. With IPv4+IPv6 dual stack, you can customize for
different scenarios.
Assume the customer environment is as follows:
Public Network
Public Network
Configuration
NIC
em1
VLAN ID
No VLAN
IP Range
10.108.10.100~10.108.10.200
Netmask
255.0.0.0
Gateway
10.0.0.1
DHCP IP
10.108.10.101
Management Network
Management
Network
Configuration
NIC
em2
VLAN ID
No VLAN
IP Range
192.168.29.10~192.168.29.20
Netmask
255.255.255.0
Gateway
192.168.29.1
Note:
For security and stability reasons, we recommend that you deploy
an independent management network and separate it from the
public networks.
The management network we mentioned here is the same as that in
ZStack Private
Cloud. That is,
the management network is the network used to manage hosts,
primary storages, and backup storages. If a management network
was created before, you can use it directly.
VPC Network-1
VPC Network
Configuration
NIC
em1
VLAN ID
2800
IP CIDR
192.168.10.0/24
Gateway
192.168.10.1
DHCP IP
192.168.10.2
VPC Network
Configuration
IP CIDR
234e:0:4569::/64
Gateway
234e:0:4569::1
DHCP IP
234e:0:4569::2
VPC Network-2
VPC Network
Configuration
NIC
em1
VLAN ID
2900
IP CIDR
192.168.11.0/24
Gateway
192.168.11.1
DHCP IP
192.168.11.2
VPC Network
Configuration
IP CIDR
234e:0:456a::/64
Gateway
234e:0:456a::1
DHCP IP
234e:0:456a::2
To use IPv4+IPv6 dual stack, follow these steps:
Set up IPv4 network environments.
Add a IPv6 network range.
Reboot the VPC vRouter.
Add a IPv6 DNS.
Create two VM instances using the dual-stack network.
Obtain the IPv6 address of the VM instance.
Test the connectivity among VM instances.
Procedure
Set up IPv4 network environments.
Create IPv4 type VPC networks according to IPv4 Basic
Deployment. Assume the created VPC networks are L3-VPC-1
and L3-VPC-2. Now, the two VPC networks under the same VPC vRouter
are both IPv4 type.
Note: You can also create a IPv6 flat network and then
add a IPv4 network range.
Add a IPv6 network range.
Add a IPv6 network range to L3-VPC-1 and L3-VPC-2 respectively
to set up a IPv4+IPv6 dual-stack network. For IPv6 network configuration
information, see Table 4 and Table 6.
On the VPC Network page, locate the IPv4 network and
click Actions > Add IPv6 Range. On the displayed Add Network Range
page, set the following parameters:
Network Range Method: Select a method to add
a network range for the VPC network. You can select IP Range or
CIDR. In this scenario, select IP Range.
IP Configuration Mode: Select
Stateful-DHCP.
Note:
Stateful-DHCP: The interface address and other
parameters are all configured through DHCP. The IP range
method supports stateful DHCP.
Stateless-DHCP: The interface address is automatically
derived from the route advertisement prefix and the
interface Mac address. Other parameters are configured
through DHCP.
SLAAC: The interface address is automatically derived
from the prefix of the route advertisement that also
contains other parameters.
Start IP: Set a start IP address for the
network range, for example, 234e:0:4568::2.
End IP: Set an end IP address for the network
range, for example, 234e:0:4568:0:ffff:ffff:ffff:ffff.
Prefix Length: Set a prefix length for the
network range, for example, 64. The prefix length ranges from 64 to
126.
Gateway: Set a gateway for the network range,
for example, 234e:0:4568::1.
DHCP IP: Optional. Set an IP address for the
DHCP server, for example, 234e:0:4568::3.
Note:
When you create an L3 network and enable the DHCP
service for the first time, or when you add the first
network range for an L3 network that has the DHCP
service enabled, you can specify an IP address for the
DHCP server.
If a DHCP IP is specified for an L3 network, you cannot
specify another DHCP IP when you add a network range for
the network.
The DHCP IP can be within or out of the added IP range.
However, the IP address must be within the CIDR block to
which the added IP range belongs and must not be in
use.
The IP range determined by the start IP and end IP
cannot contain the link-local address fe80::/10.
If not specified, the system would randomly specify a
DHCP IP within the added IP range for the DHCP
server.
Figure 1. Add IPv6 Network Range
Reboot the VPC vRouter.
To add a new type of network range to a VPC network that already has a VPC
vRouter attached, you need to reboot the VPC vRouter, otherwise the network
may not work as expected.
On the VPC vRouter page, locate the VPC vRouter and
click Actions > Reboot.
Add a IPv6 DNS.
On the DNS tab of the details page of the VPC vRouter,
click Add DNS. On the Add DNS
dialogue box, set the following parameters:
IP Version: Select IPv6.
DNS: Specify a DNS address, for example,
240c::6644.
Figure 2. Add IPv6 DNS
Create two VM instances using the dual-stack network.
Create two VM instances using L3-VPC-1 and L3-VPC-2
respectively. In this scenario, we will introduce the creation of
VM-dual-stack-1.
On the main menu of ZStack Cloud, choose Resource Center > Resource Pool > Virtual Resource > VM Instance. Click Create VM Instance. On the
displayed Create VM Instance page, set the following
parameters:
Name: Set the name as
VM-dual-stack.
Description: Optional. Enter a description
for the VM instance.
Quantity: Enter 2.
Instance Offering: Select an existing
instance offering.
Image: Select an existing image.
Root Disk Offering: Select an existing disk
offering for the root volume of the VM instance.
Network Configuration: Select the IPv4+IPv6
dual-stack network.
User Data: Optional. Inject user-defined
parameters or scripts to customize configurations for the VM
instance or to accomplish specific tasks.
Click OK to create two VM instance using the
dual-stack network.
Obtain the IPv6 address of the VM instance.
You need to manually obtain the IP address of the IPv6 VM instance. Launch
the console of the two VM instances and run the following command to obtain
the IP
address:
[root@localhost~]# dhclient -6 eth0 //eth0 indicates the NIC name
[root@localhost~]# ifconfig
Note: FE80-started
address is the link-local address.
Figure 3. Obtain IPv6 Address In this scenario, the obtained IP addresses are as follows:
Log in to VM-dual-stack-1, use IPv4 and IPv6 address respectively to
ping VM-dual-stack-2.
Log in to VM-dual-stack-2, use IPv4 and IPv6 address respectively to
ping VM-dual-stack-1.
Figure 4. Test Network Connectivity
What to do next
So far, we have introduced how to use a IPv4+IPv6
dual-stack VPC network.
Multi-Tenant Isolation
Prerequisites
You can use VLAN or VXLAN to provide isolation for multiple tenants on layer 2
network.
VLAN
VXLAN
VLAN supports a maximum of 4096 VLAN IDs, that is a
maximum of 4096 isolated tenant networks are provided in
a single VLAN network, which is difficult to meet the
needs of large-scale cloud computing data centers.
The VLAN configuration methods of each switch vendors
vary differently.
VXLAN can support a maximum of 16 million logical
networks for multi-tenant isolation, based on the
existing network typology of client's IDC.
VXLAN is an overlay technology that allows for the
creation of overlaying L2 networks. The overlay
virtualization process can be realized by software or by
a VXLAN-enabled switch. You can choose the method as
needs.
Compared to VLAN, VXLAN has higher performance loss and
higher network latency.
About this task
This chapter mainly introduces the practice of multi-tenant isolation provided by the
VXLAN VPC network.
To set up a VXLAN VPC network for multi-tenant isolation, follow these steps:
Admin creates two sub-accounts (Sub-Account-A and Sub-Account-B).
Admin creates an L2 public network and attaches it to the corresponding
cluster.
Admin creates an L3 public network.
Admin creates an L2 management network and attaches it to the corresponding
cluster.
Admin creates an L3 management network that is used to communicate with
physical resources, such as hosts, primary storage, and backup storage.
Admin adds a vRouter image.
Admin creates a vRouter offering and shares it to Sub-Account-A and
Sub-Account-B.
Admin creates a VXLAN pool, attaches it to the corresponding cluster, and
shares it to Sub-Account-A and Sub-Account-B.
Create VPC vRouters from the vRouter offering using Sub-Account-A and
Sub-Account-B respectively, for example, VPC vRouter-A and VPC
vRouter-B.
Create two VXLAN networks from the VXLAN pool using Sub-Account-A and
Sub-Account-B respectively, for example, L2-VXLAN-A1, L2-VXLAN-A2,
L2-VXLAN-B1, and L2-VXLAN-B2.
Create VPC networks using the four VXLAN networks in Sub-Account-A and
Sub-Account-B respectively, for example, VPC-A1, VPC-A2, VPC-B1, and
VPC-B2.
Create a VM instance in each sub-account using the corresponding VPC
networks, for example, VM-A1, VM-A2, VM-B1, and VM-B2.
Test the connectivity among VM instances.
Admin shares the L3 public network to Sub-Account-A and Sub-Account-B.
Create a route table to enable VM-A1 and VM-B1 that are isolated in layer 2
can communicate with each other.
Test the connectivity between VM-A1 and VM-B1.
Note:
VXLAN pool and VXLAN network together provide configuration for the
VXLAN network type.
If you create an L2 network of the VxlanNetwork type, you must specify a
software SDN-based VXLAN pool. The L2 network must correspond to a VNI
in the pool.
A VXLAN pool is only a collection of VXLAN networks and cannot be used
to create L3 networks. You can L3 networks from L2 VxlanNetworks.
Assume the customer environment is as follows:
Public Network
Public Network
Configuration
NIC
em01
VLAN ID
No VLAN
IP Range
10.151.10.100~10.151.10.200
Netmask
255.0.0.0
Gateway
10.0.0.1
DHCP IP
10.151.10.101
Management Network
Management
Network
Configuration
NIC
em02
VLAN ID
No VLAN
IP Range
192.168.28.100~192.168.28.200
Netmask
255.255.255.0
Gateway
192.168.28.1
Note:
For security and stability reasons, we recommend that you deploy
an independent management network and separate it from the
public networks.
The management network we mentioned here is the same as that in
ZStack Private
Cloud. That is,
the management network is the network used to manage hosts,
primary storages, and backup storages. If a management network
was created before, you can use it directly.
VXLAN Pool
VXLAN Pool
Configuration
VNI Range
20-1200
VTEP CIDR
192.168.28.1/24
VPC-A1
VPC Network
Configuration
NIC
em01
IP CIDR
192.168.21.0/24
Gateway
192.168.21.1
DHCP IP
192.168.21.2
VPC-A2
VPC Network
Configuration
NIC
em01
IP CIDR
192.168.22.0/24
Gateway
192.168.22.1
DHCP IP
192.168.22.2
VPC-B1
VPC Network
Configuration
NIC
em01
IP CIDR
192.168.23.0/24
Gateway
192.168.23.1
DHCP IP
192.168.23.2
VPC-B2
VPC Network
Configuration
NIC
em01
IP CIDR
192.168.24.0/24
Gateway
192.168.24.1
DHCP IP
192.168.24.2
To create a VXLAN-VPC network, follow these steps:
Procedure
Admin creates two sub-accounts (Sub-Account-A and Sub-Account-B).
On the main menu of ZStack Cloud, choose Settings > Sub-Account Setting > Sub-Account Management. On the Sub-Account page, click
Create Sub-Account. Then, the Create
Sub-Account page is displayed. On the displayed page, set the
following parameters:
Name: Enter a name for the sub-account, for
example, Sub-Account-A.
Description: Optional. Enter a description
for the sub-account.
Password: Enter a password for the
sub-account.
Confirm Password: Confirm the sub-account
password.
Pricing List: Optional. Select a pricing
list. If left blank, the default pricing list is used.
Figure 5. Create Sub-Account Similarly, create another sub-account named as
Sub-Account-B.Figure 6. Create Sub-Account
Admin creates an L2 public network and attaches it to the corresponding
cluster.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > L2 Network. On the L2 Network page, click
Create L2 Network. Then, the Create L2
Network page is displayed. On the displayed page, set the
following parameters:
Zone: By default, the current zone is
displayed.
Name: Set the name as L2-Public
Network.
Description: Optional. Enter a description
for the L2 network.
Type: Select L2NoVlanNetwork.
Cluster: Select a cluster to be attached, for
example, Cluster-1.
Network Acceleration
Mode: You can use different technologies to improve
network performance of the L2 network. In this scenario, select
Standard.
NIC Name: Enter a NIC name for the L2
network. For example, em01.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > Public Network. On the Public Network page, click
Create Public Network. The Create
Public Network page is displayed. On the displayed page, set
the following parameters:
Name: Set the name as L3-Public
Network.
Description: Optional. Enter a description
for the public network.
L2 Network: Select the existing L2-Public
Network.
Note:ZStack Cloud allows you
to use an L2 network to create multiple L3 networks. However, we
recommend that you do not use an L2 network to create multiple
L3 networks if not for specific business needs.
On the
Select L2 Network page, two tabs are
displayed:
Recommended: lists L2 networks in
the current zone that are not attached to an L3
network.
All: lists all L2 networks in the
current zone.
Network Address Type: Select
IPv4.
Network Range Method: Select IP
Range.
Start IP: Set a start IP address for the
network range, for example, 10.151.10.100.
End IP: Set an end IP address for the network
range, for example, 10.151.10.200.
Netmask: Set a netmask for the network range,
for example, 255.0.0.0.
Gateway: Set a gateway for the network range,
for example, 10.0.0.1.
IP Allocation Policy: Optional. IP addresses
can be assigned according to the following three allocation
policies:
Random: The system randomly assigns
IP addresses from the network range.
Allocate in Order:
The system assigns all available IP addresses from
the network range in ascending order. Released IP
addresses are assigned in the next allocation.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108 are
allocated. If 192.168.0.106 is released, it
will be assigned first in the next allocation.
Allocate in Cycle:
The system assigns available IP addresses to VM
instances from the network range in ascending order.
Released IP addresses are assigned when currently
available IP addresses are used up.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108 are
allocated. If 192.168.0.106 is released, it
will be assigned after 192.168.0.120 is
used.
DHCP Service: Choose
whether to enable the DHCP service.
Note:
The DHCP service is a built-in distributed service of
the Cloud, which assigns IP addresses only to resources
in the Cloud and does not conflict with your existing
DHCP server.
By default, the DHCP service is enabled so that IP
addresses are automatically assigned to resources in the
Cloud. You can customize a DHCP IP or use the DHCP IP
that the system assigned according to the IP allocation
policy.
If you disable this option, IP addresses are not
automatically assigned to resources that use this
network. Therefore, you need to manually assign IP
addresses to these resources. In addition, you cannot
specify a DHCP IP. Neither can the system allocate
one.
DHCP IP:
Optional. Set an IP address for the DHCP server.
Note:
A DHCP IP is an IP address used by the DHCP
service to assign IP addresses to resources that
use this L3 network.
If you create an L3 network for the first time
with the DHCP service enabled, or if you add the
first network range to an L3 network with the DHCP
service enabled, you can customize the DHCP
IP.
If the L3 network has a DHCP IP, you cannot
customize the DHCP IP when you add a network
range.
The DHCP IP can be in or outside the added IP
range, but it must be an unoccupied IP address in
the CIDR block of the added IP range
The IP range determined by the start IP and end
IP cannot contain the link-local address
169.254.0.0/16.
If you select random as the IP allocation policy
and this field is left blank, the system randomly
assigns IP addresses from the added network
range.
If you select allocate in order/allocate in
cycle as the IP allocation policy and this field
is left blank, the system uses the start IP
address in the network range as the DHCP IP.
DNS: Optional. Add a DNS
server to provide domain name resolution services for the public
network, for example, 223.5.5.5.
Note: When you add an IP
range for an IPv4 L3 network, note that:
The IP range cannot contain gateway IP addresses in the
format of xxx.xxx.xxx.1, broadcast addresses in
the format of xxx.xxx.xxx.255, or network
addresses in the format of xxx.xxx.xxx.0.
The IP range of a private network cannot overlap with
the IP range of a public network used to create a
vRouter offering or of a management network.
Figure 8. Create L3-Public Network
Admin creates an L2 management network and attaches it to the corresponding
cluster.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > L2 Network. On the L2 Network page, click
Create L2 Network. Then, the Create L2
Network page is displayed. On the displayed page, set the
following parameters:
Zone: By default, the current zone is
displayed.
Name: Set the name as L2-Management
Network.
Description: Optional. Enter a description
for the L2 network.
Type: Select L2NoVlanNetwork.
Cluster: Select a cluster to be attached, for
example, Cluster-1.
Network Acceleration Mode: You can use
different technologies to improve network performance of the L2
network. In this scenario, select
Standard.
NIC Name: Enter a NIC name for the L2
network. For example, em02.
Figure 9. Create L2-Management Network
Admin creates an L3 management network that is used to communicate with
physical resources, such as hosts, primary storage, and backup storage.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > Dedicated Network > Management Network. On the Management Network page, click
Create Management Network. Then, the
Create Management Network page is displayed. On the
displayed page, set the following parameters:
Name: Set the name as L3-Management
Network.
Description: Optional. Enter a description
for the management network.
L2 Network: Select the existing
L2-Management Network.
Note:ZStack Cloud allows you to use an L2 network
to create multiple L3 networks. However, we recommend that you
do not use an L2 network to create multiple L3 networks if not
for specific business needs.
On the Select L2
Network page, two tabs are displayed:
Recommended: lists L2 networks in
the current zone that are not attached to an L3
network.
All: lists all L2 networks in the
current zone.
Network Range Method: Select IP
Range.
Start IP:Set a start IP address for the
network range, for example, 192.168.28.100.
End IP: Set an end IP address for the network
range, for example, 192.168.28.200.
Netmask: Set a netmask for the network range,
for example, 255.255.255.0.
Gateway: Set a gateway for the network range,
for example, 192.168.28.1.
Note: When you add an IP range for an IPv4 L3 network, note that:
The IP range cannot contain gateway IP addresses in the
format of xxx.xxx.xxx.1, broadcast addresses in
the format of xxx.xxx.xxx.255, or network
addresses in the format of xxx.xxx.xxx.0.
The IP range of a private network cannot overlap with
the IP range of a public network used to create a
vRouter offering or of a management network.
Figure 10. Create L3-Management Network
Admin adds a vRouter image.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > vRouter > vRouter Image. On the vRouter Image page, click Add
vRouter Image. Then, the Add vRouter Image page is
displayed.
Set the following parameters:
Name: Enter a name for the vRouter image.
Description: Optional. Enter a description for the
vRouter image.
Image Usage: Specify what the vRouter image is used
for. Here, select VPC vRouter.
CPU Architecture: Select a CPU architecture for the
vRouter image. VPC vRouters created from the vRouter image inherit this CPU
architecture.
Backup Storage: Select a backup storage to store the
vRouter image.
Image Path: Enter a URL or upload a local file.
URL: Enter the download URL of the vRouter
image.
ZStack Cloud provides you
with dedicated VPC vRouter images (KVM). You can download the
latest vRouter images from the official website.
Local File: Upload a vRouter image file that
can directly be accessed by the current browser.
Note:
You can upload the vRouter image to an ImageStore or
Ceph backup storage.
A local browser will serve as a transmission relay used
for uploading the vRouter image. Do not refresh or stop
the current browser, nor stop your management node.
Otherwise, you will fail to add the vRouter image.
Admin creates a vRouter offering and shares it to Sub-Account-A and
Sub-Account-B.
Create a vRouter offering.
On the displayed page, set the following parameters:
Zone: By default, the current zone is displayed.
Name: Enter a name for the vRouter offering.
Description: Optional. Enter a description for the
vRouter offering.
CPU: Set the number of CPU cores for a
vRouter.
Note: Currently, a vRouter can have up to 240 CPU cores. In an
actual production environment, we recommend that you set more than 8 CPU
cores for a vRouter.
Memory: Set the memory size for a vRouter. Unit: MB, GB,
and TB. In an actual production environment, we recommend that the memory size
greater than 8 GB.
Image: Select a vRouter image you added
before.
Note: If
the L3 public network in the vRouter offering has a network range of the
IPv6 type, when you create a VPC vRouter, you must use the vRouter image of
version 3.10.0 or later.
Management Network: Select an L3 management network you
created before.
A management network is used by the management node to deploy and
configure resources such as hosts and VPC vRouters.
If a system network is used to manage physical resources, select the
system network as the management network.
If you use a public network to manage physical resources, select the
public network as the management network.
Public Network: Select a public network you created
before.
vRouters created from this vRouter offering can provide VPC network
services.
Figure 11. Create vRouter Offering
Share the vRouter offering to Sub-Account-A and
Sub-Account-B.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > vRouter > vRouter Offering. On the vRouter Offering page,
locate the vRouter offering and click Actions > Set Sharing Mode. On the Set Sharing Mode
dialogue box, select Share to specified
projects/accounts and select Sub-Account-A
and Sub-Account-B in Specify
Account.Figure 12. Set Sharing Mode
Admin creates a VXLAN pool, attaches it to the corresponding cluster, and
shares it to Sub-Account-A and Sub-Account-B.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > VXLAN Pool. On the VXLAN Pool page, click
Create VXLAN Pool. Then, the
Create VXLAN Pool page is displayed. On the
displayed page, set the following parameters:
Zone: By default, the current zone is
displayed.
Name: Enter a name for the VXLAN
pool.
Description: Optional. Enter a
description for the VXLAN pool.
SDN Type: Select
Software.
VNI Range: Enter the start ID and end
ID of VXLAN networks.
Note:
You can enter an ID that ranges from 1 to
16777214.
The end ID must be equal to or greater than the
start ID.
The two VNI IDs 16777215 and 16777216 are
reserved by the system of this cloud
platform.
Cluster: Optional. Attach the VXLAN
pool to a cluster.
Note:
You can attach a VXLAN pool to a cluster when
you create the VXLAN pool or after the VXLAN pool
is created.
When you attach the VXLAN pool to a cluster, IP
addresses of the compute nodes must be available
in the cluster that correspond to the VTEP CIDR
block.
VTEP CIDR: Enter the corresponding
VTEP CIDR block.
Figure 13. Create VXLAN Pool
Share the VXLAN pool to Sub-Account-A and
Sub-Account-B.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > VXLAN Pool. On the VXLAN Pool page, locate
the VXLAN pool and click Actions > Set Sharing Mode. On the Set Sharing Mode
dialogue box, select Share to specified
projects/accounts and select Sub-Account-A
and Sub-Account-B in Specify
Account.
Figure 14. Set Sharing Mode
Create VPC vRouters from the vRouter offering using Sub-Account-A and
Sub-Account-B respectively, for example, VPC vRouter-A and
VPC vRouter-B.
Log in to the Cloud using Sub-Account-A. On the main menu of ZStack Cloud, choose Resource Center > Network Resource > vRouter > VPC vRouter. On the VPC vRouter page, click
Create VPC vRouter. Then, the Create
VPC vRouter page is displayed. On the displayed page, set the
following parameters:
Name: Enter a name for the VPC vRouter.
Description: Optional. Enter a description
for the VPC vRouter.
vRouter Offering: Select a vRouter offering
you created before.
Cluster: Optional. Specify a cluster for the
host on which the VPC vRouter is to be started.
Storage Allocation Policy: Specify how the
Cloud allocates a primary storage. The following two policies are
supported:
System
Allocation: The Cloud allocates a primary
storage according to the preconfigured policy.
Custom: Select a primary storage as
needed.
Primary
Storage: Select a primary storage for
the VPC vRouter.
Host: Optional. Select a host on which the
VPC vRouter is started.
Default IPv4/IPv6 Address: Optional. Specify
a default IP address for the VPC vRouter. If not specified, the
Cloud allocates one automatically.
Assign Management Network IP: Optional.
Assign a management network IP to the VPC vRouter.
Note: To assign a
management network IP, make sure that the management network
used by the VPC vRouter is separated from the public network the
VPC vRouter uses. If the VPC vRouter uses a same network both as
its management network and public network, you cannot assign a
management network IP.
DNS: Optional. Set the DNS service for the
VPC vRouter. If not specified, 223.5.5.5 will be used.
Note:
You can set an IPv4 DNS or IPv6 DNS as needed. For
example, you can set the IPv4 DNS to 223.5.5.5 or IPv6
DNS to 240C::6644.
Services in the VPC vRouter can access the public
network services via DNS. You can also specify the other
DNS address if necessary.
For VM instances created by using a VPC network, the DNS
is the gateway of the VPC network. The VM traffics are
forwarded by a VPC vRouter.
CPU Pinning:
Associate the virtual CPUs (vCPUs) of a VPC vRouter with host pCPUs
stringently and allow you to allocate specific pCPUs for the VPC
vRouter, thus improving VPC vRouter performances.
Note:
Pinning Format
In the left input box, set a vCPU range. In the
right input box, set a pCPU range. Range format:
integer, hyphen(-), and caret (^). Use commas to
separate them.
The vCPU range depends on the vRouter offering
attached to the VPC vRouter.
The pCPU range depends on the pCPU quantity of
the selected cluster or host.
Example: In the left input box, enter 1. In the right
input box, enter 0-3,^2. This example indicates that
vCPU 1 is stringently associated with pCPU 0, pCPU 1,
and pCPU 3, while ^ represents that vCPU 2 is
excluded.
Figure 15. Create VPC vRouter-A Similarly, log in to the Cloud using Sub-Account-B and create
another VPC vRouter.
Create two VXLAN networks from the VXLAN pool using Sub-Account-A and
Sub-Account-B respectively, for example, L2-VXLAN-A1,
L2-VXLAN-A2, L2-VXLAN-B1, and L2-VXLAN-B2.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > L2 Network. On the L2 Network page, click
Create L2 Network. Then, the Create L2
Network page is displayed. On the displayed page, set the
following parameters:
Zone: By default, the current zone is
displayed.
Name: Set the name as
L2-VXLAN-A1.
Description: Optional. Enter a description
for the L2 network.
Type: Select
VxlanNetwork.
Network Acceleration Mode: You can use
different technologies to improve network performance of the L2
network. In this scenario, select
Standard.
VXLAN Pool: Select a VXLAN pool of the
software SDN type.
VNI: Optional. Select a specified VNI in the
VXLAN pool.
If not specified, the Cloud allocates a VNI
randomly.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > VPC Network. On the VPC Network page, click
Create VPC Network. The Create VPC
Network page is displayed. On the displayed page, set the
following parameters:
Name: Set the name as VPC-A1.
Description: Optional. Enter a description
for the VPC network.
L2 Network: Select the existing
L2-VXLAN-A1.
On the Select L2
Network page, two tabs are displayed:
Recommended: lists L2 networks in
the current zone that are not attached to an L3
network.
All: lists all L2 networks in the
current zone.
VPC vRouter: Optional. You can specify a VPC
vRouter when you create a VPC network or attach a VPC vRouter after
you create the VPC network.
Network Address Type: Select
IPv4.
Network Range Method: Select
CIDR.
CIDR: Set a CIDR block for the VPC network,
for example, 192.168.108.1/24.
Gateway: Set a gateway for the VPC network,
for example, 192.168.108.1.
Note:
You can use the first or last IP address in the
specified CIDR block as the gateway.
If left blank, the first IP address in the specified
CIDR block is used as the gateway.
DHCP Service: Choose whether to enable the
DHCP service.
Note:
The DHCP service is a built-in distributed service of
the Cloud, which assigns IP addresses only to resources
in the Cloud and does not conflict with your existing
DHCP server.
By default, the DHCP service is enabled so that IP
addresses are automatically assigned to resources in the
Cloud. You can customize a DHCP IP or use the DHCP IP
that the system assigned according to the IP allocation
policy.
If you disable this option, IP addresses are not
automatically assigned to resources that use this
network. Therefore, you need to manually assign IP
addresses to these resources. In addition, you cannot
specify a DHCP IP. Neither can the system allocate
one.
IP Allocation Policy: Optional. After
the DHCP service is enabled, IP addresses can be assigned
according to the following three allocation policies:
Random: The system randomly
assigns IP addresses from the network range.
Allocate in Order:
The system assigns all available IP addresses
from the network range in ascending order.
Released IP addresses are assigned in the next
allocation.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned first in the next
allocation.
Allocate in Cycle:
The system assigns available IP addresses to
VM instances from the network range in ascending
order. Released IP addresses are assigned when
currently available IP addresses are used up.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned after
192.168.0.120 is used.
DHCP IP: Optional. Set an IP address
for the DHCP server, for example, 192.168.21.2.
Note:
A DHCP IP is an IP address used by the DHCP
service to assign IP addresses to resources that
use this L3 network.
If you create an L3 network for the first time
with the DHCP service enabled, or if you add the
first network range to an L3 network with the DHCP
service enabled, you can customize the DHCP
IP.
If the L3 network has a DHCP IP, you cannot
customize the DHCP IP when you add a network
range.
The DHCP IP can be in or outside the added IP
range, but it must be an unoccupied IP address in
the CIDR block of the added IP range
The IP range determined by the start IP and end
IP cannot contain the link-local address
169.254.0.0/16.
If you select random as the IP allocation policy
and this field is left blank, the system randomly
assigns IP addresses from the added network
range.
If you select allocate in order/allocate in
cycle as the IP allocation policy and this field
is left blank, the system uses the start IP
address in the network range as the DHCP IP.
Similarly, the network connectivity of VM-B2 is expected the be the
same as that of VM-B1.
Admin shares the L3 public network to Sub-Account-A and
Sub-Account-B.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > Public Network. On the Public Network page, locate the
L3-Public Network and click Actions > Set Sharing Mode. On the Set Sharing Mode dialogue box,
select Share to specified projects/accounts and
select Sub-Account-A and Sub-Account-B in Specify
Account.
Figure 20. Set Sharing Mode
Create a route table to enable VM-A1 and VM-B1 that are isolated in layer 2 can
communicate with each other.
Create a route table.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Advanced Network Service > Route Table. On the Route Table page, click
Create Route Table. Then, the
Create Route Table page is displayed.
On the displayed page, set the following parameters:
Name: Enter a name for the route
table.
Description: Optional. Enter a
description for the route table.
VPC vRouter: Optional. Select a VPC
vRouter to which the route table is attached.
Figure 21. Create Route Table
Add two route entries to the route table.
Destination Network
Next Hop
Route Entry-1
The VPC network CIDR of
VM-A1
The public IP of the VPC
vRouter of VM-A1
Route Entry-2
The VPC network CIDR of
VM-B1
The public IP of the VPC
vRouter of VM-B1
On the Route Table page, locate the created
route table and enter its details page. On the Route
Entry tab of the details page, click Add
Route Entry to add two route entries
respectively.
Figure 22. Add Route Entry
Test the connectivity between VM-A1 and VM-B1.
Expected result:
Log in to VM-A1, ping VM-B1: Successful
Log in to VM-B1, ping VM-A2: Successful
Figure 23. Test Connectivity Between VM-A1 and VM-B1
What to do next
So far, we have introduced the deployment practice of
multi-tenant isolation in VPC network.
Multi-Web Server
About this task
To deploy a multi-web server of VPC network, follow these steps:
Create three VPC subnets from the same VPC vRouter, for example, VPC-Web,
VPC-app, and VPC-database.
Note: The network range of the three VPC subnets
cannot overlap with one another.
Create three VM instances using the three VPC subnets respectively, for
example, VM-web, VM-app, and VM-database.
Test the network connectivity among three VM instances.
Assume the customer environment is as follows:
Public Network
Public Network
Configuration
NIC
em01
VLAN ID
No VLAN
IP Range
10.151.10.100~10.151.10.200
Netmask
255.0.0.0
Gateway
10.0.0.1
Management Network
Management
Network
Configuration
NIC
em02
VLAN ID
No VLAN
IP Range
192.168.28.100~192.168.28.200
Netmask
255.255.255.0
Gateway
192.168.28.1
Note:
For security and stability reasons, we recommend that you deploy
an independent management network and separate it from the
public networks.
The management network we mentioned here is the same as that in
ZStack Cloud. That is, the management
network is the network used to manage hosts, primary storages,
and backup storages. If a management network was created before,
you can use it directly.
VPC-web
Private Network
Configuration
NIC
em01
VLAN ID
2017
IP CIDR
192.168.10.0/24
VPC-app
Private Network
Configuration
NIC
em01
VLAN ID
2020
IP CIDR
192.168.20.0/24
VPC-database
Private Network
Configuration
NIC
em01
VLAN ID
2050
IP CIDR
192.168.50.0/24
The following part describes the practice of deploying a multi-web server of VPC
network in detail.
Procedure
Create three VPC subnets from the same VPC vRouter, for example, VPC-Web,
VPC-app, and VPC-database. For detailed information, you can refer to the Create
VPC Network chapter of User Guide.
Note: The network range of the three VPC subnets cannot overlap with one
another.
Figure 24. Three VPC Subnets
Create three VM instances using the three VPC subnets respectively, for
example, VM-web, VM-app, and VM-database.
Figure 25. Three VM Instances
Test the network connectivity among three VM instances.
Log in to VM-web and use the ping command to test
network connectivity.
Expected result:
ping baidu.com: Successful
ping VM-app: Successful
ping VM-database: Successful
Note:
In VM-web system, you need to manually add the IP
addresses of VM-app and VM-database to the
/etc/hosts
directory.
[root@VM-web ~]# vim /etc/hosts
...
192.168.20.187 VM-app
192.168.50.141 VM-database
...
Figure 26. Test VM-web Network Connectivity
Log in to VM-app and use the ping command to test
network connectivity.
Expected result:
ping baidu.com: Successful
ping VM-web: Successful
ping VM-database: Successful
Note:
In VM-app system, you need to manually add the IP
addresses of VM-web and VM-database to the
/etc/hosts
directory.
[root@VM-app ~]# vim /etc/hosts
...
192.168.10.79 VM-web
192.168.50.141 VM-database
...
Figure 27. Test VM-app Network Connectivity
Log in to VM-database and use the ping command to
test network connectivity.
Expected result:
ping baidu.com: Successful
ping VM-app: Successful
ping VM-web: Successful
Note:
In VM-database system, you need to manually add the IP
addresses of VM-app and VM-web to the
/etc/hosts
directory.
[root@VM-database ~]# vim /etc/hosts
...
192.168.20.187 VM-app
192.168.10.79 VM-web
...
Figure 28. Test VM-database Network Connectivity
What to do next
So far, we have introduced the practice of deploying a
multi-web server.
STS
Prerequisites
STS: If a VPC vRouter is connected with multiple public
networks, egress traffic is sent to a public network in the same route as the ingress
traffic sent from the public network.
Make sure that all planned public networks are able to connecting to the
Internet.
Effectiveness: This policy takes effect on all public networks that are
connected with the VPC vRouter except the default public network.
About this task
To use the STS feature of a VPC vRouter, follow these steps:
Set up a basic VPC environment.
Attach multiple public networks to the VPC vRouter.
Enable the STS feature of VPC vRouter.
Functional verification.
Assume the customer environment configuration is as follows:
Public Network-Unicom (Default Public Network)
Public Network
Configuration
NIC
eth1
VLAN ID
No VLAN
CIDR
172.31.5.0/24
Public Network-Mobile
Public Network
Configuration
NIC
eth3
VLAN ID
No VLAN
CIDR
172.31.4.0/24
Management Network
Management Network
Configuration
NIC
eth2
VLAN ID
No VLAN
CIDR
10.5.117.0/24
Note:
For security and stability reasons, we recommend that you deploy
an independent management network and separate it from the
public networks.
The management network we mentioned here is the same as that in
ZStack Cloud. That is, the management
network is the network used to manage hosts, primary storages,
and backup storages. If a management network was created before,
you can use it directly.
VPC-1
VPC-1
Configuration
NIC
eth1
VLAN ID
1982
IP CIDR
192.168.3.0/24
VPC-2
VPC-2
Configuration
NIC
eth3
VLAN ID
1983
IP CIDR
192.168.4.0/24
The following part describes the practice of deploying a multiple public networks of
VPC vRouter.
Procedure
Set up a basic VPC environment.
Set up a basic VPC environment according to the assumed customer environment
configuration.
Note: The basic environment supports adding one public
network to the VPC vRouter. In this scenario, we use Public
Network-Unicom as the default public network. You can create
Public Network-Mobile in advance for later use.
Figure 29. Set up Basic VPC Environment
Attach multiple public networks to the VPC vRouter.
On the Network tab of the details page, click
Public Network. Then, click
Attach to attach a public network (Public
Network-Mobile) to the VPC vRouter.
Figure 30. Attach Public Network to VPC vRouter
Enable the STS feature of VPC vRouter.
On the details page of the VPC vRouter, turn on the
STS switch to enable the STS
feature.
Note: Modifications on the policy take effect immediately. You
do not need to restart the VPC vRouter.
Figure 31. Enable STS
At this point, the STS configuration of the VPC vRouter is completed. And all
external traffic accesses to the resources of the VPC vRouter will support
STS.
Functional verification.
Create a VM instance using the VPC network and associate EIPs created from
the two public network. Use external network to ping the
EIP created from non-default public network (Public Network-Mobile).
Expected result: Monitor the two NICs (eth1 and eth3) of the VPC vRouter and
only the NIC (eth3) of the non-default public network can receive the
requested return data.
Create a VM instance for test.
On the VM Instance page, create a VM instance
using VPC-1 or VPC-2.
Create EIPs and associate them with the VM instance.
Create EIPs using Public Network-Unicom and Public Network-Mobile
respectively and associate them with the VM instance.
Figure 32. Create and Associate EIPs
Monitor data flow direction.
Use external network to ping the EIP of the VM
instance, for example, 172.31.4.18. The requested data goes
through the eth3 NIC of the VPC vRouter.
Figure 33. External Excess to VM Instance
Log in to the VPC vRouter, use the tcpdump command
to monitor the data traffic of the two public network NICs. The
returned data only goes through the eth3, which is the same NIC that
gives the request.
Figure 34. Monitor Returned Data
Address Pool
Prerequisites
An address pool network range must co-exist with a normal
network range. An address pool network range can be only used to create VIPs to provide
network services based on VPC vRouters.
About this task
To add an address pool, follow these steps:
Plan your network.
Create a public network.
Add an address pool.
Create a VIP using the address pool.
Test whether the VIP works properly.
The following tables list the user's assumed environment configuration.
Public Network (Normal Network Range)
Public Network
Configuration
NIC
em01
VLAN ID
No VLAN
CIDR
10.151.0.0~10.151.0.255
Netmask
255.0.0.0
Gateway
10.151.0.1
Public Network (Address Pool)
Address Pool
Configuration
IP Range
172.20.0.1~172.20.0.254
Netmask
255.255.0.0
The following section describes the detailed steps of how to use an address pool.
Procedure
Plan your network.
IPv4 public networks support address pool. Make sure that the address pool
network range is planned and configured as a public network. Otherwise, the
network is unreachable.
Note: We recommend that you plan your network
according to the actual scenarios and make relevant configurations in
key switches.
Create a public network.
Create an L2 network.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > L2 Network. On the L2 Network page, click
Create L2 Network. Then, the
Create L2 Network page is displayed. On the
displayed page, set the following parameters:
Zone: By default, the current zone is
displayed.
Name: Set the name as L2- Public
Network.
Description: Optional. Enter a
description for the L2 network.
Type: Select
L2NoVlanNetwork.
Cluster: Optional. Select the cluster
to be attached, for example, Cluster-1.
Network Acceleration
Mode: You can use different technologies to
improve network performance of the L2 network. In this
scenario, select Standard.
NIC Name: Enter a NIC name for the L2
network. For example, em01.
Figure 35. Create L2-Public Network
Create an L3 public network.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > Public Network. On the Public Network page,
click Create Public Network. The
Create Public Network page is displayed. On
the displayed page, set the following parameters:
Name: Enter a name for the public
network.
Description: Optional. Enter a
description for the public network.
L2 Network: Select an L2 network for
the public network.
Note:ZStack Cloud
allows you to use an L2 network to create multiple L3
networks. However, we recommend that you do not use an
L2 network to create multiple L3 networks if not for
specific business needs.
On the
Select L2 Network page, two
tabs are displayed:
Recommended: lists L2
networks in the current zone that are not attached
to an L3 network.
All: lists all L2 networks
in the current zone.
Network Address Type: Select
IPv4.
Network Range Method: Select
IP Range.
Start IP: Set a start IP address for
the network range, for example, 10.151.0.2.
End IP: Set an end IP address for the
network range, for example, 10.151.0.254.
Netmask: Set a netmask for the
network range, for example, 255.0.0.0.
Gateway: Set a gateway for the
network range, for example, 10.0.0.1.
IP Allocation Policy: Optional. IP
addresses can be assigned according to the following three
allocation policies:
Random: The system randomly
assigns IP addresses from the network range.
Allocate in Order:
The system assigns all available IP addresses
from the network range in ascending order.
Released IP addresses are assigned in the next
allocation.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned first in the next
allocation.
Allocate in Cycle:
The system assigns available IP addresses to
VM instances from the network range in ascending
order. Released IP addresses are assigned when
currently available IP addresses are used up.
Example: Assume that the network range is
192.168.0.101～192.168.0.120, within
which 192.168.0.101～192.168.0.108
are allocated. If 192.168.0.106 is
released, it will be assigned after
192.168.0.120 is used.
DHCP Service:
Choose whether to enable the DHCP service.
Note:
The DHCP service is a built-in distributed
service of the Cloud, which assigns IP addresses
only to resources in the Cloud and does not
conflict with your existing DHCP server.
By default, the DHCP service is enabled so that
IP addresses are automatically assigned to
resources in the Cloud. You can customize a DHCP
IP or use the DHCP IP that the system assigned
according to the IP allocation policy.
If you disable this option, IP addresses are not
automatically assigned to resources that use this
network. Therefore, you need to manually assign IP
addresses to these resources. In addition, you
cannot specify a DHCP IP. Neither can the system
allocate one.
DHCP IP:
Optional. Set an IP address for the DHCP server, for
example, 172.20.108.10.
Note:
A DHCP IP is an IP address used by the DHCP
service to assign IP addresses to resources that
use this L3 network.
If you create an L3 network for the first time
with the DHCP service enabled, or if you add the
first network range to an L3 network with the DHCP
service enabled, you can customize the DHCP
IP.
If the L3 network has a DHCP IP, you cannot
customize the DHCP IP when you add a network
range.
The DHCP IP can be in or outside the added IP
range, but it must be an unoccupied IP address in
the CIDR block of the added IP range
The IP range determined by the start IP and
end IP cannot contain the link-local address
169.254.0.0/16.
If you select random as the IP allocation
policy and this field is left blank, the system
randomly assigns IP addresses from the added
network range.
If you select allocate in order/allocate in
cycle as the IP allocation policy and this field
is left blank, the system uses the start IP
address in the network range as the DHCP IP.
DNS: Optional. You can specify
114.114.114.114.
Note: When you add an IP range for an IPv4 L3 network, note
that:
The IP range cannot contain gateway IP addresses
in the format of xxx.xxx.xxx.1, broadcast
addresses in the format of xxx.xxx.xxx.255,
or network addresses in the format of
xxx.xxx.xxx.0.
The IP range of a private network cannot overlap
with the IP range of a public network used to
create a vRouter offering or of a management
network.
Figure 36. Create L3-Public Network
Add an address pool.
An address pool network range must co-exist with a normal network range. You
cannot add an address pool network range if no normal network range is
available. On the Network Range tab of the details page
of the L3-Public Network, click Add Network Range. On
the displayed Add Network Range page, set the following
parameters:
IP Address Type: By default, the IPv4 type is
displayed.
Network Range Method: By default, the IP
range method is displayed.
Network Range Type: Select Address
Pool.
Start IP: Set a start IP address for the
address pool, for example, 172.20.0.1.
End IP: Set a end IP address for the address
pool, for example, 172.20.0.254.
Note: The address pool cannot
contain broadcast addresses in the format of
xxx.xxx.xxx.255, or network addresses in the format
of xxx.xxx.xxx.0.
Netmask: Set a netmask for the address pool,
for example, 255.255.0.0.
Figure 37. Add Address Pool
Create a VIP using the address pool.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Basic Network Service > VIP. On the VIP page, click
Create VIP. Then, the Create
VIP page is displayed. On the displayed page, set the
following parameters:
Name: Enter a name for the virtual IP address
(VIP).
Description: Optional. Enter a description
for the VIP.
Network: Select an L3 network that has an
address pool.
Network Range: Select an address pool.
Assign IP: Optional. You can assign a virtual
IP address.
VIP QoS: You can limit the network bandwidth
of public VIPs and flat network VIPs. You can set the QoS for a
custom VIP when you create the VIP or after the VIP is created.
Figure 38. Create VIP
Test whether the VIP works properly.
The VIP works properly if the VIP are used to provide EIP, port forwarding,
load balancing, IPsec tunnel, and other network services. In this scenario,
we use the VIP to create an EIP for verification.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Basic Network Service > EIP. On the EIP page, click
Create EIP. Then, the Create
EIP page is displayed. On the displayed page, select
Use Existing VIP.
Figure 39. Create EIP
The successful creation of EIP indicates that the VIP created from the VPC
address pool can work properly.
What to do next
So far, we have introduced how to use an address
pool.
Elastic IP
About this task
An elastic IP address (EIP) is a method to access a private network
through other networks. An EIP converts the IP address of a network into the IP address
of another network based on the network address translation (NAT) function.
The following diagram shows the EIP application scenario in a VPC network with a
public EIP as an example.
Figure 40. EIP Application Scenario in VPC Network
The VM instance created from a VPC subnet can access to external network when it is
associated with an EIP.
The following section describes two scenarios of using EIPs in a VPC network.
Create an EIP and associate it with a VM instance.
Associate the EIP with another VM instance.
Procedure
Create VPC subnets and VM instances.
Create two subnets using the same VPC vRouter, for example, VPC Network-1 and
VPC Network-2. Then, create two VM instances using the VPC subnets
respectively.
Create an EIP and associate it with VM-1.
Create an EIP.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Basic Network Service > EIP. On the EIP page, click
Create EIP. Then, the Create
EIP page is displayed.
On the displayed page, set the following parameters:
Name: Enter a name for the EIP.
Description: Optional. Enter a description
for the EIP.
You can use a virtual IP address by using either of the following
methods:
VIP: Select Create VIP.
Network: Select an L3 network to create a
VIP. The network can be a public network or a flat
network.
Note: Currently, you cannot create a VIP with a flat
network disabled with IP address management.
Network Range: Optional. Select a network
range.
Note:
If you selected an IPv4 public network, you can select a normal
network range or an address pool. If you selected an IPv6 public
network, you can only select a normal network range.
If you selected an IPv4 or IPv6 public network, you can only select
a normal network range.
If you selected an IPv4 VPC network, you can only select a normal
network range.
Assign IP: Optional. You can assign a
virtual IP address.
Note:
If left blank, the system automatically assigns a
VIP.
If you do not select a network range, you can
specify an IP address only from a normal network
range.
VIP: Select Use Existing VIP.
Set the following parameter:
VIP:
Select an existing VIP.
Figure 41. Create EIP
Associate EIP-1 with VM-1.
On the EIP page, locate EIP-1 and click Actions > Attach NIC. Then, the Select Instance NIC
page is displayed. On the displayed page, select the NIC of
VM-1.
Figure 42. Associate EIP-1 with VM-1
Log in to VM-1 through EIP-1.
You can SSH to VM-1 using the EIP-1 from a VM instance that can
access to the public network range of the VPC network.
Figure 43. Log in to VM-1 Through EIP-1
Associate EIP-1 with VM-2.
Disassociate EIP-1 from VM-1.
On the EIP page, locate EIP-1 and click Actions > Detach NIC.
Figure 44. Disassociate EIP-1 from VM-1
Associate EIP-1 with VM-2.
On the EIP page, locate EIP-1 and click Actions > Attach NIC. Then, the Select Instance NIC
page is displayed. On the displayed page, select the NIC of
VM-2.
Figure 45. Associate EIP-1 with VM-2
Log in to VM-2 through EIP-1.
You can SSH to VM-2 using the EIP-1.
Figure 46. Log in to VM-2 Through EIP-1
Port Forwarding
About this task
This chapter introduces three scenarios of using a port forwarding in a VPC
network.
Create a port forwarding and associate it with a VM instance.
Associate a port forwarding with other VM instances.
Associate different ports of the same VIP with different VM instances.
Procedure
Create VPC subnets and VM instances.
Create two subnets using the same VPC vRouter, for example, VPC Network-1 and
VPC Network-2. Then, create two VM instances using the VPC subnets
respectively.
Create a port forwarding and associate it with VM-1.
Create a port forwarding.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Basic Network Service > Port Forwarding. On the Port Forwarding page, click
Create Port Forwarding. Then, the
Create Port Forwarding page is displayed.
On
the displayed page, set the following parameters:
Name: Enter a name for the port
forwarding rule, for example, PF-1.
Description: Optional. Enter a
description for the port forwarding rule.
VIP: You can create a VIP or use an
existing VIP to provide port forwarding services.
Create
VIP: Create a VIP. If you select to
create a VIP, set the following parameters:
Network: Select a
public network to create a VIP.
Network Range:
Optional. Select a network range. If you selected
an IPv4 public network, you can select a normal
network range or an address pool.
Assign IP: Optional.
You can assign a virtual IP address.
Note:
If left blank, the system automatically
assigns a VIP.
If you do not select a network range, you can
specify an IP address only from a normal network
range.
Use Existing VIP: Use an
existing VIP. If you select to use an existing VIP,
set the following parameters:
VIP: Select an existing VIP.
Note: The system VIP of a VPC vRouter can be used to
provide port forwarding services.
Protocol: Select
a protocol, Valid values: TCP and UDP.
Port: Select a port mapping
method.
Two port mapping methods are supported:
port-to-port mapping and port range-based
mapping.
Specified Port: If you
specify ports, set the following parameters:
Source Port: Select a
port from ports 0-65535 as the source port.
VM Port: Select a port
from ports 0-65535 as the VM port.
For example, if you set 24 as the source
port and 22 as the VM port, the traffic to port 24
of the public IP will be forwarded to port 22 of
the VM instance.
Port Range: Select two ports
from ports 0-65535 as the start port and end port,
respectively.
For example, if the port range is
22-80, traffic to ports 22-80 of the public IP
will be forwarded to ports 22-80 of the VM
instance.
Allowed CIDR: Optional. You can
specify a CIDR block to allow access to only this CIDR
block.
Figure 47. Create Port Forwarding-1
Associate PF-1 with VM-1.
On the Port Forwarding page, locate PF-1 and
click Actions > Associate VM NIC. Then, on the displayed Associate VM
NIC page, select the NIC of VM-1.Figure 48. Associate PF-1 with VM-1
Log in to VM-1 through PF-1.
You can log in to the port 22 of VM-1 by SSH the port 24 of a VM
instance that can access to public network range of the VPC
network.
Figure 49. Log in to VM-1 Through PF-1
Associate PF-1 with VM-2.
Disassociate PF-1 from VM-1.
On the Port Forwarding page, locate PF-1 and
click Actions > Disassociate VM NIC.
Figure 50. Disassociate PF-1 from VM-1
Associate PF-1 with VM-2.
On the Port Forwarding page, locate PF-1 and
click Actions > Associate VM NIC. Then, on the displayed Associate VM
NIC page, select the NIC of VM-2.
Figure 51. Associate PF-1 with VM-2
Log in to VM-2 through PF-1.
You can log in to the port 22 of VM-2 by SSH the port 24 of the VM
instance.
Figure 52. Log in to VM-2 Through PF-1
Associate different ports of the same VIP with different VM instances.
Create another port forwarding using the same VIP.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Basic Network Service > Port Forwarding. On the Port Forwarding page,
click Create Port Forwarding. Then, the
Create Port Forwarding page is
displayed.
On the displayed page, set the following parameters:
Name: Enter a name for the port
forwarding rule, for example, PF-2.
Description: Optional. Enter a
description for the port forwarding rule.
VIP: Select Use Existing
VIP.
Protocol: Select
TCP.
Port: Select Port
Range and enter 30-40.
Allowed CIDR: Optional. You can
specify a CIDR block to allow access to only this CIDR
block.
Figure 53. Create Port Forwarding
Associate PF-2 with VM-1.
On the Port Forwarding page, locate PF-2 and
click Actions > Associate VM NIC. Then, on the displayed Associate VM
NIC page, select the NIC of VM-1.Figure 54. Associate PF-2 with VM-1
You can see that the same VIP (192.168.1.74) can be associated
with different VM instances through different port forwarding
rules.
Send a message to VM-1 through PF-2.
You can use the nc command to send a message to a
port ranging form 30 to 40 of the public network IP
(192.168.1.74) from a VM instance that can access to the
public network range of the VPC network. The VM-1 can receive the
message from the corresponding port.
For example, you can send a message on source port 30 and receive the
message on the port 30 of VM-1.
Note: To clear the original iptables
in VM-1, you can use the iptables -F
command.
Figure 55. Send Message on Source Port 30 Figure 56. Receive Message on Port 30 of VM-1
Load Balancing
About this task
Typical scenario: Assume that the user has a high number of application access in the
VPC network. The user wants to use a dedicated performance load balancer to
distribute traffic flows to a group of backend servers to improve the service
capbility of the business. According to the business needs, the load balancer needs
to adopt a HTTPS protocol to monitor traffic flows. Assume the user has met the
following requirements:
The user has deployed the latest version of ZStack Cloud.
The user has deployed a public network, VPC network, and management
network.
The user has created 3 business VMs.
Th user has prepared a certificate for HTTPS monitoring.
To use a loading balancing, follow these steps:
Add a dedicated-performance LB image.
Create a load balancer instance offering.
Create a dedicated-performance load balancer.
Create a certificate.
Create a listener.
Attach a NIC to the load balancer.
Add a backend server.
Scenario test.
Procedure
Add a dedicated-performance LB image.
On the main menu of ZStack Cloud,
choose Resource Center > Network Resource > vRouter > vRouter Image. On the vRouter Image page, click
Add vRouter Image. Then, the Add
vRouter Image page is displayed.
On the displayed page, set the following parameters:
Name: Enter a name for the image.
Description: Optional. Enter a description
for the vRouter image.
Image Usage: Specify what the vRouter image
is used for. Here, select Dedicated-Performance LB.
CPU Architecture: Select a CPU architecture
for the vRouter image. LB instances created from the vRouter image
inherit this CPU architecture.
Backup Storage: Select a backup storage to
store the vRouter image.
Image Path: Enter a URL or upload a local file.
Note:
ZStack Cloud provides you with
dedicated-performance LB images (KVM). You can download the
latest vRouter images from the official website.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Basic Network Service > Load Balancing > Configuration. On the Configuration tab, click
Create Load Balancer Instance Offering. The
Create Load Balancer Instance Offering page is
displayed.
On the displayed page, set the following parameters:
Zone: By default, the current zone is
displayed.
Name: Enter a name for the load balancer (LB)
instance offering.
Description: Optional. Enter a description
for the LB instance offering.
CPU: Specify the number of CPU cores for the
LB instance offering, for example, specify 2 Core.
Memory: Specify the memory size for the LB
instance offering, for example, specify 8GB.
Image: Select a
dedicated-performance LB image that you added.
Management Network: Select a management
network that you created.
Figure 58. Create Load Balancer Instance Offering
Create a dedicated-performance load balancer.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Basic Network Service > Load Balancing. On the Load Balancer page, click
Create Load Balancer. The Create Load
Balancer page appears.
On the displayed page, set the following parameters:
Name: Enter a name for the LB.
Description: Optional. Enter a description
for the LB.
LB Type: Select Dedicated Performance.
Network: Select a network
as the frontend network of the LB. Here, select a VPC network.
VIP: You can
create a VIP or use an existing VIP to provide load balancing
services. Here, select New VIP. Set the
following parameters:
Network Range: Optional. Select an IP
range.
Assign IP: Optional. Specify a VIP.
This parameter is available only after you select an IP
range.
Backend Network: Select a network as the
backend network. Here, specify the same VPC network.
Note: You can
add multiple backend networks by attach NICs to the load
balancer. All VPC network in the same VPC vRouter to which the
VPC network is attached can be specified as backend networks.
For more information, see Attach a NIC to the load balancer.
LB Instance Name: Enter a name for the LB
instance.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Basic Network Service > Load Balancing > Certificate Management. On the Certificate Management tab,
click Create Certificate. The Create
Certificate page appears.
On the displayed page, set the following parameters:
Name: Enter a name
for the certificate.
Description: Optional. Enter a description
for the certificate.
Certificate Text: Enter the certificate
content.
Private Key: Enter the private key.
Certificate Chain: Optional. If you need to
upload multiple certificates, you need to combine the root and
intermediates certificates and then upload the certificates.
Figure 60. Create Certificate
Create a listener.
On the details page of the load balancer, click the
Listener tab. On the tab, click Create
Listener. The Create Listener page is
displayed.
On the displayed page, set the following parameters:
Name: Enter a name for the listener.
Description: Optional. Enter a description
for the listener.
Protocol: Select a listening protocol. Here,
select HTTPS.
Certificate: Associate a certificate with the
listener.
Load Balancer Port: Specify a port for load
balancing. Valid values: 1 to 65535. Here, specify100.
Backend Server Port: Specify a backend server
port. Valid values: 1 to 65535. Here, specify 80.
Load Balancer Algorithm: Set a routing rule
for data packets. Here, select Round
Robin.
Session Persistence: An innate mechanism of
the load balancing service. It identifies the association of the
interactions between a client and backend servers based on which a
load balancer can direct the client's requests to a specific backend
server and achieve business continuity.
Backend Server Group: Optional. Select a
backend server group. Here, select the default backend server
group.
Advanced: Configure advanced settings for the
listener. Here, use default settings.
Figure 61. Create Listener
Attach a NIC to the load balancer.
On details page of the load balancer, click LB
Instance. On the LB Instance tab, click
Attach on the NIC section. Then, the
Attach NIC page is displayed.
On the displayed page, set the following parameters:
Network: Select
backend network to be attached. Here, select the VPC network of the
same VPC vRouter.
IPV4 Address:
Optional. You can specify an IP address for the NIC. If not
specified, the Cloud automatically assigns an IP address within the
selected network range.
Figure 62. Attach NIC to Load Balancer
Add a backend server.
On the details page of the load balancer, click Backend Server
Group. On the tab, enter the details page of the backend
server group. On the details page, click Add Backend
Server. Then, the Add Backend Server
page is displayed.
On the displayed page, set the following parameters:
Backend Server:
You can add a VM instance or other servers outside of the Cloud as a
backend server. Here, select By Instance
NIC.
Network: Select
the VPC network of the same VPC vRouter.
NIC: Specify 3 VM instances NICs.
Figure 63. Add Backend Server
Scenario test.
In this scenario, we will run the curl command in the port 100 of the VIP
address of the load balancer: for i in
{1..20}; do curl -k https://192.168.0.249:100; done. The 3
business VM instances will be polled in sequence.
Figure 64. Scenario Test
What to do next
So far, we have introduced how to use a dedicated-performance load balancer in a VPC
network.
IPsec Tunnel
Prerequisites
Typical scenario of IPsec tunnel in a VPC network: In two isolated
ZStack Cloud environment, create two VPC environments. In
these two VPC environments, create two VPC networks (subnets) respectively. The two
VPC subnets cannot directly communicate with each other. You can realize the mutual
communication between two VPC subnets by using IPsec tunnel.
About this task
Basic steps of using IPsec tunnel:
In the first ZStack Cloud environment, create an
IPsec tunnel, specify the local public IP address in the first VPC
environment, and specify one or more VPC subnets that are locally available.
Enter the public IP address in the second VPC environment as the peer public
IP, and enter one or more VPC subnets specified in the second VPC
environment as the peer networks.
In the second ZStack Cloud environment, create an
IPsec tunnel, specify the local public IP address in the second VPC
environment, and specify one or more VPC subnets that are locally available.
Enter the public IP address in the first VPC environment as the peer public
IP, and enter one or more VPC subnets specified in the first VPC environment
as the peer networks.
Note: Make sure that the CIDR blocks of all private networks in two VPC
environments do not overlap.
The following tables list the assumed environment configurations.
The first ZStack Cloud environment:
Public Network
Public
Network
Configuration
NIC
em01
VLAN ID
No VLAN
IP Range
10.151.10.100~10.151.10.200
Netmask
255.0.0.0
Gateway
10.0.0.1
Management Network
Management
Network
Configuration
NIC
em02
VLAN ID
No VLAN
IP Range
192.168.28.100~192.168.28.200
Netmask
255.255.255.0
Gateway
192.168.28.1
Note:
For security and stability reasons, we recommend that you deploy
an independent management network and separate it from the
public networks.
The management network we mentioned here is the same as that in
ZStack Private
Cloud. That is,
the management network is the network used to manage hosts,
primary storages, and backup storages. If a management network
was created before, you can use it directly.
VPC Network-1
Private
Network
Configuration
NIC
em01
VLAN ID
2018
IP CIDR
192.168.10.0/24
VPC Network-2
Private
Network
Configuration
NIC
em01
VLAN ID
2020
IP CIDR
192.168.20.0/24
The second ZStack Cloud environment:
Public Network
Public Network
Configuration
NIC
em01
VLAN ID
No VLAN
IP Range
10.151.20.100~10.151.20.200
Netmask
255.0.0.0
Gateway
10.0.0.1
Management Network
Management Network
Configuration
NIC
em02
VLAN ID
No VLAN
IP Range
192.168.28.10~192.168.28.90
Netmask
255.255.255.0
Gateway
192.168.28.1
VPC Network-3
Private Network
Configuration
NIC
em01
VLAN ID
2017
IP CIDR
192.168.30.0/24
VPC Network-4
Private Network
Configuration
NIC
em01
VLAN ID
2030
IP CIDR
192.168.40.0/24
The follow sections describe the detailed steps of how to create an IPsec tunnel.
Procedure
Create two VPC networks (subnets) in the first ZStack Cloud environment, for example, VPC Network-1 and VPC
Network-2. Then, create two VM instances using the VPC networks respectively,
for example, creating VM-1 from VPC Network-1.
Similarly, create two VPC networks (subnets) in the second ZStack Cloud environment, for example, VPC Network -3 and VPC
Network-4. Then, create two VM instances using the VPC networks respectively,
for example, creating VM-3 from VPC Network-3.
Test the network connectivity among VM-1, VM-2 in the first environment and
VM-3, VM-4 in the second environment.
Log in to VM-1, and try to SSH to the port 22 of VM-3. You will fail to
SSH to VM-3 or ping VM-3.
Figure 65. VM-1 Fails to Communicate with VM-3
Log in to VM-1, and you will fail to try to communicate with VM-4.
Log in to VM-2, and you will fail to try to communicate with VM-3 and
VM-4.
Log in to VM-3, and you will fail to communicate with VM-1 and
VM-2.
Log in to VM-4, and you will fail to try to communicate with VM-1 and
VM-2.
Create an IPsec tunnel in the first ZStack Cloud
environment.
Create an IPsec tunnel.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Advanced Network Service > IPsec Tunnel. On the IPsec Tunnel page, click
Create IPsec Tunnel. Then, the
Create IPsec Tunnel page is displayed. On
the displayed page, set the following parameters:
Name: Enter a name for the IPsec
tunnel, for example, IPsec-1.
Description: Optional. Enter a
description for the IPsec tunnel.
Local IP Address:
VIP: You can create a VIP or
use an existing VIP to provide IPsec tunnel
services.
Create VIP:
Create a VIP. If you select to create a VIP, set
the following parameters:
Public Network: Select
a public network to create a VIP.
IP Range: Optional.
Select an IP range. If you selected an IPv4 public
network, you can select a normal IP range or an
address pool.
Assign IP: Optional.
You can assign a virtual IP address.
Note:
If left blank, the system automatically
assigns a VIP.
If you do not select a network range, you can
specify an IP address only from a normal network
range.
Use Existing
VIP: Use an existing VIP. If you
select to use an existing VIP, set the following
parameters:
VIP: Select an existing VIP.
Note: The
system VIP of a VPC vRouter can be used to provide
IPsec tunnel services.
Peer Public IP: Enter the peer public
IP address that provides IPsec tunnel services.
Source Network CIDR: Select a VPC
network attached to the VPC vRouter that is associated with
the selected public network. If only one VPC network is
attached to the VPC vRouter, the VPC network is selected by
default.
Peer CIDR: Specify a specified peer
network CIDR.
Note: The CIDR block cannot be overlapped with
the network range of the management network and public
network attached to the VPC vRouter.
Authentication Mode: psk
Authentication Key: Set a relatively
strong authentication key.
Note: The local authentication key
must be consistent with its peer.
ID Configuration Method: Configure an
ID for the local and peer devices. You can configure an ID
in the format of an IP address and name:
IP Address: Use an IP address
to identify the local and peer devices.
Local ID: The unique ID
that identifies the local device. You can use this
ID for authenticating the peer device. The local
ID must be 1-255 characters in length.
Peer ID: The unique ID
that identifies the peer device. You can use this
ID for authenticating the local device. The peer
ID must be 1-255 characters in length.
Name: Use a name to identify
the local and peer devices.
Local ID: The unique ID
that identifies the local device. You can use this
ID for authenticating the peer device. The local
ID must be 1-255 characters in length.
Peer ID: The unique ID
that identifies the peer device. You can use this
ID for authenticating the local device. The peer
ID must be 1-255 characters in length.
Advanced: You can configure advanced parameter
settings for the IPsec tunnel, including IKE configurations
and IPsec configurations. The Cloud automatically configures
default settings for the parameters, as shown in the
following list:
IKE Configuration:
IKE Version: IKEv2
IKE Authentication
Algorithm: sha256
IKE Encryption
Algorithm: aes-256
IKE DH Group: 2
IPsec Configuration:
Encapsulation Mode:
tunnel
IPsec Security
Protocol: esp
ESP Authentication
Algorithm: sha256
ESP Encryption
Algorithm: aes-256
PFS DH Group:
dh-group14
Note:
If you configure an IPsec tunnel by using a VPC
vRouter of ZStack Cloud and
a third-party device, you need to coordinate the
advanced settings of the two devices.
When you create an IPsec tunnel, you need to
adjust local advanced settings based on the IPsec
configurations of the peer network device.
Figure 66. Create IPsec Tunnel Click OK to create IPsec-1.Figure 67. IPsec Tunnel
Similarly, create another IPsec tunnel in the second ZStack Cloud environment.
Test the connectivity among VM-1, VM-2 in the first environment and VM-3, VM-4
in the second environment.
Log in to VM-1, and you can SSH to VM-3 and VM-4 through port 22 and
ping VM-3 and VM-4.
Figure 68. VM-1 Successfully Connect to VM-3 and VM-4
Log in to VM-2, and you can SSH to VM-3 and VM-4 through port 22 and
ping VM-3 and VM-4.
Log in to VM-3, and you can SSH to VM-1 and VM-2 through port 22 and
ping VM-1 and VM-2.
Figure 69. VM-3 Successfully Connect to VM-1 and VM-2
Log in to VM-4, and you can SSH to VM-1 and VM-2 through port 22 and
ping VM-1 and VM-2.
What to do next
So far, we have introduced how to use an IPsec tunnel in a
VPC network.
OSPF Area
Prerequisites
Open Shortest Path First (OSPF): An OSPF is an interior gateway
protocol of link states and is used to distribute routing information within a single
autonomous system (AS). An OSPF is widely used in a data center network and a campus
network.
Typical scenario of an OSPF area: Assume that the user has two sets of network
environment, one of which is a VPC network environment on the Cloud, and the other
is a traditional network environment that configured with OSPF protocol in the
physical environment. To ensure that the two network environments can communicate
with each other, the user need to create an OSPF area that is identical with that of
the physical environment on ZStack Cloud. Then, add a VPC
vRouter that is isolated in layer 3 network and the traditional router to the same
OSPF area to establish the neighboring relations. This way, you can realize the
mutual communication between VPC network and traditional network.
About this task
To use an OSPF area, follow these steps:
Create two VPC networks using the same VPC vRouter.
Test the network connectivity when the OSPF protocol is not used.
Create an OSPF area and add VPC vRouter to it.
Test the network connectivity when the OSPF protocol takes effect.
Note: The CIDR block of the private networks in two environments cannot overlap
with each other.
The following tables list the assumed environment configurations.
OSPF Area Configuration in Traditional Physical Network
OSPF Area
Configuration
Area ID
0.0.0.0
Type
Standard
Authentication Method
None
Public Network Configuration in Traditional Physical
Network
Public Network
Configuration
NIC
em01
VLAN ID
No VLAN
IP Range
10.151.0.0~10.151.0.100
Netmask
255.0.0.0
Gateway
10.0.0.1
Private Network Configuration in Traditional Physical Network
Router Network
Configuration
NIC
em01
IP CIDR
192.168.10.0/24
Public Network Configuration on Cloud
Public Network
Configuration
NIC
em01
VLAN ID
No VLAN
IP Range
10.151.0.101~10.151.0.255
Netmask
255.0.0.0
Gateway
10.0.0.1
Management Network on Cloud
Management
Network
Configuration
NIC
em02
VLAN ID
No VLAN
IP Range
192.168.28.100~192.168.28.200
Netmask
255.255.255.0
Gateway
192.168.28.1
Note:
For security and stability reasons, we recommend that you deploy
an independent management network and separate it from the
public networks.
The management network we mentioned here is the same as that in
ZStack Private
Cloud. That is,
the management network is the network used to manage hosts,
primary storages, and backup storages. If a management network
was created before, you can use it directly.
VPC Network-1 on Cloud
VPC Network
Configuration
NIC
em01
VLAN ID
2018
IP CIDR
192.168.3.0/24
VPC Network-2 on Cloud
VPC Network
Configuration
NIC
em01
VLAN ID
2019
IP CIDR
192.168.4.0/24
The following section describes the detailed steps of how to use an OSPF area.
Procedure
Create two VPC networks using the same VPC vRouter.
According to the planned network configuration information, create a VPC
vRouter in ZStack Cloud. Then, create two VPC
networks using the VPC vRouter.
Public Network: 10.151.0.101 to 10.151.0.255. Make
sure that the public network is on the same gateway with the
traditional physical network to ensure network interconnection.
Test the network connectivity when the OSPF protocol is not used.
Create VM instances using VPC Network-1 and VPC Network-2 respectively, for
example, VM-1 (192.168.3.251), VM-2 (192.168.4.196). You can
ping the gateway of physical network to test network
connectivity.
Expected result:
Log in to VM-1 (192.168.3.251) ping
192.168.10.1: Failed.
Log in to VM-2 (192.168.4.196) ping
192.168.10.1: Failed.
Figure 70. Test Network Connectivity
Create an OSPF area and add VPC vRouter to it.
Create an OSPF area on the Cloud with the same area ID as that of the planned
OSPF area in traditional physical network.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Advanced Network Service > OSPF Area. On the OSPF Area page, click
Create OSPF Area. Then, the Create OSPF
Area page is displayed. On the displayed page, set the
following parameters:
Area ID: Set an area ID in dotted decimal
notation that identifies an OSPF area. The area ID is in similar
format as that of IPv4 address. In this scenario, enter
0.0.0.0.
Type: Select an OSPF area type. Valid values:
Standard and Stub. In this scenario, select
Standard.
Standard: Standard areas support all
types of LSAs.
Stub: Stub areas do not support Type
4 and Type 5 LSAs.
Authentication Method: The authentication
method used when you select VPC vRouters in an OSPF area to
establish neighbors. Valid values: None, Plaintext, and MD5. In this
scenario, select None.
None: Packets are received without identity
authentication.
Plaintext: Identity authentication is implemented by
using the password contained in the received packets.
MD5: Identity authentication is implemented by using
the key ID and password MD5 hash that are
contained in the received packets.
Routing Configuration: Optional. Set routing
configurations. If you set this parameter, you need to:
VPC vRouter: Select a VPC vRouter
to add to the OSPF area, for example, VPC
vRouter-1.
Network: Select a network
associated with the VPC vRouter to add to the OSPF area,
for example, VPC Network-1 and L3-Public Network.
Note: You can add a VPC vRouter to multiple OSPF areas, but you
can add a VPC network or public network associated with the VPC
vRouter to only one OSPF area.
Figure 71. Create OSPF Area
After the OSPF area is created, you can go to the Associated
Resource tab of the details page to view neighbor vRouter
information. After the neighbor is successfully created (less than 60
seconds), the communication works properly when the OSPF protocol takes
effect.
Test the network connectivity when the OSPF protocol takes effect.
Use VM-1 and VM-2 to test the network connectivity when the OSPF protocol
takes effect.
Expected result:
Log in to VM-1 (192.168.3.251) ping
192.168.10.1: Succeeded.
Log in to VM-2 (192.168.4.196) ping
192.168.10.1: Failed.
Figure 72. Test Network Connectivity
What to do next
So far, we have introduced how to use an OSPF protocol.
Multicast Routing
Prerequisites
Multicast Routing: VPC vRouters receive multicast information sent
by multicast sources and forward the information to V instances to realize
one-to-many connections on senders and receivers.
ZStack Cloud allows you to use VM instances as the
multicast information receivers, and to use VPC vRouters as multicast
routers to participate in the multicast routing message exchanges.
VPC vRouters support the PIM-SM/PIM-SSM protocol. In the PIM-SM protocol, RP
routers are the key devices in the PIM-SM domain. You can either manually
configure RP addresses or dynamically elect or assign RP addresses according
to the BSR mechanism.
Typical scenario of multicast routing: Assume that the user has a VPC environment on
ZStack Cloud, and demands that VM instances using the VPC
vRouter to communicate can receive multicast data from the public network. To do so,
the user needs to set relevant configuration of the VPC vRouter on ZStack Cloud.
Figure 73. Multicast Routing Topology
About this task
To use multicast routing, follow these steps:
Prepare multicast source.
Configure multicast routing.
Test whether multicast routing works.
The following tables list the assumed environment configurations.
Public Network
Public Network
Configuration
NIC
em01
VLAN ID
No VLAN
IP Range
10.108.10.100~10.108.10.200
Netmask
255.0.0.0
Gateway
10.0.0.1
DHCP IP
10.108.10.101
Management Network
Management
Network
Configuration
NIC
em02
VLAN ID
No VLAN
IP Range
192.168.29.10~192.168.29.20
Netmask
255.255.255.0
Gateway
192.168.29.1
Note:
For security and stability reasons, we recommend that you deploy
an independent management network and separate it from the
public networks.
The management network we mentioned here is the same as that in
ZStack Private
Cloud. That is,
the management network is the network used to manage hosts,
primary storages, and backup storages. If a management network
was created before, you can use it directly.
VPC Network
Private Network
Configuration
NIC
em01
VLAN ID
2800
IP CIDR
192.168.1.0/24
DHCP IP
192.168.1.2
The following section describes the detailed steps of how to use a multicast
routing.
Procedure
Prepare multicast source.
Configure the VM instance as the multicast source according to the following
requirements:
Create a VM instance from the public network according to the
planned configuration. Set the VM name as VM-sender and use the
yum install -y socat command to install socat.
This way, the VM-sender can be used as the source to send multicast
messages.
Make sure that the multicast feature of the switch is enabled.
Configure multicast routing.
Create a VPC vRouter on ZStack Cloud based on the
planned network configuration. You can refer to the Basic
Deployment chapter.
Public Network: 10.108.10.100 to 10.108.10.200.
Make sure that the public network is on the same gateway with
the traditional physical network to ensure network
interconnection.
VPC vRouter: VPC vRouter-1.
On the Multicast Routing tab of the details page of
the VPC vRouter, click Enable to enable the
multicast routing feature. On the Multicast Routing
tab, click Actions > Add to add a static RP Configuration. On the displayed
Add Static RP Configuration dialogue box, set
the following parameters:
RP Address: Enter a RP address, for
example, 10.108.10.125.
Note: You can either manually
configure RP addresses or dynamically elect or assign RP
addresses according to the BSR mechanism. The RP address
must be a stable public IP address.
Group: Set an IP multicast group address
to which multicast messages are sent, for example,
239.1.1.1/32.
Note:
An IP multicast group is a collection of receivers
identified by IP multicast addresses. VPC vRouters
join the IP multicast group as its members so that
they can receive the multicast data sent to the
group.
Enter the IP multicast group address in the format
of a CIDR block.
Figure 74. Add Static RP Configuration
Create a VPC network using the VPC vRouter, and create a VM instance
from the VPC network, for example, VM-receiver. Use the yum
install -y socat command to install socat so that the
VM-receiver can receive multicast messages.
Note: VM instances need to
correctly configure the firewall to receive multicast messages, for
example, enabling IGMP protocol and receiving multicast
data.
Test whether the multicast routing works.
Launch the console of VM-sender and run the following command to
send an UDP data packets to the address whose multicast group
address is 239.1.1.1 and port is 54321 and set the TTL
of the multicast group data as
10.
[root@localhost~]# for i in {1..100} ;do echo hi+$i | socat - udp4-sendto:239.1.1.1:54321,sp=54321,ip-multicast-ttl=10 ;done
Figure 75. Send Multicast Message
Launch the console of VM-receiver and run the following command,
which indicates that specifying the NIC (em01) to add to the
multicast group (239.1.1.1) and receiving the UDP data
packets from port
54321.
As described above, the VM-receiver receives the multicast messages
from VM-sender, which indicates that the multicast routing takes effect.
What to do next
So far, we have introduced how to use multicast routing.
Distributed Routing
Prerequisites
Distributed routing: After distributed routing feature is enabled, the Cloud will
optimize east-west network traffic to improve I/O performance and reduce the network
latency. Distributed routing also strengthens the reliability of communication among
VM instances and the intranet traffic across three layers will not fail due to
vRouter failures.
Typical distributed routing scenarios:
Assume that the user has three hosts. VM-1 and VM-2 are on different hosts,
and on vxlan1: 192.168.1.0/24 and vxlan2: 192.168.2.0/24,
respectively. Since the L2 and L3 networks of the two VM instances are
different, the traffic that flows between VM-1 and VM-2 needs to be routed
through a VPC vRouter on the third host.
After the distributed routing is enabled, messages sent by VM-1 will be sent
to a VPC vRouter through the traditional path. The network proxy of the VPC
vRouter sends an optimization instruction through ZSNP protocol to that of
the compute node. Then, messages of VM-1 will be directly sent to VM-2
without passing through a VPC vRouter.
Note: ZSNP protocol: Based on IP
protocol, it is used to solve the problem that the router proxy cannot
know the information of compute node where the VM instance
resides.
About this task
This scenario mainly introduces how to use distributed routing with VXLAN network as
an example.
Create a VPC vRouter.
Create a VXLAN pool.
Create L2 private networks (L2-VXLAN1 and L2-VXLAN2) and attach them to the
corresponding cluster. These L2 private networks are used to create L3 VPC
networks.
Specify a VPC vRouter to create L3 VPC networks (VPC Netowrk-1 and VPC
Network-2).
Use VPC Network-1 to create VM-1 on Host-1 and use VPC Network-2 to create
VM-2 on Host-2.
Enable distributed routing, test the network connectivity between VPC
Network-1 and VPC Network-2, and monitor traffic flow direction.
Note: Note that all private network range must not overlap.
The following tables list the assumed environment configurations.
Public Network
Public Network
Configuration
NIC
em01
VLAN ID
No VLAN
IP Range
10.108.10.100~10.108.10.200
Netmask
255.0.0.0
Gateway
10.0.0.1
DHCP IP
10.108.10.101
Management Network
Management
Network
Configuration
NIC
em02
VLAN ID
No VLAN
IP Range
192.168.29.10~192.168.29.20
Netmask
255.255.255.0
Gateway
192.168.29.1
Note:
For security and stability reasons, we recommend that you deploy
an independent management network and separate it from the
public networks.
The management network we mentioned here is the same as that in
ZStack Private
Cloud. That is,
the management network is the network used to manage hosts,
primary storages, and backup storages. If a management network
was created before, you can use it directly.
VPC Network-1
Private Network
Configuration
NIC
em01
VLAN ID
2800
IP CIDR
192.168.1.0/24
DHCP IP
192.168.1.2
VPC Network-2
Private Network
Configuration
NIC
em01
VLAN ID
2900
IP CIDR
192.168.2.0/24
DHCP IP
192.168.2.2
The following section describes the detailed steps of how to use distributed
routing.
Procedure
Create a VPC vRouter.
Create a VPC vRouter according to the planned network configuration. For more
information, see Basic Deployment.
Public Network: 10.108.10.100 to 10.108.10.200. Make
sure that the public network is on the same gateway with the
traditional physical network to ensure network interconnection.
VPC vRouter: VPC vRouter-1.
Create a VXLAN Pool.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > VXLAN Pool. On the VXLAN Pool page, click
Create VXLAN Pool. Then, the Create
VXLAN Pool page is displayed. On the displayed page, set the
following parameters:
Zone: By default, the current zone is
displayed.
Name: Enter a name for the VXLAN pool.
Description: Optional. Enter a description
for the VXLAN pool.
SDN Type: Select
Software.
VNI Range: Enter the start ID and end ID of
VXLAN networks, for example, 1 to 1000.
Note:
You can enter an ID that ranges from 1 to 16777214.
The end ID must be equal to or greater than the start
ID.
The two VNI IDs 16777215 and 16777216 are reserved by
the system of this cloud platform.
Cluster: Optional. Attach the VXLAN pool to a cluster.
Note:
You can attach a VXLAN pool to a cluster when you create
the VXLAN pool or after the VXLAN pool is created.
When you attach the VXLAN pool to a cluster, IP
addresses of the compute nodes must be available in the
cluster that correspond to the VTEP CIDR block.
VTEP CIDR: Enter the corresponding VTEP CIDR
block.
Figure 77. Create VXLAN Pool
Create L2 private networks and attach them to the corresponding cluster. These
L2 private networks are used to create L3 VPC networks.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L2 Network Resources > L2 Network. On the L2 Network page, click
Create L2 Network. Then, the Create L2
Network page is displayed. On the displayed page, set the
following parameters:
Zone: By default, the
current zone is displayed.
Name: Enter a name for the L2 network, for
example, L2-VXLAN1.
Description: Optional. Enter a description
for the L2 network.
Type: Select
VxlanNetwork.
Network Acceleration Mode: Only Standard is
supported. No network acceleration technology is applied.
VXLAN Pool: Select a VXLAN pool of the
software SDN type.
VNI: Optional. Enter a specified VNI in the
VXLAN pool. If not specified, the Cloud allocates a VNI
randomly.
Figure 78. Create L2VxlanNetwork
Similarly, create another L2 private network named as L2-VXLAN2.
Specify a VPC vRouter to create L3 VPC networks.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > VPC Network. On the VPC Network page, click
Create VPC Network. The Create VPC
Network page appears. On the displayed page, set the
following parameters:
Name: Enter a name for the VPC network, for
example, VPC Network-1.
Description: Optional. Enter a description
for the VPC network.
L2 Network: Select
L2-VXLAN1.
VPC vRouter: Optional. You can specify a VPC
vRouter when you create a VPC network or attach a VPC vRouter after
you create the VPC network.
Network Address Type: Select
IPv4.
Network Range Method: Select
CIDR.
CIDR: Set a CIDR block for the VPC network,
for example, 192.168.1.0/24.
Gateway: Optional. Set a gateway for the VPC
network.
DHCP Service: Choose
whether to enable the DHCP service.
Note:
The DHCP service is a built-in distributed service
of the Cloud, which assigns IP addresses only to
resources in the Cloud and does not conflict with
your existing DHCP server.
By default, the DHCP service is enabled so that the
NICs using this L3 network acquire IP addresses in a
DHCP mode. You can customize a DHCP IP or use the
DHCP IP that the system assigned according to the IP
allocation policy.
If you disable this option, NICs using this L3
network acquire IP address in a Static mode. In
addition, you cannot specify a DHCP IP. Neither can
the system allocate one.
DHCP IP:
Optional. Set an IP address for the DHCP server, for
example, 172.20.108.10.
Note:
A DHCP IP is an IP address used by the DHCP
service to assign IP addresses to resources that
use this L3 network.
If you create an L3 network for the first time
with the DHCP service enabled, or if you add the
first network range to an L3 network with the DHCP
service enabled, you can customize the DHCP
IP.
If the L3 network has a DHCP IP, you cannot
customize the DHCP IP when you add a network
range.
The DHCP IP can be in or outside the added IP
range, but it must be an unoccupied IP address in
the CIDR block of the added IP range
The IP range determined by the start IP and
end IP cannot contain the link-local address
169.254.0.0/16.
If you select random as the IP allocation
policy and this field is left blank, the system
randomly assigns IP addresses from the added
network range.
If you select allocate in order/allocate in
cycle as the IP allocation policy and this field
is left blank, the system uses the start IP
address in the network range as the DHCP IP.
DNS: Optional. Provide DNS services for an L3
network.
Figure 79. Create VPC Network
Similarly, use L2-VXLAN2 to create another VPC network named as VPC
Network-2.
Use VPC Network-1 to create VM-1 on Host-1 and use VPC Network-2 to create VM-2
on Host-2.
Figure 80. Use VPC Network to Create VM Instance
Test the network connectivity between VPC Network-1 and VPC Network-2, and
monitor traffic flow direction.
Log in to VM-1, test whether VM-1 can successfully
ping VM-2.Figure 81. VM-1 Ping VM-2
Log in to VM-2, test whether VM-2 can successfully
ping VM-1.Figure 82. VM-2 Ping VM-1
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > vRouter > VPC vRouter. On the VPC vRouter page, locate the
VPC vRouter and enter its details page. On the details page, you can
view the NIC monitoring data.Figure 83. NIC Monitoring Data
As described above, VM-1 and VM-2 can communicate with each other. Traffic
flows through the VPC vRouter and can be continuously monitored on the NIC
monitoring card.
Enable distributed routing, test the network connectivity between VPC Network-1
and VPC Network-2, and monitor traffic flow direction.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > vRouter > VPC vRouter. On the VPC vRouter page, locate the
VPC vRouter and enter its details page. On the details page, turn on the
Distributed Routing switch.Figure 84. Enable Distributed Routing
Log in to VM-1, test whether VM-1 can successfully
ping VM-2.Figure 85. VM-1 Ping VM-2
Log in to VM-2, test whether VM-2 can successfully
ping VM-1.Figure 86. VM-2 Ping VM-1
Log in to the management node and run the following API to view the
distributed routing
status.
Figure 87. Enable Distributed Routing As described above, the distributed routing is successfully
enabled and the Cloud begins to optimize east-west network traffic.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > vRouter > VPC vRouter. On the VPC vRouter page, locate the
existing VPC vRouter and enter its details page. On the details page,
view the NIC monitoring data.Figure 88. NIC Monitoring Data
As described above, after the traffic between VM-1 and VM-2 is first
connected through the VPC vRouter, the subsequent traffic will be directly sent
between VM-1 and VM-2. The NIC monitor does not detect traffic flows as
expected, indicating that the distributed routing successfully takes
effect.
What to do next
So far, we have introduced how to use a distributed
routing.
VPC vRouter HA Group
Prerequisites
Typical scenario of VPC vRouter HA group: Create a VPC vRouter HA
group on ZStack Cloud. Either VPC vRouter in the group can be
a primary or secondary VPC vRouter. If the primary VPC vRouter does not work as
expected, the VPC vRouter becomes the secondary VPC vRouter in the group to ensure
high availability of business.
About this task
To use a VPC vRouter HA group, follow these steps:
Create a VPC vRouter HA group.
Create a VPC network using the VPC vRouter HA group.
Create a VM instance using the VPC network.
Test whether the VPC vRouter HA group works.
The following tables list the assumed environment configurations.
Public Network
Public Network
Configuration
NIC
em01
VLAN ID
N o VLAN
IP Range
172.24.19.64~172.24.19.79
Netmask
255.255.0.0
Gatway
172.24.0.1
Management Network
Management Network
Configuration
NIC
em02
VLAN ID
No VLAN
IP Range
192.168.18.64~192.168.18.79
Netmask
255.255.0.0
Gateway
192.168.0.1
Note:
For security and stability reasons, we recommend that you deploy
an independent management network and separate it from the
public networks.
The management network we mentioned here is the same as that in
ZStack Private
Cloud. That is,
the management network is the network used to manage hosts,
primary storages, and backup storages. If a management network
was created before, you can use it directly.
VPC Network
Private Network
Configuration
NIC
em01
VLAN ID
2768
IP CIDR
10.18.97.0/24
Gateway
10.18.97.1
DHCP IP
10.18.97.2
The following section describes the detailed steps of how to use a VPC vRouter HA
group.
Procedure
Create a VPC vRouter HA group and add VPC vRouters to the group. The Cloud
automatically configures the peer vRouters with the same configurations. For
more information, you can refer to User Guide.
Figure 89. VPC vRouter HA Group
Specify a VPC vRouter in the HA Group to create a VPC network.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > L3 Network Resources > VPC Network. On the VPC Network page, click
Create VPC Network. The Create VPC
Network page appears. On the displayed page, set the
following parameters:
Name: Enter a name for the VPC network.
Description: Optional. Enter a description
for the VPC network.
L2 Network: Select an L2 network for the VPC
network.
VPC vRouter: Optional. Select a VPC vRouter
in the HA group.
Network Address Type: Select
IPv4.
Network Range Method: Select
CIDR.
CIDR: Enter 10.18.97.0/24.
Note: The
CIDR block must not overlap.
Gateway: Optional. Set a gateway for the VPC
network.
DHCP Service: Optional. Choose whether to
enable the DHCP service.
IP Allocation Policy: Optional. After
the DHCP service is enabled, select
Random.
DHCP IP: Optional. Set an IP address
for the DHCP server, for example, 10.18.97.2.
DNS: Optional. Provide DNS services for an L3
network.
Figure 90. Create VPC Network
Create a VM instance using the VPC network.
On the main menu of ZStack Cloud, choose Resource Center > Resource Pool > Virtual Resource > VM Instance. On the VM Instance page, click
Create VM Instance. Then, the Create VM
Instance page is dispayed. On the displayed page, set the
following parameters:
Name: Enter a name for the VM instance.
Description: Optional. Enter a description
for the VM instance.
Quantity: Enter the number of VM instances to
be created. You can create VM instances in bulk.
Tag: Optional. Bind one or more tags to the
VM instance.
Group: Optional. Choose a group for the VM
instance. If you do not set this parameter, VM instance goes to the
default group.
Instance Offering: Select an existing
instance offering.
Image: Select an existing image.
Root Disk Offering: Select an existing disk
offering for the root volume of the VM instance.
Data Volume: Optional. Choose whether to
create data volumes and attach the volumes to the VM instance.
Network Configurations: Select the created
VPC network.
Make Default: Optional. Set on of the
selected networks as the default network.
Assign IP: Optional. Choose whether
to assign an IP address to the VM NIC.
MAC Address: Optional. Choose whether
to configure a MAC address for the VM instance.
You can click Add Network
Configuration to configure different
networks.
User Data: Optional. Inject user-defined
parameters or scripts to customize configurations for the VM
instance or to accomplish specific tasks.
Test whether the VPC vRouter HA group works.
Launch the VM console and test whether it can successfully
ping an Internet address for example,
www.baidu.com.Figure 91. VM Ping Internet Address
Stop the primary VPC vRouter in the HA group to simulate the
exception state of a VPC vRouter. The secondary VPC vRouter will
automatically become the primary VPC vRouter in the group. In the
mean time, you can check the ping information.Figure 92. Stop Primary VPC vRouter Figure 93. VM Ping Internet Address
As described above, the secondary VPC vRouter automatically becomes the
primary VPC vRouter, if the primary VPC vRouter does not work as expected.
The VM can still successfully ping the Internet address,
only with a short period of network latency. So, the VPC vRouter HA group
successfully takes effect.
What to do next
So far, we have introduced how to use a VPC vRouter HA
group.
Firewall
Prerequisites
Typical scenario of firewall: Assume that the user has a set of VPC environment for
the research and development of key businesses. This requires to block VM instances
in the VPC network from sending network requests of TCP/UDP/ICMP protocols to public
network. The user can create a firewall and add an ingress rule set and rule to
limit the outgoing traffic of VM instances within the network range.
About this task
To use a firewall, follow these steps:
Create a VM instance using a VPC network.
Create another VM instance using a public network.
Create a firewall.
Add an ingress rule to the firewall.
Test the network connectivity between the VM instances (VPC network and
public network).
The following tables list the assumed environment configurations.
Public Network
Public Network
Configuration
NIC
em01
VLAN ID
No VLAN
IP Range
10.108.10.100~10.108.10.200
Netmask
255.0.0.0
Gateway
10.0.0.1
DHCP IP
10.108.10.101
Management Network
Management
Network
Configuration
NIC
em02
VLAN ID
No VLAN
IP Range
192.168.29.10~192.168.29.20
Netmask
255.255.255.0
Gateway
192.168.29.1
Note:
For security and stability reasons, we recommend that you deploy
an independent management network and separate it from the
public networks.
The management network we mentioned here is the same as that in
ZStack Private
Cloud. That is,
the management network is the network used to manage hosts,
primary storages, and backup storages. If a management network
was created before, you can use it directly.
VPC Network
Private Network
Configuration
NIC
em01
VLAN ID
2800
IP CIDR
192.168.1.0/24
DHCP IP
192.168.1.2
The following section describes the detailed steps of how to use a VPC firewall.
Procedure
Create a VM instance using a VPC network.
Create a VM instance using a VPC network according to the planned network
configuration. Set the name of the VM instance as VM-VPC.
Similarly, create another VM instance using a public network and set the VM
name as VM-Public.
Create a firewall.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Advanced Network Service > Firewall. On the Firewall page, click
Create Firewall. Then, the Create
Firewall page is displayed. On the displayed page, set the
following parameters:
Name: Enter a name for the firewall.
Description: Optional. Enter a description for the
firewall.
VPC vRouter: Select a VPC vRouter that you want to defend
against attacks .
Note: The VPC vRouter that you select must be in running state
and is not associated with a firewall.
Figure 94. Create Firewall
Add an ingress rule to the firewall.
On the Rule section of the details page of the firewall,
click Add Rule on the Ingress
section. Then, the Add Rule page is displayed. On the
displayed page, set the following parameters:
Priority: Set the priority as 1001.
Note:
A smaller number indicates a higher priority. Valid
values: 1001 to 2999.
The priority of a rule in a rule set must be
unique.
Action: Select
Drop.
Accept: Accept the traffic that flows in or out of the
specified VPC vRouter.
Drop: Drop the traffic that flows in or out of the specified
VPC vRouter and does not respond to the client.
Reject: Reject the traffic that flows in or out of the
specified VPC vRouter and responds to the client.
Packets Status: Optional. In this scenario,
select none.
Protocol: Select
TCP.
TCP flag: Optional. Select none.
Port: Optional. You can set a source
port and destination port for the rule.
IP Address: Optional. Set a source IP address
and destination IP address for the rule.
Source IP Address: Enter the IP
address of the created VM instance.
Destination IP Address: Enter the IP
range of the public network, for example,
10.108.10.100-10.108.10.200.
Description: Optional. Enter a description
for the rule.
Enable Now: Turn on the switch.
Figure 95. Add Rule
Similarly, add rules of UDP protocol and ICMP protocol and set the priority
as 1002 and 1003 respectively.
Test the network connectivity between VM-VPC and VM-Public.
Test the TCP-protocol rule.
Use the iperf
command to test the TCP-protocol rule. Set VM-VPC as the sender
and VM-Public as the receiver.
Run the iperf
-s command in the receiver system. Run the
iperf -c x.x.x.x (receiver IP address) -i 1 -t
1000 command in the sender system. Then, view the
network status.Figure 96. TCP Protocol Test
Sender
Recevier
As described above, after the rule is added to the
firewall, network requests of the TCP protocol cannot be sent,
as expected.
Test the UDP-protocol rule.
Use the iperf
command to test the UDP-protocol rule. Set VM-VPC as the sender
and VM-Public as the receiver.
Run the iperf -s
-u command in the receiver system. Run the
iperf -c x.x.x.x (receiver IP address) -u -i 1 -t
1000 command in the sender system. Then, view the
network status.Figure 97. UDP Protocol Test
Sender
Receiver
As described above, after the rule is added to the
firewall, network requests of the UDP protocol cannot be
received after being sent, as expected.
Test the ICMP-protocol rule.
Log in to VM-VPC and test whether it
can successfully ping VM-Public.Figure 98. ICMP Protocol Test As described above, after the rule is added to the
firewall, network requests of the ICMP protocol cannot be sent,
as expected.
What to do next
So far, we have introduced how to use a
firewall.
Netflow
Prerequisites
A NetFlow monitors the ingress and egress traffic of the
NICs of VPC vRouters. The supported versions of data flows are V5 and
V9.
Typical scenario of Netflow: Assume that the user has a set of VPC network
environment and needs to analyse the ingress and egress traffic of a certain NIC.
The user can use a Netflow to transmit the traffic information to analysis
software.
About this task
To use a Netflow, follow these steps:
Create a VM instance using a VPC network.
Create a VM instance using a public network.
Add a Netflow.
Test whether the Netflow works.
The following tables list the assumed environment configuration.
Public Network
Public Network
Configuration
NIC
em01
VLAN ID
No VLAN
IP Range
10.151.0.100~10.151.0.200
Netmask
255.0.0.0
Gateway
10.0.0.1
DHCP IP
10.151.0.101
Management Network
Management
Network
Configuration
NIC
em02
VLAN ID
No VLAN
IP Range
192.168.29.10~192.168.29.20
Netmask
255.255.255.0
Gateway
192.168.29.1
Note:
For security and stability reasons, we recommend that you deploy
an independent management network and separate it from the
public networks.
The management network we mentioned here is the same as that in
ZStack Private
Cloud. That is,
the management network is the network used to manage hosts,
primary storages, and backup storages. If a management network
was created before, you can use it directly.
VPC Network
Private Network
Configuration
NIC
em01
VLAN ID
2800
IP CIDR
192.168.3.0/24
DHCP IP
192.168.3.2
The following section describes the detailed steps of how to use a Netflow.
Procedure
Create VM instances.
Create a VM instance using the VPC network according to planned network
configuration. Set the VM name as Flow-Sender. For more information,
see Basic
Deployment.
Similarly, create another VM instance using the public network and set the VM
name as Flow-Collector.
Add a Netflow.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Advanced Network Service > Netflow. On the Netflow page, click
Add Netflow. Then, the Add
Netflow page is displayed. On the displayed page, set the
following parameters:
Name: Enter a name for the Netflow.
Description: Optional. Enter a description
for the Netflow.
IP: Enter the IP address of
Flow-Collector.
Port: Enter 2055.
Note: Make sure that the
configured IP and port suite of the receiver is correct.
Otherwise, the Netflow service may not work as
expected.
Version: Select
V5.
Note: The output data format varies
depending on the Netflow version. Select a Netflow version based
on your business requirements.
Export Interval: Enter 60.
Routing Configuration: Optional. Set the VPC
vRouters and networks that you want to monitor.
Figure 99. Add Netflow
Test whether the Netflow works.
In this scenario, we use the iperf command to send network
traffic and the tshark software to collect Netflow traffic information.
Run the iperf -s command in the Flow-Collector
system. Run the iperf -c $Flow-Collector IP address -t 60 -P
10 in the Flow-Sender system. Then, check whether the
traffic is received.Figure 100. Send Network Traffic
Run the tshark -f "udp port 2055 and ip src 192.168.3.253 "
-i eth0 -V -c 1 -a duration:500 command in the
Flow-Collector system. Then, you can view the captured packets
information in the analysis software.Figure 101. tshark Packet Capture Information
As described above, when the traffic passes through the NIC of a VPC
vRouter, the Netflow takes effect and forwards the traffic
information to the analysis software.
What to do next
So far, we have introduced how to use a Netflow.
Port Mirroring
Prerequisites
Typical scenario of Netflow: Assume that the user has key business services running
on VM-2, so the user wants to monitor the traffic that flows in and out of VM-2 for
analysis. To ensure that the business services are not affected on VM-2, the user
decides to create a port mirroring for VM-2 on the Cloud. This way, the created port
mirroring will mirror the data traffic of VM-2 NIC and sends the data traffic to the
target VM-1 for analysis.
About this task
To use a port mirroring, follow these steps:
Create a VPC network, VM-1, and VM-2.
Create an L2 network for a flow network.
Create a flow network.
Create a port mirroring.
Add a session to the port mirroring with the VM-2 NIC as the source port and
the VM-1 NIC as the destination port.
Test whether the port mirroring works.
The following tables list the assumed environment configuration.
Management/Public Network
Configuration
NIC
eth0
VLAN ID
NoVLAN
IP Range
172.26.56.161~172.26.56.170
Netmask
255.255.0.0
Gateway
172.26.0.1
VPC Network
Configuration
NIC
eth0
VLAN ID
2800
IP CIDR
10.81.110.0/24
Netmask
255.255.255.0
Gatway
10.81.110.1
Flow Network
Configuration
NIC
eth0
VLAN ID
2900
IP CIDR
10.81.111.0/24
Netmask
255.255.255.0
Gateway
10.81.111.1
Procedure
Create a VPC network, VM-1, and VM-2.
Create a VPC network according to the environment configurations above.
Then, create 2 VM instances, VM-1 and VM-2, on this VPC network.
Attach the second NIC to VM-1.
Enter the details page of VM-1. Choose Configuration Info > NIC > Attach and attach the second NIC to VM-1. In this scenario, the
second NIC uses the public network.Figure 102. Attach Second NIC to VM-1
Create an L2 network for a flow network.
Creates an L2 network according to the environment configurations.
Create a flow network.
On the main menu of ZStack Cloud, choose Resource Center > Network Resource > Dedicated Network > Flow Network. On the Flow Network page, click
Create Flow Network to create a flow network
according to the environment configurations.
Create a port mirroring.
On the main menu of ZStack Cloud, choose Resource Center > Network Service > Advanced Network Service > Port Mirroring. On the Prot Mirroring page, click
Create Port Mirroring. Then, the Create
Port Mirroring page appears.
On the displayed page, set the
following parameters:
Name: Enter a name for the port
mirroring.
Description: Optional. Enter a description
for the port mirroring.
Flow Network: Select a flow network for port mirroring.
Note:
A flow network is a dedicated network for port
mirroring. You can use a flow network to transmit the
mirrors of data packets of NIC ports to the target
ports.
You cannot use a flow network for other purposes except
for port mirroring.
A port mirroring occupies a flow network.
The VM instances for which port mirroring is configured
must reside in the cluster where the associated flow
networks are located.
Enable Now: Optional. Choose whether to
enable port mirroring immediately after the port mirroring is
created. Enabling port mirroring immediately after the creation may
occupy physical network bandwidth. Make sure that your business is
not affected and then select the checkbox.
Add a session to the port mirroring.
Enter the details page of the port mirroring. Choose Session > Add Session. Then, the Add Session page appears.
On
the displayed page, set the following parameters:
Name: enter a name for the session.
Type: Select Bidirection.
Source VM: Select VM-2.
Source NIC: Select the VM-2 NIC.
Destination VM: Select VM-1.
Destination NIC: Select the VM-1 NIC that is
not the default NIC.
Figure 103. Add Session
Test whether the port mirroring works.
Enter the console of the VM-2. Run the command ping
${DhcpServerIp} to make VM-2 send ICMP packets to the DHCP
server.Figure 104. Source VM Sends ICMP Packets
Enter the console of the VM-1. Run the command tcpdump -eni eth1
icmp to check whether the VM-1 can receive the ICMP packets
mirrored by the port mirroring. eth1 is the port name of the destination
NIC. You can run ifconfig -a to query the NIC port
name.Figure 105. Destination VM Receives ICMP Packets
What to do next
So far, the destination VM has copied the network message
of the source VM through the port mirroring. The port mirroring takes effect as
expected, and the user can use the network messages received by VM-1 for monitoring and
analysis.
Note:
