Overview

ZStack Cloud provides VM instances with multiple network resources, including VPC firewall, security group, virtual IP address (VIP), elastic IP address (EIP), port forwarding, IPsec tunnel, load balancing, and flow monitoring.

ZStack Cloud supports the following three network models:

Flat network
vRouter network
VPC

Network Service Module

Network Service Module provides a group of network services. Note that this module has been hidden on the UI.

Network Service Module has the following four types:

Virtual Router Network Service Module (Not recommended)
Provides various network services: DNS, SNAT, load balancing, port forwarding, EIP, and DHCP.
Flat Network Service Module (Flat Network Service Provider)
Provides the following network services:
- User Data: Customizes some parameters, such as ssh-key injection. By running cloud-init, these parameters will be loaded and injected into your VM instance when the VM instance is started.
- EIP: Is realized by distributed EIP to access private networks through public networks.
- DHCP: Is realized by distributed DHCP to dynamically obtain an IP address.
  Note: The DHCP service includes the DNS feature.
- VIP QoS: Adjusts the upstream bandwidth and downstream bandwidth, and can only be applied to EIPs.
vRouter Network Service Module
Provides the following network services:
- IPsec: Achieves VPN connections.
- vRouter route table: Manages custom routes.
- Centralized DNS: Is provided when the DHCP service is enabled.
- VIP QoS: Adjusts the upstream bandwidth and downstream bandwidth.
- DNS: Uses vRouters to provide the DNS service.
- SNAT: Enables VM instances to access directly the Internet.
- Load balancing: Distributes inbound traffics from a VIP to a group of backend VM instances. Then, unavailable VM instances will be detected and isolated automatically.
- Port forwarding: Forwards port traffics of specified public IP addresses to the ports of corresponding VM instances according to specified protocols.
- EIP: Uses vRouters to access private networks of VM instances through public networks.
- DHCP: Provides the centralized DHCP service.
Security Group Network Service Module
Provides the following network service:
- Security group: Manipulates securities of VM instance firewalls by using iptables.

Flat Network Practice

In your production environments, we recommend that you use the following combination of network services:

Flat Network Service Module
- User Data: Customizes some parameters, such as ssh-key injection. By running cloud-init, these parameters will be loaded and injected into your VM instance when the VM instance is started.
- EIP: Is realized by distributed EIP can access private networks through public networks.
- DHCP: Is realized by distributed DHCP to dynamically obtain an IP address.
  Note: The DHCP service includes the DNS feature.
Security Group Network Service Module
- Security group: Manipulates securities of VM instance firewalls by using iptables.

vRouter Network Practice

In your production environments, we recommend that you use the following combination of network services:

Flat Network Service Module
- User Data: Customizes some parameters, such as ssh-key injection. By running cloud-init, these parameters will be loaded and injected into your VM instance when the VM instance is started.
- DHCP: DHCP allows you to dynamically obtain an IP address.
vRouter Network Service Module
- DNS: Uses vRouters to provide the DNS service.
- SNAT: Allows VM instances to access directly the Internet.
- vRouter route table: Manages custom routes.
- EIP: Uses vRouters to access private networks of VM instances through public networks.
- Port forwarding: Forwards port traffics of specified public IP addresses to the ports of corresponding VM instances according to specified protocols.
- Load balancing: Distributes inbound traffics from a VIP to a set of backend VM instances. Then, unavailable VM instances will be detected and isolated automatically.
- IPsec: Achieves VPN connections.
Security Group Network Service Module
- Security group: Manipulates securities of VM instance firewalls by using iptables.

VPC Network Practice

In your production environments, we recommend that you use the following combination of network services:

Flat Network Service Module
- User Data: Customizes some parameters, such as ssh-key injection. By running cloud-init, these parameters will be loaded and injected into your VM instance when the VM instance is started.
- DHCP: Is realized by distributed DHCP to dynamically obtain an IP address.
vRouter Network Service Module
- DNS: Uses VPC vRouters to provide DNS services.
- SNAT: Allows VM instances to access directly the Internet.
- vRouter route table: Manages custom routes.
- EIP: Uses VPC vRouters to access private networks of VM instances through public networks.
- Port forwarding: Forwards port traffics of specified public IP addresses to the ports of corresponding VM instances according to specified protocols.
- Load balancing: Distributes inbound traffics from a VIP to a set of backend VM instances, and unavailable VM instances will be detected and isolated automatically.
- IPsec: Achieves VPN connections.
Security Group Network Service Module
- Security group: Manipulates securities of VM instance firewalls by using iptables.

Advanced Network Services

Dynamic routing: Uses the Open Shortest Path First (OSPF) routing protocol to distribute routing information within a single autonomous system. This service applies to VPC network scenarios.
Multicast routing: Forwards the multicast information sent by the multicast source to VM instances, achieving one-to-multi-point communication in the transmission side and receiving side. This service applies to VPC network scenarios.
VPC firewall: Filters the south-north traffic on the VPC vRouter ports, effectively protecting the VPC communication security and VPC vRouter security. This service applies to VPC network scenarios.
Port mirroring: Copies and sends network traffics of VM NICs from a port to another port, and analyzes the business packets on the ports, better monitoring and managing the network data. This service applies to flat network, vRouter network, and VPC network scenarios.
Netflow: Monitors and analyzes the inbound and outbound traffics of the VPC vRouter NICs. Currently, the following two types of data-flow output formats are supported: Netflow V5 and Netflow V9. This service applies to VPC network scenarios.

VPC Firewall

A firewall is an access control policy that monitors ingress and egress traffic of VPC vRouters and decides whether to allow or block specific traffic based on the associated rule sets and rules.

Concepts

Firewall rule set: A firewall rule set is a set of rules that a firewall uses to defend against network attacks. You need to associate a rule set with the egress or ingress flow direction of VPC vRouter NICs to make the rule set take effect.
- You can associate a rule set with the egress or ingress flow direction of VPC vRouter NICs:
  - Ingress: applies to the traffic that flows into the specified VPC vRouter via a network.
  - Egress: applies to the traffic that flows out of the specified VPC vRouter via a network.
Firewall rule: A firewall rule is an access control entry associated with the egress or ingress flow direction of VPC vRouter NICs to defend against network attacks. A firewall rule includes rule priority, match condition, and behavior.
- You can associate a rule with the egress or ingress flow direction of VPC vRouter NICs:
  - Ingress: applies to the traffic that flows into the specified VPC vRouter via a network.
  - Egress: applies to the traffic that flows out of the specified VPC vRouter via a network.
- Firewall rules can be categorized into custom rules and system rules:
  - Custom rules: rules that you customize. You can select the ingress or egress direction that the rules take effect and configure the rule priorities, match conditions, and behaviors.
    - Rule priority: the priority of a rule to be matched and take effect when compared with other firewall rules. Valid values: 1001 to 2999.
      - Generally, a rule with a higher priority is primarily matched when compared to a rule with a lower priority. Priorities are represented by using numbers. A smaller number indicates a higher priority.
      - Generally, the more specific the match condition that you configure for a rule is, the higher priority you shall configure for the rule.
    - Match condition: the condition based on which traffic flowing into or out of a VPC network is matched. It includes source IP address, destination IP address, source port, destination port, packet status, and protocol.
      - You can specify one or more source and destination IP addresses. These IP addresses can be static IP addresses, IP ranges, CIDR blocks, or a mix of the three.
      - If you specify multiple entries, which include one or more CIDR blocks, the netmask of the CIDR block must be 24. If you specify only one CIDR block, the netmask of the CIDR block is not limited.
      - You can enter a maximum of ten entries, with each entry separated by a comma (,).
    - Behavior: the action to be applied to traffic that meets the match condition. Valid values: accept, drop, and reject.
      - Accept: accepts the traffic that flows in or out of the specified VPC vRouter.
      - Drop: drops the traffic that flows in or out of the specified VPC vRouter and does not respond to the client.
      - Reject: rejects the traffic that flows in or out of the specified VPC vRouter and responds to the client.
  - System rules: rules predefined to support system services. The system predefines the direction that the rules take effect, and the priority, match condition, and behavior of the rules.
    - The priority of system rules ranges from 1 to 1000 or from 4000 to 9999.
    - ZStack Cloud has predefined the following system rules:
      - Firewall rules that take effect on the ingress direction of VPC vRouter NICs:
        
        Rule 1: The priority is 4000, and the behavior and match condition combination determines to allow established or related data packets from any IP address/port, with any protocol, or to any IP address/port, to flow into the specified VPC vRouter via a network.
        
        Rule 2: The priority is 9999, and the behavior and match condition combination determines to allow new data packets from any IP address/port, with any protocol, or to any IP address/port, to flow into the specified VPC vRouter via a network.
        
        Rule 3: the default rule with a priority of 10000. The behavior and match condition combination determines to reject data packets from any IP address/port, with any protocol, in any status, or to any IP address/port, from flowing into the specified VPC vRouter via a network. You can modify the behavior of the rule. Valid values: accept, drop, and reject.
      - Firewall rules that take effect on the egress direction of VPC vRouter NICs:
        
        Rule 1: the default rule with a priority of 10000. The behavior and match condition combination determines to reject data packets from any IP address/port, with any protocol, in any status, or to any IP address/port, from flowing into the specified VPC vRouter via a network. You can modify the behavior of the rule. Valid values: accept, drop, and reject.
      - System rules cannot be modified, except the behavior of the default rule.
      - System rules cannot be created or deleted.
Rule template: A rule template is a template that you can select when you add rules to a rule set or a firewall.
IP/Port set: An IP or port set is a set of IP addresses or ports that you can select when you add rules to a rule set or a firewall.

Fundamentals

ZStack Cloud allows you to associate rule sets and rules with the ingress and egress direction of VPC vRouter NICs. Then traffics that flow in or out of the VPC vRouter NICs are filtered based on the rule priority, match condition, behavior, and the effect direction. This ensures the security of data communications across VPC networks, of VPC vRouters, and of user business operations.

Assume that a server and two VM instances are deployed in a VPC network to run significant business applications. To ensure business security, firewall rule sets and rules are associated with the ingress or egress direction of VPC vRouters, so that only trustful traffics from the public network are allowed to access VM data in the VPC network and that the server in the VPC network can access the server data in the public network.

When VM-1 attempts to access VM-3: The traffic from VM-1 will match the inbound rule set of the public NIC on the VPC vRouter. If malicious traffics are detected, the access is denied.
When VM-2 attempts to access VM-4: The traffic from VM-2 will match the inbound rule of the public NIC on the VPC vRouter, and then will match the outbound rule set of the private NIC on the VPC vRouter. If trusted traffics are detected, the access is allowed.
When Server-2 attempts to access Server-1: The traffic from Sever-2 will match the inbound rule set of the private NIC on the VPC vRouter, and then will match the outbound rule set of the public NIC on the VPC vRouter. If trusted traffics are detected, the access is allowed.

Firewall vs Security

A firewall manages the south-north traffic of VPC networks. A security group manages the east-west traffic of VPC networks and is applied to VM NICs. The two services complement with each other. The following table compares the two services from three aspects.

Item	Security Group	Firewall
Application scope	VM NIC	The entire VPC network
Deployment mode	Distributed	Centralized
Deployment location	VM instance	VPC vRouter
Configuration policy	Supports only Allow and Reject policies	Allows you to customize Accept, Drop, or Reject policies as needed
Priority	Allows you to customize priorities	Allows you to customize priorities
Match condition	Source IP/security group, destination IP/security group, source port, destination port, and protocol	Source IP address, source port, destination IP address, destination port, protocol, and packet status

Security Group

A security group provides security control services for VM NICs. It filters the ingress or egress TCP, UDP, and ICMP packets of VM NICs based on the specified security rules.

Feature Framework

Security Group and Security Rule

A security group control and filter NIC ingress/egress flows through security rules. A security group can have one or more security rules. The security rules can be categorized into system rules and custom rules according to their creation mechanism.

System Rules: The rules added by the system automatically to allow mutual communications among NICs in the same security group. System rules have higher priorities than all custom rules and cannot be modified or deleted. If you need to deny communication among the NICs in the same security group, disable the corresponding system rules.
Custom Rule: Rules added by users as needed.

A security rule has the following attributes: direction, object, protocol&port, policy, and priority.

Direction: Security rules filter flows based on the flow source or flow destination. They can be categorized into the following two types based on the direction of flows they control.
- Ingress Rule: Ingress rules take effect on flows accessing VM NICs. They are responsible for filtering ingress flow sources.
- Egress Rule: Egress rules take effect on flows out of VM NICs. They are responsible for filtering egress flow destinations.
Object: The flow sources or destinations that controlled by the security rules.
- Source: Corresponds to ingress rules. You can set the source as IP addresses or security groups.
  - IP address: Allow or reject the flows from this IP address to access VM NICs in the current security group.
  - Security group: Allow or reject flows from NICs in another security group to access NICs in the current security group.
- Destination: Corresponds to egress rules. You can set the destination as IP addresses or security groups.
  - IP address: Allow or reject the VM NICs in the current security group to access the IP address.
  - Security group: Allow or reject the VM NICs in the current security group to access NICs in another security group.
Protocol&Port: The protocol and port that the security rule take effect on.
- ALL: The security rule takes effect on all protocols. You cannot specify port in this case.
- TCP: The security rule takes effect on the flows using TCP protocols and the from the specified ports. Supported ports 1-65535.
- UDP: The security rule takes effect on the flows using UDP protocols and the from the specified ports. Supported ports 1-65535.
- ICMP: The security rule takes effect on the flows using all ICMP protocols. The start port and end port are both -1.
Sample:
- An ingress rule, whose protocol is TCP, source is 192.168.12.0/24, port is 1000, and policy is Allow, means allows flows from 192.168.12.0/24 to use the TCP protocol to access the 1000 port of NICs in the group.
- An egress rule, whose protocol is UDP, destination is 192.168.12.0/24, port is 1000-1001, and policy is Allow, means allows NICs in the group to use the TCP protocols to access the 1000 and 1001 ports of 192.168.12.0/24.
Policy: The action that the security rules make on the specified flows.
- Allow: Permits the flows to or from the NICs.
- Reject: Prevents the flows to or from the NIC.
Priority:
- You can set priorities for rules on the same direction. The highest rule take effect when a conflict occurs in such a scenario as you set more than one rule, especially an allow rule and a reject rule, on the same source or destination.
- Supported value: 1-100. A higher value indicates a lower priority.

Security Group and VM NIC

A security group provide security controls to VM NICs attached to it. A security group can be attached to one or more VM NICs, and a VM NIC can be attached to one or more security groups.

Priority:
- If you attach more than one security groups to a VM NIC, you can set priorities for these groups. The NIC matches the rules of the group with the highest priority first, and then the group of lower priorities.
- By default, all admin security group have higher priority than user security groups.
Policies for Other Flows:
- After an NIC is attached to security groups, you need to set a default flow policy to process the flows that are not stipulated by security group rules.
- By default, all ingress rules that are not stipulated are rejected and all egress rules that are not stipulated are allowed.

Security Group and Permission

Security groups are divided into admin security groups and tenant/sub-account security groups. Generally, admin security groups are created and owned by administrators (including admin and platform managers); tenant/sub-account security groups are created and owned by tenants/sub-accounts.

A tenant/sub-account can view and manage security groups owned by itself.
The administrator can view and manage all security group. When attach security groups to NICs, note that an admin security group can be attached to any NIC, while a tenant/sub-account security group can be attached to only NICs owned by the same tenant/sub-account.

Security Group VS Firewall

Item	Security Group	Firewall
Application scope	VM NIC	The entire VPC network
Deployment mode	Distributed	Centralized
Deployment location	VM instance	VPC vRouter
Configuration policy	Supports only Allow and Reject policies	Allows you to customize Accept, Drop, or Reject policies as needed
Priority	Allows you to customize priorities	Allows you to customize priorities
Match condition	Source IP/security group, destination IP/security group, source port, destination port, and protocol	Source IP address, source port, destination IP address, destination port, protocol, and packet status

Considerations

If you use a security group along with other network services, such as load balancing and route table, make sure that the security group rules required by these network services are added to the security group.
Public networks, flat networks, and VPC networks support the security group service. It is provided by the security group network service module, which uses iptables to implement security control.
A security group is a distributed firewall. Each security rule change, NIC association or disassociation will cause the security group rule to be updated on all associated VM instances.

Virtual IP

In bridged network environments, a virtual IP address (VIP) provides network services such as serving as an elastic IP address (EIP), port forwarding, load balancing, IPsec tunneling. When a VIP provides the preceding network services, packets are sent to the VIP and then routed to the destination network where VM instances are located.

VIPs created from a public network can provide network services such as EIP and load balancing for flat networks.
VIPs created from a public network can provide network services, such as EIP, port forwarding, load balancing, and IPsec tunnel, for VPC networks.
VIPs created from a VPC network can provide load balancing services for VPC networks.
VIPs created from a flat network can provide network services, such as EIP and load balancing, for flat networks.

You can use a VIP to provide performance-shared load balancing services. A performance-shared load balancer uses a VPC vRouter to provide load balancing services. Traffic is distributed to backend servers by the VPC vRouter. If the VPC vRouter is providing multiple services, the load balancing service shares the performance of the VPC vRouter along with other services.

Concepts

Public VIP: VIPs created from a public network. You can manually create a public VIP or use a public VIP automatically created after a VPC vRouter creation.
- A public VIP can provide network services, such as EIP and load balancing, for flat networks. A public VIP can also provide network services, such as EIP, port forwarding, load balancing, and IPsec tunnel, for VPC networks.
- You can use a public VIP to simultaneously provide port forwarding, load balancing, and IPsec tunnel services. You can also use a public VIP to provide one service for multiple VM instances. However, you cannot specify the same port number for different services.
- A public VIP supports QoS, monitoring data, performance TOP 5, performance analysis, alarm, and other features.
VPC VIP: VIPs created from a VPC network. A VPC VIP can only be manually created.
- A VPC VIP can provide load balancing services for VPC networks.
- VPC VIPs do not support QoS, monitoring data, performance TOP 5, performance analysis, and alarm features.
Flat network VIP: VIPs created from a flat network. You can manually create a flat network VIP or use a flat network VIP automatically created after a VPC vRouter creation.
- A flat network VIP provides network services, such as EIP and load balancing, for flat networks.
- A flat network VIP supports QoS, monitoring data, performance TOP 5, performance analysis, alarm, and other features.
Custom VIP: manually created VIPs. You can customize a public VIP, VPC VIP, and flat network VIP based on your needs.
- One custom public VIP can only be applied to one EIP instance.
- Custom VIPs cannot be used across VPC vRouters.
- When you use the EIP, port forwarding, load balancing, or IPsec tunnel services, you can select Create VIP to create a new VIP, or you can select Use Existing VIP to provide the services.
System VIP: VIPs automatically created by using the L3 network attached to VPC vRouters after the VPC vRouter creation. System VIPS can be categorized into public VIPs and flat network VIPs.
- A system VIP belongs to only one VPC vRouter. When you attach a public network to a VPC vRouter, the Cloud will automatically create a system VIP. This VIP is the default IP address of the vRouter in the network.
- By default, the system VIPs created from public networks are used to provide the source network address translation (SNAT) service.
- When you use the EIP, port forwarding, load balancing, or IPsec tunnel service, you can select Use Existing VIP to provide the services.

Elastic IP

An elastic IP address (EIP) functions based on the NAT technology. IP addresses in a private network are translated into an EIP that is in another network. This way, private networks can be accessed from other networks by using EIPs.

Concepts

Public EIP: The EIP service provided by a virtual IP address (VIP) created from a public network.
- The private network is an isolated network that cannot be directly accessed from other networks or the Internet. A public EIP can directly associate the access to a public network with the VM IP of the private network.
- A public EIP can be associated with or disassociated from a VM instance dynamically.
- A public EIP can be associated with VM instances created from private networks, such as flat networks and VPC networks.
  - The public EIP realized by a distributed EIP can access flat networks through public networks.
  - A VPC vRouter can be used to access VPC networks through public networks.
Flat EIP: The EIP service provided by a VIP created from a flat network.
- L3 isolations exist between flat networks of different network ranges. Therefore, these flat networks cannot be accessed directly. A flat EIP can be used to associate the access to one flat network with the VM IP created from another flat network.
- A flat EIP can be associated with or disassociated from a VM instance dynamically.
- A flat EIP can be associated with VM instances created from other flat networks.

Scenarios

EIP usage in a flat network scenario:
The following diagram shows how an EIP is used in a flat network scenario.

Figure 3. EIP Usage in Flat Network Scenario
- Public networks can connect to the Internet through firewalls.
- Flat networks provide IP addresses for VM instances in each compute node. Notice that these IP addresses cannot connect to the Internet by default.
- A distributed EIP is deployed on each compute node, and can be associated with public networks or private networks separately.
EIP usage in a VPC network scenario:
The following diagram shows how an EIP is used in a VPC network scenario.

Figure 4. EIP Usage in VPC Network Scenario

Considerations

When you use an EIP, note that:

An instance can have only one EIP associated at a time.
The EIP association and disassociation operations take effect in real time.
Associating or disassociating an EIP does not affect the running of an instance.

Port Forwarding

Port forwarding functions based on the layer-3 forwarding service of VPC vRouters. This service forwards traffic flows of the specified IP addresses and ports in a public network to specified ports of VM instances by using the specified protocol. If your public IP addresses are insufficient, you can configure port forwarding for multiple VM instances by using one public IP address and port.

VM instances in a private network for which SNAT is enabled can access external networks. However, the VM instances in a private network are inaccessible to external networks. You can use a port forwarding rule to allow the access to specified ports of the VM instances from external networks.
You can associate a port forwarding rule with a VM NIC and disassociate a port forwarding rule from a VM NIC based on your business needs.
Port forwarding services are provided only by VPC vRouters.
Port forwarding rules are applied to a public network associated with a VPC vRouter and a private network where VM instances reside, as shown in the following figure.
Figure 5. Port Forwarding
Port forwarding is achieved by using a virtual IP address (VIP).
- A VIP is an available IP address in a public network.
- You can use an existing VIP or create a VIP to provide port forwarding services.
- Two port forwarding methods are supported: port-to-port mapping and port range-based mapping.
Figure 6. VIP-Port Forwarding

Limits

The port forwarding service has the following limits:

The firewall policy of a VM instance must open the port specified for port forwarding.
The ports used for port forwarding by the same VIP must be unique.
You can use a VIP to provide port forwarding services for different ports of multiple VM NICs in the same L3 network.
You can use only one VIP to provide port forwarding services for a VM instance.
If you disassociate a VIP from a VM instance and then associate the VIP with the VM instance, you can select VM NICs that reside in the same L3 network as the previously disassociated VM instance.
The source port range and target port range used for port forwarding must be consistent. For example, if you set the source port range to 22-80, the target port range must also be 22-80.

Load Balancing

A load balancer distributes traffic flows of a virtual IP address to backend servers. It automatically inspects the availability of backend servers and isolates unavailable servers during traffic distribution. This way, the load balancer improves the availability and service capability of your business. ZStack Cloud supports multiple NIC teaming for NIC redundancy and load-balancing capabilities.

The Cloud provides the following two types of load balancing services:

Shared-performance load balancing: uses a VPC vRouter to provide load balancing services. Traffic is distributed to backend servers by the VPC vRouter. If the VPC vRouter is providing multiple services, the load balancing service shares the performance of the VPC vRouter with other services.
Dedicated-performance load balancing: uses a load balancer instance to provide load balancing services. Traffic is distributed to backend servers by the load balancer instance. A load balancer instance is a custom VM instance dedicated to providing load balancing services.

Concepts

Frontend network: A frontend network is a type of network that is associated with a load balancer. Requests from the network are distributed by the load balancer to backend servers based on a specified policy.
- Shared-performance load balancer: You can specify a public network or VPC network as a frontend network.
- Dedicated-performance load balancer: You can specify a public network, flat network, or VPC network as a frontend network.
Backend network:A backend network is a type of network that is associated with a load balancer. Requests from frontend networks are distributed by the load balancer to servers in the backend network.
- Shared-Performance Load Balancer:
  - If you specify a public network as the frontend network, you can specify any one of the VPC networks of the VPC vRouter to which the public network is attached as the backend network.
  - If you specify a VPC network as the frontend network, you can specify any one of the VPC networks of the VPC vRouter to which the VPC network is attached as the backend network.
- Dedicated-Performance Load Balancer:
  - If you specify a public network as the frontend network, you can specify a flat network or any one of the VPC networks of the VPC vRouter to which the public network is attached as the backend network.
  - If you specify a flat network as the frontend network, you must specify the same network as the backend network.
  - If you specify a VPC network of a VPC vRouter as the frontend network, you must specify the same network as the backend network. If you need to associate the load balancer with more backend networks, you can attach more NICs to the load balancer instance. Note that the backend networks that you associate are among the other VPC networks of the VPC vRouter.
Load balancer instance: A load balancer instance is a custom VM instance used to provide load balancing services.
- The network where the default NIC of a load balancer instance resides is the frontend network of the load balancer instance. The default NIC cannot be detached from a load balancer instance.
- The networks of the NICs of a load balancer instance, except the default NIC, are the backend networks of the load balancer.
- The management NIC (if any) cannot be detached.
LB image: A dedicated-performance load balancer (LB) image encapsulates dedicated-performance load-balancing services and can be used to create load balancer instances. However, a dedicated-performance load balancer image cannot be used to create VM instances.
Load balancer instance: A load balancer (LB) instance offering defines the CPU, memory, image, and management network configuration settings used to create LB instances. LB instances provide load balancing services for the public network, flat network, and VPC network.
Listener: A listener monitors the frontend requests of a load balancer and distributes the requests to a backend server based on the specified policy. In addition, the listener performs health checks on backend servers.
- Listeners support the TCP, HTTP, HTTPS, and UDP protocols.
- A load balancer can be associated with multiple listeners while a listener can be associated with only one load balancer.
- If the listener uses the weighted round-robin load-balancing algorithm, you can set the weight value for each individual backend server on the backend server group details page.
Forwarding rule: A forwarding rule forwards the requests from different domain names or URLs to different backend server groups.
- A forwarding rule is composed of a domain name and URL.
- A listener can have up to 40 forwarding rules.
- You can configure a domain-based or URL-based forwarding rule for a load balancer. You can add multiple forwarding rules to a listener and associate these rules with different backend server groups.
- A forwarding rule is matched by using the exact match and fuzzy match mechanisms. If multiple forwarding rules are matched, the forwarding rule matched through the exact match mechanism is used.
Certificate: If you select HTTPS for a listener, associate it with a certificate to make the listener take effect. You can upload either a certificate or certificate chain.
Backend server group: A backend server group is a group of backend servers that handles requests distributed by load balancers. It is the basic unit for traffic distribution by load balancer instances.
- A load balancer can be associated with multiple backend server groups, while a backend server group can be associated with only one load balancer.
- A backend server group can be associated with multiple listeners in the same load balancer.
- Creating a load balancer will automatically create an empty backend server group.
Backend server: A backend server handles requests distributed by a load balancer. You can add a VM instance on the Cloud or a server on a third-party cloud as a backend server.

IPsec Tunnel

An IPSec tunnel encrypts and verifies IP packets that transmit over a virtual private network (VPN) from one site to another.

The following are the characteristics of an IPsec tunnel:

IPsec negotiation mode:
For security reasons, we only support the Main mode. The Aggressive mode is not supported.
IPsec security protocol:
We support only the Encapsulating Security Payload (ESP) protocol.
IPsec encapsulation mode:
We support the Tunnel mode. The Transport mode is not supported.
IPsec routing model:
We support only policy-based IPSec VPN. Route-based IPSec VPN is not supported. Therefore, the tunnel supports only unicast data, and does not support multicast and broadcast.

The typical usage scenario of an IPsec tunnel in vRouter networks is as follows:

Prepare two isolated ZStack Cloud and set up two VPC environments in these two clouds respectively. In each VPC environment, create two VPC networks respectively and make sure that these VPC networks cannot communicate with each other. Then, you can use an IPsec tunnel to achieve communication between these VPC networks.

Shared Bandwidth

Shared Bandwidth: A shared bandwidth provides bandwidth sharing service and centralized speed control for public network VIPs. You can bind multiple VIPs to a shared bandwidth to allow instances using these VIPs to share the same bandwidth resource, thereby reducing the cost on public network communications.

Fundamental

Shared Bandwidth is a network service provided by a VPC vRouter. A shared bandwidth can be used by multiple public network VIPs. The total network speed of these VIPs is limited below the size of the shared bandwidth.

Public network VIPs provide network services, such as EIP and Port Forwarding, to VPC networks, enabling the VM instances on VPC networks to access the public network. If an amount of VM instances use VIPs belonging to the same shared bandwidth, these VM instance can share the bandwidth resource and are limited centrally on the network speed when they access the public network. This effectively helps you reduce the cost on public network.

Note: Currently, a shared bandwidth can be used by VIPs residing on the same VPC vRouters. To make a VIP successfully limited by a shared bandwidth, you must make it provide network services to VM NICs on the VPC networks attached to the VPC vRouter that the shared bandwidth attaches. If a VIP is bound to a shared bandwidth but is removed from the specified VPC vRouter later, the shared bandwidth no longer limit its speed.

Advantages

The Shared Bandwidth service provided by ZStack Cloud has the following advantages:

Reduce Network Cost: Allows multiple VM instances to share the same bandwidth resource, increasing the utilization of the bandwidth as well as reducing the bandwidth costs.
Flexible O&M: You can bind/unbind a VIP to/from a shared bandwidth whenever you need, flexibly choosing whether to use the bandwidth sharing and centralized speed limit service. In addition to Shared Bandwidth, ZStack Cloud provides other methods for you to meet various requirements on the network speed limit.
- Adding QoS to a VIP individually: You can add a QoS to a VIP individually to provide a dedicated bandwidth and speed limit service for it. Note that if the VIP is bind to a shared bandwidth, the QoS added for it individually does not take effect during it is using the shared bandwidth. After the VIP is unbind from the shared bandwidth, its individual QoS takes effect again.
- Adding QoS to a NIC individually: You can add a QoS to a VM NIC individually from the VM details page to provide a dedicated bandwidth and speed limit service for the NIC. If the NIC has an individual QoS added as well as uses a VIP with QoS, its speed is limited by the lower one among its own QoS and the VIP QoS.
Good Performance Guarantee: Shared bandwidth and other QoS services provided by ZStack Cloud guarantee a necessary bandwidth for core business during network congestion to ensure the stable running of these businesses.

Quick Start

To use the Shared Bandwidth service, follow these steps:

Create a shared bandwidth and associate a VPC vRouter.
Bind public network VIPs on the VPC vRouter to the shared bandwidth.
Create network services, such as EIPs, based on the VIPs.
Bind EIPs to VM NICs.
The VM NICs share this shared bandwidth and are centrally limited on the network speed.

PreviousNetwork Service NextInventory