• Network Range Method: Select a method to add a network range for the VPC network. You can select IP Range or CIDR. In this scenario, select IP Range.
• IP Configuration Mode: Select Stateful-DHCP.
  Note:

  • Stateful-DHCP: The interface address and other parameters are all configured through DHCP. The IP range method supports stateful DHCP.
  • Stateless-DHCP: The interface address is automatically derived from the route advertisement prefix and the interface Mac address. Other parameters are configured through DHCP.
  • SLAAC: The interface address is automatically derived from the prefix of the route advertisement that also contains other parameters.
• Start IP: Set a start IP address for the network range, for example, 234e:0:4568::2.
• End IP: Set an end IP address for the network range, for example, 234e:0:4568:0:ffff:ffff:ffff:ffff.
• Prefix Length: Set a prefix length for the network range, for example, 64. The prefix length ranges from 64 to 126.
• Gateway: Set a gateway for the network range, for example, 234e:0:4568::1.
• DHCP IP: Optional. Set an IP address for the DHCP server, for example, 234e:0:4568::3.
  Note:

  • When you create an L3 network and enable the DHCP service for the first time, or when you add the first network range for an L3 network that has the DHCP service enabled, you can specify an IP address for the DHCP server.
  • If a DHCP IP is specified for an L3 network, you cannot specify another DHCP IP when you add a network range for the network.
  • The DHCP IP can be within or out of the added IP range. However, the IP address must be within the CIDR block to which the added IP range belongs and must not be in use.
  • The IP range determined by the start IP and end IP cannot contain the link-local address fe80::/10.
  • If not specified, the system would randomly specify a DHCP IP within the added IP range for the DHCP server.

• IP Version: Select IPv6.
• DNS: Specify a DNS address, for example, 240c::6644.

• Name: Set the name as VM-dual-stack.
• Description: Optional. Enter a description for the VM instance.
• Quantity: Enter 2.
• Instance Offering: Select an existing instance offering.
• Image: Select an existing image.
• Root Disk Offering: Select an existing disk offering for the root volume of the VM instance.
• Network Configuration: Select the IPv4+IPv6 dual-stack network.
• User Data: Optional. Inject user-defined parameters or scripts to customize configurations for the VM instance or to accomplish specific tasks.

[root@localhost~]# dhclient -6 eth0  //eth0 indicates the NIC name
[root@localhost~]# ifconfig

Note: FE80-started address is the link-local address.

• VM-dual-stack-1 IPv4 address: 192.168.10.105
• VM-dual-stack-1 IPv6 address: 234e:0:4569::61:bcf4
• VM-dual-stack-2 IPv4 address: 192.168.11.250
• VM-dual-stack-2 IPv6 address: 234e:0:456a::46:7348

• Log in to VM-dual-stack-1, use IPv4 and IPv6 address respectively to ping VM-dual-stack-2.
• Log in to VM-dual-stack-2, use IPv4 and IPv6 address respectively to ping VM-dual-stack-1.

• Name: Enter a name for the sub-account, for example, Sub-Account-A.
• Description: Optional. Enter a description for the sub-account.
• Password: Enter a password for the sub-account.
• Confirm Password: Confirm the sub-account password.
• Pricing List: Optional. Select a pricing list. If left blank, the default pricing list is used.

• Zone: By default, the current zone is displayed.
• Name: Set the name as L2-Public Network.
• Description: Optional. Enter a description for the L2 network.
• Switch Type: Select Linux Bridge.
• Network Type: Select L2NoVlanNetwork.
• Cluster: Select a cluster to be attached, for example, Cluster-1.
• NIC Name: Enter a NIC name for the L2 network. For example, em01.

• Name: Set the name as L3-Public Network.
• Description: Optional. Enter a description for the public network.
• L2 Network: Select the existing L2-Public Network.
  Note: ZStack Cloud allows you to use an L2 network to create multiple L3 networks. However, we recommend that you do not use an L2 network to create multiple L3 networks if not for specific business needs.
  On the Select L2 Network page, two tabs are displayed:

  • Recommended: lists L2 networks in the current zone that are not attached to an L3 network.
  • All: lists all L2 networks in the current zone.
• Network Address Type: Select IPv4.
• Network Range Method: Select IP Range.
• Start IP: Set a start IP address for the network range, for example, 10.151.10.100.
• End IP: Set an end IP address for the network range, for example, 10.151.10.200.
• Netmask: Set a netmask for the network range, for example, 255.0.0.0.
• Gateway: Set a gateway for the network range, for example, 10.0.0.1.
• DHCP Service: Choose whether to enable the DHCP service.
  Note:

  • The DHCP service is a built-in distributed service of the Cloud, which assigns IP addresses only to resources in the Cloud and does not conflict with your existing DHCP server.
  • By default, the DHCP service is enabled so that IP addresses are automatically assigned to resources in the Cloud. You can customize a DHCP IP or use the DHCP IP that the system assigned according to the IP allocation policy.
  • If you disable this option, IP addresses are not automatically assigned to resources that use this network. Therefore, you need to manually assign IP addresses to these resources. In addition, you cannot specify a DHCP IP. Neither can the system allocate one.
  • IP Allocation Policy: Optional. IP addresses can be assigned according to the following three allocation policies:
    • Random: The system randomly assigns IP addresses from the network range.
    • Allocate in Order:
      • The system assigns all available IP addresses from the network range in ascending order. Released IP addresses are assigned in the next allocation.
      • Example: Assume that the network range is 192.168.0.101～192.168.0.120, within which 192.168.0.101～192.168.0.108 are allocated. If 192.168.0.106 is released, it will be assigned first in the next allocation.
    • Allocate in Cycle:
      • The system assigns available IP addresses to VM instances from the network range in ascending order. Released IP addresses are assigned when currently available IP addresses are used up.
      • Example: Assume that the network range is 192.168.0.101～192.168.0.120, within which 192.168.0.101～192.168.0.108 are allocated. If 192.168.0.106 is released, it will be assigned after 192.168.0.120 is used.
  • DHCP IP: Optional. Set an IP address for the DHCP server.
    Note:

    • A DHCP IP is an IP address used by the DHCP service to assign IP addresses to resources that use this L3 network.
    • If you create an L3 network for the first time with the DHCP service enabled, or if you add the first network range to an L3 network with the DHCP service enabled, you can customize the DHCP IP.
    • If the L3 network has a DHCP IP, you cannot customize the DHCP IP when you add a network range.
    • The DHCP IP can be in or outside the added IP range, but it must be an unoccupied IP address in the CIDR block of the added IP range
    • The IP range determined by the start IP and end IP cannot contain the link-local address 169.254.0.0/16.
    • If you select random as the IP allocation policy and this field is left blank, the system randomly assigns IP addresses from the added network range.
    • If you select allocate in order/allocate in cycle as the IP allocation policy and this field is left blank, the system uses the start IP address in the network range as the DHCP IP.
• DNS: Optional. Add a DNS server to provide domain name resolution services for the public network, for example, 223.5.5.5.
  Note: When you add an IP range for an IPv4 L3 network, note that:

  • The IP range cannot contain gateway IP addresses in the format of xxx.xxx.xxx.1, broadcast addresses in the format of xxx.xxx.xxx.255, or network addresses in the format of xxx.xxx.xxx.0.
  • The IP range of a private network cannot overlap with the IP range of a public network used to create a vRouter offering or of a management network.

• Zone: By default, the current zone is displayed.
• Name: Set the name as L2-Management Network.
• Description: Optional. Enter a description for the L2 network.
• Switch Type: Select Linux Bridge.
• Network Type: Select L2NoVlanNetwork.
• Cluster: Select a cluster to be attached, for example, Cluster-1.
• NIC Name: Enter a NIC name for the L2 network. For example, em02.

• Name: Set the name as L3-Management Network.
• Description: Optional. Enter a description for the management network.
• L2 Network: Select the existing L2-Management Network.
  Note: ZStack Cloud allows you to use an L2 network to create multiple L3 networks. However, we recommend that you do not use an L2 network to create multiple L3 networks if not for specific business needs.
  On the Select L2 Network page, two tabs are displayed:

  • Recommended: lists L2 networks in the current zone that are not attached to an L3 network.
  • All: lists all L2 networks in the current zone.
• Network Range Method: Select IP Range.
• Start IP:Set a start IP address for the network range, for example, 192.168.28.100.
• End IP: Set an end IP address for the network range, for example, 192.168.28.200.
• Netmask: Set a netmask for the network range, for example, 255.255.255.0.
• Gateway: Set a gateway for the network range, for example, 192.168.28.1.
• Note: When you add an IP range for an IPv4 L3 network, note that:

  • The IP range cannot contain gateway IP addresses in the format of xxx.xxx.xxx.1, broadcast addresses in the format of xxx.xxx.xxx.255, or network addresses in the format of xxx.xxx.xxx.0.
  • The IP range of a private network cannot overlap with the IP range of a public network used to create a vRouter offering or of a management network.

• Name: Enter a name for the vRouter image.
• Description: Optional. Enter a description for the vRouter image.
• Image Usage: Display VPC vRouter.
• CPU Architecture: Select a CPU architecture for the vRouter image. VPC vRouters created from the vRouter image inherit this CPU architecture.
• OS: Select a OS for the vRouter image. Supported OS types differ depending on the CPU architecture.
• Image Storage: Select an image storage to store the vRouter image.
• Image Path: Enter a URL or upload a local file.
  • URL: Enter the download URL of the vRouter image.
  • Local File: Upload a vRouter image file that can directly be accessed by the current browser.
    Note:

    • You can upload the vRouter image to an ImageStore or Ceph image storage.
    • A local browser will serve as a transmission relay used for uploading the vRouter image. Do not refresh or stop the current browser, nor stop your management node. Otherwise, you will fail to add the vRouter image.

• Name: Enter a name for the VPC vRouter.
• Description: Optional. Enter a description for the VPC vRouter.
• vRouter Offering: Select a vRouter offering you created before.
• Cluster: Optional. Specify a cluster for the host on which the VPC vRouter is to be started.
• Storage Allocation Policy: Specify how the Cloud allocates a primary storage. The following two policies are supported:
  • System Allocation: The Cloud allocates a primary storage according to the preconfigured policy.
  • Custom: Select a primary storage as needed.
    • Primary Storage: Select a primary storage for the VPC vRouter.
• Host: Optional. Select a host on which the VPC vRouter is started.
• Default IPv4/IPv6 Address: Optional. Specify a default IP address for the VPC vRouter. If not specified, the Cloud allocates one automatically.
• Assign Management Network IP: Optional. Assign a management network IP to the VPC vRouter.
  Note: To assign a management network IP, make sure that the management network used by the VPC vRouter is separated from the public network the VPC vRouter uses. If the VPC vRouter uses a same network both as its management network and public network, you cannot assign a management network IP.
• DNS: Optional. Set the DNS service for the VPC vRouter. If not specified, 223.5.5.5 will be used.
  Note:

  • You can set an IPv4 DNS or IPv6 DNS as needed. For example, you can set the IPv4 DNS to 223.5.5.5 or IPv6 DNS to 240C::6644.
  • Services in the VPC vRouter can access the public network services via DNS. You can also specify the other DNS address if necessary.
  • For VM instances created by using a VPC network, the DNS is the gateway of the VPC network. The VM traffics are forwarded by a VPC vRouter.
• CPU Pinning: Associate the virtual CPUs (vCPUs) of a VPC vRouter with host pCPUs stringently and allow you to allocate specific pCPUs for the VPC vRouter, thus improving VPC vRouter performances.
  Note:

  • Pinning Format
    • In the left input box, set a vCPU range. In the right input box, set a pCPU range. Range format: integer, hyphen(-), and caret (^). Use commas to separate them.
    • The vCPU range depends on the vRouter offering attached to the VPC vRouter.
    • The pCPU range depends on the pCPU quantity of the selected cluster or host.
  • Example: In the left input box, enter 1. In the right input box, enter 0-3,^2. This example indicates that vCPU 1 is stringently associated with pCPU 0, pCPU 1, and pCPU 3, while ^ represents that vCPU 2 is excluded.

• Zone: By default, the current zone is displayed.
• Name: Set the name as L2-VXLAN-A1.
• Description: Optional. Enter a description for the L2 network.
• Switch Type: Select Linux Bridge.
• Network Type: Select VxlanNetwork.
• VXLAN Pool: Select a VXLAN pool of the software SDN type.
• VNI: Optional. Select a specified VNI in the VXLAN pool.

  If not specified, the Cloud allocates a VNI randomly.

• Name: Set the name as VPC-A1.
• Description: Optional. Enter a description for the VPC network.
• L2 Network: Select the existing L2-VXLAN-A1.
  On the Select L2 Network page, two tabs are displayed:

  • Recommended: lists L2 networks in the current zone that are not attached to an L3 network.
  • All: lists all L2 networks in the current zone.
• VPC vRouter: Optional. You can specify a VPC vRouter when you create a VPC network or attach a VPC vRouter after you create the VPC network.
• Network Address Type: Select IPv4.
• Network Range Method: Select CIDR.
• CIDR: Set a CIDR block for the VPC network, for example, 192.168.108.1/24.
• Gateway: Set a gateway for the VPC network, for example, 192.168.108.1.
  Note:

  • You can use the first or last IP address in the specified CIDR block as the gateway.
  • If left blank, the first IP address in the specified CIDR block is used as the gateway.
• DHCP Service: Choose whether to enable the DHCP service.
  Note:

  • The DHCP service is a built-in distributed service of the Cloud, which assigns IP addresses only to resources in the Cloud and does not conflict with your existing DHCP server.
  • By default, the DHCP service is enabled so that IP addresses are automatically assigned to resources in the Cloud. You can customize a DHCP IP or use the DHCP IP that the system assigned according to the IP allocation policy.
  • If you disable this option, IP addresses are not automatically assigned to resources that use this network. Therefore, you need to manually assign IP addresses to these resources. In addition, you cannot specify a DHCP IP. Neither can the system allocate one.
  • IP Allocation Policy: Optional. After the DHCP service is enabled, IP addresses can be assigned according to the following three allocation policies:
    • Random: The system randomly assigns IP addresses from the network range.
    • Allocate in Order:
      • The system assigns all available IP addresses from the network range in ascending order. Released IP addresses are assigned in the next allocation.
      • Example: Assume that the network range is 192.168.0.101～192.168.0.120, within which 192.168.0.101～192.168.0.108 are allocated. If 192.168.0.106 is released, it will be assigned first in the next allocation.
    • Allocate in Cycle:
      • The system assigns available IP addresses to VM instances from the network range in ascending order. Released IP addresses are assigned when currently available IP addresses are used up.
      • Example: Assume that the network range is 192.168.0.101～192.168.0.120, within which 192.168.0.101～192.168.0.108 are allocated. If 192.168.0.106 is released, it will be assigned after 192.168.0.120 is used.
  • DHCP IP: Optional. Set an IP address for the DHCP server, for example, 192.168.21.2.
    Note:

    • A DHCP IP is an IP address used by the DHCP service to assign IP addresses to resources that use this L3 network.
    • If you create an L3 network for the first time with the DHCP service enabled, or if you add the first network range to an L3 network with the DHCP service enabled, you can customize the DHCP IP.
    • If the L3 network has a DHCP IP, you cannot customize the DHCP IP when you add a network range.
    • The DHCP IP can be in or outside the added IP range, but it must be an unoccupied IP address in the CIDR block of the added IP range
    • The IP range determined by the start IP and end IP cannot contain the link-local address 169.254.0.0/16.
    • If you select random as the IP allocation policy and this field is left blank, the system randomly assigns IP addresses from the added network range.
    • If you select allocate in order/allocate in cycle as the IP allocation policy and this field is left blank, the system uses the start IP address in the network range as the DHCP IP.
• DNS: Optional.

1. Log in to VM-A1 and use the ping command to test the network connectivity:
   Expected result:

   • ping baidu.com: Successful
   • ping VM-A2: Successful
   • ping VM-B1: Failed (Two VXLAN-VPC network are isolated in layer 2)
   • ping VM-B2: Failed (Two VXLAN-VPC network are isolated in layer 2)

   Note:

   In VM-A1 system, you need to manually add the IP addresses of other VM instances to the /etc/hosts directory.

   [root@Localhost~]# vim /etc/hosts
   ...
   192.168.22.156 VM-A2
   192.168.23.177 VM-B1
   192.168.24.193 VM-B2
   ...

   
   
   

2. Similarly, the network connectivity of VM-A2 is expected the be the same as that of VM-A1.
3. Log in to VM-B1 and use the ping command to test the network connectivity.
   Expected result:

   • ping baidu.com: Successful
   • ping VM-A1: Failed (Two VXLAN-VPC network are isolated in layer 2)
   • ping VM-A2: Failed (Two VXLAN-VPC network are isolated in layer 2)
   • ping VM-B2: Successful

   Note:

   In VM-B1 system, you need to manually add the IP addresses of other VM instances to the /etc/hosts directory.

   [root@Localhost~]# vim /etc/hosts
   ...
   192.168.21.250 VM-A1
   192.168.22.156 VM-A2
   192.168.24.193 VM-B2
   ...

   
   
   

4. Similarly, the network connectivity of VM-B2 is expected the be the same as that of VM-B1.

• Log in to VM-A1, ping VM-B1: Successful
• Log in to VM-B1, ping VM-A2: Successful

1. Log in to VM-web and use the ping command to test network connectivity.
   Expected result:

   • ping baidu.com: Successful
   • ping VM-app: Successful
   • ping VM-database: Successful

   Note:

   In VM-web system, you need to manually add the IP addresses of VM-app and VM-database to the /etc/hosts directory.

   [root@VM-web ~]# vim /etc/hosts
   ...
   192.168.20.187 VM-app
   192.168.50.141 VM-database
   ...

   
   
   

2. Log in to VM-app and use the ping command to test network connectivity.
   Expected result:

   • ping baidu.com: Successful
   • ping VM-web: Successful
   • ping VM-database: Successful

   Note:

   In VM-app system, you need to manually add the IP addresses of VM-web and VM-database to the /etc/hosts directory.

   [root@VM-app ~]# vim /etc/hosts
   ...
   192.168.10.79 VM-web
   192.168.50.141 VM-database
   ...

   
   
   

3. Log in to VM-database and use the ping command to test network connectivity.
   Expected result:

   • ping baidu.com: Successful
   • ping VM-app: Successful
   • ping VM-web: Successful

   Note:

   In VM-database system, you need to manually add the IP addresses of VM-app and VM-web to the /etc/hosts directory.

   [root@VM-database ~]# vim /etc/hosts
   ...
   192.168.20.187 VM-app
   192.168.10.79 VM-web
   ...

   
   
   

• IP Address Type: By default, the IPv4 type is displayed.
• Network Range Method: By default, the IP range method is displayed.
• Network Range Type: Select Address Pool.
• Start IP: Set a start IP address for the address pool, for example, 172.20.0.1.
• End IP: Set a end IP address for the address pool, for example, 172.20.0.254.
  Note: The address pool cannot contain broadcast addresses in the format of xxx.xxx.xxx.255, or network addresses in the format of xxx.xxx.xxx.0.
• Netmask: Set a netmask for the address pool, for example, 255.255.0.0.

• Name: Enter a name for the virtual IP address (VIP).
• Description: Optional. Enter a description for the VIP.
• Network: Select an L3 network that has an address pool.
• Network Range: Select an address pool.
• Assign IP: Optional. You can assign a virtual IP address.
• VIP QoS: You can limit the network bandwidth of public VIPs and flat network VIPs. You can set the QoS for a custom VIP when you create the VIP or after the VIP is created.

• Name: Set the security group name.
• Description: Optional. Set the security group description.
• Switch Type: Select Linux Bridge.
• NIC: Choose the NIC of VM1.
• Ingress Rule: Click Add Rule and set the first ingress rule for the security group.
  • Type: Displays Ingress.
  • Priority: Set as 1 by default.
  • Policy: Choose Allow.
  • IP Address Type: Choose IPv4.
  • Protocol: Choose ALL.
  • Source: Set a source from which flows can access the security group. Choose IP/CIDR and enter 10.81.111.3 here.
  • Enable: Enable this rule.
  • Description: Optional. Enter a description for the rule.
  Click Add Rule and set the second ingress rule for the security group.

  • Type: Displays Ingress.
  • Priority: Set as 2, which means this ingress rule has a lower priority than the first ingress rule.
  • Policy: Choose Reject.
  • IP Address Type: Choose IPv4.
  • Protocol: Choose ALL.
  • Source: Set a source from which flows cannot access the security group. Choose IP/CIDR and enter 10.81.111.0/24 here.
  • Enable: Enable this rule.
  • Description: Optional. Enter a description for the rule.
• Egress Rule: Click Add Rule and set the first egress rule for the security group.
  • Type: Displays Egress.
  • Priority: Set as 1 by default.
  • Policy: Choose Allow.
  • IP Address Type: Choose IPv4.
  • Protocol: Choose ALL.
  • Destination: Set a destination to which flows from the security group are allowed. Choose IP/CIDR and enter 10.81.111.3 here.
  • Enable: Enable this rule.
  • Description: Optional. Enter a description for the rule.
  Click Add Rule and set the second egress rule for the security group.

  • Type: Displays Egress.
  • Priority: Set as 2, which means this egress rule has a lower priority than the first egress rule.
  • Policy: Choose Reject.
  • IP Address Type: Choose IPv4.
  • Protocol: Choose ALL.
  • Destination: Set a destination to which flows from the security group are denied. Choose IP/CIDR and enter 10.81.111.0/24 here.
  • Enable: Enable this rule.
  • Description: Optional. Enter a description for the rule.

• Name: Enter a name for the LB image.
• Description: Optional. Enter a description for the LB image.
• CPU Architecture: Select a CPU architecture for the LB image. LB instances created from the image inherit this CPU architecture.
• Backup Storage: Select a backup storage to store the LB image.
• Image Path: Enter a URL or upload a local file. In this case, enter a URL.
  • URL: Enter the download URL of the LB image.

• Zone: By default, the current zone is displayed.
• Name: Enter a name for the load balancer (LB) instance offering.
• Description: Optional. Enter a description for the LB instance offering.
• CPU: Specify the number of CPU cores for the LB instance offering, for example, specify 2 Core.
• Memory: Specify the memory size for the LB instance offering, for example, specify 8GB.
• Image: Select a dedicated-performance LB image that you added.
• Management Network: Select a management network that you created.

• Name: Enter a name for the LB.
• Description: Optional. Enter a description for the LB.
• LB Type: Select Dedicated Performance.
• Frontend Network Protocol: Select the network protocol for the frontend network. Here, select IPv4.
• Frontend Network: Select a network as the frontend network of the LB. Here, select a VPC network.
• VIP: You can create a VIP or use an existing VIP to provide load balancing services. Here, select New VIP. Set the following parameters:
  • Network Range: Optional. Select an IP range.
  • Assign IP: Optional. Specify a VIP. This parameter is available only after you select an IP range.
• Backend Network: Select a network as the backend network. Here, specify the same VPC network.
  Note: You can add multiple backend networks by attach NICs to the load balancer. All VPC network in the same VPC vRouter to which the VPC network is attached can be specified as backend networks. For more information, see Attach a NIC to the load balancer.
• HA Mode: Select single node.
• LB Instance Name: Enter a name for the LB instance.
• Load Balancer Offering: Select a LB offering.

• Storage Allocation Policy: Select the storage allocation policy for the load balancer. Supports System Allocation and Custom. Here, select Custom.

• Name: Enter a name for the certificate.
• Description: Optional. Enter a description for the certificate.
• Certificate Text: Enter the certificate content.
• Private Key: Enter the private key.
• Certificate Chain: Optional. If you need to upload multiple certificates, you need to combine the root and intermediates certificates and then upload the certificates.

• Name: Enter a name for the listener.
• Description: Optional. Enter a description for the listener.
• Protocol: Select a listening protocol. Here, select HTTPS.
• Certificate: Associate a certificate with the listener.
• Load Balancer Port: Specify a port for load balancing. Valid values: 1 to 65535. Here, specify100.
• Backend Server Port: Specify a backend server port. Valid values: 1 to 65535. Here, specify 80.
• Load Balancer Algorithm: Set a routing rule for data packets. Here, select Round Robin.
• Session Persistence: An innate mechanism of the load balancing service. It identifies the association of the interactions between a client and backend servers based on which a load balancer can direct the client's requests to a specific backend server and achieve business continuity.
• Backend Server Group: Optional. Select a backend server group. Here, select the default backend server group.
• Advanced: Configure advanced settings for the listener. Here, use default settings.

• Network: Select backend network to be attached. Here, select the VPC network of the same VPC vRouter.
• IPV4 Address: Optional. You can specify an IP address for the NIC. If not specified, the Cloud automatically assigns an IP address within the selected network range.

• Backend Server: You can add a VM instance or other servers outside of the Cloud as a backend server. Here, select By Instance NIC.
• Network: Select the VPC network of the same VPC vRouter.
• NIC: Specify 3 VM instances NICs.

1. Public Network: 10.151.0.101 to 10.151.0.255. Make sure that the public network is on the same gateway with the traditional physical network to ensure network interconnection.
2. VPC vRouter: VPC vRouter-1.
3. VPC Network: VPC Network-1 (192.168.3.0/24), VPC Network-2 (192.168.4.0/24).

• Log in to VM-1 (192.168.3.251) ping 192.168.10.1: Failed.
• Log in to VM-2 (192.168.4.196) ping 192.168.10.1: Failed.

• Area ID: Set an area ID in dotted decimal notation that identifies an OSPF area. The area ID is in similar format as that of IPv4 address. In this scenario, enter 0.0.0.0.
• Type: Select an OSPF area type. Valid values: Standard and Stub. In this scenario, select Standard.
  • Standard: Standard areas support all types of LSAs.
  • Stub: Stub areas do not support Type 4 and Type 5 LSAs.
• Authentication Method: The authentication method used when you select VPC vRouters in an OSPF area to establish neighbors. Valid values: None, Plaintext, and MD5. In this scenario, select None.
  • None: Packets are received without identity authentication.
  • Plaintext: Identity authentication is implemented by using the password contained in the received packets.
  • MD5: Identity authentication is implemented by using the key ID and password MD5 hash that are contained in the received packets.
• Routing Configuration: Optional. Set routing configurations. If you set this parameter, you need to:
  • VPC vRouter: Select a VPC vRouter to add to the OSPF area, for example, VPC vRouter-1.
  • Network: Select a network associated with the VPC vRouter to add to the OSPF area, for example, VPC Network-1 and L3-Public Network.
  Note: You can add a VPC vRouter to multiple OSPF areas, but you can add a VPC network or public network associated with the VPC vRouter to only one OSPF area.

• Log in to VM-1 (192.168.3.251) ping 192.168.10.1: Succeeded.
• Log in to VM-2 (192.168.4.196) ping 192.168.10.1: Failed.

1. Create a VM instance from the public network according to the planned configuration. Set the VM name as VM-sender and use the yum install -y socat command to install socat. This way, the VM-sender can be used as the source to send multicast messages.
2. Make sure that the multicast feature of the switch is enabled.

1. Launch the console of VM-sender and run the following command to send an UDP data packets to the address whose multicast group address is 239.1.1.1 and port is 54321 and set the TTL of the multicast group data as 10.

   [root@localhost~]# for i in {1..100} ;do echo hi+$i | socat - udp4-sendto:239.1.1.1:54321,sp=54321,ip-multicast-ttl=10 ;done 

   
   
   

2. Launch the console of VM-receiver and run the following command, which indicates that specifying the NIC (em01) to add to the multicast group (239.1.1.1) and receiving the UDP data packets from port 54321.

   [root@localhost~]# socat stdio udp4-recv:54321,ip-add-membership=239.1.1.1:em01

   
   
   

1. Public Network: 10.108.10.100 to 10.108.10.200. Make sure that the public network is on the same gateway with the traditional physical network to ensure network interconnection.
2. VPC vRouter: VPC vRouter-1.

• Zone: By default, the current zone is displayed.
• Name: Enter a name for the VXLAN pool.
• Description: Optional. Enter a description for the VXLAN pool.
• SDN Type: Select Software.
• VNI Range: Enter the start ID and end ID of VXLAN networks, for example, 1 to 1000.
  Note:

  • You can enter an ID that ranges from 1 to 16777214.
  • The end ID must be equal to or greater than the start ID.
  • The two VNI IDs 16777215 and 16777216 are reserved by the system of this cloud platform.
• Cluster: Optional. Attach the VXLAN pool to a cluster.
  Note:

  • You can attach a VXLAN pool to a cluster when you create the VXLAN pool or after the VXLAN pool is created.
  • When you attach the VXLAN pool to a cluster, IP addresses of the compute nodes must be available in the cluster that correspond to the VTEP CIDR block.
• VTEP CIDR: Enter the corresponding VTEP CIDR block.

• Zone: By default, the current zone is displayed.
• Name: Enter a name for the L2 network, for example, L2-VXLAN1.
• Description: Optional. Enter a description for the L2 network.
• Switch Type: Select Linux Bridge.
• Network Type: Select VxlanNetwork.
• VXLAN Pool: Select a VXLAN pool of the software SDN type.
• VNI: Optional. Enter a specified VNI in the VXLAN pool. If not specified, the Cloud allocates a VNI randomly.

• Name: Enter a name for the VPC network, for example, VPC Network-1.
• Description: Optional. Enter a description for the VPC network.
• L2 Network: Select L2-VXLAN1.
• VPC vRouter: Optional. You can specify a VPC vRouter when you create a VPC network or attach a VPC vRouter after you create the VPC network.
• Network Address Type: Select IPv4.
• Network Range Method: Select CIDR.
• CIDR: Set a CIDR block for the VPC network, for example, 192.168.1.0/24.
• Gateway: Optional. Set a gateway for the VPC network.
• DHCP Service: Choose whether to enable the DHCP service.
  Note:

  • The DHCP service is a built-in distributed service of the Cloud, which assigns IP addresses only to resources in the Cloud and does not conflict with your existing DHCP server.
  • By default, the DHCP service is enabled so that the NICs using this L3 network acquire IP addresses in a DHCP mode. You can customize a DHCP IP or use the DHCP IP that the system assigned according to the IP allocation policy.
  • If you disable this option, NICs using this L3 network acquire IP address in a Static mode. The Cloud does not assign IP addresses to NICs automatically. If the NICs need IP addresses, you need to configure IP addresses for them manually. In addition, you cannot specify a DHCP IP. Neither can the system allocate one.
  • IP Allocation Policy: Optional. If the DHCP service enabled, IP addresses can be assigned according to the following three allocation policies:
    • Random: The system randomly assigns IP addresses from the network range.
    • Allocate in Order:
      • The system assigns all available IP addresses from the network range in ascending order. Released IP addresses are assigned in the next allocation.
      • Example: Assume that the network range is 192.168.0.101～192.168.0.120, within which 192.168.0.101～192.168.0.108 are allocated. If 192.168.0.106 is released, it will be assigned first in the next allocation.
    • Allocate in Cycle:
      • The system assigns available IP addresses to VM instances from the network range in ascending order. Released IP addresses are assigned when currently available IP addresses are used up.
      • Example: Assume that the network range is 192.168.0.101～192.168.0.120, within which 192.168.0.101～192.168.0.108 are allocated. If 192.168.0.106 is released, it will be assigned after 192.168.0.120 is used.
  • DHCP IP: Optional. Set an IP address for the DHCP server, for example, 172.20.108.10.
    Note:

    • A DHCP IP is an IP address used by the DHCP service to assign IP addresses to resources that use this L3 network.
    • If you create an L3 network for the first time with the DHCP service enabled, or if you add the first network range to an L3 network with the DHCP service enabled, you can customize the DHCP IP.
    • If the L3 network has a DHCP IP, you cannot customize the DHCP IP when you add a network range.
    • The DHCP IP can be in or outside the added IP range, but it must be an unoccupied IP address in the CIDR block of the added IP range
    • The IP range determined by the start IP and end IP cannot contain the link-local address 169.254.0.0/16.
    • If you select random as the IP allocation policy and this field is left blank, the system randomly assigns IP addresses from the added network range.
    • If you select allocate in order/allocate in cycle as the IP allocation policy and this field is left blank, the system uses the start IP address in the network range as the DHCP IP.
• DNS: Optional. Provide DNS services for an L3 network.

• Name: Enter a name for the VPC network.
• Description: Optional. Enter a description for the VPC network.
• L2 Network: Select an L2 network for the VPC network.
• VPC vRouter: Optional. Select a VPC vRouter in the HA group.
• Network Address Type: Select IPv4.
• Network Range Method: Select CIDR.
• CIDR: Enter 10.18.97.0/24.
  Note: The CIDR block must not overlap.
• Gateway: Optional. Set a gateway for the VPC network.
• DHCP Service: Optional. Choose whether to enable the DHCP service.
  • IP Allocation Policy: Optional. After the DHCP service is enabled, select Random.
  • DHCP IP: Optional. Set an IP address for the DHCP server, for example, 10.18.97.2.
• DNS: Optional. Provide DNS services for an L3 network.

• Name: Enter a name for the VM instance.
• Description: Optional. Enter a description for the VM instance.
• Quantity: Enter the number of VM instances to be created. You can create VM instances in bulk.
• Tag: Optional. Bind one or more tags to the VM instance.
• Group: Optional. Choose a group for the VM instance. If you do not set this parameter, VM instance goes to the default group.
• Instance Offering: Select an existing instance offering.
• Image: Select an existing image.
• Root Disk Offering: Select an existing disk offering for the root volume of the VM instance.
• Data Volume: Optional. Choose whether to create data volumes and attach the volumes to the VM instance.
• Network Configurations: Select the created VPC network.
  • Make Default: Optional. Set on of the selected networks as the default network.
  • Assign IP: Optional. Choose whether to assign an IP address to the VM NIC.
  • MAC Address: Optional. Choose whether to configure a MAC address for the VM instance.

  You can click Add Network Configuration to configure different networks.

• User Data: Optional. Inject user-defined parameters or scripts to customize configurations for the VM instance or to accomplish specific tasks.

1. Launch the VM console and test whether it can successfully ping an Internet address for example, www.baidu.com.

   
   
   

2. Stop the primary VPC vRouter in the HA group to simulate the exception state of a VPC vRouter. The secondary VPC vRouter will automatically become the primary VPC vRouter in the group. In the mean time, you can check the ping information.

   
   
   

   
   
   

• Name: Set to VPC-Firewall.
• Description: Optional. You can leave it empty.
• VPC vRouter: Set to VPCvRouter.
  Note: To create a firewall, the VPC vRouter must be running and not bindded to any firewall.

• Priority: Set the rule priority to 1001.
  Note:

  • The priority range is 1001-2999. A smaller number indicates a higher priority.
  • The priority of each rule in the same rule set must be unique.
• Action: Select Drop.
  • Accept: Allow network requests on the VPC vRouter to pass through.
  • Drop: Block network requests on the VPC vRouter without sending feedback to the requester.
  • Reject: Block network requests on the VPC vRouter and send rejection feedback to the requester.
• Packets Status: Optional. Do not select.
• Protocol: Select TCP.
• Source IP Address: Enter the IP address of the VPC VM instance.
• Destination IP Address: Enter the IP range of L3-Public: 10.108.10.100-10.108.10.200.
• Enable Now: Turn on Enable Now.

1. Create a VM instance using the public network.

   Create a VM instance, set the name to VM-Public, and attach the public network.

2. Verify the TCP protocol rule.

   Use the iperf command to verify the TCP protocol rule, with VM-VPC as the sender and VM-Public as the receiver.

   Run iperf -s on the receiver. Run iperf -c x.x.x.x (receiver IP address) -i 1 -t 1000 on the sender. Check the network status as shown in Figure 101:

   Sender
   
   

   Receiver
   
   

   As shown above, after setting the rule, TCP protocol network requests cannot be sent, as expected.
3. Verify the UDP protocol rule.

   Use the iperf command to verify the UDP protocol rule, with VM-VPC as the sender and VM-Public as the receiver.

   Run iperf -s -u on the receiver. Run iperf -c x.x.x.x (receiver IP address) -u -i 1 -t 1000 on the sender. Check the network status as shown in Figure 102:

   Sender
   
   

   Receiver
   
   

   As shown above, after setting the rule, UDP protocol network requests cannot be received after being sent, as expected.
4. Verify the ICMP protocol rule.
   Log in to VM-VPC and check whether it can ping VM-Public, as shown in Figure 103:

   
   
   

   As shown above, after setting the rule, ICMP protocol network requests cannot be sent, as expected.

• Name: Enter a name for the Netflow.
• Description: Optional. Enter a description for the Netflow.
• IP: Enter the IP address of Flow-Collector.
• Port: Enter 2055.
  Note: Make sure that the configured IP and port suite of the receiver is correct. Otherwise, the Netflow service may not work as expected.
• Version: Select V5.
  Note: The output data format varies depending on the Netflow version. Select a Netflow version based on your business requirements.
• Export Interval: Enter 60.
• Routing Configuration: Optional. Set the VPC vRouters and networks that you want to monitor.

1. Run the iperf -s command in the Flow-Collector system. Run the iperf -c $Flow-Collector IP address -t 60 -P 10 in the Flow-Sender system. Then, check whether the traffic is received.

   
   
   

2. Run the tshark -f "udp port 2055 and ip src 192.168.3.253 " -i eth0 -V -c 1 -a duration:500 command in the Flow-Collector system. Then, you can view the captured packets information in the analysis software.

   
   
   

3. As described above, when the traffic passes through the NIC of a VPC vRouter, the Netflow takes effect and forwards the traffic information to the analysis software.

• Name: Enter a name for the port mirroring.
• Description: Optional. Enter a description for the port mirroring.
• Flow Network: Select a flow network for port mirroring.
  Note:

  • A flow network is a dedicated network for port mirroring. You can use a flow network to transmit the mirrors of data packets of NIC ports to the target ports.
  • You cannot use a flow network for other purposes except for port mirroring.
  • A port mirroring occupies a flow network.
  • The VM instances for which port mirroring is configured must reside in the cluster where the associated flow networks are located.
• Enable Now: Optional. Choose whether to enable port mirroring immediately after the port mirroring is created. Enabling port mirroring immediately after the creation may occupy physical network bandwidth. Make sure that your business is not affected and then select the checkbox.

• Name: enter a name for the session.
• Type: Select Bidirection.
• Source VM: Select VM-2.
• Source NIC: Select the VM-2 NIC.
• Destination VM: Select VM-1.
• Destination NIC: Select the VM-1 NIC that is not the default NIC.