Re: [Users] Networking questions (LONG)

Hello Alan, On 09/01/14 10:07, Alan Murrell wrote: > Hello, > > I am evaluating oVirt as a replacement/alternative to VMware deployments > we typically do. I have installed and all-in-one setup on a test box > (which itself used to be an ESXi server), but it only has one NIC. I > trying to duplicate our typical configuration we do in VMware, which is > this: > > 1.) we create several "port groups" on the vSwitch, each assigned a > VLAN ID, such as: > > - VLAN001 (VLAN ID: 1) > - VLAN002 (VLAN ID: 2) > - VLAN009 (VLAN ID: 9) > - VLAN010 (VLAN ID: 10) > - VLAN200 (VLAN ID: 200) > - TRUNK (VLAN ID: 4095 - in VMware-world, VLAN ID "4095" is "all > VLANS" and basically just passes the VLANs through to whatever is > attached to the port group for the VM to handle) > > 2.) We assign VMs to port groups appropriate for the VLAN they are > part of. > 3.) The only VM that has a NIC assigned to the "TRUNK" port group is > the firewall (which is Linux), and we create VLAN interfaces on it > (i.e., "eth1.1", "eth1.2", "eth1.10", "eth1.200"). The firewall VM acts > as the router between the various VLANs. > > To replicate the above in oVirt, I created logical networks for each > VLAN, and assigned the appropriate VLAN ID. It seems oVirt/KVM does not > have an equivalent for VMware's VLAN ID of "4095", so after some > searching around, so for the "TRUNK" network, I left it with no VLAN > assigned. Because i cannot add VLAN and non-VLAN networks to the same > physical NIC, after some searching around, it looks like I may have to > utilise two NICS: one for the VLAN networks and one for the "TRUNK" network. That is true. One non-VLAN network can in fact sit on the same NIC with VLAN networks, but it has to be non-VM.

However, I'm not sure that you in fact need a "TRUNK" VM network in oVirt. If you want your firewall VM to get all traffic from the VLANs, you could create a vNIC for each network, to which you'll attach a profile (oVirt's equivalent of port group if I'm not mistaken) of the corresponding network. The host can remain with just the VLAN networks attached to its NICs, without a designated "TRUNK". This way the firewall VM will get something like "eth1" for VLAN 1, "eth2" for VLAN 200 and so forth, which might be close enough to what you described on your previous setup (oVirt currently doesn't allow creating VLANs inside VMs). And if I correctly understood your needs it will save you the trouble you described below (well, you would need the one dummy interface). > > Because, at this point, I am not yet concerned with making the test VMs > I will be setting up be accessible from outside the virtual lab > environment (i.e., everything will communicate within my oVirt > server/network for now), I am trying to make use of "dummy" interfaces, > but I am not sure the best way to make use of this. I am able to create > the dummy* interfaces and have them show up in oVirt, but I am not sure > of how they should be setup. Here is what I am *thinking* should be > done, but want to make sure it is correct before getting too deep: > > - I will use the physical NIC for management, therefore the > "ovirtmgmt" bridge with eth0 assigned to it will remain as-is > - Create two dummy interfaces: "dummy0" and "dummy1" > - Create a new bridge, "ovirtvm" and assign "dummy0" and "dummy1" to it This is something that currently can't be done from within the oVirt engine, but if my above suggestion works for you then it won't be needed. > - Attach the VLAN-enabled networks to "dummy0" > - Attach the "TRUNK" network to "dummy1"

> > Would the above be the way to go about this? The one thing I am not > sure of is whether or not having no VLAN assigned (on the "TRUNK" > network) accomplishes the same this as the "VLAN ID 4095" in VMware: > will oVirt/KVM just pass the traffic through for the VM attached to it > to deal with?