Networks

The following are general, high-level networking recommendations.

  • Use bond network interfaces, especially on production hosts
  • Use VLANs to separate different traffic types
  • Use 1 GbE networks for management traffic
  • Use 10 GbE, 25 GbE, 40 GbE, or 100 GbE for virtual machines and Ethernet-based storage
  • When adding physical interfaces to a host for storage use, uncheck VM network so that the VLAN is assigned directly to the physical interface

The Oracle Linux Virtualization Manager host and all Oracle Linux KVM hosts must have a fully-qualified domain name (FQDN) as well as forward and reverse name resolution. Oracle recommend using DNS. Alternatively, you can use the /etc/hosts file for name resolution, however, this requires more work and is error-prone.

All DNS services used for name resolution must be hosted outside of the environment.

Logical Networks

In Oracle Linux Virtualization Manager, you configure logical networks to represent the resources required to ensure the network connectivity of the Oracle Linux KVM hosts for a specific purpose, for example to indicate that a network interface controller (NIC) is on a management network.

You define a logical network for a data center, apply the network to one or more clusters, and then configure the hosts by assigning the logical networks to the hosts physical interfaces. Once you implement the network on all the hosts in a cluster, the network becomes operational. You perform all these operations from the Administration Portal.

At the cluster level, you can assign one or more network roles to a logical network to specify its purpose:

  • A management network is used for communication between Oracle Linux Virtualization Manager and the hosts.
  • A VM network is used for virtual machine communication, a virtual machine's virtual NIC is attached to a VM network. For more information, see Creating a Logical Network in the Oracle Linux Virtualization Manager: Administration Guide.
  • A display network is used to connect clients to virtual machine graphical consoles, using either the VNC or RDP protocols.
  • A migration network is used to migrate virtual machines between the hosts in a cluster.

By default a single logical network named ovirtmgmt is created and this is used for all network communication in a data center. You separate the network traffic according to your needs by defining and applying additional logical networks.

One logical network is configured as the default route for the hosts.

A logical network can be marked as a required network. If a required network ceases to function, any KVM hosts associated with the network become non-operational.

For logical networks that are not VM networks, you connect the host directly to the network using either a physical network interface, a VLAN interface, or a bond.

For VM networks, a bridge is created on the host for each logical network. Virtual machine VNICs are connected to the bridges as needed. The bridge is connected to the network using either a physical network interface, a VLAN interface, or a bond.

Figure 4-4 Bridge Networks


Shows bridges created on Oracle Linux KVM hosts for VM networks, as described in the preceding text.

You can perform most network configuration operations on hosts from the Administration Portal, including:

  • Assign a host NIC to logical networks.
  • Configure a NIC's boot protocol, IP settings, and DNS settings.
  • Create bonds and VLAN interfaces on KVM hosts.

When there are a large number of KVM hosts and logical networks, using network labels enables you to simplify administration. Labels can be applied to logical networks and host interfaces. When you set a label on a network, you to deploy the network on host NICs that have the same label. This requires that the host NICs are configured for DHCP.

VLANs

A virtual local area network (VLAN) enables hosts and virtual machines to communicate regardless of their actual physical location on a LAN.

VLANs enable you improve security by segregating network traffic. Broadcasts between devices in the same VLAN are not visible to other devices with a different VLAN, even if they exist on the same switch.

VLANs can also help to compensate for the lack of physical NICs on hosts. A host or virtual machine can be connected to different VLANs using a single physical NIC or bond. This is implemented using VLAN interfaces.

A VLAN is identified by an ID. A VLAN interface attached to a host's NIC or bond is assigned a VLAN ID and handles the traffic for the VLAN. When traffic is routed through the VLAN interface, it is automatically tagged with the VLAN ID configured for that interface, and is then routed through the NIC or bond that the VLAN interface is attached to.

The switch uses the VLAN ID to segregate traffic among the different VLANs operating on the same physical link. In this way, a VLAN functions exactly like a separate physical connection.

You need to configure the VLANs needed to support your logical networks before you can use them. This is usually accomplished using switch trunking. Trunking involves configuring ports on the switch to enable multiple VLAN traffic on these ports, to ensure that packets are correctly transmitted to their final destination. The configuration required depends on the switches you use.

When you create a logical network, you can assign a VLAN ID to the network. When you assign a host NIC or bond to the network, the VLAN interface is automatically created on the host and attached to the selected device.

Figure 4-5 VLANs


Diagram illustrating the use of VLANs on logical networks, as described in the preceding text.

Figure 4-6 VLANs over Network Bonds


Diagram illustrating VLAN over network bonds, as described in the preceding text.

Virtual NICs

A virtual machine uses a virtual network interface controller (VNIC) to connect to a logical network.

VNICs are always attached to a bridge on a KVM host. A bridge is a software network device that enables the VNICS to share a physical network connection and to appear as separate physical devices on a logical network.

Oracle Linux Virtualization Manager automatically assigns a MAC address to a VNIC. Each MAC address corresponds to a single VNIC. Because MAC addresses must be unique on a network, the MAC addresses are allocated from a predefined range of addresses, known as a MAC address pool. MAC address pools are defined for a cluster.

Virtual machines are connected to a logical network by their VNICs. The IP address of each VNIC can be set independently, by DHCP or statically, using the tools available in the operating system of the virtual machine. To use DHCP, you need to configure a DHCP server on the logical network.

Virtual machines can communicate with any other machine on the virtual network, and, depending on the configuration of the logical network, with public networks such as the Internet.

For more information, see Customizing vNIC Profiles for Virtual Machines in the Oracle Linux Virtualization Manager: Administration Guide.

Bonds

Bonds bind multiple NICs into a single interface. A bonded network interface combines the transmission capability of all the NICs included in the bond and acts as a single network interface, which can provide greater transmission speed. Because all network interface cards in the bond must fail for the bond itself to fail, bonding provides increased fault tolerance.

There are four different bonding modes:

  • Mode 1 - Active-Backup
  • Mode 2 - Load balance XOR Policy
  • Mode 3 - Broadcast
  • Mode 4 (default) - Dynamic link aggregation IEEE 802.3ad

Bonding modes 2 and 4 require static etherchannel enabled (not LACP-negotiated) and LACP-negotiated etherchannel enabled on physical switches respectively.

Figure 4-7 Network Bonds


Diagram illustrating bonds binding NICs into a single interface, as described in the preceding text.

MAC Address Pools

MAC address pools define the range (or ranges) of MAC addresses allocated for each cluster. A MAC address pool is specified for each cluster. By using MAC address pools, the Manager can automatically generate and assign MAC addresses to new virtual network devices, which helps to prevent MAC address duplication. MAC address pools are more memory efficient when all MAC addresses related to a cluster are within the range for the assigned MAC address pool.

The same MAC address pool can be shared by multiple clusters, but each cluster has a single MAC address pool assigned. A default MAC address pool is created by the Manager and is used if another MAC address pool is not assigned.

Note:

If more than one cluster shares a network, you should not rely solely on the default MAC address pool because the virtual machines in each cluster attempt to use the same range of MAC addresses, which can lead to conflicts. To avoid MAC address conflicts, check the MAC address pool ranges to ensure that each cluster is assigned a unique MAC address range.

The MAC address pool assigns the next available MAC address after the last address that is returned to the pool. If there are no further addresses left in the range, the search starts again from the beginning of the range. If there are multiple MAC address ranges with available MAC addresses defined in a single MAC address pool, the ranges take turns in serving incoming requests in a similar manner as when MAC addresses are selected.