Isolating VM Traffic Using VLANs
来源:互联网 发布:企业网络危机处理 编辑:程序博客网 时间:2024/05/29 06:46
原文:http://openvswitch.org/support/config-cookbooks/vlan-configuration-cookbook/
Isolating VM Traffic Using VLANs
The goal of this configuration cookbook is to isolate VM traffic using VLANs.
Environment
This walkthrough assumes the environment is configured as described in the following sections.
Two Physical Networks
- Data Network: Ethernet network for VM data traffic, which will carry VLAN-tagged traffic between VMs. Your physical switch(es) must be capable of forwarding VLAN-tagged traffic and the physical switch ports should operate as VLAN trunks. (Usually this is the default behavior. Configuring your physical switching hardware is beyond the scope of this document.)
- Management Network: This network is not strictly required, but it is a simple way to give the physical host an IP address for remote access, since an IP address cannot be assigned directly to eth0 (more on that in a moment).
Two Physical Hosts
The environment assumes the use of two hosts, named Host1 and Host2. Both hosts are running Open vSwitch. Each host has two NICs, eth0 and eth1, which are configured as follows:
- eth0 is connected to the Data Network. No IP address is assigned to eth0.
- eth1 is connected to the Management Network (if necessary). eth1 has an IP address that is used to reach the physical host for management.
Four Virtual Machines
Each host will run two virtual machines (VMs). VM1 and VM2 are running on Host1, while VM3 and VM4 are running on Host2.
Each VM has a single interface that appears as a Linux device (e.g., "tap0") on the physical host. (Note: for Xen/XenServer, VM interfaces appears as Linux devices with names like "vif1.0". Other Linux systems may present these interfaces as "vnet0", "vnet1", etc.)
The following diagram graphically illustrates the environment assumed by this configuration cookbook:
Configuration Steps
Perform the following configuration on Host 1:
Create an OVS bridge:
ovs-vsctl add-br br0
Add eth0 to the bridge (by default, all OVS ports are VLAN trunks, so eth0 will pass all VLANs):
ovs-vsctl add-port br0 eth0
Note that when you add eth0 to the OVS bridge, any IP addresses that might have been assigned to eth0 stop working. IP address assigned to eth0 should be migrated to a different interface before adding eth0 to the OVS bridge. This is the reason for the separate management connection via eth1.
Add VM1 as an "access port" on VLAN 100. This means that traffic coming into OVS from VM1 will be untagged and considered part of VLAN 100:
ovs-vsctl add-port br0 tap0 tag=100
Add VM2 on VLAN 200.
ovs-vsctl add-port br0 tap1 tag=200
Repeat these steps on Host 2:
Setup a bridge with eth0 as a VLAN trunk:
ovs-vsctl add-br br0 ovs-vsctl add-port br0 eth0
Add VM3 to VLAN 100:
ovs-vsctl add-port br0 tap0 tag=100
Add VM4 to VLAN 200:
ovs-vsctl add-port br0 tap1 tag=200
Testing
Pings from VM1 to VM3 should succeed, as these two VMs are on the same VLAN.
Pings from VM2 to VM4 should also succeed, since these VMs are also on the same VLAN as each other.
Pings from VM1/VM3 to VM2/VM4 should not succeed, as these VMs are on different VLANs. If you have a router configured to forward between the VLANs, then pings will work, but packets arriving at VM3 should have the source MAC address of the router, not of VM1.
- Isolating VM Traffic Using VLANs
- Using VLANs with OVS and libvirt
- Using VLANs with OVS and libvirt
- myEvalSVC,2.2,Using traffic traces
- Identifying P2P users using traffic analysis
- OER Voice Traffic Optimization Using Active Probes
- Using IP Instances with VLANs or How to Make a Few NICs Look Like Many
- Security Onion Searching DNS Traffic using Bro and ELSA
- Isolating Linux High System Load
- HSRP with Interface VLANs
- Using CSS Galleries to get visitors - a comparison of traffic over 1 month and 1 year
- How to Monitor and Log Network Traffic on Linux Using vnStat
- How to Monitor and Log Network Traffic on Linux Using vnStat
- 分析文献:Boosting the scalability of botnet detection using adaptive traffic sampling
- WordPress.Com Serves 70,000 Req/Sec And Over 15 Gbit/Sec Of Traffic Using NGINX
- 【NDN VANET】Rapid Traffic Information Dissemination Using Named Data 学习笔记
- Network Virtualization: Beyond VLANs – Part 1: VLANs
- Private VLANS(私用Vlan)
- 真机测试别人的demo才出现"The identity used to sign the executable is no longer valid"
- Android-通知Notification全解析
- WebPack系列教程(三):什么是WebPack
- [iOS]Missing iOS Distribution signing identity for XXXXXX
- Ambiguous use of subscript
- Isolating VM Traffic Using VLANs
- PAT-Speech Patterns (25)
- 关于字符串的截取各种方法讲解
- css中px,em,rem,pt的区别
- select的基本学习
- Linux c 开发 - 内存管理器ptmalloc
- unity3d 在UGUI中制作自适应调整大小的滚动布局控件
- 令operator=返回一个reference to *this
- android:screenOrientation属性