Networking concepts

Every network adapter of a virtual machine is plugged into a network. In Kyvernon a network is a host-bridge network: a name, a VLAN and a bridge that exists on the hosts. With OVN logical networks switched on, a distributed port group is a network as well: a segment that spans hosts. This page explains the parts and how a public address from an IP pool ends up on a virtual machine.

Networks and host bridges

A host-bridge network has a name of 1 to 80 characters, a VLAN id, the name of a bridge and the hosts that offer it. It belongs to a datacenter. Without a list of hosts, the network is offered on every host of the datacenter. In the console it is an object of the inventory with a Summary, a Configure tab and a list of the virtual machines that use it.

The host bridge is a bridge that an administrator builds on each host before the network is used, for example br-vm. It is an Open vSwitch bridge by default. A Linux bridge is possible, but it supports neither VLANs, port security nor DHCP, and it cannot carry public addresses from IP pools. The console creates Open vSwitch networks; a Linux bridge is set through the API. When a virtual machine starts, the host agent plugs the tap device of each network adapter into the bridge of the network.

Networks of the kinds Distributed and Overlay are inventory objects that come from the vSphere API. Changes to distributed switches and distributed port groups are guarded by the privileges DVSwitch.* and DVPortgroup.*. The console, the native API and the CLI create and change host-bridge networks, the kind Standard, and these need the privileges Network.Config and Network.Delete.

A network has one VLAN id from 0 to 4094. The value 0 means untagged. Every port of a virtual machine is an access port of that VLAN: the guest sends and receives untagged frames, and a frame that the guest tags itself does not leave the port. The uplink of the bridge must carry the VLAN to the provider's network.

Port security and port-group policy

Port security is on by default and is the checkbox Port security (MAC and leased address) of a network. A network adapter may send only from its own MAC address and from the addresses that Kyvernon has leased or allocated to it. A guest cannot answer DHCP requests of other guests or claim an address that belongs to another port. Without IPv4 settings on the network, the MAC address is still enforced. For network adapters that have addresses from an IP pool, port security is always on, whatever the setting of the network: anti-spoofing is mandatory for them.

A network can also carry a port-group policy with three parts: security (MAC address changes and Forged transmits), traffic shaping and NIC teaming. The dialog behind Edit policy sets them, and tools that use the vSphere API can store the same policy. The host agent realises the settings: average and burst bandwidth through traffic limits on the virtual machine ports, and two or more uplinks in the teaming policy as a bond on the Open vSwitch bridge. Promiscuous mode cannot be accepted; observe traffic with a mirror session instead. Editing the network keeps the policy.

DHCP, leases and quarantine networks

A network can answer DHCP itself. You give it a prefix, a gateway, a range of addresses and optionally DNS servers, a domain name, an MTU and a lease time (86,400 seconds by default). Kyvernon allocates one fixed lease per MAC address from the range, at most 1,024 per network, before a virtual machine is sent to a host. The address is therefore the same after a restart. This range is for internal addresses; public addresses come from IP pools. The console sets the gateway, the range, the prefix length and the DNS servers; the other values are set through the API.

A quarantine network has its own bridge that the host agent creates. It has no uplink, no gateway and no DNS. Virtual machines on it reach each other and the DHCP server only. It needs IPv4 settings with a DHCP server identifier and no gateway. Restore verification starts restored virtual machines on a network of this kind.

How a public address reaches a virtual machine

An administrator creates an IP pool on a network. The pool holds public ranges, a gateway and, optionally, an IPv6 prefix. An address of the pool is allocated to a network adapter, by its MAC address. The first address is the primary IPv4 address and, when the pool has an IPv6 prefix, a block of it. Further addresses are extra addresses.

Port security lets the adapter send from these addresses. The primary IPv4 address is the DHCP lease of the adapter. Extra addresses and the IPv6 block are configured in the guest, for example with cloud-init.

The uplink of the network decides how the provider's router reaches the address. In bridged mode, the uplink interface is in the bridge, and the provider must accept the MAC addresses of the guests. In proxy mode, the host routes each public address to the bridge and answers the router of the provider with proxy ARP and proxy NDP; the operator enables forwarding and proxy ARP and NDP on the uplink once. The console shows the uplink of a pool, and the mode is set through the API.

A released address stays in quarantine for 14 days before it is handed out again. Outgoing mail on port 25 is blocked per pool and can be allowed per server.

Distributed port groups as segments

When the controller has OVN logical networks switched on (an operator setting of the controller), every distributed port group is a segment: one logical switch that spans the hosts of its distributed switch. A port group with a VNI, or with VLAN 0, is an overlay segment. Its traffic between hosts travels in Geneve tunnels between the tunnel addresses of the hosts, so the provider's network does not need to know the VLAN. A port group with a VLAN id is a VLAN-backed segment. Its traffic leaves each host on the uplink of the distributed switch, tagged with that VLAN.

Each network adapter on such a port group is a logical port of the segment, named after the virtual machine and the device key of the adapter. Port security is on: the adapter may send only from its own MAC address. During a live migration the port is bound on both hosts until the virtual machine runs on the destination. The controller writes the segments and ports into the OVN Northbound database again after every change, after a lost connection and every five minutes, so a change made behind its back does not last.

The distributed firewall applies to these adapters in the same way as to adapters on host-bridge networks: the same groups, policies, modes and profiles. Each host reports the rule counters, the log records and the would-drops of mode monitor of its own adapters. When an adapter moves from mode monitor to enforce, the host forgets the connections the adapter had, so the enforced rules decide about them again.

A port group can have addresses: a subnet with gateway, DNS servers and a range, and an IPv6 prefix. Every adapter on it then gets a fixed IPv4 address from the range, or the address an administrator fixed for its MAC, and the IPv6 address derived from its MAC; OVN hands them out by DHCP, and port security lets the adapter send only from them. The distributed firewall knows these addresses, so a group of virtual machines also matches their traffic by address. A distributed switch lists, per member host, the physical NIC behind each uplink; VLAN-backed port groups leave the host through it. Without uplinks, virtual machines on a VLAN-backed segment reach each other only on the same host; overlay segments work between hosts. Without OVN logical networks, an adapter on a distributed port group has no link. Distributed switches and port groups shows the steps.

Names and traffic of public addresses

Each public address can have a reverse DNS name, which Kyvernon writes to a DNS server or passes to an operator as a request. The traffic of a server is counted per period, with a billable direction and an optional limit. Both are shown on the Networks tab of the server.

Related tasks

• Host-bridge networks creates, edits and deletes networks.
• IP pools shows the pools and their addresses.
• Public addresses assigns addresses to servers.
• Reverse DNS sets the name of an address.
• Traffic shows the traffic and limit of a server.
• Firewall concepts explains the distributed firewall.
• Networking troubleshooting lists symptoms and remedies.