Skip to content

Commit 398e42b

Browse files
yaocw2020yaocw2020
committed
Add network best practice document
1 parent 0496dae commit 398e42b

File tree

3 files changed

+215
-0
lines changed

3 files changed

+215
-0
lines changed

‎docs/networking/best-practice.md

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
---
2+
sidebar_position: 6
3+
sidebar_label: Best Practice
4+
title: "Harvester Network Best Practice"
5+
keywords:
6+
- Harvester
7+
- Networking
8+
---
9+
10+
<head>
11+
<link rel="canonical" href="https://docs.harvesterhci.io/v1.2/networking/best-pratice"/>
12+
</head>
13+
14+
## Overview
15+
In this best practice guide, we will introduce how to configure Harvester and the external network to achieve the following goals:
16+
- Traffic isolation between the management plane and the data plane
17+
- General external switch and router configurations
18+
- Network access to VMs from different VLANs
19+
- Access Harvester load balancers from different VLANs
20+
21+
We will use the following diagram as an example to illustrate the best practice.
22+
23+
![](/img/v1.2/networking/best-practice.png)
24+
25+
The diagram shows a Harvester cluster composed of two hosts. It contains:
26+
- Hardware:
27+
- Two Harvester servers with daul ports network card.
28+
- One "non VLAN-aware" switch and one "VLAN-aware" switch. We will use "Cisco like" configuration as example.
29+
- One router. We will use "Cisco like" configuration as example.
30+
31+
- Cabing:
32+
- The NIC eth0 of the node1 connected to the port `ethernet1/1` of the switch1, while the NIC eth0 of the node2 connected to the port `ethernet1/2` of the switch1.
33+
- The NIC eth1 of the node1 connected to the port `ethernet1/1` of the switch2, while the NIC eth1 of the node2 connected to the port `ethernet1/2` of the switch2.
34+
- The port `ethernet1/3` of the switch1 connected to the port `ethernet0/1` of the router.
35+
- The port `ethernet1/3` of the switch2 connected to the port `ethernet0/2` of the router.
36+
37+
- Network Specification:
38+
- Assume that the subnet of the Harvester hosts is in the VLAN untagged network.
39+
- Assume all hosts are in the IPv4 subnet `10.10.0.0/24`, the gateway IP address is `10.10.0.254`.
40+
- Assume that the VM network allows VLAN 100-200.
41+
- Assume the IPv4 subnets of the VM network are:
42+
- untagged network: `192.168.0.0/24`, the gateway IP address is `192.168.0.254`.
43+
- VLAN 100: `192.168.100.0/24`, the gateway IP address is `192.168.100.254`.
44+
- VLAN 200: `192.168.200.0/24`, the gateway IP address is `192.168.200.254`.
45+
46+
- Harvester Configuration:
47+
- Two cluster networks: `mgmt` and `vm`.
48+
- Three VM networks under cluster network `vm`: `vlan100`, `vlan200` and `untagged`.
49+
- Six VMs, from `VM1` to `VM6`.
50+
- One guest cluster `demo` composed by `VM3` and `VM4`.
51+
- Two VM load balancers and one guest Kubernetes cluster load balancer.
52+
53+
## Multiple Cluster Networks for Traffic Isolation
54+
The two Harvester hosts equip with two NICs. Specifically, NIC `eth0` is used for the management network (mapped to the cluster network `mgmt`), while NIC `eth1` is used for the VM network (mapped to the cluster network `vm`).
55+
56+
It's beneficial to use two cluster networks to achieve traffic isolation between the management plane and the data plane. If there is an issue with the VM network, you can still use the management network for emergency handling to ensure business continuity. Similarly, if there is a failure in the management network, VM traffic is not affected.
57+
58+
If your hardware equips with more NICs, it's recommended to use not less than two NICs for one cluster network. For example, you can use NIC `eth0` and `eth1` for the management network, and use NIC `eth2` and `eth3` for the VM network.
59+
60+
## External Switch and Router Configuration
61+
1. ** Switch1 Configuration **
62+
Since the management network is under the untagged network, switch1 can be a "non VLAN-aware" switch. Typically, a "non VLAN-aware" switch cannot be configured.
63+
64+
2. ** Switch2 Configuration **
65+
Configure the ports `ethernet1/1`, `ethernet1/2` and `ethernet1/3` as trunk ports, and allow VLAN 100-200.
66+
67+
```
68+
switch2# config terminal
69+
switch2(config)# interface ethernet1/1
70+
switch2(config-if)# switchport
71+
switch2(config-if)# switchport mode trunk
72+
switch2(config-if)# switchport trunk allowed vlan 100-200
73+
switch2(config-if)# switchport trunk native vlan 1
74+
switch2(config-if)# no shutdown
75+
switch2(config)# interface ethernet1/2
76+
switch2(config-if)# switchport
77+
switch2(config-if)# switchport mode trunk
78+
switch2(config-if)# switchport trunk allowed vlan 100-200
79+
switch2(config-if)# switchport trunk native vlan 1
80+
switch2(config-if)# no shutdown
81+
switch2(config)# interface ethernet1/3
82+
switch2(config-if)# switchport
83+
switch2(config-if)# switchport mode trunk
84+
switch2(config-if)# switchport trunk allowed vlan 100-200
85+
switch2(config-if)# switchport trunk native vlan 1
86+
switch2(config-if)# no shutdown
87+
switch2(config-if)# end
88+
switch2# copy running-config startup-config
89+
```
90+
91+
3. ** Router Configuration **
92+
93+
- Configure a DHCP pool for the management network
94+
95+
```
96+
router# config terminal
97+
router(config)# ip dhcp pool mgmt
98+
router(dhcp-config)# network 10.10.0.0 255.255.255.0
99+
router(dhcp-config)# default-router 10.10.0.254
100+
router(dhcp-config)# interface ethernet0/1
101+
router(config-if)# ip address 10.10.0.254 255.255.255.0
102+
router(config-if)# no shutdown
103+
router(config)# exit
104+
router# copy running-config startup-config
105+
```
106+
107+
- Configure three DHCP pools for the VM networks(untagged, vlan100 and vlan200)
108+
109+
```
110+
router# config terminal
111+
router(config)# ip dhcp pool vm-untagged
112+
router(dhcp-config)# network 192.168.0.0 255.255.255.0
113+
router(dhcp-config)# default-router 192.168.0.254
114+
router(dhcp-config)# ip dhcp pool vm-vlan100
115+
router(dhcp-config)# network 192.168.100.0 255.255.255.0
116+
router(dhcp-config)# default-router 192.168.100.254
117+
router(dhcp-config)# ip dhcp pool vm-vlan200
118+
router(dhcp-config)# network 192.168.200.0 255.255.255.0
119+
router(dhcp-config)# default-router 192.168.200.254
120+
router(config-if)# interface ethernet0/2
121+
router(config-if)# ip address 192.168.0.254 255.255.255.0
122+
router(config-if)# no shutdown
123+
router(config-subif)# interface ethernet0/2.100
124+
router(config-subif)# encapsulation dot1q 100
125+
router(config-subif)# ip address 192.168.100.254 255.255.255.0
126+
router(config-subif)# interface ethernet0/2.200
127+
router(config-subif)# encapsulation dot1q 200
128+
router(config-subif)# ip address 192.168.200.254 255.255.255.0
129+
router(config-subif)# end
130+
router# copy running-config startup-config
131+
```
132+
133+
## Network access to VMs from different VLANs
134+
135+
1. Network connection between VM networks
136+
137+
The router configuration above uses the [`A router on a stick`](https://www.grandmetric.com/knowledge-base/design_and_configure/router-on-a-stick-approach-cisco-configuration/) technology to allow VMs among untagged network, VLAN 100 and VLAN 200 to communicate with each other. Thus, it's not required to add any more configurations on the router.
138+
139+
2. Network connection between VM networks and the management network
140+
141+
A feasible method to ensure network connectivity between VM networks and the management network is to manually add static routes. The following commands add static routes on the router to allow VMs in the untagged network, VLAN 100 and VLAN 200 to access the management network.
142+
143+
```
144+
router(config)# config terminal
145+
router(config)# ip route 10.10.0.0 255.255.255.0 ethernet0/1
146+
router(config)# ip route 192.168.0.0 255.255.255.0 ethernet0/2
147+
router(config)# ip route 192.168.100.0 255.255.255.0 ethernet0/2
148+
router(config)# ip route 192.168.200.0 255.255.255.0 ethernet0/2
149+
router(config)# end
150+
```
151+
152+
The route table would be like this:
153+
154+
```
155+
Router#show ip route
156+
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
157+
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
158+
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
159+
E1 - OSPF external type 1, E2 - OSPF external type 2
160+
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
161+
ia - IS-IS inter area, * - candidate default, U - per-user static route
162+
o - ODR, P - periodic downloaded static route
163+
164+
Gateway of last resort is not set
165+
166+
C 192.168.200.0/24 is directly connected, Ethernet0/2.200
167+
10.0.0.0/24 is subnetted, 1 subnets
168+
C 10.10.0.0 is directly connected, Ethernet0/1
169+
C 192.168.0.0/24 is directly connected, Ethernet0/2
170+
C 192.168.100.0/24 is directly connected, Ethernet0/2.100
171+
```
172+
173+
## Access Harvester load balancers from different VLANs
174+
The Harvester load balancer is divided into two types: VM load balancer and guest Kubernetes cluster load balancer.
175+
176+
1. The load balancer IP of the VM load balancer is only exposed within the same network as the Harvester hosts, or in other words, the management network. To access the VM load balancer from outside the network, you have to prove the route from outside client to the management network. For example, if the VM load balancer `lb1` has obtained its load balancer IP var DHCP and you want to access it from the VM `VM5`, you need to add the following static route on the router to
177+
178+
```
179+
router(config)# ip route 10.10.0.0 255.255.255.0 ethernet0/1
180+
router(config)# ip route 192.168.0.0 255.255.255.0 ethernet0/2
181+
```
182+
183+
2. The load balancer IP of the guest Kubernetes cluster load balancer is exposed within the VM network. In the diagram above, the guest cluster `demo` is within the VM network `vlan200` because the VMs consist of the guest cluster are in the `vlan200`. Thus, the guest Kubernetes cluster load balancer `lb2` is exposed within the VM network `vlan200`. There are three scenarios to explain how to access `lb2` if it has obtained the load balancer IP via DHCP:
184+
- You can access it from the VM `VM3` and `VM4` directly because they are in the `vlan200`.
185+
- You can also access it from the VMs in other VM network directly because of the `A router on a stick` configuration.
186+
- You can access it from the Harvester hosts, or in other words, the management network by adding the static route on the router.
187+
188+
```
189+
router(config)# ip route 10.10.0.0 255.255.255.0 ethernet0/1
190+
router(config)# ip route 192.168.200.0 255.255.255.0 ethernet0/2
191+
```
192+
193+
194+
:::note
195+
196+
Except static route used above, you can also use dynamic routing protocols such as RIP, BGP, OSPF and ISIS according to your network planning and requirements.
197+
198+
:::

‎docs/networking/deep-dive.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,23 @@ External network devices typically refer to switches and DHCP servers. With a cl
113113
| mode 5(balance-tlb) | none |
114114
| mode 6(balance-alb) | none |
115115

116+
For example, if the bond mode is 802.3ad, you need to configure LACP on the switch. The following is an example of LACP configuration on Cisco switch:
117+
```
118+
interface port-channel1
119+
switchport trunk encapsulation dot1q
120+
switchport mode trunk
121+
122+
interface g0/25
123+
switchport trunk encapsulation dot1q
124+
switchport mode trunk
125+
channel-group 1 mode active
126+
127+
interface g0/27
128+
switchport trunk encapsulation dot1q
129+
switchport mode trunk
130+
channel-group 1 mode active
131+
```
132+
116133
- If you want VMs in a VLAN to be able to obtain IP addresses through the DHCP protocol, configure an IP pool for that VLAN in the DHCP server.
117134
118135

‎static/img/v1.2/networking/best-practice.png

199 KB
Loading

0 commit comments

Comments
 (0)