On 04/24/09 00:06, Erik Nordmark wrote:
Patrick Pinchera wrote:
I'm working with a customer who wants to put 16 containers in an M8000 server. Each of these containers will have the need to have a "private network" that they all share so that they can all talk to each other, and the network traffic DOES NOT have to go outside of the server. Some of it is broadcast traffic.

What isolation requirements does the customer have for the other external IP communication? For instance, will all the zones be connected to the same external LANs or VLANs, or are there security requirements that require them to be on isolated LANs or VLANs?

If they are on the same LANs or VLANs, then the zones can be configured as shared-ip zones, and the local IP addresses can be used. (The loopback address - 127.0.0.1 - stays within the same zone, but the IP address assigned to zoneA can be used to reach it from zoneB, C, etc without going outside of the box.)

The above places no load on the NIC (the packets are looped back inside TCP/IP), and continues to work even if the NIC fails, as long as the IP addresses are still assigned and up.

If they have security requirements that require separate LANs or VLANs for the zone's external communication, then they should use exclusive-IP zones and the lack of vnic and etherstub support in S10 becomes a stumbling block. Perhaps Steffen has a workaround for that.

Ooh, a light bulb went off. If you need some separation of the zones, such a A to B to C to D, you could potentially use a single NIC, and use VLAN interfaces on that one NIC to for A to go through B and C to get to D. That is if otherwise the kernel would send it straight away. I may have to try this out.

Pat, what is your configuration?

Steffen



   Erik

I would like to know some details on how to implement this, and what the performance benefits are. I've been told the following, and would like to hear some clarifications, or if there is an issue I'm unaware of.

    * the global zone will recognize that the network traffic is staying
      inside of the global zone, and will only go down so far in the
      network stack, never having to go out the physical ethernet port.
    * This Inter-Zone networking ends up being a memory copy to transfer
      data from one zone to the other.
    * Do I use the loopback interface for configuring this? Or do I need
      to share a physical port among the zones?
    * If the port is shared among the 16 containers, this will reduce
      the total number of physical gigabit ethernet ports I need for the
      system.
    * If I need a physical port, is there a particular ethernet card I
      should use over another? I know some cards have more "processing
      power" than others.
    * Can I use two ports and get some redundancy in case one port fails?
    * What kind of performance benefits can I expect, vs. having to go
      outside the box to an ethernet switch? Has anyone benchmarked
      this? I know it would be dependent upon the system architecture
      (clock speed, bus speed, etc.)

Thanks in advance,
Pat

_______________________________________________
zones-discuss mailing list
zones-discuss@opensolaris.org

_______________________________________________
zones-discuss mailing list
zones-discuss@opensolaris.org

Reply via email to