If the machine has only one NIC installed, there are at least two issues that will prevent tools like ACC from working in a non-global zone.
- Since there is only one network interface on the system, it is not possible to dedicate that interface to the non-global zone where ACC is supposed to run. Hence all the zones, including the global zone, must share the physical network interface.
- When the physical network interface is being shared across multiple zones, it is not possible to plumb/unplumb the network interface from a Shared-IP Non-Global Zone. Only the root users in the global zone can plumb/unplumb the lone physical network interface.
- When a non-global zone is created with the default configuration, Shared-IP zone is created by default. Shared-IP zones have separate IP addresses, but share the IP routing configuration with the global zone.
Fortunately, Solaris 10 has a solution to the aforementioned issues in the form of Network Virtualization. Crossbow is the code name for network virtualization in Solaris. Crossbow provides the necessary building blocks to virtualize a single physical network interface into multiple virtual network interfaces (VNICs) - so the solution to the issue at hand is to create a virtual network interface, and then to create an Exclusive-IP Non-Global Zone using the virtual NIC. Rest of the blog post demonstrates the simple steps to create a VNIC, and to configure a non-global zone as Exclusive-IP Zone.
Create a Virtual Network Interface using Crossbow
- Make sure the OS has Crossbow functionality
global# cat /etc/release
Solaris Express Community Edition snv_111 SPARC
Copyright 2009 Sun Microsystems, Inc. All Rights Reserved.
Use is subject to license terms.
Assembled 23 March 2009
Crossbow has been integrated into Solaris Express Community Edition (Nevada) build 105 - hence all Nevada builds starting with build 105 will have the Crossbow functionality. OpenSolaris 2009.06 and the next major update to Solaris 10 are expected to have the support for network virtualization out-of-the-box. - Check the existing zones and the available physical and virtual network interfaces.
global# zoneadm list -cv
ID NAME STATUS PATH BRAND IP
0 global running / native shared
global# dladm show-link
LINK CLASS MTU STATE OVER
e1000g0 phys 1500 up --
In this example, there is only one NIC, e1000g0, on the server; and there are no non-global zones installed. - Create a virtual network interface based on device e1000g0 with an automatically generated MAC address. If the NIC has factory MAC addresses available, one of them will be used. Otherwise, a random address is selected. The
automode is the default action if none is specified.
global# dladm create-vnic -l e1000g0 vnic1 - Check the available network interfaces one more time. Now you should be able to see the newly created virtual NIC in addition to the existing physical network interface. It is also possible to list only the virtual NICs.
global# dladm show-link
LINK CLASS MTU STATE OVER
e1000g0 phys 1500 up --
vnic1 vnic 1500 up e1000g0
global# dladm show-vnic
LINK OVER SPEED MACADDRESS MACADDRTYPE VID
vnic1 e1000g0 1000 2:8:20:32:9:10 random 0
Create a Non-Global Zone with the VNIC
- Create an Exclusive-IP Non-Global Zone with the newly created VNIC being the primary network interface.
global # mkdir -p /export/zones/sapacc
global # chmod 700 /export/zones/sapacc
global # zonecfg -z sapacc
sapacc: No such zone configured
Use 'create' to begin configuring a new zone.
zonecfg:sapacc> create
zonecfg:sapacc> set zonepath=/export/zones/sapacc
zonecfg:sapacc> set autoboot=false
zonecfg:sapacc> set ip-type=exclusive
zonecfg:sapacc> add net
zonecfg:sapacc:net> set physical=vnic1
zonecfg:sapacc:net> end
zonecfg:sapacc> verify
zonecfg:sapacc> commit
zonecfg:sapacc> exit
global # zoneadm -z sapacc install
global # zoneadm -z sapacc boot
global # zoneadm list -cv
ID NAME STATUS PATH BRAND IP
0 global running / native shared
1 sapacc running /export/zones/sapacc native excl - Configure the new non-global zone including the IP address and the network services
global # zlogin -C -e [ sapacc
...
> Confirm the following information. If it is correct, press F2;
to change any information, press F4.
Host name: sap-zone2
IP address: 10.6.227.134
System part of a subnet: Yes
Netmask: 255.255.255.0
Enable IPv6: No
Default Route: Detect one upon reboot - Inside the non-global zone, check the status of the VNIC and the status of the network service
local# hostname
sap-zone2
local# zonename
sapacc
local# ifconfig -a
lo0: flags=2001000849
inet 127.0.0.1 netmask ff000000
vnic1: flags=1000843
inet 10.6.227.134 netmask ffffff00 broadcast 10.6.227.255
ether 2:8:20:32:9:10
lo0: flags=2002000849
inet6 ::1/128
local# svcs svc:/network/physical
STATE STIME FMRI
disabled 13:02:18 svc:/network/physical:nwam
online 13:02:24 svc:/network/physical:default - Check the network connectivity.
From inside the non-global zone to the outside world:
local# ping -s sap29
PING sap29: 56 data bytes
64 bytes from sap29 (10.6.227.177): icmp_seq=0. time=0.680 ms
64 bytes from sap29 (10.6.227.177): icmp_seq=1. time=0.452 ms
64 bytes from sap29 (10.6.227.177): icmp_seq=2. time=0.561 ms
64 bytes from sap29 (10.6.227.177): icmp_seq=3. time=0.616 ms
^C
----sap29 PING Statistics----
4 packets transmitted, 4 packets received, 0% packet loss
round-trip (ms) min/avg/max/stddev = 0.452/0.577/0.680/0.097
From the outside world to the non-global zone:
remotehostonWAN# telnet sap-zone2
Trying 10.6.227.134...
Connected to sap-zone2.sun.com.
Escape character is '^]'.
login: test
Password:
Sun Microsystems Inc. SunOS 5.11 snv_111 November 2008
-bash-3.2$ /usr/sbin/ifconfig -a
lo0: flags=2001000849
inet 127.0.0.1 netmask ff000000
vnic1: flags=1000843
inet 10.6.227.134 netmask ffffff00 broadcast 10.6.227.255
lo0: flags=2002000849
inet6 ::1/128
-bash-3.2$ exit
logout
Connection to sap-zone2 closed.
Dynamic [Re]Configuration of the [Virtual] Network Interface in a Non-Global Zone
- Finally try plumbing down/up the virtual network interface inside the Exclusive-IP Non-Global Zone
global # zlogin -C -e [ sapacc
[Connected to zone 'sapacc' console]
..
zoneconsole# ifconfig vnic1 unplumb
zoneconsole# /usr/sbin/ifconfig -a
lo0: flags=2001000849
inet 127.0.0.1 netmask ff000000
zoneconsole# ifconfig vnic1 plumb
zoneconsole# ifconfig vnic1 10.6.227.134 netmask 255.255.255.0 up
zoneconsole# /usr/sbin/ifconfig -a
lo0: flags=2001000849
inet 127.0.0.1 netmask ff000000
vnic1: flags=1000843
inet 10.6.227.134 netmask ffffff00 broadcast 10.6.227.255
lo0: flags=2002000849
inet6 ::1/128
As simple as that! Before we conclude, be informed that prior to Crossbow, Solaris system administrators were required to use Virtual Local Area Networks (VLAN) to achieve similar outcomes.
Check Zones and Containers FAQ, if you are stuck with a strange situation or if you need some interesting ideas around virtualization on Solaris.
________________
Technorati Tags:
Solaris | 
Virtualization | 
Crossbow | 
SAP | 
NetWeaver
0 comments:
Post a Comment