Here's my feedback.
We are running a fare number of solaris containers, across a series of
supported subnets. As of the Solaris 10 R3 release ( release 11/06 ) it was not
possible to use ipfilter for the loopback packets between zones.
With R4 ( Release 08/07 ) you now can by having the first non-commented line in
the ipf.conf file on the global zone as follows:
set intercept_loopback true;
Also, I need to clarify a definition so to speak. The difference between
trunking and tagging can be a bit misleading, especially if you're old school
like myself having done this job now for coming on 30 years.
The term trunking, in the old days, meant the extension of the physical network
to the server in question, ie, no defined VLAN on the switch ports. SUN's use
of trunking actually defines the method of device aggregation for HA network
connectivity. Last I looked, dladm is the utility to define device aggreagtion.
Tagging defines a virtual NIC on the Solaris server, which passes a VID to a
tagged port on your network switch determining which VLAN the packet is to be
sent on.
quick config can be achieved with something like
ifconfig e1000g1001 10.0.1.1 netmask 255.255.255.0 broadcast 10.0.1.255 plumb
ifconfig e1000g1001 up
ifconfig e1000g2001 10.0.2.1 netmask 255.255.255.0 broadcast 10.0.2.255 plumb
ifconfig e1000g2001 up
or you can create /etc/hostname.e100g1001 and /etc/hostname.e100g2001
with the associated addresses in them.
The new ability to set the zone's ip-type to exclusive does in fact create a
much better security model as far as looped back packets on the same global
zone is concerned, but as mentioned, at a cost. Even if the physical NIC is set
as a tagged NIC ( ie a VNIC ), it can only be used by a single Solaris
container. This obviously can become problematic if you are deploying a larger
number of containers on a single global zone.
I have tested isolation capabilites at the global zone layer using a series of
rules in the global zone's ipf.conf with very good results. Entries similiar to
block in quick proto tcp/udp from x.x.1.0/24 to x.x.2.0/24 keep state
block out dup-to e1000g1002 quick proto tcp/udp from x.x.1.0/24 to x.x.2.0/24
keep state
will achieve isolation between subnets and/or containers at least on the same
global zone, and if a infrastructure firewall is in place as well, the
duplicate packet will be forced out the NIC/VNIC defined.
Other options like route add zoneA's IP zoneB's IP -interface -reject can
also be used at the global zone, but this command would have to be initiated
after zoneA and zoneB are already booted so that the global zone's IP-Stack has
record of the IP addresses in use. this also would require a series of entries
to add the rejection for any combination of activity based on the local zones
installed.
As for the raw use of VNIC's, it works great. Our environment currently
supports 8 VLAN's on each global zone, and we are able to dynamically add new
ones when required.
Regards,
Dan G
This message posted from opensolaris.org
___
zones-discuss mailing list
zones-discuss@opensolaris.org
