My apologies for the lateness of this summary - work has been interesting.
The solution on the routing side was to plumb and fully activate two nics in
the global zone for the two subnets the whole root zones would be active in.
For the zones themselves each nic assigned to a zone was plumbed with a null
address and gateway in the global zone and with the zone specific
information within the zone. No routing was needed in the zones - the
global routing table is passed through to the zones.
This is suboptimal from a security standpoint as the global zone must be in
the public sphere if the working zones are. It is also wasteful of nics.
The long term solution, budget allowing, would be to buy some newer nics.
Thank you to all who helped.
Matthew
On 4/2/08 8:49 PM, Steffen Weiberle [EMAIL PROTECTED] wrote:
Matthew Taylor wrote:
Thank you, and to those who replied off line as well. I will try it out and
report back on my success (or not) in the morning.
It does strike me that this should be in the docs. I have gone through
817-1592-15, the Zones admin guide, and find little to nothing on what the
configuration of the global zone should be to enable shared-ip. I can't be
the only one to want to use otherwise not in use physical nics.
Its not in the docs because (AFAIK) it is not a test, and thus not
supported, configuration. As I state or paraphrase it, because of the
shared IP, the expectation is that the global and non-global zones are
on the same subnet. Many deployments want to have the global, or system
administrative, zone on a separate admin network, and the non-global
zones on the service networks. The original implementation, and dare I
say design [1], was not to that. And as I have been repeatedly told by
folks who know the routing very well, trying to get routing to do the
right thing and what users would like it to do may be very difficult in
a single IP instance.
IP Instances is in place to help address that, but as you have found
out, unfortunately it does not work with all NICs (in Solaris and in
OpenSolaris prior to b84).
I have been reading the design doc recently and need to look back at the
networking part to be sure.
Steffen
[1] http://www.opensolaris.org/os/community/arc/caselog/2002/174/
This message posted from opensolaris.org
___
zones-discuss mailing list
zones-discuss@opensolaris.org
--
Matthew Taylor
Montgomery College
Office of Information Technology
240.567.3100
[EMAIL PROTECTED]
___
zones-discuss mailing list
zones-discuss@opensolaris.org
