Networking Help

[guddler]

Can anyone help with this please?

I've got a machine I'm trying to set up that is a host for numerous VMs. The host is Ubuntu 10.04. The VMs are KVM. Currently the setup is as follows:

Host:

eth0 - n/c

eth1 - n/c

eth2 - inet manual, physically connected to network A

eth3 - n/c

br0 - ip static (172.16.x.x), bridged to eth2 (only)

So the VMs are currently using br0 and are working fine on the 172.16.x.x network

What I need to do is, firstly:

eth0 - n/c

eth1 - n/c

eth2 - inet manual, physically connected to network A

eth3 - inet manual, physically connected to network B

br0 - ip static (172.16.x.x), bridged to eth2 (only)

br1 - ip static (10.2.x.x), bridged to eth3 (only)

So now I can introduce new VMs that are on the 10.2.x.x network.

I figured that would be easy enough. I've done the groundwork on the firewalls, routers and VPN concentrator(s). So far so good.

As soon as I brought up eth3 I lost connection to the host and can no longer connect on either eth2 or eth3. So I'm having to send someone in to Manchester in the morning to physically push keys and bring eth3 back down again

Any idea what's up? I don't see why the second bridge should even remotely interfere with the 1st !!!

Ultimately, to take this to it's logical conclusion, I want to then connect eth0 to network A / br0 and eth1 to network B / br1 for resilience (they will be connected to the failover F/W).

Is this setup even possible or is there something fundamental I'm missing here?

I guess it's possible that the addition of the new bridge might require the host to be rebooted but I've tried to avoid that as one of the existing VMs has live customers on it

If anyone remotely understood all of that, can anyone help??

[EDIT]PS: I've been working on this since Friday PM and have quite literally just exhausted all possibilities to the point I am certain I can't get a connection to the host.

However, the VMs that are running on network A are still running just fine and can talk on the network as normal. Most odd!!

guddler2011-01-16 21:45:00

 

[guddler]

Ugh, just reading up on this, I think there's 2 parts.

Firstly I need to add another network card that will become eth4.

I then need to bond eth0 and eth1 to make bond0 and bond eth2 and eth3 to make bond1.

bond0 and bond1 need to be bridged to br0 and br1 respectively and finally (though not in this order) eth4 becomes my plain vanilla ethernet connection to the host.

Somewhere in there, I think I'm going to get hit by spanning as well and need to install stp on one or more of the bridges?

Think I'm in for a fun day tomorrow!

 

[guddler]

Woot! I just got this baby going!

Slightly revised config. Have had to forgo redundancy for now but then, for now, it's mostly not live servers (there's 1).

I've now got

eth0 - br0 - network A

eth1 - br1 - network B

eth2 - direct - host network

eth3 - br2 - network C

The key is not only to not assign any gateway, but actually to not assign any IP stuff at all, just configure the bridge parameters and set it up to simply pass packets. That way everything is totally transparent to the guests, there are no multiple default routes to screw you over and if security is breached in one of the VMs somehow there is no route to the host unless I explicitly open one in the firewall.

Exactly what I wanted to achieve!

 

[trm]

Nice fix

 

[guddler]

Ugh, and I just fixed why one of my networks was just throwing "destination host unreachable" in the guest. helps if I bring the interface up in the PIX really doesn't it - DOH!!!

Right, my head's baked for the day now. Actually it was baked by about 2pm