Shared-IP and Exclusive-IP in Non-Global Solaris Zones

May 11, 2009 · Filed Under General Solaris topics 

If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!

Just a few days ago I’ve been busy configuring one of the Solaris 10 zones on a DMZ server, and sure enough I hit one of the most common IP-related issues with non-global zones.

Shared IP configuration for non-global Solaris zones

By default, non-global zones will be configured with a shared IP functionality. What this means is that IP layer configuration and state is shared between the zone you’re creating and the global zone. This usually implies both zones being on the same IP subnet for each given NIC.

Shared IP mode is defined by the following statement in zone configuration:

set ip-type=shared

Here’s all the commands needed to enable it for a zone called s10zone in my example:

solaris# zonecfg -z s10zone
zonecfg:s10zone> set ip-type=shared
zonecfg:s10zone> verify
zonecfg:s10zone> commit
zonecfg:s10zone> end
solaris#

While I’ve deployed quite a few zones before, it was only recently that I learned what sharing IP layer configuration meant in practical terms: no IP routing within non-global zone. So if for some reason you want your non-global zone to use a different IP route for connecting one of the available networks, you really can’t don it in shared IP mode, because your non-global zone can only inherit the routing rules of the global zone.

You still have an option of assigning different IP addresses to different virtual interfaces of a non-global zone, but unless their routing is catered for by the global zone, it won’t be of much use.

Exclusive IP configuration for non-global Solaris zones

Configured using this statement in zone configuration:

set ip-type=exclusive

… this mode implies that a given non-global zone will have exclusive access to one of the NICs on your system.

While for me the most important aspect of such exclusivity was the possibility to configure zone-specific routing, there’s obviously much more offered by this mode:

  • DHCPv4 and IPv6 stateless address autoconfiguration
  • IP Filter, including network address translation (NAT) functionality
  • IP Network Multipathing (IPMP)
  • IP routing
  • ndd for setting TCP/UDP/SCTP as well as IP/ARP-level knobs
  • IP security (IPsec) and IKE, which automates the provision of authenticated keying material for IPsec security association

So here it is – another design lesson for you – make sure you know what kind of networking your zones will need.

See also:

Tags:

Comments

7 Responses to “Shared-IP and Exclusive-IP in Non-Global Solaris Zones”

  1. Eric on May 13th, 2009 12:15 am

    It would be useful if ip-type was set per interface instead of globally per zone. Then you could use one shared network for management in addition to the exclusive interface(s).

  2. Gleb Reys on May 13th, 2009 7:19 am

    Indeed, Eric!

    It’s always possible manage the zone via local console (zlogin -C) though.

  3. Prashanth on May 13th, 2009 4:47 pm

    I have one NIC in my server.I need to have IPSec setup for the local zone and hence have to create this zone in exclusive mode. If I do so, can the global zone be still assigned a IP on this NIC

  4. bbr on May 14th, 2009 9:03 am

    does it means you can serve NFS request within a zone with exclusive IP? aka run NFS server inside a zone?

    bbr

  5. Gleb Reys on May 14th, 2009 10:57 am

    Prashanth, you have to manage IP address from within the exclusive-ip zone.

  6. Gleb Reys on May 14th, 2009 11:04 am

    bbr, thanks for asking!

    Last time I checked, native NFS server functionality was global zone only. I think exclusive-ip provides direct access to networking stack, but not Solaris kernel.

    Here’s the NFS related FAQ entry for zones:

    http://opensolaris.org/os/community/zones/faq/#svc_nfs

  7. Changing hostname in Solaris | Solaris Blog on May 20th, 2009 3:26 pm

    [...] IP address configuration in Solaris zones [...]

Leave a Reply