In order to secure intra-cluster flows in an environment where network segmentation is non-existent, it is sometimes necessary to configure the backplane network to isolate them from production flows.
Overview of the backplane network
The backplane network creates a dedicated interface in a separate VLAN on all CVM and AHV hosts in the cluster for the exchange of storage replication traffic. The backplane network shares the same physical adapters on the br0 bridge by default, but uses a different non-routable VLAN. This allows the cluster flows to be isolated from those of the production machines logically and/or physically.
Use case
In our case, the client network has no network segmentation and all its equipment is in the same subnet (servers, PCs, printers, phones, etc.).
The goal was therefore to set up the backplane network to isolate and secure intra-cluster flows on a dedicated VLAN independent of the rest of the network (flows in red on the diagram):
The first step is to modify the configuration of the Top-of-Rack switches to add the new VLAN. In our usecase, we will do a logical segmentation.
Top-of-rack switch configuration
Before activating the backplane network, it is necessary to prepare the ports of the top-of-rack switches for this operation. In our case, we are on Mellanox switches with an active-backup port configuration with an administration VLAN in 100 and an unrouted VLAN dedicated to the backplane network in 3000:
interface ethernet 1/1
switchport mode hybrid
switchport hybrid allowed-vlan add 3000
switchport access vlan 100
exit
interface ethernet 1/2
switchport mode hybrid
switchport hybrid allowed-vlan add 3000
switchport access vlan 100
exit
interface ethernet 1/3
switchport mode hybrid
switchport hybrid allowed-vlan add 3000
switchport access vlan 100
exit
interface ethernet 1/4
switchport mode hybrid
switchport hybrid allowed-vlan add 3000
switchport access vlan 100
exitOf course, you must adapt the commands to your switch model and reproduce this configuration on the 2nd Top of Rack switch.
BE CAREFUL not to make any mistakes when modifying your network configuration at the risk of compromising access to your cluster.
Once the configuration is complete, it is now possible to set up the backplane network on the cluster.
Configuring the backplane network
Before you can start, it is imperative to put all hosts in maintenance mode. To do this, you must connect to a CVM and type the following command:
acli host.enter_maintenance_mode HOST_IPYou must repeat the command with the IP address of each host in your cluster.
Once all the hosts are in maintenance mode, you must connect to Prism Element, go to the “Setting > Network Configuration > Internal Interfaces” menu:
Opposite “Backplane LAN” click on “Configure”:
In the window that appears, enter:
- the IP address of the network you want to use for the backplane network
- the subnet mask associated with this subnet
- the ID of the VLAN you have chosen
- the virtual switch that will have to carry it
Tips and best practices for choosing your backplane network:
- the network must not be routed
- it must not exist on the network
- it must be chosen large enough to integrate the existing nodes and possibly an expand cluster
- the VLAN ID must be unique on the network
Once the configuration operation is complete on the cluster, you must exit all the maintenance hosts with the following command:
acli host.exit_maintenance_mode HOST_IPYou have to enter the command on a CVM and repeat it with the IP address of each host in the cluster.
In network configuration, you will see that the backplane network is now configured and active:
Your intra cluster traffic is now isolated from the rest of the network.
