This blog post is the first part of a series of quick wrap ups for the impatient to quickly start and configure their new Solaris 11 servers. My advice is always the same: read the manual.
Network Configuration Changes in Solaris 11
Network configuration in Solaris 11 is pretty different than it was in earlier Solaris releases (including Solaris Express) and many administrators may be taken by surprise. Some of these changes were introduced in the corresponding OpenSolaris projects, such as Crossbows, and may be known by many of us. To sum things up, the major differences are the following:- Network configuration is now managed by a profile.
- The dladm command now centralizes the configuration of layer 2 datalinks: many tasks performed by the ifconfig command on previous Solaris releases are now to be performed using the dladm command.
- Datalink names aren't bound to their hardware driver name any longer.
- IP interfaces on layer 3 are configured by using the ipadm command: the venerable ifconfig command has been deprecated in the Solaris 11 release.
- IP network multi pathing (IPMP) groups are now implemented as IP interface and as such, configured with the ipadm command.
- The new ipmpstat command has been introduced to gather statistics about IPMP groups.
- Network virtualization has been implemented on the network device level.
The Solaris 11 Network Stack
The new Solaris 11 network stack is similar to Solaris 10's. Yet, some improvements have been introduced that administrators are simply going to love.In the new network stack, the software layer has been decoupled from the hardware layer: this means that:
- The network configuration of a system (or a zone) is insulated from the hardware it's running upon.
- As already stated, datalink names can be customized.
- Many network abstractions (such as VNICs) are managed in the datalink layer: this means that all of the datalink configurations can be centrally managed with one administrative interface.
- If the underlying hardware of a box changes.
- If you migrate zones across systems.
- If you write generic configurations for a wide set of boxes.
$ dladm show-phys
LINK MEDIA STATE SPEED DUPLEX DEVICE
net0 Ethernet up 1000 full e1000g0
net1 Ethernet up 1000 full e1000g1
Network Auto-Magic (NWAM)
Long time users of older Solaris Express releases will remember the introduction of the Network Auto-Magic feature into the operating system. NWAM is a feature that automates the basic network configuration of a Solaris box. NWAM in Solaris 11 has been greatly enhanced and it now supports the following concepts:- NCP.
- Location.
A Location profile is another administrative unit that let the administrator specify:
- The conditions under which a profile should be activated.
- The naming service configuration.
- The domain name.
- The IP filter rules.
- The IPSec policy.
At a given time, only one NCP and one Location profile will be active in a Solaris system.
NWAM is handy when a system network configuration is changed often and an administrator, in those cases, can encapsulate the different and required configurations in profiles (NCPs and Location profiles) and activate them when needed.
If you're using the Solaris 11 desktop, you can use the Network Preferences application (which can be found into the System/Administration menu) to quickly build NCPs and Location profiles.
 |
| Network Preferences |
In the following sections we will use some NWAM administrative commands but we won't dig into this subject any more and let NWAM administration be the topic of another post.
Configuring the Network
Depending on how a newly Solaris 11 installation has been performed, your initial network configuration may differ. If you've installed it from the Live CD, the Automatic NCP and the Automatic Location profile are active. These profiles are pretty simple: they configure every IP interface and the name service using DHCP, leaving any other configuration option (IP filters, IPSec, etc.) disabled.
If you're using Solaris on your PC this configuration may be good for you but chances are you might be installing some server that requires a less trivial network configuration.
Creating an NCP profile
The first thing you're going to do is creating a new NCP:
$ netcfg create ncp datacenter
The datacenter NCP will be the container of our configuration and we will add the NCU that we need for every link and IP interface we're going to configure.
# netcfg
netcfg> select ncp datacenter
netcfg:ncp:datacenter> create ncu phys net0
Created ncu 'net0'. Walking properties ...
activation-mode (manual) [manual|prioritized]>
link-mac-addr>
link-autopush>
link-mtu>
netcfg:ncp:datacenter:ncu:net0> end
Committed changes
netcfg:ncp:datacenter> create ncu ip net0
Created ncu 'net0'. Walking properties ...
ip-version (ipv4,ipv6) [ipv4|ipv6]> ipv4
ipv4-addrsrc (dhcp) [dhcp|static]> static
ipv4-addr> 192.168.1.53
ipv4-default-route> 192.168.1.1
netcfg:ncp:datacenter:ncu:net0> end
Committed changes
netcfg:ncp:datacenter> exit
With the netcfg command we created an NCP with the following characteristics:
- It has an NCU for a physical interface (net0). This NCU has been configured with default values for all of its properties (such as MAC address or MTU).
- It has an NCU for an IP interface (net0). This NCU has been configured with a static IPv4 address and a default router.
If you activate this profile, your system will reconfigure the network according to the settings of this NCP:
# netadm enable -p ncp datacenter
Enabling ncp 'datacenter'
If we now check the IP interfaces we can see how they've been configured according to the above-mentioned NCUs: the net1 IP interface is up while the net0 interface has disappeared.
# ipadm show-if
IFNAME CLASS STATE ACTIVE OVER
lo0 loopback ok yes --
net1 ip ok yes --
If we check the IP addresses currently used, the ipadm command confirms that only net1 has been assigned an address which is the static address we configured in the NCU. Again, net0 has disappeared.
# ipadm show-addr
ADDROBJ TYPE STATE ADDR
lo0/v4 static ok 127.0.0.1/8
net1/_a static ok 192.168.1.53/24
lo0/v6 static ok ::1/128
If we know check the state of the datalinks, we can see that net0 is in the unknown state while net1 is up.
# dladm show-phys
LINK MEDIA STATE SPEED DUPLEX DEVICE
net0 Ethernet unknown 1000 full e1000g0
net1 Ethernet up 1000 full e1000g1
If we wanted to add both the net0 datalink and IP interface into the profile, we could simply modify it and create the corresponding NCUs.
If we now try to resolve some name, however, we discover that it's not going to work. If you remember, we're still using the Automatic location profile which configure the name resolver using DHCP. In this case, however, DHCP isn't being used so that the resolver is not going to resolve any name.
What we need now, is a corresponding location profile.
Creating a Location Profile
To configure the resolver settings, we can now create a new location profile, using once more the netcfg command:
netcfg> create loc datacenter
Created loc 'datacenter'. Walking properties ...
activation-mode (manual) [manual|conditional-any|conditional-all]>
nameservices (dns) [dns|files|nis|ldap]>
nameservices-config-file ("/etc/nsswitch.dns")>
dns-nameservice-configsrc (dhcp) [manual|dhcp]> manual
dns-nameservice-domain>
dns-nameservice-servers> 192.168.1.1
dns-nameservice-search> yourdomain.com
dns-nameservice-sortlist>
dns-nameservice-options>
nfsv4-domain>
ipfilter-config-file>
ipfilter-v6-config-file>
ipnat-config-file>
ippool-config-file>
ike-config-file>
ipsecpolicy-config-file>
netcfg:loc:datacenter>
netcfg:loc:datacenter> end
Committed changes
netcfg> end
As soon as we enable the newly created location profile, the resolver is going to use the configured settings and it's just going to work:
$ netadm enable -p loc datacenter
Enabling loc 'datacenter'
$ nslookup www.oracle.com
Server: 192.168.1.1
Address: 192.168.1.1#53
Non-authoritative answer:
www.oracle.com canonical name = www.oracle.com.edgekey.net.
www.oracle.com.edgekey.net canonical name = e4606.b.akamaiedge.net.
Name: e4606.b.akamaiedge.net
Address: 2.20.190.174
Conclusion
As you can see, configuring the basic network settings in a Solaris 11 system is clean and easy. The new administrative interface lets you easily define, store and activate on-demand multiple network configuration for your system without the need of writing and maintaing multiple copies of the old style Solaris network configuration files.
No comments:
Post a Comment