Recently, in one of our projects we needed a Cloudstack 3.0 setup with advanced mode networking options. Cloudstack has two options of networking setup viz basic and advanced. Setting up Cloudstack in basic mode is pretty simple! But, for setting up Cloudstack with advance mode one needs a clear understanding of internals of networking in advanced mode. This post will cover most of the concepts required along with step by step guide of advanced mode Cloudstack setup.
CloudStack 3.0 basic mode does not have VLAN enabled i.e. all instances created under basic mode have a public IP assigned. Users outside the platform can access these instances directly using the public IP associated with those instances. Also, basic mode doesn’t provide flexibility in networking. Setting up advanced mode provides such flexibility. In advanced mode, admins can customize networking options such as VPN access, load balancing, firewall and port forwarding for particular account. Virtual routers (setup using VLANs, refer diagram) in advance mode serves as abstraction for all the instances associated with that account and helps in routing the network traffic.
Lets first discuss the common terminology used in CloudStack setup -
Hosts are basic physical blocks of the Cloudstack platform. A host can be single XenServer or ESX server. The number of guest virtual machines that can be hosted on Cloudstack can be determined by number of hosts and capacity of each host. Hosts are not visible to the end user. An end user cannot determine which Host their guest has been assigned to.
Clusters are second level of physical scaling in Cloudstack platform. Cluster is a group of hosts (for Ex. XenServer or VSphere) that have same hypervisor type and share the primary storage. Size of cluster is limited by underlying hypervisor type. In a particular cluster, instances can migrate from one host to another.
Clusters can be Cloud Managed or Externally Managed. For Ex. ‘Xenserver’ based clusters are ‘Cloudmanaged’ however, for ‘VMWare’ based clusters are managed by vCenter servers.
Pod is a collection of different types of clusters. It is a third level of physical scaling in CloudStack platform. The pod may contain only one cluster or multiple clusters with different base hypervisor type. A Pod is frequently mapped to a single rack with a layer-2 switch.
Zones are fourth level of physical scaling in Cloudstack platform. Zones can also provide physical isolation from other zones. Users have option to choose zone while deploying their guest VMs. Admins can setup private zones which is only accessible to specific domain. Each node in zone shares the secondary storage and network.
Guest VM’s root disks and other additional data disks are stored on primary storage. Instances in a particular cluster have same primary storage for them. Speed of primary storage directly impact guest VM performance.
Root volumes are created when guest VM is created on Cloudstack platform. Additional data disks can be added later or they can be added while guest VM deployment. Root disks are deleted when guest VM is destroyed. but, data disks are not deleted from primary storage when VM is destroyed which is a main difference between two types.
Secondary storage is used for storing templates, ISO images and snapshots on cloudstack platform. Submissions to secondary storage go through the Secondary Storage VM (System VM). The Secondary Storage VM can retrieve templates and ISO images from URLs.
Each zone can have multiple secondary storage devices of type NFS added to them.
Different types of Networks in CloudStack platform
Before we start discussing the setup & configurations for advance mode, lets first understand the types of network used in Cloudstack platform. CloudStack has three networks – Public, Private and Link local network.
Every account has a internal network associated with it called a “link local network”. All guest VMs associated with the account communicate on this network and guest VMs on two different clusters (for Ex. XenServer and VSphere) communicate on a private network. Through public network, other users can access the CloudStack resources. [refer diagram below]
Users of Internet can access Cloudstack resources through Public network. For every account source NAT is created and a public IP is allocated to that network. Resources belonging to this account, if public, are accessible through the public IP address. Multiple public IPs can be assigned to single resource.
Two instances on different hosts communicate with each other using private network. For Ex. The client has instances on two different hypervisors- ‘Xenserver’ and ‘VMWare’ and if these instances want to communicate in between them then they can communicate on private network.
Link local network
The Management Server automatically creates a Virtual Router for each guest virtual network. A virtual router is a special virtual machine that runs on the Hosts. This router communicates with other resources of the account on link local network as shown in diagram above.
We will now discuss how to setup Advance zone with VLANs-
Setting Up Zone in Advanced mode
Advanced mode provides the most flexibility in allowing administrators to provide custom network offerings such as providing Firewall, VPN, or Load Balancer support as well as enabling direct vs virtual networking. Advanced mode of CloudStack setup can be setup in two modes – with VLANs or with Security groups.
Step 1: Login to admin console.
Step 2: Navigate to menu: System > Zones from let side bar menues
Step 3: Select Add zone and choose ‘Advanced’. Click next.
Step 4: Enter name and other details provided by your network provider.
Step 5: In CloudStack 3.0, for every NIC present on management server, a separate physical network is should be created. If the management server has only one NIC, click next else add additional physical networks.
Step 6: CloudStack’s resources like virtual machines are accessible to outside world through domain router. Every domain router is associated with a public IP which is picked from pool of IP addresses provided at time of zone setup. Add appropriate public IP range for CloudStack setup.
NOTE: If VLAN ID is specified, all the CloudStack requests will be tagged with that VLAN ID. For communication with CloudStack’s resources, requests should be tagged with VLAN ID specified. If VLAN ID is not specified, outside resources can communicate with CloudStack without any restrictions.
Step 7: The next step is to add pod specific settings. The reserved System IPs are used for creation of private network.
Step 8: Enter the VLAN Range which will be used by CloudStack for it’s internal communication. A separate VLAN range should be specified for every physical network created in step 5.
Step 9: Add Cluster, host configurations with primary and secondary storage servers. Click next. CloudStack will create physical network, pods and clusters inside new zone. System VMs will come up after successfully adding host, primary and secondary storage in the zone. Wait for their state to change to ‘Running’ state.
Step 10: Check status of BUILTIN templates from templates menu. If they are in downloading state, wait till the downloading is complete.
That’s it! You have setup a Cloudstack with advanced networking options and now you can spawn your first VM instance.