How to assign an additional/alias IP addresses to a network card (NIC)?

Latest response

Hello folks,
I'm looking for best practice to assign and manage an additional/alias IP addresses to a network card (NIC) in RHEL 7 and RHEL 8.

Most of my network configurations for a host with a single NIC looks something like this:

# cat /etc/sysconfig/network-scripts/ifcfg-ens192
TYPE=Ethernet
BOOTPROTO=none
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
IPV6_FAILURE_FATAL=no
IPV6_PRIVACY=no
NAME=ens192
DEVICE=ens192
ONBOOT=yes
DNS1=192.168.0.1
DNS2=192.168.0.2
PEERDNS=no
DOMAIN="foo.example.com example.com"
IPADDR=192.168.3.56
PREFIX=24
GATEWAY=192.168.3.1

Today when I have to add an additional IP address to this NIC I would create a new file called ifcfg-ens192:1 with the follwoing content:

# cat /etc/sysconfig/network-scripts/ifcfg-ens192\:1
DEVICE=ens192:1
ONPARENT=on
IPADDR=192.168.3.8
PREFIX=24

Afterwards I restart the network service via systemctl restart network to activate the new (virtual) interface. The new interface is active imediatly. How could I prevent this? The new IP should stay inactive until I enable it via ifup ens192\:1.

Besides that, what do you suggest is the recommend way for RHEL 7 and RHEL 8 to bring up and down (virtual) interfaces? I would like to know how to control which IP is UP or DOWN and I'm not sure wether to choose ifup|ifdown, ip or nmcli.

When the additional/virtual interface is down, it is not shown in the output of ifconfig -a and ip a. How could I get a view of all virtual interfaces in status DOWN?

I'm looking forward reading your suggestions.

Best regards,
Joerg

Responses

Those sort of interfaces with a colon like ens192:1 are called "alias interfaces" and have fallen out of favor. There are a few obscure situations where they don't work, it is recommended to move away from them.

The replacement is simply adding IP addresses as secondary IPs on the original interface.

In ifcfg files with the network initscript, this is done with IPADDRn and similar arguments where n is a number below 255, for example:

IPADDR1=10.0.0.1
PREFIX1=24
IPADDR2=172.16.0.1
PREFIX2=28

or you can use NETMASKn as below:

IPADDR1=10.0.0.1
NETMASK1=255.255.255.0
IPADDR2=172.16.0.1
NETMASK2=255.255.255.240

If you're using NetworkManager, then these can be added easily in the GUI or nmtui, or using nmcli like:

nmcli con mod CONNECTION +ipv4.addresses "10.0.0.1/24,172.16.0.1/28"

On RHEL7 and RHEL8 I think you're better to stick with either NetworkManager or the network initscripts. Don't use both at once, so don't mix up the commands like run ifup/ifdown while running NM. Use the proper NM equivalent like nmcli con up ethX and so on.

If you want to change config files under NetworkManager instead of editing the connection properties, then run nmcli con reload to read the new config files. Don't restart the NetworkManager service, it's not designed to be restarted after boot.

Also the old net-tools package has been deprecated for a very long time, instead of ifconfig consider using the equivalent ip commands like ip addr or ip route.

Hello Jamie,
Thanks for your response.

I undestand how to assign a secondary or third IP address to an interface. What I did not understand yet is how to control whether the additional IP address is up or down?

Would the additional IP addresses be active on boot? If yes, how to prevent that? How to enable/disable the additional addresses on demand? Could you give me an example?

Thank you in advance
Joerg

Thank you so much, it helped to build small server as router and gateway

Hello to everyone,
I still got a little stuck here. So I hope someone could give some examples in how to deal with the following topics, so I could hopefully understand them.

I undestand how to assign a secondary or third IP address to an interface. What I did not understand yet is how to control whether the additional IP address is up or down?

Would the additional IP addresses be active on boot? If yes, how to prevent that? How to enable/disable the additional addresses on demand? Could you give me an example?

Is anybody out there who could give me a helping hand here?

Best regards,
Joerg

Hi perhaps I can get help here. I have 2 redhat 7.6 servers. I just added IP aliases to both. Both new IPs are the same vlan however although they both appear active only one is responding from outside the server . this is the working one:

cat ifcfg-bond0:1 DEVICE=bond0:1 NAME=bond0:1 TYPE=Bond BONDING_MASTER=yes IPADDR=159.244.136.40 NETMASK=255.255.255.0 ONBOOT=yes BOOTPROTO=none BONDING_OPTS="mode=4 miimon=100 lacp_rate=1" NM_CONTROLLED="no"

this is the one that is not working: cat ifcfg-bond0:1 DEVICE=bond0:1 NAME=bond0:1 TYPE=Bond BONDING_MASTER=yes IPADDR=145.55.17.50 NETMASK=255.255.255.0 ONBOOT=yes BOOTPROTO=none BONDING_OPTS="mode=4 miimon=100 lacp_rate=1" NM_CONTROLLED="no"

hi perhaps this option in the interface config file is what you are looking for:

ONBOOT=yes

Hi Julian,
As far as I know this option is for the interface itself and it's primary ip address, not for the secondary ip address.

Regards,
Joerg

Virtual interfaces are controlled with the ONPARENT setting. Not sure ONPARENT=on is valid. I believe the valid options are yes|no. So to stop it from coming up automatically, you need to set it to no. (ONPARENT=no) if you want it up automatically, set it to yes. (ONPARENT=yes) Article related to RHEL 5. But it applies to 6 and 7 (don't know about 8), if you are using the network scripts: https://access.redhat.com/solutions/169503

Hi,

When using a virutal interface I could simply use ifup/ifdown commands to start and stop it. But as Jamie posted in his comment above so called virtual or alias interfaces have fallen out of favor.

The new world order seems to be adding a secondary ip address on the original interface. But I'm still not sure if this second or maybe even third ip address comes up and down with the first address or if it is possible to control them independent from each other.

Example: When I have an interface with two ip addresses, bringing down the interface takes both ip addresses offline.

What do I have to do to enable/disable only the second or first ip address on an interface?

Best regards, Joerg

I have wondered this myself :P My guess is:

If you don't want an address on the interface at boot, comment it out of the file.

If you wish to put an address down later, you could do so with NetworkManager or ip addr.

"The new world order seems to be adding a secondary ip address on the original interface" <--- I don't think this is correct. The new world order is to use nmcli, but if you are going to be managing your network scripts manually, and you want this behaviour (to manually manage when they come up), then you'd need to either manage them on a separate file, with the ONPARENT option, or, like Jamie says, commenting the lines with the additional IPs on the main configuration file. I've been looking through the documentation and can't find anything about how to manage them with nmcli, except that you just add a list of IPs.. so I get you need to use -g to retrieve all the configured IPs and then reconfigure without the one you don't want.. The advantage of using nmcli is that it's more scriptable than using the files.. but it certainly behaves differently, so you need to be aware of the differences..

Hello,

I confirm, the best way is to set the additional IP on ifcfg-ens192:1 else you can't show the additional ip using "ifconfig" (you have to use only "ip a" ), you can't control these additional ip one by one without restarting primary interface. So, you can use

cat /etc/sysconfig/network-scripts/ifcfg-ens192:1

DEVICE=ens192:1 ONPARENT=on IPADDR=192.168.0.10 NETMASK=255.255.255.0 #OR # PREFIX=24

Hi Reda,

So you are still using the ifcfg files to configure 'alias interfaces', which as Jamie has posted have fallen out of favor. At least for Red Hat.

When I'm looking into the RHEL 7 Networking Guide and RHEL 8 Configuring and managing networking on how to configure ip networking they both mention (in this order):

  1. Use the Network Manager
  2. Use the GNOME GUI
  3. Use the ifcfg files

In addition I found the KB 783533 which tires to explain the differences in network intitscripts and the Network Manager in RHEL 7.

Taken all these sources and the information from this thread into consideration I would guess that from Red Hat's point of view the Network Manager is the preferred method to configure ip networking in RHEL 7 and 8. Would you agree on this?

So when Red Hat seems to support/prefer the Network Manager it seems not wise to remove it and use the old ways only, instead. Well I guess we (at least my colleagues and me) are going to learn something, then.

Cheers,
Joerg

I have been successful in creating network alias files and having them work the way that we need them to on our RHEL v7.x servers. However, I guess the developers do not realize how important this feature is for server admins. To be able to bring a web site up or down, without affecting other web sites, or the main server's network, is a must. What if you need to make some changes to a web site, or move just one web site to another server, and not take everything down? Without the ability to have network script alias files you would loose this ability.

Since the NetworkManager tui/gui no longer works the way that we need it to. You will need to stop the NetworkManager service, as it cannot control an aliased interface. In order to stop NetworkManager follow the following steps:

systemctl stop NetworkManager systemctl disable NetworkManager

Here is how to create a network alias file - first edit your /etc/sysconfig/network-scripts main network file and change it to something like this - cat ifcfg-ens192

NAME=ens192 DEVICE=ens192 TYPE=Ethernet BOOTPROTO=none DEFROUTE=yes IPV4_FAILURE_FATAL=yes IPV6INIT=yes IPV6_AUTOCONF=yes IPV6_DEFROUTE=yes IPV6_FAILURE_FATAL=no IPV6_ADDR_GEN_MODE=stable-privacy ONBOOT=yes DNS1=10.x.x.61 DNS2=10.x.x.41 DNS3=10.x.x.31 DNS4=10.x.x.21 DOMAIN="your.com" UUID=03da3400-2234-q567-1234-zzxxrrttasdfasdf3 IPADDR=10.x.x.105 PREFIX=16 GATEWAY=10.x.x.x IPV6_PEERDNS=yes IPV6_PEERROUTES=yes IPV6_PRIVACY=no ZONE=public

Create the alias interface configuration file. Here is an example

cat ifcfg-ens192:01

Test Web Site

DEVICE=ens192:01 ONPARENT=yes
NM_CONTROLLED=no IPADDR=10.x.x.101 PREFIX=16

NAME="Test Web Site

Then bring up the interface to make the changes take effect:

ifup ens192:01

Check to see that the alias IP has started using ifconfig

> ifconfig

ens192: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 10.x.x.105 netmask 255.x.x.x broadcast 10.xx.x ether 00:30:45:67:89:10 txqueuelen 10000 (Ethernet) RX packets 2511800865 bytes 378599611561 (352.5 GiB) RX errors 0 dropped 27829784 overruns 0 frame 0 TX packets 1307884453 bytes 4436126338281 (4.0 TiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

ens192:01: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 10.x.x.101 netmask 255.x.x.x broadcast 10.x.x.x ether 00:23:45:67:89:11 txqueuelen 10000 (Ethernet)

Please excuse the word wrapping, and lack of cl lf.

Hi, I know this is an old thread but I need to do this now and can't seem to get this to work as expected or documented. I have tried disabling NetworkManager and using the alias files ens192:1 , and installing network-scripts which gives you the the ifup ifdown scripts for these interfaces. But I cannot manage them individually I get device not found or recognized errors. I have opened a case with Redhat but they are confused by my request.

Thanks

Hi Michael Faucher,

Please see the post near the top or at the top by Jamie Bainbridge. I don't always make an additional virtual IP address for an interface, but when I do, the method by Jamie Bainbridge is exactly what I use and it works. I have not tried it with RHEL 8, but the path of nmcli would probably work too.

Kind Regards,
RJ

I'm aware that the original question was how to add an interface without immediately activating it, but it appears to have evolved into 'what is the best practice to add an IP address'.

Maybe my question is better posed to the Azure crowd, but I'll try it here since we've got some expert ears listening. If the initial interface is DHCP, is it still recommended to add the next address using nmcli con mod Wired\ connection\ 1 +ipv4.addresses 10.2.1.211/32?

Also, if the first post above can be edited I think Jamie Bainbridge left the + off of ipv4.addresses.

Good idea, thanks!

I added the + and changed the ethX to CONNECTION to make it clearer to target the connection name instead of the device, as you correctly point out below.

Oh I may have found my typo, too. The network was supposed to be /24 not /32:

# nmcli connection modify Wired\ connection\ 1 +ipv4.addresses 10.2.1.211/24

Another question I had, and answered with a quick look at the docs, was: if one is to use nmcli with con mod, do you target the device itself or the connection?

# nmcli -p device
=====================
  Status of devices
=====================
DEVICE  TYPE      STATE      CONNECTION         
----------------------------------------------------------------------
eth0    ethernet  connected  Wired connection 1 
lo      loopback  unmanaged  --  

[RHEL-8.4:root@host ~]# nmcli con mod 
filename              id                    System\ eth0          uuid                  
help                  path                  --temporary           Wired\ connection\ 1

Target the connection, as the command at the top of this comment does.