Configuring and managing networking

Red Hat Enterprise Linux 9.0 Beta

A guide to configuring and managing networking in Red Hat Enterprise Linux 9

Red Hat Customer Content Services

Abstract

This document describes how to manage networking on Red Hat Enterprise Linux 9.

RHEL Beta release

Red Hat provides Red Hat Enterprise Linux Beta access to all subscribed Red Hat accounts. The purpose of Beta access is to:

  • Provide an opportunity to customers to test major features and capabilities prior to the general availability release and provide feedback or report issues.
  • Provide Beta product documentation as a preview. Beta product documentation is under development and is subject to substantial change.

Note that Red Hat does not support the usage of RHEL Beta releases in production use cases. For more information, see What does Beta mean in Red Hat Enterprise Linux and can I upgrade a RHEL Beta installation to a General Availability (GA) release?.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see our CTO Chris Wright’s message.

Providing feedback on Red Hat documentation

We appreciate your input on our documentation. Please let us know how we could make it better. To do so:

  • For simple comments on specific passages:

    1. Make sure you are viewing the documentation in the Multi-page HTML format. In addition, ensure you see the Feedback button in the upper right corner of the document.
    2. Use your mouse cursor to highlight the part of text that you want to comment on.
    3. Click the Add Feedback pop-up that appears below the highlighted text.
    4. Follow the displayed instructions.
  • For submitting more complex feedback, create a Bugzilla ticket:

    1. Go to the Bugzilla website.
    2. As the Component, use Documentation.
    3. Fill in the Description field with your suggestion for improvement. Include a link to the relevant part(s) of documentation.
    4. Click Submit Bug.

Chapter 1. Consistent network interface device naming

Red Hat Enterprise Linux provides methods for consistent and predictable device naming for network interfaces. These features help locating and differentiating network interfaces.

The kernel assigns names to network interfaces by concatenating a fixed prefix and a number that increases as the kernel initialize the network devices. For instance, eth0 would represent the first device being probed on start-up. However, these names do not necessarily correspond to labels on the chassis. Modern server platforms with multiple network adapters can encounter non-deterministic and counter-intuitive naming of these interfaces. This affects both network adapters embedded on the system board and add-in adapters.

In Red Hat Enterprise Linux, the udev device manager supports a number of different naming schemes. By default, udev assigns fixed names based on firmware, topology, and location information. This has the following advantages:

  • Device names are fully predictable.
  • Device names stay fixed even if you add or remove hardware, because no re-enumeration takes places.
  • Defective hardware can be seamlessly replaced.

1.1. Network interface device naming hierarchy

If consistent device naming is enabled, which is the default in Red Hat Enterprise Linux, the udev device manager generates device names based on the following schemes:

SchemeDescriptionExample

1

Device names incorporate firmware or BIOS-provided index numbers for onboard devices. If this information is not available or applicable, udev uses scheme 2.

eno1

2

Device names incorporate firmware or BIOS-provided PCI Express (PCIe) hot plug slot index numbers. If this information is not available or applicable, udev uses scheme 3.

ens1

3

Device names incorporate the physical location of the connector of the hardware. If this information is not available or applicable, udev uses scheme 5.

enp2s0

4

Device names incorporate the MAC address. Red Hat Enterprise Linux does not use this scheme by default, but administrators can optionally use it.

enx525400d5e0fb

5

The traditional unpredictable kernel naming scheme. If udev cannot apply any of the other schemes, the device manager uses this scheme.

eth0

By default, Red Hat Enterprise Linux selects the device name based on the NamePolicy setting in the /usr/lib/systemd/network/99-default.link file. The order of the values in NamePolicy is important. Red Hat Enterprise Linux uses the first device name that is both specified in the file and that udev generated.

If you manually configured udev rules to change the name of kernel devices, those rules take precedence.

1.2. How the network device renaming works

By default, consistent device naming is enabled in Red Hat Enterprise Linux. The udev device manager processes different rules to rename the devices. The following list describes the order in which udev processes these rules and what actions these rules are responsible for:

  1. The /usr/lib/udev/rules.d/60-net.rules file defines that the /lib/udev/rename_device helper utility searches for the HWADDR parameter in /etc/sysconfig/network-scripts/ifcfg-* files. If the value set in the variable matches the MAC address of an interface, the helper utility renames the interface to the name set in the DEVICE parameter of the file.
  2. The /usr/lib/udev/rules.d/71-biosdevname.rules file defines that the biosdevname utility renames the interface according to its naming policy, provided that it was not renamed in the previous step.
  3. The /usr/lib/udev/rules.d/75-net-description.rules file defines that udev examines the network interface device and sets the properties in udev-internal variables, that will be processed in the next step. Note that some of these properties might be undefined.
  4. The /usr/lib/udev/rules.d/80-net-setup-link.rules file calls the net_setup_link udev built-in which then applies the policy. The following is the default policy that is stored in the /usr/lib/systemd/network/99-default.link file:

    [Link]
    NamePolicy=kernel database onboard slot path
    MACAddressPolicy=persistent

    With this policy, if the kernel uses a persistent name, udev does not rename the interface. If the kernel does not use a persistent name, udev renames the interface to the name provided by the hardware database of udev. If this database is not available, Red Hat Enterprise Linux falls back to the mechanisms described above.

    Alternatively, set the NamePolicy parameter in this file to mac for media access control (MAC) address-based interface names.

  5. The /usr/lib/udev/rules.d/80-net-setup-link.rules file defines that udev renames the interface based on the udev-internal parameters in the following order:

    1. ID_NET_NAME_ONBOARD
    2. ID_NET_NAME_SLOT
    3. ID_NET_NAME_PATH

    If one parameter is not set, udev uses the next one. If none of the parameters are set, the interface is not renamed.

Steps 3 and 4 implement the naming schemes 1 to 4 described in Network interface device naming hierarchy.

Additional resources

1.3. Predictable network interface device names on the x86_64 platform explained

When the consistent network device name feature is enabled, the udev device manager creates the names of devices based on different criteria. This section describes the naming scheme when Red Hat Enterprise Linux is installed on a x86_64 platform.

The interface name starts with a two-character prefix based on the type of interface:

  • en for Ethernet
  • wl for wireless LAN (WLAN)
  • ww for wireless wide area network (WWAN)

Additionally, one of the following is appended to one of the above-mentioned prefix based on the schema the udev device manager applies:

  • o<on-board_index_number>
  • s<hot_plug_slot_index_number>[f<function>][d<device_id>]

    Note that all multi-function PCI devices have the [f<function>] number in the device name, including the function 0 device.

  • x<MAC_address>
  • [P<domain_number>]p<bus>s<slot>[f<function>][d<device_id>]

    The [P<domain_number>] part defines the PCI geographical location. This part is only set if the domain number is not 0.

  • [P<domain_number>]p<bus>s<slot>[f<function>][u<usb_port>][…​][c<config>][i<interface>]

    For USB devices, the full chain of port numbers of hubs is composed. If the name is longer than the maximum (15 characters), the name is not exported. If there are multiple USB devices in the chain, udev suppresses the default values for USB configuration descriptors (c1) and USB interface descriptors (i0).

1.4. Predictable network interface device names on the System z platform explained

When the consistent network device name feature is enabled, the udev device manager on the System z platform creates the names of devices based on the bus ID. The bus ID identifies a device in the s390 channel subsystem.

For a channel command word (CCW) device, the bus ID is the device number with a leading 0.n prefix where n is the subchannel set ID.

Ethernet interfaces are named, for example, enccw0.0.1234. Serial Line Internet Protocol (SLIP) channel-to-channel (CTC) network devices are named, for example, slccw0.0.1234.

Use the znetconf -c or the lscss -a commands to display available network devices and their bus IDs.

1.5. Disabling consistent interface device naming during the installation

This section describes how to disable consistent interface device naming during the installation.

Warning

Red Hat recommends not to disable consistent device naming and does not support this feature on hosts with more than one network interface. Disabling consistent device naming can cause different kind of problems. For example, if you add another network interface card to the system, the assignment of the kernel device names, such as eth0, is no longer fixed. Consequently, after a reboot, the Kernel can name the device differently.

Procedure

  1. Boot the Red Hat Enterprise Linux 9 installation media.
  2. In the boot manager, select Install Red Hat Enterprise Linux 9, and press the Tab key to edit the entry.
  3. Append the net.ifnames=0 parameter to the kernel command line:

    vmlinuz... net.ifnames=0
  4. Press Enter to start the installation.

1.6. Disabling consistent interface device naming on an installed system

This section describes how to disable consistent interface device naming on a RHEL system that is already installed.

Warning

Red Hat recommends not to disable consistent device naming and does not support this feature on hosts with more than one network interface. Disabling consistent device naming can cause different kinds of problems. For example, if you add another network interface card to the system, the assignment of the kernel device names, such as eth0, is no longer fixed. Consequently, after a reboot, the Kernel can name the device differently.

Prerequisites

  • The system uses consistent interface device naming, which is the default.

Procedure

  1. Edit the /etc/default/grub file and append the net.ifnames=0 parameter to the GRUB_CMDLINE_LINUX variable:

    GRUB_CMDLINE_LINUX="... net.ifnames=0"
  2. Rebuild the grub.cfg file:

    • On a system with UEFI boot mode:

      # grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg
    • On a system with legacy boot mode:

      # grub2-mkconfig -o /boot/grub2/grub.cfg
  3. Display the current profile names and the associated device names:

    # nmcli -f NAME,DEVICE,FILENAME connection show
    NAME           DEVICE  FILENAME
    System enp1s0  enp1s0  /etc/sysconfig/network-scripts/ifcfg-enp1s0
    System enp7s0  enp7s0  /etc/NetworkManager/system-connections/enp7s0.nmconnection

    Note which profile name and configuration file is associated with each device.

  4. Remove HWADDR parameters from all connection profiles:

    # sed -i '/^HWADDR=/d' /etc/sysconfig/network-scripts/ifcfg-enp1s0 /etc/NetworkManager/system-connections/enp7s0.nmconnection
  5. Display the MAC addresses that are associated with the Ethernet devices:

    # ip link show
    ...
    2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
        link/ether 00:53:00:c5:98:1c brd ff:ff:ff:ff:ff:ff
    3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
        link/ether 00:53:00:b6:87:c6 brd ff:ff:ff:ff:ff:ff
  6. Reboot the host:

    # reboot
  7. After the reboot, display the Ethernet devices and identify the new interface name based on the MAC address:

    # ip link show
    ...
    2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
        link/ether 00:53:00:b6:87:c6 brd ff:ff:ff:ff:ff:ff
    3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
        link/ether 00:53:00:c5:98:1c brd ff:ff:ff:ff:ff:ff

    If you compare the current output with the previous one:

    • Interface enp7s0 (MAC address 00:53:00:b6:87:c6) is now named eth0.
    • Interface enp1s0 (MAC address 00:53:00:c5:98:1c) is now named eth1.
  8. Rename the configuration file:

    # mv /etc/NetworkManager/system-connections/enp7s0.nmconnection /etc/NetworkManager/system-connections/eth0.nmconnection
    # mv /etc/sysconfig/network-scripts/ifcfg-enp1s0 /etc/sysconfig/network-scripts/ifcfg-eth1
  9. Reload NetworkManager:

    # nmcli connection reload
  10. If no profile name is set in the configuration files, NetworkManager uses a default value. To determine the current profile name after you renamed and reloaded the connections, enter:

    # nmcli -f NAME,DEVICE,FILENAME connection show
    NAME           FILENAME
    System enp7s0  /etc/NetworkManager/system-connections/eth0.nmconnection
    System enp1s0  /etc/sysconfig/network-scripts/ifcfg-eth1

    You require the profile names in the next step.

  11. Rename the NetworkManager connection profiles and update the interface name in each profile:

    # nmcli connection modify "System enp7s0" connection.id eth0 connection.interface-name eth0
    # nmcli connection modify "System enp1s0" connection.id eth1 connection.interface-name eth1
  12. Reactivate the NetworkManager connections:

    # nmcli connection up eth0
    # nmcli connection up eth1

1.7. Customizing the prefix of Ethernet interfaces

You can customize the prefix of Ethernet interface names during the Red Hat Enterprise Linux installation.

Important

Red Hat does not support customizing the prefix using the prefixdevname utility on already deployed systems.

After the RHEL installation, the udev service names Ethernet devices <prefix>.<index>. For example, if you select the prefix net, RHEL names Ethernet interfaces net0, net1, and so on.

Prerequisites

  • The prefix you want to set meets the following requirements:

    • It consists of ASCII characters.
    • It is an alpha-numeric string.
    • It is shorter than 16 characters.
    • It does not conflict with any other well-known prefix used for network interface naming, such as eth, eno, ens, and em.

Procedure

  1. Boot the Red Hat Enterprise Linux installation media.
  2. In the boot manager:

    1. Select the Install Red Hat Enterprise Linux <version> entry, and press Tab to edit the entry.
    2. Append net.ifnames.prefix=<prefix> to the kernel options.
    3. Press Enter to start the installer.
  3. Install Red Hat Enterprise Linux.

Verification

  • After the installation, display the Ethernet interfaces:

    # ip link show
    ...
    2: net0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
        link/ether 00:53:00:c5:98:1c brd ff:ff:ff:ff:ff:ff
    3: net1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
        link/ether 00:53:00:c2:39:9e brd ff:ff:ff:ff:ff:ff
    ...

1.8. Additional resources

  • See the udev(7) man page for details about the udev device manager.

Chapter 2. Getting started with NetworkManager

By default, RHEL uses NetworkManager to manage the network configuration and connections.

2.1. Benefits of using NetworkManager

The main benefits of using NetworkManager are:

  • Offering an API through D-Bus which allows to query and control network configuration and state. In this way, networking can be checked and configured by multiple applications ensuring a synced and up-to-date networking status. For example, the RHEL web console, which monitors and configures servers through a web browser, uses the NetworkManager D-BUS interface to configure networking, as well as the Gnome GUI, the nmcli and the nm-connection-editor tools. Each change made in one of these tools is detected by all the others.
  • Making Network management easier: NetworkManager ensures that network connectivity works. When it detects that there is no network configuration in a system but there are network devices, NetworkManager creates temporary connections to provide connectivity.
  • Providing easy setup of connection to the user: NetworkManager offers management through different tools — GUI, nmtui, nmcli.
  • Supporting configuration flexibility. For example, configuring a WiFi interface, NetworkManager scans and shows the available wifi networks. You can select an interface, and NetworkManager displays the required credentials providing automatic connection after the reboot process. NetworkManager can configure network aliases, IP addresses, static routes, DNS information, and VPN connections, as well as many connection-specific parameters. You can modify the configuration options to reflect your needs.
  • Maintaining the state of devices after the reboot process and taking over interfaces which are set into managed mode during restart.
  • Handling devices which are not explicitly set unmanaged but controlled manually by the user or another network service.

2.2. An overview of utilities and applications you can use to manage NetworkManager connections

You can use the following utilities and applications to manage NetworkManager connections:

  • nmcli: A command-line utility to manage connections.
  • nmtui: A curses-based text user interface (TUI). To use this application, install the NetworkManager-tui package.
  • nm-connection-editor: A graphical user interface (GUI) for NetworkManager-related tasks. To start this application, enter nm-connection-editor in a terminal of a GNOME session.
  • control-center: A GUI provided by the GNOME shell for desktop users. Note that this application supports less features than nm-connection-editor.
  • The network connection icon in the GNOME shell: This icon represents network connection states and serves as visual indicator for the type of connection you are using.

Chapter 3. Configuring NetworkManager to ignore certain devices

By default, NetworkManager manages all devices except the lo (loopback) device. However, you can set certain devices as unmanaged to configure that NetworkManager ignores these devices. With this setting, you can manually manage these devices, for example, using a script.

3.1. Permanently configuring a device as unmanaged in NetworkManager

You can configure devices as unmanaged based on several criteria, such as the interface name, MAC address, or device type. This procedure describes how to permanently set the enp1s0 interface as unmanaged in NetworkManager.

To temporarily configure network devices as unmanaged, see Temporarily configuring a device as unmanaged in NetworkManager.

Procedure

  1. Optional: Display the list of devices to identify the device you want to set as unmanaged:

    # nmcli device status
    DEVICE  TYPE      STATE         CONNECTION
    enp1s0  ethernet  disconnected  --
    ...
  2. Create the /etc/NetworkManager/conf.d/99-unmanaged-devices.conf file with the following content:

    [keyfile]
    unmanaged-devices=interface-name:enp1s0

    To set multiple devices as unmanaged, separate the entries in the unmanaged-devices parameter with semicolon:

    [keyfile]
    unmanaged-devices=interface-name:interface_1;interface-name:interface_2;...
  3. Reload the NetworkManager service:

    # systemctl reload NetworkManager

Verification steps

  • Display the list of devices:

    # nmcli device status
    DEVICE  TYPE      STATE      CONNECTION
    enp1s0  ethernet  unmanaged  --
    ...

    The unmanaged state next to the enp1s0 device indicates that NetworkManager does not manage this device.

Additional resources

  • The Device List Format section in the NetworkManager.conf(5) man page.

3.2. Temporarily configuring a device as unmanaged in NetworkManager

You can configure devices as unmanaged based on several criteria, such as the interface name, MAC address, or device type. This procedure describes how to temporarily set the enp1s0 interface as unmanaged in NetworkManager.

Use this method, for example, for testing purposes. To permanently configure network devices as unmanaged, see Permanently configuring a device as unmanaged in NetworkManager.

Use this method, for example, for testing purposes. To permanently configure network devices as unmanaged, see the Permanently configuring a device as unmanaged in NetworkManager section in the Configuring and managing networking documentation.

Procedure

  1. Optional: Display the list of devices to identify the device you want to set as unmanaged:

    # nmcli device status
    DEVICE  TYPE      STATE         CONNECTION
    enp1s0  ethernet  disconnected  --
    ...
  2. Set the enp1s0 device to the unmanaged state:

    # nmcli device set enp1s0 managed no

Verification steps

  • Display the list of devices:

    # nmcli device status
    DEVICE  TYPE      STATE      CONNECTION
    enp1s0  ethernet  unmanaged  --
    ...

    The unmanaged state next to the enp1s0 device indicates that NetworkManager does not manage this device.

Additional resources

  • The Device List Format section in the NetworkManager.conf(5) man page

Chapter 4. Using nmtui to manage network connections using a text-based interface

The nmtui application is a text user interface (TUI) for NetworkManager. The following section provides how you can configure a network interface using nmtui.

Note

The nmtui application does not support all connection types. In particular, you cannot add or modify VPN connections or Ethernet connections that require 802.1X authentication.

4.1. Starting the nmtui utility

This procedure describes how to start the NetworkManager text user interface, nmtui.

Prerequisites

  • The NetworkManager-tui package is installed.

Procedure

  1. To start nmtui, enter:

    # nmtui
    nmtui Select an Option
  2. To navigate:

    • Use the cursors or press Tab to step forwards and press Shift+Tab to step back through the options.
    • Use Enter to select an option.
    • Use the Space bar to toggle the status of check boxes.

4.2. Adding a connection profile using nmtui

The nmtui application provides a text user interface to NetworkManager. This procedure describes how to add a new connection profile.

Prerequisites

  • The NetworkManager-tui package is installed.

Procedure

  1. Start the NetworkManager text user interface utility:

    # nmtui
  2. Select the Edit a connection menu entry, and press Enter.
  3. Select the Add button, and press Enter.
  4. Select Ethernet, and press Enter.
  5. Fill the fields with the connection details.

    add connection in nmtui
  6. Select OK to save the changes.
  7. Select Back to return to the main menu.
  8. Select Activate a connection, and press Enter.
  9. Select the new connection entry, and press Enter to activate the connection.
  10. Select Back to return to the main menu.
  11. Select Quit.

Verification steps

  1. Display the status of the devices and connections:

    # nmcli device status
    DEVICE      TYPE      STATE      CONNECTION
    enp1s0      ethernet  connected  Example-Connection
  2. To display all settings of the connection profile:

    # nmcli connection show Example-Connection
    connection.id:              Example-Connection
    connection.uuid:            b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76
    connection.stable-id:       --
    connection.type:            802-3-ethernet
    connection.interface-name:  enp1s0
    ...

    If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service.

    Additional resources

4.3. Applying changes to a modified connection using nmtui

After you modified a connection in nmtui, you must reactivate the connection. Note that reactivating a connection in nmtui temporarily deactivates the connection.

Procedure

  1. In the main menu, select the Activate a connection menu entry:

    nmtui Activate a Connection
  2. Select the modified connection.
  3. On the right, select the Deactivate button, and press Enter:

    nmtui Deactivate a Modified Connection
  4. Select the connection again.
  5. On the right, select the Activate button, and press Enter:

    nmtui Activate a Modified Connection

Chapter 5. Getting started with nmcli

This section describes general information about the nmcli utility.

5.1. The different output formats of nmcli

The nmcli utility supports different options to modify the output of nmcli commands. Using these options, you can display only the required information. This simplifies processing the output in scripts.

By default, the nmcli utility displays its output in a table-like format:

# nmcli device
DEVICE  TYPE      STATE      CONNECTION
enp1s0  ethernet  connected  enp1s0
lo      loopback  unmanaged  --

Using the -f option, you can display specific columns in a custom order. For example, to display only the DEVICE and STATE column, enter:

# nmcli -f DEVICE,STATE device
DEVICE  STATE
enp1s0  connected
lo      unmanaged

The -t option enables you to display the individual fields of the output in a colon-separated format:

# nmcli -t device
enp1s0:ethernet:connected:enp1s0
lo:loopback:unmanaged:

Combining the -f and -t to display only specific fields in colon-separated format can be helpful when you process the output in scripts:

# nmcli -f DEVICE,STATE -t device
enp1s0:connected
lo:unmanaged

5.2. Using tab completion in nmcli

If the bash-completion package is installed on your host, the nmcli utility supports tab completion. This enables you to auto-complete option names and to identify possible options and values.

For example, if you type nmcli con and press Tab, then the shell automatically completes the command to nmcli connection.

For the completion, the options or value you have typed must be unique. If it is not unique, then nmcli displays all possibilities. For example, if you type nmcli connection d and press Tab, then the command shows command delete and down as possible options.

You can also use tab completion to display all properties you can set in a connection profile. For example, if you type nmcli connection modify connection_name and press Tab, the command shows the full list of available properties.

5.3. Frequent nmcli commands

The following is an overview about frequently-used nmcli commands.

  • To display the list connection profiles, enter:

    # nmcli connection show
    NAME    UUID                                  TYPE      DEVICE
    enp1s0  45224a39-606f-4bf7-b3dc-d088236c15ee  ethernet  enp1s0
  • To display the settings of a specific connection profile, enter:

    # nmcli connection show connection_name
    connection.id:             enp1s0
    connection.uuid:           45224a39-606f-4bf7-b3dc-d088236c15ee
    connection.stable-id:      --
    connection.type:           802-3-ethernet
    ...
  • To modify properties of a connection, enter:

    # nmcli connection modify connection_name property value

    You can modify multiple properties using a single command if you pass multiple property value combinations to the command.

  • To display the list of network devices, their state, and which connection profiles use the device, enter:

    # nmcli device
    DEVICE  TYPE      STATE         CONNECTION
    enp1s0  ethernet  connected     enp1s0
    enp8s0  ethernet  disconnected  --
    enp7s0  ethernet  unmanaged     --
    ...
  • To activate a connection, enter:

    # nmcli connection up connection_name
  • To deactivate a connection, enter:

    # nmcli connection down connection_name

Chapter 6. Configuring an Ethernet connection

This section describes different ways how to configure an Ethernet connection with static and dynamic IP addresses.

6.1. Configuring a static Ethernet connection using nmcli

This procedure describes adding an Ethernet connection with the following settings using the nmcli utility:

  • A static IPv4 address - 192.0.2.1 with a /24 subnet mask
  • A static IPv6 address - 2001:db8:1::1 with a /64 subnet mask
  • An IPv4 default gateway - 192.0.2.254
  • An IPv6 default gateway - 2001:db8:1::fffe
  • An IPv4 DNS server - 192.0.2.200
  • An IPv6 DNS server - 2001:db8:1::ffbb
  • A DNS search domain - example.com

Procedure

  1. Add a new NetworkManager connection profile for the Ethernet connection:

    # nmcli connection add con-name Example-Connection ifname enp7s0 type ethernet

    The further steps modify the Example-Connection connection profile you created.

  2. Set the IPv4 address:

    # nmcli connection modify Example-Connection ipv4.addresses 192.0.2.1/24
  3. Set the IPv6 address:

    # nmcli connection modify Example-Connection ipv6.addresses 2001:db8:1::1/64
  4. Set the IPv4 and IPv6 connection method to manual:

    # nmcli connection modify Example-Connection ipv4.method manual
    # nmcli connection modify Example-Connection ipv6.method manual
  5. Set the IPv4 and IPv6 default gateways:

    # nmcli connection modify Example-Connection ipv4.gateway 192.0.2.254
    # nmcli connection modify Example-Connection ipv6.gateway 2001:db8:1::fffe
  6. Set the IPv4 and IPv6 DNS server addresses:

    # nmcli connection modify Example-Connection ipv4.dns "192.0.2.200"
    # nmcli connection modify Example-Connection ipv6.dns "2001:db8:1::ffbb"

    To set multiple DNS servers, specify them space-separated and enclosed in quotes.

  7. Set the DNS search domain for the IPv4 and IPv6 connection:

    # nmcli connection modify Example-Connection ipv4.dns-search example.com
    # nmcli connection modify Example-Connection ipv6.dns-search example.com
  8. Activate the connection profile:

    # nmcli connection up Example-Connection
    Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/13)

Verification steps

  1. Display the status of the devices and connections:

    # nmcli device status
    DEVICE      TYPE      STATE      CONNECTION
    enp7s0      ethernet  connected  Example-Connection
  2. To display all settings of the connection profile:

    # nmcli connection show Example-Connection
    connection.id:              Example-Connection
    connection.uuid:            b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76
    connection.stable-id:       --
    connection.type:            802-3-ethernet
    connection.interface-name:  enp7s0
    ...
  3. Use the ping utility to verify that this host can send packets to other hosts.

    • Ping an IP address in the same subnet.

      For IPv4:

      # ping 192.0.2.3

      For IPv6:

      # ping 2001:db8:2::1

      If the command fails, verify the IP and subnet settings.

    • Ping an IP address in a remote subnet.

      For IPv4:

      # ping 198.162.3.1

      For IPv6:

      # ping 2001:db8:2::1
      • If the command fails, ping the default gateway to verify settings.

        For IPv4:

        # ping 192.0.2.254

        For IPv6:

        # ping 2001:db8:1::fffe
  4. Use the host utility to verify that name resolution works. For example:

    # host client.example.com

    If the command returns any error, such as connection timed out or no servers could be reached, verify your DNS settings.

Troubleshooting steps

  1. If the connection fails or if the network interface switches between an up and down status:

    • Make sure that the network cable is plugged-in to the host and a switch.
    • Check whether the link failure exists only on this host or also on other hosts connected to the same switch the server is connected to.
    • Verify that the network cable and the network interface are working as expected. Perform hardware diagnosis steps and replace defect cables and network interface cards.
    • If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service

Additional resources

6.2. Configuring a static Ethernet connection using the nmcli interactive editor

This procedure describes adding an Ethernet connection with the following settings using the nmcli interactive mode:

  • A static IPv4 address - 192.0.2.1 with a /24 subnet mask
  • A static IPv6 address - 2001:db8:1::1 with a /64 subnet mask
  • An IPv4 default gateway - 192.0.2.254
  • An IPv6 default gateway - 2001:db8:1::fffe
  • An IPv4 DNS server - 192.0.2.200
  • An IPv6 DNS server - 2001:db8:1::ffbb
  • A DNS search domain - example.com

Procedure

  1. To add a new NetworkManager connection profile for the Ethernet connection, and starting the interactive mode, enter:

    # nmcli connection edit type ethernet con-name Example-Connection
  2. Set the network interface:

    nmcli> set connection.interface-name enp7s0
  3. Set the IPv4 address:

    nmcli> set ipv4.addresses 192.0.2.1/24
  4. Set the IPv6 address:

    nmcli> set ipv6.addresses 2001:db8:1::1/64
  5. Set the IPv4 and IPv6 connection method to manual:

    nmcli> set ipv4.method manual
    nmcli> set ipv6.method manual
  6. Set the IPv4 and IPv6 default gateways:

    nmcli> set ipv4.gateway 192.0.2.254
    nmcli> set ipv6.gateway 2001:db8:1::fffe
  7. Set the IPv4 and IPv6 DNS server addresses:

    nmcli> set ipv4.dns 192.0.2.200
    nmcli> set ipv6.dns 2001:db8:1::ffbb

    To set multiple DNS servers, specify them space-separated and enclosed in quotes.

  8. Set the DNS search domain for the IPv4 and IPv6 connection:

    nmcli> set ipv4.dns-search example.com
    nmcli> set ipv6.dns-search example.com
  9. Save and activate the connection:

    nmcli> save persistent
    Saving the connection with 'autoconnect=yes'. That might result in an immediate activation of the connection.
    Do you still want to save? (yes/no) [yes] yes
  10. Leave the interactive mode:

    nmcli> quit

Verification steps

  1. Display the status of the devices and connections:

    # nmcli device status
    DEVICE      TYPE      STATE      CONNECTION
    enp7s0      ethernet  connected  Example-Connection
  2. To display all settings of the connection profile:

    # nmcli connection show Example-Connection
    connection.id:              Example-Connection
    connection.uuid:            b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76
    connection.stable-id:       --
    connection.type:            802-3-ethernet
    connection.interface-name:  enp7s0
    ...
  3. Use the ping utility to verify that this host can send packets to other hosts.

    • Ping an IP address in the same subnet.

      For IPv4:

      # ping 192.0.2.3

      For IPv6:

      # ping 2001:db8:2::1

      If the command fails, verify the IP and subnet settings.

    • Ping an IP address in a remote subnet.

      For IPv4:

      # ping 198.162.3.1

      For IPv6:

      # ping 2001:db8:2::1
      • If the command fails, ping the default gateway to verify settings.

        For IPv4:

        # ping 192.0.2.254

        For IPv6:

        # ping 2001:db8:1::fffe
  4. Use the host utility to verify that name resolution works. For example:

    # host client.example.com

    If the command returns any error, such as connection timed out or no servers could be reached, verify your DNS settings.

Troubleshooting steps

  1. If the connection fails or if the network interface switches between an up and down status:

    • Make sure that the network cable is plugged-in to the host and a switch.
    • Check whether the link failure exists only on this host or also on other hosts connected to the same switch the server is connected to.
    • Verify that the network cable and the network interface are working as expected. Perform hardware diagnosis steps and replace defect cables and network interface cards.

If the configuration on the disk does not match the configuration on the device, starting or restarting NetworkManager creates an in-memory connection that reflects the configuration of the device. For further details and how to avoid this problem, see NetworkManager duplicates a connection after restart of NetworkManager service

Additional resources

6.3. Configuring a static Ethernet connection using nmstatectl

This procedure describes how to configure an Ethernet connection for the enp7s0 device with the following settings using the nmstatectl utility:

  • A static IPv4 address - 192.0.2.1 with the /24 subnet mask
  • A static IPv6 address - 2001:db8:1::1 with the /64 subnet mask
  • An IPv4 default gateway - 192.0.2.254
  • An IPv6 default gateway - 2001:db8:1::fffe
  • An IPv4 DNS server - 192.0.2.200
  • An IPv6 DNS server - 2001:db8:1::ffbb
  • A DNS search domain - example.com

The nmstatectl utility ensures that, after setting the configuration, the result matches the configuration file. If anything fails, nmstatectl automatically rolls back the changes to avoid leaving the system in an incorrect state.

The procedure defines the interface configuration in YAML format. Alternatively, you can also specify the configuration in JSON format.

Prerequisites

  • The nmstate package is installed.

Procedure

  1. Create a YAML file, for example ~/create-ethernet-profile.yml, with the following contents:

    ---
    interfaces:
    - name: enp7s0
      type: ethernet
      state: up
      ipv4:
        enabled: true
        address:
        - ip: 192.0.2.1
          prefix-length: 24
        dhcp: false
      ipv6:
        enabled: true
        address:
        - ip: 2001:db8:1::1
          prefix-length: 64
        autoconf: false
        dhcp: false
    routes:
      config:
      - destination: 0.0.0.0/0
        next-hop-address: 192.0.2.254
        next-hop-interface: enp7s0
      - destination: ::/0
        next-hop-address: 2001:db8:1::fffe
        next-hop-interface: enp7s0
    dns-resolver:
      config:
        search:
        - example.com
        server:
        - 192.0.2.200
        - 2001:db8:1::ffbb
  2. Apply the settings to the system:

    # nmstatectl apply ~/create-ethernet-profile.yml

Verification steps

  1. Display the status of the devices and connections:

    # nmcli device status
    DEVICE      TYPE      STATE      CONNECTION
    enp7s0      ethernet  connected  enp7s0
  2. Display all settings of the connection profile:

    # nmcli connection show enp7s0
    connection.id:              enp7s0
    connection.uuid:            b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76
    connection.stable-id:       --
    connection.type:            802-3-ethernet
    connection.interface-name:  enp7s0
    ...
  3. Display the connection settings in YAML format:

    # nmstatectl show enp7s0

Additional resources

  • nmstatectl(8) man page
  • /usr/share/doc/nmstate/examples/

6.4. Configuring a static Ethernet connection using RHEL System Roles with the interface name

This procedure describes how to use RHEL System roles to remotely add an Ethernet connection for the enp7s0 interface with the following settings by running an Ansible playbook:

  • A static IPv4 address - 192.0.2.1 with a /24 subnet mask
  • A static IPv6 address - 2001:db8:1::1 with a /64 subnet mask
  • An IPv4 default gateway - 192.0.2.254
  • An IPv6 default gateway - 2001:db8:1::fffe
  • An IPv4 DNS server - 192.0.2.200
  • An IPv6 DNS server - 2001:db8:1::ffbb
  • A DNS search domain - example.com

Run this procedure on the Ansible control node.

Prerequisites

  • The ansible-core and rhel-system-roles packages are installed on the control node.
  • If you use a different remote user than root when you run the playbook, this user has appropriate sudo permissions on the managed node.
  • The host uses NetworkManager to configure the network.

Procedure

  1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

    node.example.com
  2. Create the ~/ethernet-static-IP.yml playbook with the following content:

    ---
    - name: Configure an Ethernet connection with static IP
      hosts: node.example.com
      become: true
      tasks:
      - include_role:
          name: linux-system-roles.network
    
        vars:
          network_connections:
            - name: enp7s0
    	  interface_name: enp7s0
              type: ethernet
              autoconnect: yes
              ip:
                address:
                  - 192.0.2.1/24
                  - 2001:db8:1::1/64
                gateway4: 192.0.2.254
                gateway6: 2001:db8:1::fffe
                dns:
                  - 192.0.2.200
                  - 2001:db8:1::ffbb
                dns_search:
                  - example.com
              state: up
  3. Run the playbook:

    • To connect as root user to the managed host, enter:

      # ansible-playbook -u root ~/ethernet-static-IP.yml
    • To connect as a user to the managed host, enter:

      # ansible-playbook -u user_name --ask-become-pass ~/ethernet-static-IP.yml

      The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

    If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Additional resources

  • /usr/share/ansible/roles/rhel-system-roles.network/README.md
  • ansible-playbook(1) man page

6.5. Configuring a static Ethernet connection using RHEL System Roles with a device path

This procedure describes how to use RHEL System roles to remotely add an Ethernet connection with static IP address for devices that match a specific device path by running an Ansible playbook.

You can identify the device path with the following command:

# udevadm info /sys/class/net/<device_name> | grep ID_PATH=

This procedure sets the following settings to the device that matches the PCI ID 0000:00:0[1-3].0 expression, but not 0000:00:02.0:

  • A static IPv4 address - 192.0.2.1 with a /24 subnet mask
  • A static IPv6 address - 2001:db8:1::1 with a /64 subnet mask
  • An IPv4 default gateway - 192.0.2.254
  • An IPv6 default gateway - 2001:db8:1::fffe
  • An IPv4 DNS server - 192.0.2.200
  • An IPv6 DNS server - 2001:db8:1::ffbb
  • A DNS search domain - example.com

Run this procedure on the Ansible control node.

Prerequisites

  • The ansible-core and rhel-system-roles packages are installed on the control node.
  • If you use a different remote user than root when you run the playbook, this user has appropriate sudo permissions on the managed node.
  • The host uses NetworkManager to configure the network.

Procedure

  1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

    node.example.com
  2. Create the ~/ethernet-dynamic-IP.yml playbook with the following content:

    ---
    - name: Configure an Ethernet connection with dynamic IP
      hosts: node.example.com
      become: true
      tasks:
      - include_role:
          name: linux-system-roles.network
    
        vars:
          network_connections:
            - name: example
    	  match:
    	    path:
    	      - pci-0000:00:0[1-3].0
    	      - &!pci-0000:00:02.0
              type: ethernet
              autoconnect: yes
              ip:
                address:
                  - 192.0.2.1/24
                  - 2001:db8:1::1/64
                gateway4: 192.0.2.254
                gateway6: 2001:db8:1::fffe
                dns:
                  - 192.0.2.200
                  - 2001:db8:1::ffbb
                dns_search:
                  - example.com
              state: up

    The match parameter in this example defines that Ansible applies the play to devices that match PCI ID 0000:00:0[1-3].0, but not 0000:00:02.0. For further details about special modifiers and wild cards you can use, see the match parameter description in the /usr/share/ansible/roles/rhel-system-roles.network/README.md file.

  3. Run the playbook:

    • To connect as root user to the managed host, enter:

      # ansible-playbook -u root ~/ethernet-dynamic-IP.yml
    • To connect as a user to the managed host, enter:

      # ansible-playbook -u user_name --ask-become-pass ~/ethernet-dynamic-IP.yml

      The --ask-become-pass option makes sure that the ansible-playbook command promptsv for the sudo password of the user defined in the -u user_name option.

    If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Additional resources

  • /usr/share/ansible/roles/rhel-system-roles.network/README.md file
  • ansible-playbook(1) man page

6.6. Configuring a dynamic Ethernet connection using nmcli

This procedure describes adding an dynamic Ethernet connection using the nmcli utility. With this setting, NetworkManager requests the IP settings for this connection from a DHCP server.

Prerequisites

  • A DHCP server is available in the network.

Procedure

  1. Add a new NetworkManager connection profile for the Ethernet connection:

    # nmcli connection add con-name Example-Connection ifname enp7s0 type ethernet
  2. Optionally, change the host name NetworkManager sends to the DHCP server when using the Example-Connection profile:

    # nmcli connection modify Example-Connection ipv4.dhcp-hostname Example ipv6.dhcp-hostname Example
  3. Optionally, change the client ID NetworkManager sends to an IPv4 DHCP server when using the Example-Connection profile:

    # nmcli connection modify Example-Connection ipv4.dhcp-client-id client-ID

    Note that there is no dhcp-client-id parameter for IPv6. To create an identifier for IPv6, configure the dhclient service.

Verification steps

  1. Display the status of the devices and connections:

    # nmcli device status
    DEVICE      TYPE      STATE      CONNECTION
    enp7s0      ethernet  connected  Example-Connection
  2. To display all settings of the connection profile:

    # nmcli connection show Example-Connection
    connection.id:              Example-Connection
    connection.uuid:            b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76
    connection.stable-id:       --
    connection.type:            802-3-ethernet
    connection.interface-name:  enp7s0
    ...
  3. Use the ping utility to verify that this host can send packets to other hosts.

    • Ping an IP address in the same subnet.

      For IPv4:

      # ping 192.0.2.3

      For IPv6:

      # ping 2001:db8:2::1

      If the command fails, verify the IP and subnet settings.

    • Ping an IP address in a remote subnet.

      For IPv4:

      # ping 198.162.3.1

      For IPv6:

      # ping 2001:db8:2::1
      • If the command fails, ping the default gateway to verify settings.

        For IPv4:

        # ping 192.0.2.254

        For IPv6:

        # ping 2001:db8:1::fffe
  4. Use the host utility to verify that name resolution works. For example:

    # host client.example.com

    If the command returns any error, such as connection timed out or no servers could be reached, verify your DNS settings.

Additional resources

6.7. Configuring a dynamic Ethernet connection using the nmcli interactive editor

This procedure describes adding an dynamic Ethernet connection using the interactive editor of the nmcli utility. With this setting, NetworkManager requests the IP settings for this connection from a DHCP server.

Prerequisites

  • A DHCP server is available in the network.

Procedure

  1. To add a new NetworkManager connection profile for the Ethernet connection, and starting the interactive mode, enter:

    # nmcli connection edit type ethernet con-name Example-Connection
  2. Set the network interface:

    nmcli> set connection.interface-name enp7s0
  3. Optionally, change the host name NetworkManager sends to the DHCP server when using the Example-Connection profile:

    nmcli> set ipv4.dhcp-hostname Example
    nmcli> set ipv6.dhcp-hostname Example
  4. Optionally, change the client ID NetworkManager sends to an IPv4 DHCP server when using the Example-Connection profile:

    nmcli> set ipv4.dhcp-client-id client-ID

    Note that there is no dhcp-client-id parameter for IPv6. To create an identifier for IPv6, configure the dhclient service.

  5. Save and activate the connection:

    nmcli> save persistent
    Saving the connection with 'autoconnect=yes'. That might result in an immediate activation of the connection.
    Do you still want to save? (yes/no) [yes] yes
  6. Leave the interactive mode:

    nmcli> quit

Verification steps

  1. Display the status of the devices and connections:

    # nmcli device status
    DEVICE      TYPE      STATE      CONNECTION
    enp7s0      ethernet  connected  Example-Connection
  2. To display all settings of the connection profile:

    # nmcli connection show Example-Connection
    connection.id:              Example-Connection
    connection.uuid:            b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76
    connection.stable-id:       --
    connection.type:            802-3-ethernet
    connection.interface-name:  enp7s0
    ...
  3. Use the ping utility to verify that this host can send packets to other hosts.

    • Ping an IP address in the same subnet.

      For IPv4:

      # ping 192.0.2.3

      For IPv6:

      # ping 2001:db8:2::1

      If the command fails, verify the IP and subnet settings.

    • Ping an IP address in a remote subnet.

      For IPv4:

      # ping 198.162.3.1

      For IPv6:

      # ping 2001:db8:2::1
      • If the command fails, ping the default gateway to verify settings.

        For IPv4:

        # ping 192.0.2.254

        For IPv6:

        # ping 2001:db8:1::fffe
  4. Use the host utility to verify that name resolution works. For example:

    # host client.example.com

    If the command returns any error, such as connection timed out or no servers could be reached, verify your DNS settings.

Additional resources

6.8. Configuring a dynamic Ethernet connection using nmstatectl

This procedure describes how to add an dynamic Ethernet for the enp7s0 device using the nmstatectl utility. With the settings in this procedure, NetworkManager requests the IP settings for this connection from a DHCP server.

The nmstatectl utility ensures that, after setting the configuration, the result matches the configuration file. If anything fails, nmstatectl automatically rolls back the changes to avoid leaving the system in an incorrect state.

The procedure defines the interface configuration in YAML format. Alternatively, you can also specify the configuration in JSON format.

Prerequisites

  • The nmstate package is installed.

Procedure

  1. Create a YAML file, for example ~/create-ethernet-profile.yml, with the following contents:

    ---
    interfaces:
    - name: enp7s0
      type: ethernet
      state: up
      ipv4:
        enabled: true
        auto-dns: true
        auto-gateway: true
        auto-routes: true
        dhcp: true
      ipv6:
        enabled: true
        auto-dns: true
        auto-gateway: true
        auto-routes: true
        autoconf: true
        dhcp: true
  2. Apply the settings to the system:

    # nmstatectl apply ~/create-ethernet-profile.yml

Verification steps

  1. Display the status of the devices and connections:

    # nmcli device status
    DEVICE      TYPE      STATE      CONNECTION
    enp7s0      ethernet  connected  enp7s0
  2. Display all settings of the connection profile:

    # nmcli connection show enp7s0
    connection.id:              enp7s0_
    connection.uuid:            b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76
    connection.stable-id:       --
    connection.type:            802-3-ethernet
    connection.interface-name:  enp7s0
    ...
  3. Display the connection settings in YAML format:

    # nmstatectl show enp7s0

Additional resources

  • nmstatectl(8) man page
  • /usr/share/doc/nmstate/examples/

6.9. Configuring a dynamic Ethernet connection using RHEL System Roles with the interface name

This procedure describes how to use RHEL System Roles to remotely add a dynamic Ethernet connection for the enp7s0 interface by running an Ansible playbook. With this setting, the network connection requests the IP settings for this connection from a DHCP server. Run this procedure on the Ansible control node.

Prerequisites

  • A DHCP server is available in the network.
  • The ansible-core and rhel-system-roles packages are installed on the control node.
  • If you use a different remote user than root when you run the playbook, this user has appropriate sudo permissions on the managed node.
  • The host uses NetworkManager to configure the network.

Procedure

  1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

    node.example.com
  2. Create the ~/ethernet-dynamic-IP.yml playbook with the following content:

    ---
    - name: Configure an Ethernet connection with dynamic IP
      hosts: node.example.com
      become: true
      tasks:
      - include_role:
          name: linux-system-roles.network
    
        vars:
          network_connections:
            - name: enp7s0
    	  interface_name: enp7s0
              type: ethernet
              autoconnect: yes
              ip:
                dhcp4: yes
                auto6: yes
              state: up
  3. Run the playbook:

    • To connect as root user to the managed host, enter:

      # ansible-playbook -u root ~/ethernet-dynamic-IP.yml
    • To connect as a user to the managed host, enter:

      # ansible-playbook -u user_name --ask-become-pass ~/ethernet-dynamic-IP.yml

      The --ask-become-pass option makes sure that the ansible-playbook command promptsv for the sudo password of the user defined in the -u user_name option.

    If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Additional resources

  • /usr/share/ansible/roles/rhel-system-roles.network/README.md file
  • ansible-playbook(1) man page

6.10. Configuring a dynamic Ethernet connection using RHEL System Roles with a device path

This procedure describes how to use RHEL System Roles to remotely add a dynamic Ethernet connection for devices that match a specific device path by running an Ansible playbook. With dynamic IP settings, the network connection requests the IP settings for this connection from a DHCP server. Run this procedure on the Ansible control node.

You can identify the device path with the following command:

# udevadm info /sys/class/net/<device_name> | grep ID_PATH=

Prerequisites

  • A DHCP server is available in the network.
  • The ansible-core and rhel-system-roles packages are installed on the control node.
  • If you use a different remote user than root when you run the playbook, this user has appropriate sudo permissions on the managed node.
  • The host uses NetworkManager to configure the network.

Procedure

  1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

    node.example.com
  2. Create the ~/ethernet-dynamic-IP.yml playbook with the following content:

    ---
    - name: Configure an Ethernet connection with dynamic IP
      hosts: node.example.com
      become: true
      tasks:
      - include_role:
          name: linux-system-roles.network
    
        vars:
          network_connections:
            - name: example
    	  match:
    	    path:
    	      - pci-0000:00:0[1-3].0
    	      - &!pci-0000:00:02.0
              type: ethernet
              autoconnect: yes
              ip:
                dhcp4: yes
                auto6: yes
              state: up

    The match parameter in this example defines that Ansible applies the play to devices that match PCI ID 0000:00:0[1-3].0, but not 0000:00:02.0. For further details about special modifiers and wild cards you can use, see the match parameter description in the /usr/share/ansible/roles/rhel-system-roles.network/README.md file.

  3. Run the playbook:

    • To connect as root user to the managed host, enter:

      # ansible-playbook -u root ~/ethernet-dynamic-IP.yml
    • To connect as a user to the managed host, enter:

      # ansible-playbook -u user_name --ask-become-pass ~/ethernet-dynamic-IP.yml

      The --ask-become-pass option makes sure that the ansible-playbook command promptsv for the sudo password of the user defined in the -u user_name option.

    If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Additional resources

  • /usr/share/ansible/roles/rhel-system-roles.network/README.md file
  • ansible-playbook(1) man page

6.11. Configuring an Ethernet connection using control-center

Ethernet connections are the most frequently used connections types in physical or virtual machines. This section describes how to configure this connection type in the GNOME control-center:

Note that control-center does not support as many configuration options as the nm-connection-editor application or the nmcli utility.

Prerequisites

  • A physical or virtual Ethernet device exists in the server’s configuration.
  • GNOME is installed.

Procedure

  1. Press the Super key, enter Settings, and press Enter.
  2. Select Network in the navigation on the left.
  3. Click the + button next to the Wired entry to create a new profile.
  4. Optional: Set a name for the connection on the Identity tab.
  5. On the IPv4 tab, configure the IPv4 settings. For example, select method Manual, set a static IPv4 address, network mask, default gateway, and DNS server:

    IPv4 settings control center
  6. On the IPv6 tab, configure the IPv6 settings. For example, select method Manual, set a static IPv6 address, network mask, default gateway, and DNS server:

    IPv6 settings control center
  7. Click the Add button to save the connection. The GNOME control-center automatically activates the connection.

Verification steps

  1. Display the status of the devices and connections:

    # nmcli device status
    DEVICE      TYPE      STATE      CONNECTION
    enp7s0      ethernet  connected  Example-Connection
  2. To display all settings of the connection profile:

    # nmcli connection show Example-Connection
    connection.id:              Example-Connection
    connection.uuid:            b6cdfa1c-e4ad-46e5-af8b-a75f06b79f76
    connection.stable-id:       --
    connection.type:            802-3-ethernet
    connection.interface-name:  enp7s0
    ...
  3. Use the ping utility to verify that this host can send packets to other hosts.

    • Ping an IP address in the same subnet.

      For IPv4:

      # ping 192.0.2.3

      For IPv6:

      # ping 2001:db8:2::1

      If the command fails, verify the IP and subnet settings.

    • Ping an IP address in a remote subnet.

      For IPv4:

      # ping 198.162.3.1

      For IPv6:

      # ping 2001:db8:2::1
      • If the command fails, ping the default gateway to verify settings.

        For IPv4:

        # ping 192.0.2.254

        For IPv6:

        # ping 2001:db8:1::fffe
  4. Use the host utility to verify that name resolution works. For example:

    # host client.example.com

    If the command returns any error, such as connection timed out or no servers could be reached, verify your DNS settings.

Troubleshooting steps

  1. If the connection fails or if the network interface switches between an up and down status:

    • Make sure that the network cable is plugged-in to the host and a switch.
    • Check whether the link failure exists only on this host or also on other hosts connected to the same switch the server is connected to.
    • Verify that the network cable and the network interface are working as expected. Perform hardware diagnosis steps and replace defect cables and network interface cards.

Additional Resources

6.12. Configuring an Ethernet connection using nm-connection-editor

Ethernet connections are the most frequently used connection types in physical or virtual servers. This section describes how to configure this connection type using the nm-connection-editor application.

Prerequisites

  • A physical or virtual Ethernet device exists in the server’s configuration.
  • GNOME is installed.

Procedure

  1. Open a terminal, and enter:

    $ nm-connection-editor
  2. Click the + button to add a new connection.
  3. Select the Ethernet connection type, and click Create.
  4. On the General tab:

    1. To automatically enable this connection when the system boots or when you restart the NetworkManager service:

      1. Select Connect automatically with priority.
      2. Optional: Change the priority value next to Connect automatically with priority.

        If multiple connection profiles exist for the same device, NetworkManager enables only one profile. By default, NetworkManager activates the last-used profile that has auto-connect enabled. However, if you set priority values in the profiles, NetworkManager activates the profile with the highest priority.

    2. Clear the All users may connect to this network check box if the profile should be available only to the user that created the connection profile.

    ethernet connection general tab

  5. On the Ethernet tab, select a device and, optionally, further Ethernet-related settings. ethernet connection settings
  6. On the IPv4 Settings tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, and DNS server: IPv4 settings nm connection editor
  7. On the IPv6 Settings tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, and DNS server: IPv6 settings nm connection editor
  8. Save the connection.
  9. Close nm-connection-editor.

Verification steps

  1. Use the ping utility to verify that this host can send packets to other hosts.

    • Ping an IP address in the same subnet.

      For IPv4:

      # ping 192.0.2.3

      For IPv6:

      # ping 2001:db8:2::1

      If the command fails, verify the IP and subnet settings.

    • Ping an IP address in a remote subnet.

      For IPv4:

      # ping 198.162.3.1

      For IPv6:

      # ping 2001:db8:2::1
      • If the command fails, ping the default gateway to verify settings.

        For IPv4:

        # ping 192.0.2.254

        For IPv6:

        # ping 2001:db8:1::fff3
    • Use the host utility to verify that name resolution works. For example:

      # host client.example.com

      If the command returns any error, such as connection timed out or no servers could be reached, verify your DNS settings.

Additional Resources

6.13. Configuring the DHCP behavior of a NetworkManager connection

A Dynamic Host Configuration Protocol (DHCP) client requests the dynamic IP address and corresponding configuration information from a DHCP server each time a client connects to the network.

When you configured a connection to retrieve an IP address from a DHCP server, the NetworkManager requests an IP address from a DHCP server. By default, the client waits 45 seconds for this request to be completed. When a DHCP connection is started, a dhcp client requests an IP address from a DHCP server.

Prerequisites

  • A connection that uses DHCP is configured on the host.

Procedure

  1. Set the ipv4.dhcp-timeout and ipv6.dhcp-timeout properties. For example, to set both options to 30 seconds, enter:

    # nmcli connection modify connection_name ipv4.dhcp-timeout 30 ipv6.dhcp-timeout 30

    Alternatively, set the parameters to infinity to configure that NetworkManager does not stop trying to request and renew an IP address until it is successful.

  2. Optional: Configure the behavior if NetworkManager does not receive an IPv4 address before the timeout:

    # nmcli connection modify connection_name ipv4.may-fail value

    If you set the ipv4.may-fail option to:

    • yes, the status of the connection depends on the IPv6 configuration:

      • If the IPv6 configuration is enabled and successful, NetworkManager activates the IPv6 connection and no longer tries to activate the IPv4 connection.
      • If the IPv6 configuration is disabled or not configured, the connection fails.
    • no, the connection is deactivated. In this case:

      • If the autoconnect property of the connection is enabled, NetworkManager retries to activate the connection as many times as set in the autoconnect-retries property. The default is 4.
      • If the connection still cannot acquire a DHCP address, auto-activation fails. Note that after 5 minutes, the auto-connection process starts again to acquire an IP address from the DHCP server.
  3. Optional: Configure the behavior if NetworkManager does not receive an IPv6 address before the timeout:

    # nmcli connection modify connection_name ipv6.may-fail value

Additional resources

  • nm-settings(5) man page

Chapter 7. Managing Wi-Fi connections

This section describes how to configure and manage Wi-Fi connections.

7.1. Setting the wireless regulatory domain

In Red Hat Enterprise Linux, the crda package contains the Central Regulatory Domain Agent that provides the kernel with the wireless regulatory rules for a given jurisdiction. It is used by certain udev scripts and should not be run manually unless debugging udev scripts. The kernel runs crda by sending a udev event upon a new regulatory domain change. Regulatory domain changes are triggered by the Linux wireless subsystem (IEEE-802.11). This subsystem uses the regulatory.bin file to keep its regulatory database information.

The setregdomain utility sets the regulatory domain for your system. Setregdomain takes no arguments and is usually called through system script such as udev rather than manually by the administrator. If a country code look-up fails, the system administrator can define the COUNTRY environment variable in the /etc/sysconfig/regdomain file.

Additional resources

  • setregdomain(1) man page
  • crda(8) man page
  • regulatory.bin(5) man page
  • iw(8) man page

7.2. Configuring a Wi-Fi connection using nmcli

This procedure describes how to configure a Wi-fi connection profile using nmcli.

Prerequisites

  • The nmcli utility to be installed.
  • Make sure that the WiFi radio is on (default):

    ~]$ nmcli radio wifi on

Procedure

  1. To create a Wi-Fi connection profile with static IP configuration:

    ~]$ nmcli con add con-name MyCafe ifname wlan0 type wifi ssid MyCafe ` `ip4 192.168.100.101/24 gw4 192.168.100.1
  2. Set a DNS server. For example, to set 192.160.100.1 as the DNS server:

    ~]$ nmcli con modify con-name MyCafe ipv4.dns "192.160.100.1"
  3. Optionally, set a DNS search domain. For example, to set the search domain to example.com:

    ~]$ nmcli con modify con-name MyCafe ipv4.dns-search "example.com"
  4. To check a specific property, for example mtu:

    ~]$ nmcli connection show id MyCafe | grep mtu
    802-11-wireless.mtu:                     auto
  5. To change the property of a setting:

    ~]$ nmcli connection modify id MyCafe 802-11-wireless.mtu 1350
  6. To verify the change:

    ~]$ nmcli connection show id MyCafe | grep mtu
    802-11-wireless.mtu:                     1350

Verification steps

  1. Use the ping utility to verify that this host can send packets to other hosts.

    • Ping an IP address in the same subnet. For example:

      # ping 192.168.100.103

      If the command fails, verify the IP and subnet settings.

    • Ping an IP address in a remote subnet. For example:

      # ping 198.51.16.3
      • If the command fails, ping the default gateway to verify settings.

        # ping 192.168.100.1
  2. Use the host utility to verify that name resolution works. For example:

    # host client.example.com

    If the command returns any error, such as connection timed out or no servers could be reached, verify your DNS settings.

7.3. Configuring a Wi-Fi connection using control-center

When you connect to a Wi-Fi, the network settings are prefilled depending on the current network connection. This means that the settings will be detected automatically when the interface connects to a network.

This procedure describes how to use control-center to manually configure the Wi-Fi settings.

Procedure

  1. Press the Super key to enter the Activities Overview, type Wi-Fi and press Enter. In the left-hand-side menu entry you see the list of available networks.
  2. Select the gear wheel icon to the right of the Wi-Fi connection name that you want to edit, and the editing connection dialog appears. The Details menu window shows the connection details where you can make further configuration.

    Options

    1. If you select Connect automatically, NetworkManager auto-connects to this connection whenever NetworkManager detects that it is available. If you do not want NetworkManager to connect automatically, clear the check box. Note that when the check box is clear, you have to select that connection manually in the network connection icon’s menu to cause it to connect.
    2. To make a connection available to other users, select the Make available to other users check box.
    3. You can also control the background data usage. If you leave Restrict background data usage unspecified (default), then NetworkManager tries to download data that you are actively using. Otherwise, select the check box and NetworkManager sets the connection as metered, and applies restriction on the background data usage.

      Note

      To delete a Wi-Fi connection, click the Forget Connection red box.

  3. Select the Identity menu entry to see the basic configuration options.

    SSID — The Service Set Identifier (SSID) of the access point (AP).

    BSSID — The Basic Service Set Identifier (BSSID) is the MAC address, also known as a hardware address, of the specific wireless access point you are connecting to when in Infrastructure mode. This field is blank by default, and you are able to connect to a wireless access point by SSID without having to specify its BSSID. If the BSSID is specified, it will force the system to associate to a specific access point only. For ad-hoc networks, the BSSID is generated randomly by the mac80211 subsystem when the ad-hoc network is created. It is not displayed by NetworkManager.

    MAC address — The MAC address allows you to associate a specific wireless adapter with a specific connection (or connections).

    Cloned Address — A cloned MAC address to use in place of the real hardware address. Leave blank unless required.

  4. For further IP address configuration , select the IPv4 and IPv6 menu entries.

    By default, both IPv4 and IPv6 are set to automatic configuration depending on current network settings. This means that addresses such as the local IP address, DNS address, and other settings will be detected automatically when the interface connects to a network. If a DHCP server assigns the IP configuration in this network, this is sufficient, but you can also provide static configuration in the IPv4 and IPv6 Settings. In the IPv4 and IPv6 menu entries, you can see the following settings:

    • IPv4 Method

      • Automatic (DHCP) — Choose this option if the network you are connecting to uses Router Advertisements (RA) or a DHCP server to assign dynamic IP addresses. You can see the assigned IP address in the Details menu entry.
      • Link-Local Only — Choose this option if the network you are connecting to does not have a DHCP server and you do not want to assign IP addresses manually. Random addresses will be assigned as per RFC 3927 with prefix 169.254/16.
      • Manual — Choose this option if you want to assign IP addresses manually.
      • DisableIPv4 is disabled for this connection.
    • DNS

      If Automatic is ON, and no DHCP server is available that assigns DNS servers to this connection, switch it to OFF to enter the IP address of a DNS server separating the IPs by comma.

    • Routes

      Note that in the Routes section, when Automatic is ON, routes from Router Advertisements (RA) or DHCP are used, but you can also add additional static routes. When OFF, only static routes are used.

      • Address — Enter the IP address of a remote network, sub-net, or host.
      • Netmask — The netmask or prefix length of the IP address entered above.
      • Gateway — The IP address of the gateway leading to the remote network, sub-net, or host entered above.
      • Metric — A network cost, a preference value to give to this route. Lower values will be preferred over higher values.
    • Use this connection only for resources on its network

      Select this check box to prevent the connection from becoming the default route.

      Alternatively, to configure IPv6 settings in a Wi-Fi connection, select the IPv6 menu entry:

    • IPv6 Method

      • Automatic — Choose this option to use IPv6 Stateless Address AutoConfiguration (SLAAC) to create an automatic, stateless configuration based on the hardware address and Router Advertisements (RA).
      • Automatic, DHCP only — Choose this option to not use RA, but request information from DHCPv6 directly to create a stateful configuration.
      • Link-Local Only — Choose this option if the network you are connecting to does not have a DHCP server and you do not want to assign IP addresses manually. Random addresses will be assigned as per RFC 4862 with prefix FE80::0.
      • Manual — Choose this option if you want to assign IP addresses manually.
      • DisableIPv6 is disabled for this connection.
    • The DNS, Routes, Use this connection only for resources on its network fields are common to IPv4 settings.
  5. To configure Security settings in a Wi-Fi connection, select the Security menu entry. The following configuration options are available:

    • Security

      • None — Do not encrypt the Wi-Fi connection.
      • WEP 40/128-bit Key — Wired Equivalent Privacy (WEP), from the IEEE 802.11 standard. Uses a single pre-shared key (PSK).
      • WEP 128-bit Passphrase — An MD5 hash of the passphrase to derive a WEP key.

        Warning

        If the Wi-Fi use no encryption, WEP, or WPA, do not use the network because it is insecure and everyone can read the data you send over this network.

      • LEAP — Lightweight Extensible Authentication Protocol, from Cisco Systems.
      • Dynamic WEP (802.1X) — WEP keys are changed dynamically.
      • WPA & WPA2 Personal — Wi-Fi Protected Access (WPA), from the draft IEEE 802.11i standard. A replacement for WEP. Wi-Fi Protected Access II (WPA2), from the 802.11i-2004 standard. Personal mode uses a pre-shared key (WPA-PSK).
      • WPA & WPA2 Enterprise — WPA for use with a RADIUS authentication server to provide IEEE 802.1X network access control.
    • Password — Enter the password to be used in the authentication process.
  6. Once you have finished the configuration, click the Apply button to save it.
Note

When you add a new connection by clicking the plus button, NetworkManager creates a new configuration file for that connection and then opens the same dialog that is used for editing an existing connection. The difference between these dialogs is that an existing connection profile has a Details menu entry.

7.4. Connecting to a Wi-Fi network with nmcli

This procedure describes how to connect to a wireless connection using the nmcli utility.

Prerequisites

  • The nmcli utility to be installed.
  • Make sure that the WiFi radio is on (default):

    ~]$ nmcli radio wifi on

Procedure

  1. To refresh the available Wi-Fi connection list:

    ~]$ nmcli device wifi rescan
  2. To view the available Wi-Fi access points:

    ~]$ nmcli dev wifi list
    
    IN-USE  SSID      MODE   CHAN  RATE        SIGNAL  BARS  SECURITY
    ...
            MyCafe    Infra  3     405 Mbit/s  85      ▂▄▆█  WPA1 WPA2
  3. To connect to a Wi-Fi connection using nmcli:

    ~]$ nmcli dev wifi connect SSID-Name password wireless-password

    For example:

    ~]$ nmcli dev wifi connect MyCafe password wireless-password

    Note that if you want to disable the Wi-Fi state:

    ~]$ nmcli radio wifi off

7.5. Connecting to a hidden Wi-Fi network using nmcli

All access points have a Service Set Identifier (SSID) to identify them. However, an access point may be configured not to broadcast its SSID, in which case it is hidden, and will not show up in NetworkManager’s list of Available networks.

This procedure shows how you can connect to a hidden network using the nmcli tool.

Prerequisites

  • The nmcli utility to be installed.
  • To know the SSID, and password of the Wi-Fi connection.
  • Make sure that the WiFi radio is on (default):

    ~]$ nmcli radio wifi on

Procedure

  • Connect to the SSID that is hidden:

    ~]$ nmcli dev wifi connect SSID_Name password wireless_password hidden yes

7.6. Connecting to a Wi-Fi network using the GNOME GUI

This procedure describes how you can connect to a wireless network to get access to the Internet.

Procedure

  1. Open the GNOME Shell network connection icon menu from the top right-hand corner of the screen.
  2. Select Wi-Fi Not Connected.
  3. Click the Select Network option.
  4. Click the name of the network to which you want to connect, and then click Connect.

    Note that if you do not see the network, the network might be hidden.

  5. If the network is protected by a password or encryption keys are required, enter the password and click Connect.

    Note that if you do not know the password, contact the administrator of the Wi-Fi network.

  6. If the connection is successful, the name of the network is visible in the connection icon menu and the wireless indicator is on the top right-hand corner of the screen.

Chapter 8. Configuring VLAN tagging

This section describes how to configure Virtual Local Area Network (VLAN). A VLAN is a logical network within a physical network. The VLAN interface tags packets with the VLAN ID as they pass through the interface, and removes tags of returning packets.

You create a VLAN interface on top of another interface, such as an Ethernet, bond, team, or bridge device. This interface is called the parent interface.

8.1. Configuring VLAN tagging using nmcli commands

This section describes how to configure Virtual Local Area Network (VLAN) tagging using the nmcli utility.

Prerequisites

  • The interface you plan to use as a parent to the virtual VLAN interface supports VLAN tags.
  • If you configure the VLAN on top of a bond interface:

    • The ports of the bond are up.
    • The bond is not configured with the fail_over_mac=follow option. A VLAN virtual device cannot change its MAC address to match the parent’s new MAC address. In such a case, the traffic would still be sent with the then incorrect source MAC address.
    • The bond is usually not expected to get IP addresses via DHCP or IPv6 autoconfiguration. Ensure it by setting ipv4.method=disable and ipv6.method=ignore options while creating a bond; otherwise if DHCP/IPv6-autoconf fails after some time, the interface might be brought down.
  • The switch the host is connected to is configured to support VLAN tags. For details, see the documentation of your switch.

Procedure

  1. Display the network interfaces:

    # nmcli device status
    DEVICE   TYPE      STATE         CONNECTION
    enp1s0   ethernet  disconnected  enp1s0
    bridge0  bridge    connected     bridge0
    bond0    bond      connected     bond0
    ...
  2. Create the VLAN interface. For example, to create a VLAN interface named vlan10 that uses enp1s0 as its parent interface and that tags packets with VLAN ID 10, enter:

    # nmcli connection add type vlan con-name vlan10 ifname vlan10 vlan.parent enp1s0 vlan.id 10

    Note that the VLAN must be within the range from 0 to 4094.

  3. By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. Optionally, set a different MTU value:

    # nmcli connection modify vlan10 802-3-ethernet.mtu 2000
  4. Configure the IP settings of the VLAN device. Skip this step if you want to use this VLAN device as a port of other devices.

    1. Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

      # nmcli connection modify vlan10 ipv4.addresses '192.0.2.1/24'
      # nmcli connection modify vlan10 ipv4.gateway '192.0.2.254'
      # nmcli connection modify vlan10 ipv4.dns '192.0.2.253'
      # nmcli connection modify vlan10 ipv4.method manual
    2. Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

      # nmcli connection modify vlan10 ipv6.addresses '2001:db8:1::1/32'
      # nmcli connection modify vlan10 ipv6.gateway '2001:db8:1::fffe'
      # nmcli connection modify vlan10 ipv6.dns '2001:db8:1::fffd'
      # nmcli connection modify vlan10 ipv6.method manual
  5. Activate the connection:

    # nmcli connection up vlan10

Verification steps

  1. Verify the settings:

    # ip -d addr show vlan10
    4: vlan10@enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
        link/ether 52:54:00:d5:e0:fb brd ff:ff:ff:ff:ff:ff promiscuity 0
        vlan protocol 802.1Q id 10 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
        inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute vlan10
           valid_lft forever preferred_lft forever
        inet6 2001:db8:1::1/32 scope global noprefixroute
           valid_lft forever preferred_lft forever
        inet6 fe80::8dd7:9030:6f8e:89e6/64 scope link noprefixroute
           valid_lft forever preferred_lft forever

Additional resources

8.2. Configuring VLAN tagging using nm-connection-editor

This section describes how to configure Virtual Local Area Network (VLAN) tagging using the nm-connection-editor application.

Prerequisites

  • The interface you plan to use as a parent to the virtual VLAN interface supports VLAN tags.
  • If you configure the VLAN on top of a bond interface:

    • The ports of the bond are up.
    • The bond is not configured with the fail_over_mac=follow option. A VLAN virtual device cannot change its MAC address to match the parent’s new MAC address. In such a case, the traffic would still be sent with the then incorrect source MAC address.
  • The switch the host is connected to is configured to support VLAN tags. For details, see the documentation of your switch.

Procedure

  1. Open a terminal, and enter nm-connection-editor:

    $ nm-connection-editor
  2. Click the + button to add a new connection.
  3. Select the VLAN connection type, and click Create.
  4. On the VLAN tab:

    1. Select the parent interface.
    2. Select the VLAN id. Note that the VLAN must be within the range from 0 to 4094.
    3. By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. Optionally, set a different MTU value.
    4. Optionally, set the name of the VLAN interface and further VLAN-specific options.

      vlan settings nm connection editor

  5. Configure the IP settings of the VLAN device. Skip this step if you want to use this VLAN device as a port of other devices.

    1. On the IPv4 Settings tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, and DNS server: vlan IPv4 settings nm connection editor
    2. On the IPv6 Settings tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, and DNS server: vlan IPv6 settings nm connection editor
  6. Click Save to save the VLAN connection.
  7. Close nm-connection-editor.

Verification steps

  1. Verify the settings:

    # ip -d addr show vlan10
    4: vlan10@enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
        link/ether 52:54:00:d5:e0:fb brd ff:ff:ff:ff:ff:ff promiscuity 0
        vlan protocol 802.1Q id 10 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
        inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute vlan10
           valid_lft forever preferred_lft forever
        inet6 2001:db8:1::1/32 scope global noprefixroute
           valid_lft forever preferred_lft forever
        inet6 fe80::8dd7:9030:6f8e:89e6/64 scope link noprefixroute
           valid_lft forever preferred_lft forever

8.3. Configuring VLAN tagging using nmstatectl

This section describes how to use the nmstatectl utility to configure a VLAN with ID 10 that uses an Ethernet connection. As the parent device, the VLAN connection contains the IP, default gateway, and DNS configurations.

Depending on your environment, adjust the YAML file accordingly. For example, to use a bridge, or bond device in the VLAN, adapt the base-iface attribute and type attributes of the ports you use in the VLAN.

Prerequisites

  • To use Ethernet devices as ports in the VLAN, the physical or virtual Ethernet devices must be installed on the server.
  • The nmstate package is installed.

Procedure

  1. Create a YAML file, for example ~/create-vlan.yml, with the following contents:

    ---
    interfaces:
    - name: vlan10
      type: vlan
      state: up
      ipv4:
        enabled: true
        address:
        - ip: 192.0.2.1
          prefix-length: 24
        dhcp: false
      ipv6:
        enabled: true
        address:
        - ip: 2001:db8:1::1
          prefix-length: 64
        autoconf: false
        dhcp: false
      vlan:
        base-iface: enp1s0
        id: 10
    - name: enp1s0
      type: ethernet
      state: up
    
    routes:
      config:
      - destination: 0.0.0.0/0
        next-hop-address: 192.0.2.254
        next-hop-interface: vlan10
      - destination: ::/0
        next-hop-address: 2001:db8:1::fffe
        next-hop-interface: vlan10
    
    dns-resolver:
      config:
        search:
        - example.com
        server:
        - 192.0.2.200
        - 2001:db8:1::ffbb
  2. Apply the settings to the system:

    # nmstatectl apply ~/create-vlan.yml

Verification steps

  1. Display the status of the devices and connections:

    # nmcli device status
    DEVICE      TYPE      STATE      CONNECTION
    vlan10      vlan      connected  vlan10
  2. Display all settings of the connection profile:

    # nmcli connection show vlan10
    connection.id:              vlan10
    connection.uuid:            1722970f-788e-4f81-bd7d-a86bf21c9df5
    connection.stable-id:       --
    connection.type:            vlan
    connection.interface-name:  vlan10
    ...
  3. Display the connection settings in YAML format:

    # nmstatectl show vlan0

Additional resources

  • nmstatectl(8) man page
  • /usr/share/doc/nmstate/examples/

8.4. Configuring VLAN tagging using System Roles

You can use the networking RHEL System Role to configure VLAN tagging. This procedure describes how to add an Ethernet connection and a VLAN with ID 10 that uses this Ethernet connection. As the parent device, the VLAN connection contains the IP, default gateway, and DNS configurations.

Depending on your environment, adjust the play accordingly. For example:

  • To use the VLAN as a port in other connections, such as a bond, omit the ip attribute, and set the IP configuration in the parent configuration.
  • To use team, bridge, or bond devices in the VLAN, adapt the interface_name and type attributes of the ports you use in the VLAN.

Prerequisites

  • The ansible-core and rhel-system-roles packages are installed on the control node.
  • If you use a different remote user than root when you run the playbook, this user has appropriate sudo permissions on the managed node.

Procedure

  1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

    node.example.com
  2. Create the ~/vlan-ethernet.yml playbook with the following content:

    ---
    - name: Configure a VLAN that uses an Ethernet connection
      hosts: node.example.com
      become: true
      tasks:
      - include_role:
          name: linux-system-roles.network
    
        vars:
          network_connections:
            # Add an Ethernet profile for the underlying device of the VLAN
            - name: enp1s0
              type: ethernet
    	  interface_name: enp1s0
    	  autoconnect: yes
              state: up
    	  ip:
    	    dhcp4: no
    	    auto6: no
    
            # Define the VLAN profile
            - name: vlan10
              type: vlan
              ip:
                address:
                  - "192.0.2.1/24"
                  - "2001:db8:1::1/64"
                gateway4: 192.0.2.254
                gateway6: 2001:db8:1::fffe
                dns:
                  - 192.0.2.200
                  - 2001:db8:1::ffbb
                dns_search:
                  - example.com
              vlan_id: 10
    	  parent: enp1s0
              state: up

    The parent attribute in the VLAN profile configures the VLAN to operate on top of the enp1s0 device.

  3. Run the playbook:

    • To connect as root user to the managed host, enter:

      # ansible-playbook -u root ~/vlan-ethernet.yml
    • To connect as a user to the managed host, enter:

      # ansible-playbook -u user_name --ask-become-pass ~/vlan-ethernet.yml

      The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

    If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Additional resources

  • /usr/share/ansible/roles/rhel-system-roles.network/README.md file
  • ansible-playbook(1) man page

Chapter 9. Configuring a network bridge

A network bridge is a link-layer device which forwards traffic between networks based on a table of MAC addresses. The bridge builds the MAC addresses table by listening to network traffic and thereby learning what hosts are connected to each network. For example, you can use a software bridge on a Red Hat Enterprise Linux host to emulate a hardware bridge or in virtualization environments, to integrate virtual machines (VM) to the same network as the host.

A bridge requires a network device in each network the bridge should connect. When you configure a bridge, the bridge is called controller and the devices it uses ports.

You can create bridges on different types of devices, such as:

  • Physical and virtual Ethernet devices
  • Network bonds
  • Network teams
  • VLAN devices

Due to the IEEE 802.11 standard which specifies the use of 3-address frames in Wi-Fi for the efficient use of airtime, you cannot configure a bridge over Wi-Fi networks operating in Ad-Hoc or Infrastructure modes.

9.1. Configuring a network bridge using nmcli commands

This section explains how to configure a network bridge using the nmcli utility.

Prerequisites

Procedure

  1. Create a bridge interface:

    # nmcli connection add type bridge con-name bridge0 ifname bridge0

    This command creates a bridge named bridge0, enter:

  2. Display the network interfaces, and note the names of the interfaces you want to add to the bridge:

    # nmcli device status
    DEVICE  TYPE      STATE         CONNECTION
    enp7s0  ethernet  disconnected  --
    enp8s0  ethernet  disconnected  --
    bond0   bond      connected     bond0
    bond1   bond      connected     bond1
    ...

    In this example:

    • enp7s0 and enp8s0 are not configured. To use these devices as ports, add connection profiles in the next step.
    • bond0 and bond1 have existing connection profiles. To use these devices as ports, modify their profiles in the next step.
  3. Assign the interfaces to the bridge.

    1. If the interfaces you want to assign to the bridge are not configured, create new connection profiles for them:

      # nmcli connection add type ethernet slave-type bridge con-name bridge0-port1 ifname enp7s0 master bridge0
      # nmcli connection add type ethernet slave-type bridge con-name bridge0-port2 ifname enp8s0 master bridge0

      These commands create profiles for enp7s0 and enp8s0, and add them to the bridge0 connection.

    2. If you want to assign an existing connection profile to the bridge, set the master parameter of these connections to bridge0:

      # nmcli connection modify bond0 master bridge0
      # nmcli connection modify bond1 master bridge0

      These commands assign the existing connection profiles named bond0 and bond1 to the bridge0 connection.

  4. Configure the IP settings of the bridge. Skip this step if you want to use this bridge as a ports of other devices.

    1. Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain of the bridge0 connection, enter:

      # nmcli connection modify bridge0 ipv4.addresses '192.0.2.1/24'
      # nmcli connection modify bridge0 ipv4.gateway '192.0.2.254'
      # nmcli connection modify bridge0 ipv4.dns '192.0.2.253'
      # nmcli connection modify bridge0 ipv4.dns-search 'example.com'
      # nmcli connection modify bridge0 ipv4.method manual
    2. Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain of the bridge0 connection, enter:

      # nmcli connection modify bridge0 ipv6.addresses '2001:db8:1::1/64'
      # nmcli connection modify bridge0 ipv6.gateway '2001:db8:1::fffe'
      # nmcli connection modify bridge0 ipv6.dns '2001:db8:1::fffd'
      # nmcli connection modify bridge0 ipv6.dns-search 'example.com'
      # nmcli connection modify bridge0 ipv6.method manual
  5. Optional: Configure further properties of the bridge. For example, to set the Spanning Tree Protocol (STP) priority of bridge0 to 16384, enter:

    # nmcli connection modify bridge0 bridge.priority '16384'

    By default, STP is enabled.

  6. Activate the connection:

    # nmcli connection up bridge0
  7. Verify that the ports are connected, and the CONNECTION column displays the port’s connection name:

    # nmcli device
    DEVICE   TYPE      STATE      CONNECTION
    ...
    enp7s0   ethernet  connected  bridge0-port1
    enp8s0   ethernet  connected  bridge0-port2

    Red Hat Enterprise Linux activates controller and ports when the system boots. By activating any port connection, the controller is also activated. However, in this case, only one port connection is activated. By default, activating the controller does not automatically activate the ports. However, you can enable this behavior by setting:

    1. Enable the connection.autoconnect-slaves parameter of the bridge connection:

      # nmcli connection modify bridge0 connection.autoconnect-slaves 1
    2. Reactivate the bridge:

      # nmcli connection up bridge0

Verification steps

  • Display the link status of Ethernet devices that are ports of a specific bridge:

    # ip link show master bridge0
    3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000
        link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff
    4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000
        link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ff
  • Display the status of Ethernet devices that are ports of any bridge device:

    # bridge link show
    3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100
    4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100
    5: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state forwarding priority 32 cost 100
    6: enp11s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state blocking priority 32 cost 100
    ...

    To display the status for a specific Ethernet device, use the bridge link show dev ethernet_device_name command.

Additional resources

9.2. Configuring a network bridge using nm-connection-editor

This section explains how to configure a network bridge using the nm-connection-editor application.

Note that nm-connection-editor can add only new ports to a bridge. To use an existing connection profile as a port, create the bridge using the nmcli utility as described in Configuring a network bridge using nmcli commands.

Prerequisites

  • Two or more physical or virtual network devices are installed on the server.
  • To use Ethernet devices as ports of the bridge, the physical or virtual Ethernet devices must be installed on the server.
  • To use team, bond, or VLAN devices as ports of the bridge, ensure that these devices are not already configured.

Procedure

  1. Open a terminal, and enter nm-connection-editor:

    $ nm-connection-editor
  2. Click the + button to add a new connection.
  3. Select the Bridge connection type, and click Create.
  4. In the Bridge tab:

    1. Optional: Set the name of the bridge interface in the Interface name field.
    2. Click the Add button to create a new connection profile for a network interface and adding the profile as a port to the bridge.

      1. Select the connection type of the interface. For example, select Ethernet for a wired connection.
      2. Optionally, set a connection name for the port device.
      3. If you create a connection profile for an Ethernet device, open the Ethernet tab, and select in the Device field the network interface you want to add as a port to the bridge. If you selected a different device type, configure it accordingly.
      4. Click Save.
    3. Repeat the previous step for each interface you want to add to the bridge.

      add nic to bridge in nm connection editor

  5. Optional: Configure further bridge settings, such as Spanning Tree Protocol (STP) options.
  6. Configure the IP settings of the bridge. Skip this step if you want to use this bridge as a port of other devices.

    1. In the IPv4 Settings tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain:

      bridge IPv4 settings nm connection editor

    2. In the IPv6 Settings tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain:

      bridge IPv6 settings nm connection editor

  7. Save the bridge connection.
  8. Close nm-connection-editor.

Verification steps

  • Display the link status of Ethernet devices that are ports of a specific bridge.

    # ip link show master bridge0
    3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000
        link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff
    4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000
        link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ff
  • Display the status of Ethernet devices that are ports in any bridge device:

    # bridge link show
    3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100
    4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100
    5: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state forwarding priority 32 cost 100
    6: enp11s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge1 state blocking priority 32 cost 100
    ...

    To display the status for a specific Ethernet device, use the bridge link show dev ethernet_device_name command.

9.3. Configuring a network bridge using nmstatectl

This section describes how to use the nmstatectl utility to configure a Linux network bridge bridge0 with following settings:

  • Network interfaces in the bridge: enp1s0 and enp7s0
  • Spanning Tree Protocol (STP): Enabled
  • Static IPv4 address: 192.0.2.1 with the /24 subnet mask
  • Static IPv6 address: 2001:db8:1::1 with the /64 subnet mask
  • IPv4 default gateway: 192.0.2.254
  • IPv6 default gateway: 2001:db8:1::fffe
  • IPv4 DNS server: 192.0.2.200
  • IPv6 DNS server: 2001:db8:1::ffbb
  • DNS search domain: example.com

Prerequisites

  • Two or more physical or virtual network devices are installed on the server.
  • To use Ethernet devices as ports in the bridge, the physical or virtual Ethernet devices must be installed on the server.
  • To use team, bond, or VLAN devices as ports in the bridge, set the interface name in the port list, and define the corresponding interfaces.
  • The nmstate package is installed.

Procedure

  1. Create a YAML file, for example ~/create-bridge.yml, with the following contents:

    ---
    interfaces:
    - name: bridge0
      type: linux-bridge
      state: up
      ipv4:
        enabled: true
        address:
        - ip: 192.0.2.1
          prefix-length: 24
        dhcp: false
      ipv6:
        enabled: true
        address:
        - ip: 2001:db8:1::1
          prefix-length: 64
        autoconf: false
        dhcp: false
      bridge:
        options:
          stp:
            enabled: true
        port:
          - name: enp1s0
          - name: enp7s0
    - name: enp1s0
      type: ethernet
      state: up
    - name: enp7s0
      type: ethernet
      state: up
    
    routes:
      config:
      - destination: 0.0.0.0/0
        next-hop-address: 192.0.2.254
        next-hop-interface: bridge0
      - destination: ::/0
        next-hop-address: 2001:db8:1::fffe
        next-hop-interface: bridge0
    dns-resolver:
      config:
        search:
        - example.com
        server:
        - 192.0.2.200
        - 2001:db8:1::ffbb
  2. Apply the settings to the system:

    # nmstatectl apply ~/create-bridge.yml

Verification steps

  1. Display the status of the devices and connections:

    # nmcli device status
    DEVICE      TYPE      STATE      CONNECTION
    bridge0     bridge    connected  bridge0
  2. Display all settings of the connection profile:

    # nmcli connection show bridge0
    connection.id:              bridge0
    connection.uuid:            e2cc9206-75a2-4622-89cf-1252926060a9
    connection.stable-id:       --
    connection.type:            bridge
    connection.interface-name:  bridge0
    ...
  3. Display the connection settings in YAML format:

    # nmstatectl show bridge0

Additional resources

  • nmstatectl(8) man page
  • /usr/share/doc/nmstate/examples/

Chapter 10. Configuring network teaming

This section describes the basics of network teaming, the differences between bonding and teaming, and how to configure a network team on Red Hat Enterprise Linux.

Important

Network teaming is deprecated in Red Hat Enterprise Linux 9. Consider using the network bonding driver as an alternative. For details, see Configuring network bonding.

You can create network teams on different types of devices, such as:

  • Physical and virtual Ethernet devices
  • Network bonds
  • Network bridges
  • VLAN devices

10.1. Migrating a network team configuration to network bond

Network teaming is deprecated in Red Hat Enterprise Linux 9. If you already have a working network team configured, for example because you upgraded from an earlier RHEL version, you can migrate the configuration to a network bond that is managed by NetworkManager.

Important

The team2bond utility only converts the network team configuration to a bond. Afterwards, you must manually configure further settings of the bond, such as IP addresses and DNS configuration.

Prerequisites

  • The team-team0 NetworkManager connection profile is configured and manages the team0 device.
  • The teamd package is installed.

Procedure

  1. Optional: Display the IP configuration of the team-team0 NetworkManager connection:

    # nmcli connection show team-team0 | egrep "^ip"
    ...
    ipv4.method:                            manual
    ipv4.dns:                               192.0.2.253
    ipv4.dns-search:                        example.com
    ipv4.addresses:                         192.0.2.1/24
    ipv4.gateway:                           192.0.2.254
    ...
    ipv6.method:                            manual
    ipv6.dns:                               2001:db8:1::fffd
    ipv6.dns-search:                        example.com
    ipv6.addresses:                         2001:db8:1::1/64
    ipv6.gateway:                           2001:db8:1::fffe
    ...
  2. Export the configuration of the team0 device to a JSON file:

    # teamdctl team0 config dump actual > /tmp/team0.json
  3. Remove the network team. For example, if you configured the team in NetworkManager, remove the team-team0 connection profile and the profiles of associated ports:

    # nmcli connection delete team-team0
    # nmcli connection delete team-team0-port1
    # nmcli connection delete team-team0-port2
  4. Run the team2bond utility in dry-run mode to display nmcli commands that set up a network bond with similar settings as the team device:

    # team2bond --config=/tmp/team0.json --rename=bond0
    nmcli con add type bond ifname bond0 bond.options "mode=active-backup,num_grat_arp=1,num_unsol_na=1,resend_igmp=1,miimon=100,miimon=100"
    nmcli con add type ethernet ifname enp7s0 master bond0
    nmcli con add type ethernet ifname enp8s0 master bond0

    The first command contains two miimon options because the team configuration file contained two link_watch entries. Note that this does not affect the creation of the bond.

    If you bound services to the device name of the team and want to avoid updating or breaking these services, omit the --rename=bond0 option. In this case, team2bond uses the same interface name for the bond as for the team.

  5. Verify that the options for the bond the team2bond utility suggested are correct.
  6. Create the bond. You can execute the suggested nmcli commands or re-run the team2bond command with the --exec-cmd option:

    # team2bond --config=/tmp/team0.json --rename=bond0 --exec-cmd
    Connection 'bond-bond0' (0241a531-0c72-4202-80df-73eadfc126b5) successfully added.
    Connection 'bond-slave-enp7s0' (38489729-b624-4606-a784-1ccf01e2f6d6) successfully added.
    Connection 'bond-slave-enp8s0' (de97ec06-7daa-4298-9a71-9d4c7909daa1) successfully added.

    You require the name of the bond connection profile (bond-bond0) in the next steps.

  7. Set the IPv4 settings that were previously configured on team-team0 to the bond-bond0 connection:

    # nmcli connection modify bond-bond0 ipv4.addresses '192.0.2.1/24'
    # nmcli connection modify bond-bond0 ipv4.gateway '192.0.2.254'
    # nmcli connection modify bond-bond0 ipv4.dns '192.0.2.253'
    # nmcli connection modify bond-bond0 ipv4.dns-search 'example.com'
    # nmcli connection modify bond-bond0 ipv4.method manual
  8. Set the IPv6 settings that were previously configured on team-team0 to the bond-bond0 connection:

    # nmcli connection modify bond-bond0 ipv6.addresses '2001:db8:1::1/64'
    # nmcli connection modify bond-bond0 ipv6.gateway '2001:db8:1::fffe'
    # nmcli connection modify bond-bond0 ipv6.dns '2001:db8:1::fffd'
    # nmcli connection modify bond-bond0 ipv6.dns-search 'example.com'
    # nmcli connection modify bond-bond0 ipv6.method manual
  9. Activate the connection:

    # nmcli connection up bond-bond0

Verification

  1. Display the IP configuration of the bond-bond0 NetworkManager connection:

    # nmcli connection show bond-bond0 | egrep "^ip"
    ...
    ipv4.method:                            manual
    ipv4.dns:                               192.0.2.253
    ipv4.dns-search:                        example.com
    ipv4.addresses:                         192.0.2.1/24
    ipv4.gateway:                           192.0.2.254
    ...
    ipv6.method:                            manual
    ipv6.dns:                               2001:db8:1::fffd
    ipv6.dns-search:                        example.com
    ipv6.addresses:                         2001:db8:1::1/64
    ipv6.gateway:                           2001:db8:1::fffe
    ...
  2. Display the status of the bond:

    # cat /proc/net/bonding/bond0
    Ethernet Channel Bonding Driver: v5.13.0-0.rc7.51.el9.x86_64
    
    Bonding Mode: fault-tolerance (active-backup)
    Primary Slave: None
    Currently Active Slave: enp7s0
    MII Status: up
    MII Polling Interval (ms): 100
    Up Delay (ms): 0
    Down Delay (ms): 0
    Peer Notification Delay (ms): 0
    
    Slave Interface: enp7s0
    MII Status: up
    Speed: Unknown
    Duplex: Unknown
    Link Failure Count: 0
    Permanent HW addr: 52:54:00:bf:b1:a9
    Slave queue ID: 0
    
    Slave Interface: enp8s0
    MII Status: up
    Speed: Unknown
    Duplex: Unknown
    Link Failure Count: 0
    Permanent HW addr: 52:54:00:04:36:0f
    Slave queue ID: 0

    In this example, both ports are up.

  3. To verify that bonding failover works:

    1. Temporarily remove the network cable from the host. Note that there is no method to properly test link failure events using the command line.
    2. Display the status of the bond:

      # cat /proc/net/bonding/bond0

10.2. Understanding network teaming

Network teaming is a feature that combines or aggregates network interfaces to provide a logical interface with higher throughput or redundancy.

Network teaming uses a kernel driver to implement fast handling of packet flows, as well as user-space libraries and services for other tasks. This way, network teaming is an easily extensible and scalable solution for load-balancing and redundancy requirements.

Important

Certain network teaming features, such as the fail-over mechanism, do not support direct cable connections without a network switch. For further details, see Is bonding supported with direct connection using crossover cables?

10.3. Understanding the default behavior of controller and port interfaces

Consider the following default behavior of, when managing or troubleshooting team or bond port interfaces using the NetworkManager service:

  • Starting the controller interface does not automatically start the port interfaces.
  • Starting a port interface always starts the controller interface.
  • Stopping the controller interface also stops the port interface.
  • A controller without ports can start static IP connections.
  • A controller without ports waits for ports when starting DHCP connections.
  • A controller with a DHCP connection waiting for ports completes when you add a port with a carrier.
  • A controller with a DHCP connection waiting for ports continues waiting when you add a port without carrier.

10.5. Installing the teamd service

To configure a network team in NetworkManager, you require the teamd service and the team plug-in for NetworkManager. Both are installed on Red Hat Enterprise Linux by default. This section describes how you install the required packages in case that you remove them.

Prerequisites

  • An active Red Hat subscription is assigned to the host.

Procedure

  • Install the teamd and NetworkManager-team packages:

    # yum install teamd NetworkManager-team

10.6. Configuring a network team using nmcli commands

This section describes how to configure a network team using nmcli utility.

Important

Network teaming is deprecated in Red Hat Enterprise Linux 9. Consider using the network bonding driver as an alternative. For details, see Configuring network bonding.

Prerequisites

Procedure

  1. Create a team interface:

    # nmcli connection add type team con-name team0 ifname team0 team.runner activebackup

    This command creates a network team named team0 that uses the activebackup runner.

  2. Optionally, set a link watcher. For example, to set the ethtool link watcher in the team0 connection profile:

    # nmcli connection modify team0 team.link-watchers "name=ethtool"

    Link watchers support different parameters. To set parameters for a link watcher, specify them space-separated in the name property. Note that the name property must be surrounded by quotes. For example, to use the ethtool link watcher and set its delay-up parameter to 2500 milliseconds (2.5 seconds):

    # nmcli connection modify team0 team.link-watchers "name=ethtool delay-up=2500"

    To set multiple link watchers and each of them with specific parameters, the link watchers must be separated by a comma. The following example sets the ethtool link watcher with the delay-up parameter and the arp_ping link watcher with the source-host and target-host parameter:

    # nmcli connection modify team0 team.link-watchers "name=ethtool delay-up=2, name=arp_ping source-host=192.0.2.1 target-host=192.0.2.2"
  3. Display the network interfaces, and note the names of the interfaces you want to add to the team:

    # nmcli device status
    DEVICE  TYPE      STATE         CONNECTION
    enp7s0  ethernet  disconnected  --
    enp8s0  ethernet  disconnected  --
    bond0   bond      connected  bond0
    bond1   bond      connected  bond1
    ...

    In this example:

    • enp7s0 and enp8s0 are not configured. To use these devices as ports, add connection profiles in the next step. Note that you can only use Ethernet interfaces in a team that are not assigned to any connection.
    • bond0 and bond1 have existing connection profiles. To use these devices as ports, modify their profiles in the next step.
  4. Assign the port interfaces to the team:

    1. If the interfaces you want to assign to the team are not configured, create new connection profiles for them:

      # nmcli connection add type ethernet slave-type team con-name team0-port1 ifname enp7s0 master team0
      # nmcli connection add type ethernet slave-type team con-name team0-port2 ifname enp8s0 master team0

      . These commands create profiles for enp7s0 and enp8s0, and add them to the team0 connection.

    2. To assign an existing connection profile to the team, set the master parameter of these connections to team0:

      # nmcli connection modify bond0 master team0
      # nmcli connection modify bond1 master team0

      These commands assign the existing connection profiles named bond0 and bond1 to the team0 connection.

  5. Configure the IP settings of the team. Skip this step if you want to use this team as a ports of other devices.

    1. Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain the team0 connection, enter:

      # nmcli connection modify team0 ipv4.addresses '192.0.2.1/24'
      # nmcli connection modify team0 ipv4.gateway '192.0.2.254'
      # nmcli connection modify team0 ipv4.dns '192.0.2.253'
      # nmcli connection modify team0 ipv4.dns-search 'example.com'
      # nmcli connection modify team0 ipv4.method manual
    2. Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain of the team0 connection, enter:

      # nmcli connection modify team0 ipv6.addresses '2001:db8:1::1/64'
      # nmcli connection modify team0 ipv6.gateway '2001:db8:1::fffe'
      # nmcli connection modify team0 ipv6.dns '2001:db8:1::fffd'
      # nmcli connection modify team0 ipv6.dns-search 'example.com'
      # nmcli connection modify team0 ipv6.method manual
  6. Activate the connection:

    # nmcli connection up team0

Verification steps

  • Display the status of the team:

    # teamdctl team0 state
    setup:
      runner: activebackup
    ports:
      enp7s0
        link watches:
          link summary: up
          instance[link_watch_0]:
            name: ethtool
            link: up
            down count: 0
      enp8s0
        link watches:
          link summary: up
          instance[link_watch_0]:
            name: ethtool
            link: up
            down count: 0
    runner:
      active port: enp7s0

    In this example, both ports are up.

Additional resources

10.7. Configuring a network team using nm-connection-editor

This section describes how you configure a network team using the nm-connection-editor application.

Note that nm-connection-editor can add only new ports to a team. To use an existing connection profile as a port, create the team using the nmcli utility as described in Configuring a network team using nmcli commands.

Important

Network teaming is deprecated in Red Hat Enterprise Linux 9. Consider using the network bonding driver as an alternative. For details, see Configuring network bonding.

Prerequisites

  • Two or more physical or virtual network devices are installed on the server.
  • To use Ethernet devices as ports of the team, the physical or virtual Ethernet devices must be installed on the server.
  • To use team, bond, or VLAN devices as ports of the team, ensure that these devices are not already configured.

Procedure

  1. Open a terminal, and enter nm-connection-editor:

    $ nm-connection-editor
  2. Click the + button to add a new connection.
  3. Select the Team connection type, and click Create.
  4. In the Team tab:

    1. Optional: Set the name of the team interface in the Interface name field.
    2. Click the Add button to add a new connection profile for a network interface and adding the profile as a port to the team.

      1. Select the connection type of the interface. For example, select Ethernet for a wired connection.
      2. Optional: Set a connection name for the port.
      3. If you create a connection profile for an Ethernet device, open the Ethernet tab, and select in the Device field the network interface you want to add as a port to the team. If you selected a different device type, configure it accordingly. Note that you can only use Ethernet interfaces in a team that are not assigned to any connection.
      4. Click Save.
    3. Repeat the previous step for each interface you want to add to the team.

      add nic to team in nm connection editor

    4. Click the Advanced button to set advanced options to the team connection.

      1. In the Runner tab, select the runner.
      2. In the Link Watcher tab, set the link watcher and its optional settings.
      3. Click OK.
  5. Configure the IP settings of the team. Skip this step if you want to use this team as a port of other devices.

    1. In the IPv4 Settings tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain: team IPv4 settings nm connection editor
    2. In the IPv6 Settings tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain: team IPv6 settings nm connection editor
  6. Save the team connection.
  7. Close nm-connection-editor.

Verification steps

  • Display the status of the team:

    # teamdctl team0 state
    setup:
      runner: activebackup
    ports:
      enp7s0
        link watches:
          link summary: up
          instance[link_watch_0]:
            name: ethtool
            link: up
            down count: 0
      enp8s0
        link watches:
          link summary: up
          instance[link_watch_0]:
            name: ethtool
            link: up
            down count: 0
    runner:
      active port: enp7s0

Chapter 11. Configuring network bonding

This section describes the basics of network bonding, the differences between bonding and teaming, and how to configure a network bond on Red Hat Enterprise Linux.

You can create bonds on different types of devices, such as:

  • Physical and virtual Ethernet devices
  • Network bridges
  • Network teams
  • VLAN devices

11.1. Understanding network bonding

Network bonding is a method to combine or aggregate network interfaces to provide a logical interface with higher throughput or redundancy.

The active-backup, balance-tlb, and balance-alb modes do not require any specific configuration of the network switch. However, other bonding modes require configuring the switch to aggregate the links. For example, Cisco switches requires EtherChannel for modes 0, 2, and 3, but for mode 4, the Link Aggregation Control Protocol (LACP) and EtherChannel are required.

For further details, see the documentation of your switch and Linux Ethernet Bonding Driver HOWTO.

Important

Certain network bonding features, such as the fail-over mechanism, do not support direct cable connections without a network switch. For further details, see the Is bonding supported with direct connection using crossover cables? KCS solution.

11.2. Understanding the default behavior of controller and port interfaces

Consider the following default behavior of, when managing or troubleshooting team or bond port interfaces using the NetworkManager service:

  • Starting the controller interface does not automatically start the port interfaces.
  • Starting a port interface always starts the controller interface.
  • Stopping the controller interface also stops the port interface.
  • A controller without ports can start static IP connections.
  • A controller without ports waits for ports when starting DHCP connections.
  • A controller with a DHCP connection waiting for ports completes when you add a port with a carrier.
  • A controller with a DHCP connection waiting for ports continues waiting when you add a port without carrier.

11.3. Upstream Switch Configuration Depending on the Bonding Modes

The following table describes which settings you must apply to the upstream switch depending on the bonding mode:

Bonding modeConfiguration on the switch

0 - balance-rr

Requires static Etherchannel enabled (not LACP-negotiated)

1 - active-backup

Requires autonomous ports

2 - balance-xor

Requires static Etherchannel enabled (not LACP-negotiated)

3 - broadcast

Requires static Etherchannel enabled (not LACP-negotiated)

4 - 802.3ad

Requires LACP-negotiated Etherchannel enabled

5 - balance-tlb

Requires autonomous ports

6 - balance-alb

Requires autonomous ports

For configuring these settings on your switch, see the switch documentation.

11.4. Configuring a network bond using nmcli commands

This section describes how to configure a network bond using nmcli commands.

Prerequisites

Procedure

  1. Create a bond interface:

    # nmcli connection add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup"

    This command creates a bond named bond0 that uses the active-backup mode.

    To additionally set a Media Independent Interface (MII) monitoring interval, add the miimon=interval option to the bond.options property. For example, to use the same command but, additionally, set the MII monitoring interval to 1000 milliseconds (1 second), enter:

    # nmcli connection add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup,miimon=1000"
  2. Display the network interfaces, and note names of interfaces you plan to add to the bond:

    # nmcli device status
    DEVICE   TYPE      STATE         CONNECTION
    enp7s0   ethernet  disconnected  --
    enp8s0   ethernet  disconnected  --
    bridge0  bridge    connected     bridge0
    bridge1  bridge    connected     bridge1
    ...

    In this example:

    • enp7s0 and enp8s0 are not configured. To use these devices as ports, add connection profiles in the next step.
    • bridge0 and bridge1 have existing connection profiles. To use these devices as ports, modify their profiles in the next step.
  3. Assign interfaces to the bond:

    1. If the interfaces you want to assign to the bond are not configured, create new connection profiles for them:

      # nmcli connection add type ethernet slave-type bond con-name bond0-port1 ifname enp7s0 master bond0
      # nmcli connection add type ethernet slave-type bond con-name bond0-port2 ifname enp8s0 master bond0

      These commands create profiles for enp7s0 and enp8s0, and add them to the bond0 connection.

    2. To assign an existing connection profile to the bond, set the master parameter of these connections to bond0:

      # nmcli connection modify bridge0 master bond0
      # nmcli connection modify bridge1 master bond0

      These commands assign the existing connection profiles named bridge0 and bridge1 to the bond0 connection.

  4. Configure the IP settings of the bond. Skip this step if you want to use this bond as a port of other devices.

    1. Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain to the bond0 connection, enter:

      # nmcli connection modify bond0 ipv4.addresses '192.0.2.1/24'
      # nmcli connection modify bond0 ipv4.gateway '192.0.2.254'
      # nmcli connection modify bond0 ipv4.dns '192.0.2.253'
      # nmcli connection modify bond0 ipv4.dns-search 'example.com'
      # nmcli connection modify bond0 ipv4.method manual
    2. Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain to the bond0 connection, enter:

      # nmcli connection modify bond0 ipv6.addresses '2001:db8:1::1/64'
      # nmcli connection modify bond0 ipv6.gateway '2001:db8:1::fffe'
      # nmcli connection modify bond0 ipv6.dns '2001:db8:1::fffd'
      # nmcli connection modify bond0 ipv6.dns-search 'example.com'
      # nmcli connection modify bond0 ipv6.method manual
  5. Activate the connection:

    # nmcli connection up bond0
  6. Verify that the ports are connected, and the CONNECTION column displays the port’s connection name:

    # nmcli device
    DEVICE   TYPE      STATE      CONNECTION
    ...
    enp7s0   ethernet  connected  bond0-port1
    enp8s0   ethernet  connected  bond0-port2

    Red Hat Enterprise Linux activates controller and port devices when the system boots. By activating any port connection, the controller is also activated. However, in this case, only one port connection is activated. By default, activating the controller does not automatically activate the ports. However, you can enable this behavior by setting:

    1. Enable the connection.autoconnect-slaves parameter of the bond’s connection:

      # nmcli connection modify bond0 connection.autoconnect-slaves 1
    2. Reactivate the bridge:

      # nmcli connection up bond0

Verification steps

  1. Temporarily remove the network cable from the host.

    Note that there is no method to properly test link failure events using software utilities. Tools that deactivate connections, such as nmcli, show only the bonding driver’s ability to handle port configuration changes and not actual link failure events.

  2. Display the status of the bond:

    # cat /proc/net/bonding/bond0

11.5. Configuring a network bond using nm-connection-editor

This section describes how to configure a network bond using the nm-connection-editor application.

Note that nm-connection-editor can add only new ports to a bond. To use an existing connection profile as a port, create the bond using the nmcli utility as described in Configuring a network bond using nmcli commands.

Prerequisites

  • Two or more physical or virtual network devices are installed on the server.
  • To use Ethernet devices as ports of the bond, the physical or virtual Ethernet devices must be installed on the server.
  • To use team, bond, or VLAN devices as ports of the bond, ensure that these devices are not already configured.

Procedure

  1. Open a terminal, and enter nm-connection-editor:

    $ nm-connection-editor
  2. Click the + button to add a new connection.
  3. Select the Bond connection type, and click Create.
  4. In the Bond tab:

    1. Optional: Set the name of the bond interface in the Interface name field.
    2. Click the Add button to add a network interface as a port to the bond.

      1. Select the connection type of the interface. For example, select Ethernet for a wired connection.
      2. Optional: Set a connection name for the port.
      3. If you create a connection profile for an Ethernet device, open the Ethernet tab, and select in the Device field the network interface you want to add as a port to the bond. If you selected a different device type, configure it accordingly. Note that you can only use Ethernet interfaces in a bond that are not configured.
      4. Click Save.
    3. Repeat the previous step for each interface you want to add to the bond:

      add nic to bond in nm connection editor

    4. Optional: Set other options, such as the Media Independent Interface (MII) monitoring interval.
  5. Configure the IP settings of the bond. Skip this step if you want to use this bond as a port of other devices.

    1. In the IPv4 Settings tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, DNS server, and DNS search domain:

      bond IPv4 settings nm connection editor

    2. In the IPv6 Settings tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, DNS server, and DNS search domain:

      bond IPv6 settings nm connection editor

  6. Click Save to save the bond connection.
  7. Close nm-connection-editor.

Verification steps

  1. Temporarily remove the network cable from the host.

    Note that there is no method to properly test link failure events using software utilities. Tools that deactivate connections, such as nmcli, show only the bonding driver’s ability to handle port configuration changes and not actual link failure events.

  2. Display the status of the bond:

    # cat /proc/net/bonding/bond0

11.6. Configuring a network bond using nmstatectl

This section describes how to use the nmstatectl utility to configure a network bond, bond0, with the following settings:

  • Network interfaces in the bond: enp1s0 and enp7s0
  • Mode: active-backup
  • Static IPv4 address: 192.0.2.1 with a /24 subnet mask
  • Static IPv6 address: 2001:db8:1::1 with a /64 subnet mask
  • IPv4 default gateway: 192.0.2.254
  • IPv6 default gateway: 2001:db8:1::fffe
  • IPv4 DNS server: 192.0.2.200
  • IPv6 DNS server: 2001:db8:1::ffbb
  • DNS search domain: example.com

Prerequisites

  • Two or more physical or virtual network devices are installed on the server.
  • To use Ethernet devices as ports in the bond, the physical or virtual Ethernet devices must be installed on the server.
  • To use team, bridge, or VLAN devices as ports in the bond, set the interface name in the port list, and define the corresponding interfaces.
  • The nmstate package is installed.

Procedure

  1. Create a YAML file, for example ~/create-bond.yml, with the following contents:

    ---
    interfaces:
    - name: bond0
      type: bond
      state: up
      ipv4:
        enabled: true
        address:
        - ip: 192.0.2.1
          prefix-length: 24
        dhcp: false
      ipv6:
        enabled: true
        address:
        - ip: 2001:db8:1::1
          prefix-length: 64
        autoconf: false
        dhcp: false
      link-aggregation:
        mode: active-backup
        port:
        - enp1s0
        - enp7s0
    - name: enp1s0
      type: ethernet
      state: up
    - name: enp7s0
      type: ethernet
      state: up
    
    routes:
      config:
      - destination: 0.0.0.0/0
        next-hop-address: 192.0.2.254
        next-hop-interface: bond0
      - destination: ::/0
        next-hop-address: 2001:db8:1::fffe
        next-hop-interface: bond0
    
    dns-resolver:
      config:
        search:
        - example.com
        server:
        - 192.0.2.200
        - 2001:db8:1::ffbb
  2. Apply the settings to the system:

    # nmstatectl apply ~/create-bond.yml

Verification steps

  1. Display the status of the devices and connections:

    # nmcli device status
    DEVICE      TYPE      STATE      CONNECTION
    bond0       bond      connected  bond0
  2. Display all settings of the connection profile:

    # nmcli connection show bond0
    connection.id:              bond0
    connection.uuid:            79cbc3bd-302e-4b1f-ad89-f12533b818ee
    connection.stable-id:       --
    connection.type:            bond
    connection.interface-name:  bond0
    ...
  3. Display the connection settings in YAML format:

    # nmstatectl show bond0

Additional resources

  • nmstatectl(8) man page
  • /usr/share/doc/nmstate/examples/

11.7. Configuring a network bond using RHEL System Roles

You can use the network RHEL System Role to configure a network bond. This procedure describes how to configure a bond in active-backup mode that uses two Ethernet devices, and sets an IPv4 and IPv6 addresses, default gateways, and DNS configuration.

Note

Set the IP configuration on the bridge and not on the ports of the Linux bridge.

Prerequisites

  • The ansible-core package and rhel-system-roles packages are installed on the control node.
  • If you use a different remote user than root when you run the playbook, this user has appropriate sudo permissions on the managed node.
  • Two or more physical or virtual network devices are installed on the server.

Procedure

  1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

    node.example.com
  2. Create the ~/bond-ethernet.yml playbook with the following content:

    ---
    - name: Configure a network bond that uses two Ethernet ports
      hosts: node.example.com
      become: true
      tasks:
      - include_role:
          name: linux-system-roles.network
    
        vars:
          network_connections:
            # Define the bond profile
            - name: bond0
              type: bond
              interface_name: bond0
              ip:
                address:
                  - "192.0.2.1/24"
                  - "2001:db8:1::1/64"
                gateway4: 192.0.2.254
                gateway6: 2001:db8:1::fffe
                dns:
                  - 192.0.2.200
                  - 2001:db8:1::ffbb
                dns_search:
                  - example.com
              bond:
                mode: active-backup
              state: up
    
            # Add an Ethernet profile to the bond
            - name: bond0-port1
              interface_name: enp7s0
              type: ethernet
              controller: bond0
              state: up
    
            # Add a second Ethernet profile to the bond
            - name: bond0-port2
              interface_name: enp8s0
              type: ethernet
              controller: bond0
              state: up
  3. Run the playbook:

    • To connect as root user to the managed host, enter:

      # ansible-playbook -u root ~/bond-ethernet.yml
    • To connect as a user to the managed host, enter:

      # ansible-playbook -u user_name --ask-become-pass ~/bond-ethernet.yml

      The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

    If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Additional resources

  • /usr/share/ansible/roles/rhel-system-roles.network/README.md file
  • ansible-playbook(1) man page

11.8. Creating a network bond to enable switching between an Ethernet and wireless connection without interrupting the VPN

RHEL users who connect their workstation to their company’s network typically use a VPN to access remote resources. However, if the workstation switches between an Ethernet and Wi-Fi connection, for example, if you release a laptop from a docking station with an Ethernet connection, the VPN connection is interrupted. To avoid this problem, you can create a network bond that uses the Ethernet and Wi-Fi connection in active-backup mode.

Prerequisites

  • The host contains an Ethernet and a Wi-Fi device.
  • An Ethernet and Wi-Fi NetworkManager connection profile has been created and both connections work independently.

    This procedure uses the following connection profiles to create a network bond named bond0:

    • Docking_station associated with the enp11s0u1 Ethernet device
    • Wi-Fi associated with the wlp61s0 Wi-Fi device

Procedure

  1. Create a bond interface in active-backup mode:

    # nmcli connection add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup"

    This command names both the interface and connection profile bond0.

  2. Configure the IPv4 settings of the bond:

    • If a DHCP server in your network assigns IPv4 addresses to hosts, no action is required.
    • If your local network requires static IPv4 addresses, set the address, network mask, default gateway, DNS server, and DNS search domain to the bond0 connection:

      # nmcli connection modify bond0 ipv4.addresses '192.0.2.1/24'
      # nmcli connection modify bond0 ipv4.gateway '192.0.2.254'
      # nmcli connection modify bond0 ipv4.dns '192.0.2.253'
      # nmcli connection modify bond0 ipv4.dns-search 'example.com'
      # nmcli connection modify bond0 ipv4.method manual
  3. Configure the IPv6 settings of the bond:

    • If your router or a DHCP server in your network assigns IPv6 addresses to hosts, no action is required.
    • If your local network requires static IPv6 addresses, set the address, network mask, default gateway, DNS server, and DNS search domain to the bond0 connection:

      # nmcli connection modify bond0 ipv6.addresses '2001:db8:1::1/64'
      # nmcli connection modify bond0 ipv6.gateway '2001:db8:1::fffe'
      # nmcli connection modify bond0 ipv6.dns '2001:db8:1::fffd'
      # nmcli connection modify bond0 ipv6.dns-search 'example.com'
      # nmcli connection modify bond0 ipv6.method manual
  4. Display the connection profiles:

    # nmcli connection show
    NAME             UUID                                  TYPE      DEVICE
    Docking_station  256dd073-fecc-339d-91ae-9834a00407f9  ethernet  enp11s0u1
    Wi-Fi            1f1531c7-8737-4c60-91af-2d21164417e8  wifi      wlp61s0
    ...

    You require the names of the connection profiles and the Ethernet device name in the next steps.

  5. Assign the connection profile of the Ethernet connection to the bond:

    # nmcli connection modify Docking_station master bond0
  6. Assign the connection profile of the Wi-Fi connection to the bond:

    # nmcli connection modify Wi-Fi master bond0
  7. If your Wi-Fi network uses MAC filtering to allow only MAC addresses on a allow list to access the network, configure that NetworkManager dynamically assigns the MAC address of the active port to the bond:

    # nmcli connection modify bond0 +bond.options fail_over_mac=1

    With this setting, you must set only the MAC address of the Wi-Fi device to the allow list instead of the MAC address of both the Ethernet and Wi-Fi device.

  8. Set the device associated with the Ethernet connection as primary device of the bond:

    # nmcli con modify bond0 +bond.options "primary=enp11s0u1"

    With this setting, the bond always uses the Ethernet connection if it is available.

  9. Configure that NetworkManager automatically activates ports when the bond0 device is activated:

    # nmcli connection modify bond0 connection.autoconnect-slaves 1
  10. Activate the bond0 connection:

    # nmcli connection up bond0

Verification steps

  • Display the currently active device, the status of the bond and its ports:

    # cat /proc/net/bonding/bond0
    Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
    
    Bonding Mode: fault-tolerance (active-backup) (fail_over_mac active)
    Primary Slave: enp11s0u1 (primary_reselect always)
    Currently Active Slave: enp11s0u1
    MII Status: up
    MII Polling Interval (ms): 1
    Up Delay (ms): 0
    Down Delay (ms): 0
    Peer Notification Delay (ms): 0
    
    Slave Interface: enp11s0u1
    MII Status: up
    Speed: 1000 Mbps
    Duplex: full
    Link Failure Count: 0
    Permanent HW addr: 00:53:00:59:da:b7
    Slave queue ID: 0
    
    Slave Interface: wlp61s0
    MII Status: up
    Speed: Unknown
    Duplex: Unknown
    Link Failure Count: 2
    Permanent HW addr: 00:53:00:b3:22:ba
    Slave queue ID: 0

Chapter 12. Setting up a WireGuard VPN

WireGuard is a high-performance VPN solution that runs in the Linux kernel. It uses modern cryptography and is easier to configure than many other VPN solutions. Additionally, WireGuard’s small codebase reduces the surface for attacks and, therefore, improves security. For authentication and encryption, WireGuard uses keys similar to SSH.

Important

WireGuard is provided as a Technology Preview only. Technology Preview features are not supported with Red Hat production Service Level Agreements (SLAs), might not be functionally complete, and Red Hat does not recommend using them for production. These previews provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

See Technology Preview Features Support Scope on the Red Hat Customer Portal for information about the support scope for Technology Preview features.

To set up a WireGuard VPN, you must complete the following steps. You can perform each step by using different options:

  1. Create public and private keys for every host in the VPN.
  2. Configure the WireGuard server by using nmcli, nm-connection-editor, or the wg-quick service.
  3. Configure firewalld on the WireGuard server by using the command line or graphical interface.
  4. Configure the WireGuard client by using nmcli, nm-connection-editor, or the wg-quick service.

Note that WireGuard operates only on the network layer (layer 3). Therefore, you cannot use DHCP and must assign static IP addresses or IPv6 link-local addresses to the tunnel devices on both the server and clients.

Important

You can use WireGuard only if the Federal Information Processing Standard (FIPS) mode in RHEL is disabled.

Note that all hosts that participate in a WireGuard VPN are peers. This documentation uses the terms client to describe hosts that establish a connection and server to describe the host with the fixed hostname or IP address that the clients connect to and optionally route all traffic through this server.

12.1. Protocols and primitives used by WireGuard

WireGuard uses the following protocols and primitives:

  • ChaCha20 for symmetric encryption, authenticated with Poly1305, using Authenticated Encryption with Associated Data (AEAD) construction as described in RFC7539
  • Curve25519 for Elliptic-curve Diffie–Hellman (ECDH) key exchange
  • BLAKE2s for hashing and keyed hashing, as described in RFC7693
  • SipHash24 for hash table keys
  • HKDF for key derivation, as described in RFC5869

12.2. How WireGuard uses tunnel IP addresses, public keys, and remote endpoints

When WireGuard sends a network packet to a peer:

  1. WireGuard reads the destination IP from the packet and compares it to the list of allowed IP addresses in the local configuration. If the peer is not found, WireGuard drops the packet.
  2. If the peer is valid, WireGuard encrypts the packet using the peer’s public key.
  3. The sending host looks up the most recent Internet IP address of the host and sends the encrypted packet to it.

When WireGuard receives a packet:

  1. WireGuard decrypts the packet using private key of the remote host.
  2. WireGuard reads the internal source address from the packet and looks up whether the IP is configured in the list of allowed IP addresses in the settings for the peer on the local host. If the source IP is on the allowlist, WireGuard accepts the packet. If the IP address is not on the list, WireGuard drops the packet.

The association of public keys and allowed IP addresses is called Cryptokey Routing Table. This means that the list of IP addresses behaves similar to a routing table when sending packets, and as a kind of access control list when receiving packets.

12.3. Using a WireGuard client behind NAT and firewalls

WireGuard uses the UDP protocol and transmits data only when a peer sends packets. Stateful firewalls and network address translation (NAT) on routers track connections to enable a peer behind NAT or a firewall to receive packets.

To keep the connection active, WireGuard supports persistent keepalives. This means you can set an interval at which WireGuard sends keepalive packets. By default, the persistent keep-alive feature is disabled to reduce network traffic. Enable this feature on the client if you use the client in a network with NAT or if a firewall closes the connection after some time of inactivity.

12.4. Creating private and public keys to be used in WireGuard connections

WireGuard uses base64-encoded private and public keys to authenticate hosts to each other. Therefore, you must create the keys on each host that participates in the WireGuard VPN.

Important

For secure connections, create different keys for each host, and ensure that you only share the public key with the remote WireGuard host. Do not use the example keys used in this documentation.

Procedure

  1. Install the wireguard-tools package:

    # yum install wireguard-tools
  2. Create a private key and a corresponding public key for the host:

    # wg genkey | tee /etc/wireguard/$HOSTNAME.private.key | wg pubkey > /etc/wireguard/$HOSTNAME.public.key

    You will need the content of the key files, but not the files themselves. However, Red Hat recommends keeping the files in case that you need to remember the keys in future.

  3. Set secure permissions on the key files:

    # chmod 600 /etc/wireguard/$HOSTNAME.private.key /etc/wireguard/$HOSTNAME.public.key
  4. Display the private key:

    # cat /etc/wireguard/$HOSTNAME.private.key
    YFAnE0psgIdiAF7XR4abxiwVRnlMfeltxu10s/c4JXg=

    You will need the private key to configure the WireGuard connection on the local host. Do not share the private key.

  5. Display the public key:

    # cat /etc/wireguard/server.public.key
    UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=

    You will need the public key to configure the WireGuard connection on the remote host.

Additional resources

  • The wg(8) man page

12.5. Configuring a WireGuard server using nmcli

You can configure the WireGuard server by creating a connection profile in NetworkManager. Use this method to let NetworkManager manage the WireGuard connection.

This procedure assumes the following settings:

  • Server:

    • Private key: YFAnE0psgIdiAF7XR4abxiwVRnlMfeltxu10s/c4JXg=
    • Tunnel IPv4 address: 192.0.2.1/24
    • Tunnel IPv6 address: 2001:db8:1::1/32
  • Client:

    • Public key: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=
    • Tunnel IPv4 address: 192.0.2.2/24
    • Tunnel IPv6 address: 2001:db8:1::2/32

Prerequisites

  • You have generated the public and private key for both the server and client.
  • You know the following information:

    • The private key of the server
    • The static tunnel IP addresses and subnet masks of the client
    • The public key of the client
    • The static tunnel IP addresses and subnet masks of the server

Procedure

  1. Add a NetworkManager WireGuard connection profile:

    # nmcli connection add type wireguard con-name server-wg0 ifname wg0 autoconnect no

    This command creates a profile named server-wg0 and assigns the virtual interface wg0 to it. To prevent the connection from starting automatically after you add it without finalizing the configuration, disable the autoconnect parameter.

  2. Set the tunnel IPv4 address and subnet mask of the server:

    # nmcli connection modify server-wg0 ipv4.method manual ipv4.addresses 192.0.2.1/24
  3. Set the tunnel IPv6 address and subnet mask of the server:

    # nmcli connection modify server-wg0 ipv6.method manual ipv6.addresses 2001:db8:1::1/32
  4. Add the server’s private key to the connection profile:

    # nmcli connection modify server-wg0 wireguard.private-key "YFAnE0psgIdiAF7XR4abxiwVRnlMfeltxu10s/c4JXg="
  5. Set the port for incoming WireGuard connections:

    # nmcli connection modify server-wg0 wireguard.listen-port 51820

    Always set a fixed port number on hosts that receive incoming WireGuard connections. If you do not set a port, WireGuard uses a random free port each time you activate the wg0 interface.

  6. Add peer configurations for each client that you want to allow to communicate with this server. You must add these settings manually, because the nmcli utility does not support setting the corresponding connection properties.

    1. Edit the /etc/NetworkManager/system-connections/server-wg0.nmconnection file, and append:

      [wireguard-peer.bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=]
      allowed-ips=192.0.2.2;2001:db8:1::2;
      • The [wireguard-peer.<public_key_of_the_client>] entry defines the peer section of the client, and the section name contains the public key of the client.
      • The allowed-ips parameter sets the tunnel IP addresses of the client that are allowed to send data to this server.

        Add a section for each client.

    2. Reload the server-wg0 connection profile:

      # nmcli connection load /etc/NetworkManager/system-connections/server-wg0.nmconnection
  7. Optional: Configure the connection to start automatically, enter:

    # nmcli connection modify server-wg0 autoconnect yes
  8. Reactivate the server-wg0 connection:

    # nmcli connection up server-wg0

Verification

  1. Display the interface configuration of the wg0 device:

    # wg show wg0
    interface: wg0
      public key: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
      private key: (hidden)
      listening port: 51820
    
    peer: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=
      allowed ips: 192.0.2.2/32, 2001:db8:1::2/128

    To display the private key in the output, use the WG_HIDE_KEYS=never wg show wg0 command.

  2. Display the IP configuration of the wg0 device:

    # ip address show wg0
    20: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
        link/none
        inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute wg0
           valid_lft forever preferred_lft forever
        inet6 2001:db8:1::1/32 scope global noprefixroute
           valid_lft forever preferred_lft forever
        inet6 fe80::3ef:8863:1ce2:844/64 scope link noprefixroute
           valid_lft forever preferred_lft forever

Additional resources

  • The wg(8) man page
  • The WireGuard setting section in the nm-settings(5) man page

12.6. Configuring a WireGuard server using nm-connection-editor

You can configure the WireGuard server by creating a connection profile in NetworkManager. Use this method to let NetworkManager manage the WireGuard connection.

Prerequisites

  • You have generated the public and private key for both the server and client.
  • You know the following information:

    • The private key of the server
    • The static tunnel IP addresses and subnet masks of the client
    • The public key of the client
    • The static tunnel IP addresses and subnet masks of the server

Procedure

  1. Open a terminal, and enter:

    # nm-connection-editor
  2. Add a new connection by clicking the + button.
  3. Select the WireGuard connection type, and click Create.
  4. Optional: Update the connection name.
  5. On the General tab, select Connect automatically with priority. Optionally, set a priority value.
  6. On the WireGuard tab:

    1. Enter the name of the virtual interface, such as wg0, that NetworkManager should assign to the connection.
    2. Enter the private key of the server.
    3. Set the listen port number, such as 51820, for incoming WireGuard connections.

      Always set a fixed port number on hosts that receive incoming WireGuard connections. If you do not set a port, WireGuard uses a random free port each time you activate the interface.

    4. Click Add to add peers:

      1. Enter the public key of the client.
      2. Set the Allowed IPs field to the tunnel IP addresses of the client that are allowed to send data to this server.
      3. Click Apply.
  7. On the IPv4 Settings tab:

    1. Select Manual in the Method list.
    2. Click Add to enter the tunnel IPv4 address and the subnet mask. Leave the Gateway field empty.
  8. On the IPv6 Settings tab:

    1. Select Manual in the Method list.
    2. Click Add to enter the tunnel IPv6 address and the subnet mask. Leave the Gateway field empty.
  9. Click Save to store the connection profile.

Verification

  1. Display the interface configuration of the wg0 device:

    # wg show wg0
    interface: wg0
      public key: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
      private key: (hidden)
      listening port: 51820
    
    peer: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=
      allowed ips: 192.0.2.2/32, 2001:db8:1::2/128

    To display the private key in the output, use the WG_HIDE_KEYS=never wg show wg0 command.

  2. Display the IP configuration of the wg0 device:

    # ip address show wg0
    20: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
        link/none
        inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute wg0
           valid_lft forever preferred_lft forever
        inet6 2001:db8:1::1/32 scope global noprefixroute
           valid_lft forever preferred_lft forever
        inet6 fe80::3ef:8863:1ce2:844/64 scope link noprefixroute
           valid_lft forever preferred_lft forever

Additional resources

  • The wg(8) man page

12.7. Configuring a WireGuard server using the wg-quick service

You can configure the WireGuard server by creating a configuration file in the /etc/wireguard/ directory. Use this method to configure the service independently from NetworkManager.

This procedure assumes the following settings:

  • Server:

    • Private key: YFAnE0psgIdiAF7XR4abxiwVRnlMfeltxu10s/c4JXg=
    • Tunnel IPv4 address: 192.0.2.1/24
    • Tunnel IPv6 address: 2001:db8:1::1/32
  • Client:

    • Public key: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=
    • Tunnel IPv4 address: 192.0.2.2/24
    • Tunnel IPv6 address: 2001:db8:1::2/32

Prerequisites

  • You have generated the public and private key for both the server and client.
  • You know the following information:

    • The private key of the server
    • The static tunnel IP addresses and subnet masks of the client
    • The public key of the client
    • The static tunnel IP addresses and subnet masks of the server

Procedure

  1. Install the wireguard-tools package:

    # yum install wireguard-tools
  2. Create the /etc/wireguard/wg0.conf file with the following content:

    [Interface]
    Address = 192.0.2.1/24, 2001:db8:1::1/32
    ListenPort = 51820
    PrivateKey = YFAnE0psgIdiAF7XR4abxiwVRnlMfeltxu10s/c4JXg=
    
    [Peer]
    PublicKey = bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=
    AllowedIPs = 192.0.2.2, 2001:db8:1::2
    • The [Interface] section describes the WireGuard settings of the interface on the server:

      • Address: A comma-separated list of the server’s tunnel IP addresses.
      • PrivateKey: The private key of the server.
      • ListenPort: The port on which WireGuard listens for incoming UDP connections.

        Always set a fixed port number on hosts that receive incoming WireGuard connections. If you do not set a port, WireGuard uses a random free port each time you activate the wg0 interface.

    • Each [Peer] section describes the settings of one client:

      • PublicKey: The public key of the client.
      • AllowedIPs: The tunnel IP addresses of the client that are allowed to send data to this server.
  3. Enable and start the WireGuard connection:

    # systemctl enable --now wg-quick@wg0

    The systemd instance name must match the name of the configuration file in the /etc/wireguard/ directory without the .conf suffix. The service also uses this name for the virtual network interface.

Verification

  1. Display the interface configuration of the wg0 device:

    # wg show wg0
    interface: wg0
      public key: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
      private key: (hidden)
      listening port: 51820
    
    peer: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=
      allowed ips: 192.0.2.2/32, 2001:db8:1::2/128

    To display the private key in the output, use the WG_HIDE_KEYS=never wg show wg0 command.

  2. Display the IP configuration of the wg0 device:

    # ip address show wg0
    20: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
        link/none
        inet 192.0.2.1/24 scope global wg0
           valid_lft forever preferred_lft forever
        inet6 2001:db8:1::1/32 scope global
           valid_lft forever preferred_lft forever

Additional resources

  • The wg(8) man page
  • The wg-quick(8) man page

12.8. Configuring firewalld on a WireGuard server using the command line

You must configure the firewalld service on the WireGuard server to allow incoming connections from clients. Additionally, if clients should be able to use the WireGuard server as the default gateway and route all traffic through the tunnel, you must enable masquerading.

Procedure

  1. Open the WireGuard port for incoming connections in the firewalld service:

    # firewall-cmd --permanent --add-port=51820/udp --zone=public
  2. If clients should route all traffic through the tunnel and use the WireGuard server as the default gateway, enable masquerading for the public zone:

    # firewall-cmd --permanent --zone=public --add-masquerade
  3. Reload the firewalld rules.

    # firewall-cmd --reload

Verification

  • Display the configuration of the public zone:

    # firewall-cmd --list-all
    public (active)
      ...
      ports: 51820/udp
      masquerade: yes
      ...

Additional resources

  • The firewall-cmd(1) man page

12.9. Configuring firewalld on a WireGuard server using the graphical interface

You must configure the firewalld service on the WireGuard server to allow incoming connections from clients. Additionally, if clients should be able to use the WireGuard server as the default gateway and route all traffic through the tunnel, you must enable masquerading.

Procedure

  1. Press the Super key, enter firewall, and select the Firewall application from the results.
  2. Select Permanent in the Configuration list.
  3. Select the public zone.
  4. Allow incoming connections to the WireGuard port:

    1. On the Ports tab, click Add.
    2. Enter the port number you set for incoming WireGuard connections:
    3. Select udp from the Protocol list.
    4. Click OK.
  5. If clients should route all traffic through the tunnel and use the WireGuard server as the default gateway:

    1. Navigate to the Masquerading tab of the public zone.
    2. Select Masquerade zone.
  6. Select OptionsReload Firewalld.

Verification

  • Display the configuration of the public zone:

    # firewall-cmd --list-all
    public (active)
      ...
      ports: 51820/udp
      masquerade: yes
      ...

12.10. Configuring a WireGuard client using nmcli

You can configure a WireGuard client by creating a connection profile in NetworkManager. Use this method to let NetworkManager manage the WireGuard connection.

This procedure assumes the following settings:

  • Client:

    • Private key: aPUcp5vHz8yMLrzk8SsDyYnV33IhE/k20e52iKJFV0A=
    • Tunnel IPv4 address: 192.0.2.2/24
    • Tunnel IPv6 address: 2001:db8:1::2/32
  • Server:

    • Public key: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
    • Tunnel IPv4 address: 192.0.2.1/24
    • Tunnel IPv6 address: 2001:db8:1::1/32

Prerequisites

  • You have generated the public and private key for both the server and client.
  • You know the following information:

    • The private key of the client
    • The static tunnel IP addresses and subnet masks of the client
    • The public key of the server
    • The static tunnel IP addresses and subnet masks of the server

Procedure

  1. Add a NetworkManager WireGuard connection profile:

    # nmcli connection add type wireguard con-name client-wg0 ifname wg0 autoconnect no

    This command creates a profile named client-wg0 and assigns the virtual interface wg0 to it. To prevent the connection from starting automatically after you add it without finalizing the configuration, disable the autoconnect parameter.

  2. Optional: Configure NetworkManager so that it does not automatically start the client-wg connection:

    # nmcli connection modify client-wg0 autoconnect no
  3. Set the tunnel IPv4 address and subnet mask of the client:

    # nmcli connection modify client-wg0 ipv4.method manual ipv4.addresses 192.0.2.2/24
  4. Set the tunnel IPv6 address and subnet mask of the client:

    # nmcli connection modify client-wg0 ipv6.method manual ipv6.addresses 2001:db8:1::2/32
  5. If you want to route all traffic through the tunnel, set the tunnel IP addresses of the server as the default gateway:

    # nmcli connection modify client-wg0 ipv4.gateway 192.0.2.1 ipv6.gateway 2001:db8:1::1
  6. Add the server’s private key to the connection profile:

    # nmcli connection modify client-wg0 wireguard.private-key "aPUcp5vHz8yMLrzk8SsDyYnV33IhE/k20e52iKJFV0A="
    1. Edit the /etc/NetworkManager/system-connections/client-wg0.nmconnection file, and append:

      [wireguard-peer.UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=]
      endpoint=server.example.com:51820
      allowed-ips=192.0.2.1;2001:db8:1::1;
      persistent-keepalive=20
      • The [wireguard-peer.<public_key_of_the_server>] entry defines the peer section of the server, and the section name contains the public key of the server.
      • The endpoint parameter sets the hostname or IP address and the port of the server. The client uses this information to establish the connection.
      • The allowed-ips parameter sets a list of IP addresses that are allowed to send data to this client. For example, set the parameter to:

        • The tunnel IP addresses of the server to allow only the server to communicate with this client. The value in the example above configures this scenario.
        • 0.0.0.0/0;::/0; to allow any remote IPv4 and IPv6 address to communicate with this client. Use this setting to route all traffic through the tunnel and use the WireGuard server as default gateway.
      • The optional persistent-keepalive parameter defines an interval in seconds in which WireGuard sends a keepalive packet to the server. Set this parameter if you use the client in a network with network address translation (NAT) or if a firewall closes the UDP connection after some time of inactivity.
    2. Reload the client-wg0 connection profile:

      # nmcli connection load /etc/NetworkManager/system-connections/client-wg0.nmconnection
  7. Reactivate the client-wg0 connection:

    # nmcli connection up client-wg0

Verification

  1. Ping the IP addresses of the server:

    # ping 192.0.2.1
    # ping6 2001:db8:1::1
  2. Display the interface configuration of the wg0 device:

    # wg show wg0
    interface: wg0
      public key: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=
      private key: (hidden)
      listening port: 51820
    
    peer: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
      endpoint: server.example.com:51820
      allowed ips: 192.0.2.1/32, 2001:db8:1::1/128
      latest handshake: 1 minute, 41 seconds ago
      transfer: 824 B received, 1.01 KiB sent
      persistent keepalive: every 20 seconds

    To display the private key in the output, use the WG_HIDE_KEYS=never wg show wg0 command.

    Note that the output contains only the latest handshake and transfer entries if you have already sent traffic through the VPN tunnel.

  3. Display the IP configuration of the wg0 device:

    # ip address show wg0
    10: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
        link/none
        inet 192.0.2.2/24 brd 192.0.2.255 scope global noprefixroute wg0
           valid_lft forever preferred_lft forever
        inet6 2001:db8:1::2/32 scope global noprefixroute
           valid_lft forever preferred_lft forever
        inet6 fe80::73d9:6f51:ea6f:863e/64 scope link noprefixroute
           valid_lft forever preferred_lft forever

Additional resources

  • The wg(8) man page
  • The WireGuard setting section in the nm-settings(5) man page

12.11. Configuring a WireGuard client using nm-connection-editor

You can configure a WireGuard client by creating a connection profile in NetworkManager. Use this method to let NetworkManager manage the WireGuard connection.

Prerequisites

  • You have generated the public and private key for both the server and client.
  • You know the following information:

    • The private key of the client
    • The static tunnel IP addresses and subnet masks of the client
    • The public key of the server
    • The static tunnel IP addresses and subnet masks of the server

Procedure

  1. Open a terminal, and enter:

    # nm-connection-editor
  2. Add a new connection by clicking the + button.
  3. Select the WireGuard connection type, and click Create.
  4. Optional: Update the connection name.
  5. Optional: On the General tab, select Connect automatically with priority.
  6. On the WireGuard tab:

    1. Enter the name of the virtual interface, such as wg0, that NetworkManager should assign to the connection.
    2. Enter client’s private key.
    3. Click Add to add peers:

      1. Enter the public key of the server.
      2. Set the Allowed IPs field. For example, set it to:

        • The tunnel IP addresses of the server to allow only the server to communicate with this client.
        • 0.0.0.0/0;::/0; to allow any remote IPv4 and IPv6 address to communicate with this client. Use this setting to route all traffic through the tunnel and use the WireGuard server as default gateway.
      3. Enter the hostname or IP address and port of the WireGuard server into the Endpoint field. Use the following format: hostname_or_IP:port_number
      4. Optional: If you use the client in a network with network address translation (NAT) or if a firewall closes the UDP connection after some time of inactivity, set a persistent keep alive interval in seconds. In this interval, the client sends a keepalive packet to the server.
      5. Click Apply.
  7. On the IPv4 Settings tab:

    1. Select Manual in the Method list.
    2. Click Add to enter the tunnel IPv4 address and the subnet mask.
    3. If you want to route all traffic through the tunnel, set the tunnel IPv4 address of the server in the Gateway field. Otherwise, leave the field empty.
  8. On the IPv6 Settings tab:

    1. Select Manual in the Method list.
    2. Click Add to enter the tunnel IPv6 address and the subnet mask.
    3. If you want to route all traffic through the tunnel, set the tunnel IPv6 address of the server in the Gateway field. Otherwise, leave the field empty.
  9. Click Save to store the connection profile.

Verification

  1. Ping the IP addresses of the server:

    # ping 192.0.2.1
    # ping6 2001:db8:1::1
  2. Display the interface configuration of the wg0 device:

    # wg show wg0
    interface: wg0
      public key: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=
      private key: (hidden)
      listening port: 51820
    
    peer: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
      endpoint: server.example.com:51820
      allowed ips: 192.0.2.1/32, 2001:db8:1::1/128
      latest handshake: 1 minute, 41 seconds ago
      transfer: 824 B received, 1.01 KiB sent
      persistent keepalive: every 20 seconds

    To display the private key in the output, use the WG_HIDE_KEYS=never wg show wg0 command.

    Note that the output only contains the latest handshake and transfer entries if you have already sent traffic through the VPN tunnel.

  3. Display the IP configuration of the wg0 device:

    # ip address show wg0
    10: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
        link/none
        inet 192.0.2.2/24 brd 192.0.2.255 scope global noprefixroute wg0
           valid_lft forever preferred_lft forever
        inet6 2001:db8:1::2/32 scope global noprefixroute
           valid_lft forever preferred_lft forever
        inet6 fe80::73d9:6f51:ea6f:863e/64 scope link noprefixroute
           valid_lft forever preferred_lft forever

Additional resources

  • The wg(8) man page

12.12. Configuring a WireGuard client using the wg-quick service

You can configure a WireGuard client by creating a configuration file in the /etc/wireguard/ directory. Use this method to configure the service independently from NetworkManager.

This procedure assumes the following settings:

  • Client:

    • Private key: aPUcp5vHz8yMLrzk8SsDyYnV33IhE/k20e52iKJFV0A=
    • Tunnel IPv4 address: 192.0.2.2/24
    • Tunnel IPv6 address: 2001:db8:1::2/32
  • Server:

    • Public key: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
    • Tunnel IPv4 address: 192.0.2.1/24
    • Tunnel IPv6 address: 2001:db8:1::1/32

Prerequisites

  • You have generated the public and private key for both the server and client.
  • You know the following information:

    • The private key of the client
    • The static tunnel IP addresses and subnet masks of the client
    • The public key of the server
    • The static tunnel IP addresses and subnet masks of the server

Procedure

  1. Install the wireguard-tools package:

    # yum install wireguard-tools
  2. Create the /etc/wireguard/wg0.conf file with the following content:

    [Interface]
    Address = 192.0.2.2/24, 2001:db8:1::2/32
    PrivateKey = aPUcp5vHz8yMLrzk8SsDyYnV33IhE/k20e52iKJFV0A=
    
    [Peer]
    PublicKey = UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
    AllowedIPs = 192.0.2.1, 2001:db8:1::1
    Endpoint = server.example.com:51820
    PersistentKeepalive = 20
    • The [Interface] section describes the WireGuard settings of the interface on the client:

      • Address: A comma-separated list of the client’s tunnel IP addresses.
      • PrivateKey: The private key of the client.
    • The [Peer] section describes the settings of the server:

      • PublicKey: The public key of the server.
      • AllowedIPs: The IP addresses that are allowed to send data to this client. For example, set the parameter to:

        • The tunnel IP addresses of the server to allow only the server to communicate with this client. The value in the example above configures this scenario.
        • 0.0.0.0/0, ::/0 to allow any remote IPv4 and IPv6 address to communicate with this client. Use this setting to route all traffic through the tunnel and use the WireGuard server as default gateway.
      • Endpoint: Sets the hostname or IP address and the port of the server. The client uses this information to establish the connection.
      • The optional persistent-keepalive parameter defines an interval in seconds in which WireGuard sends a keepalive packet to the server. Set this parameter if you use the client in a network with network address translation (NAT) or if a firewall closes the UDP connection after some time of inactivity.
  3. Enable and start the WireGuard connection:

    # systemctl enable --now wg-quick@wg0

    The systemd instance name must match the name of the configuration file in the /etc/wireguard/ directory without the .conf suffix. The service also uses this name for the virtual network interface.

Verification

  1. Ping the IP addresses of the server:

    # ping 192.0.2.1
    # ping6 2001:db8:1::1
  2. Display the interface configuration of the wg0 device:

    # wg show wg0
    interface: wg0
      public key: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=
      private key: (hidden)
      listening port: 51820
    
    peer: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
      endpoint: server.example.com:51820
      allowed ips: 192.0.2.1/32, 2001:db8:1::1/128
      latest handshake: 1 minute, 41 seconds ago
      transfer: 824 B received, 1.01 KiB sent
      persistent keepalive: every 20 seconds

    To display the private key in the output, use the WG_HIDE_KEYS=never wg show wg0 command.

    Note that the output contains only the latest handshake and transfer entries if you have already sent traffic through the VPN tunnel.

  3. Display the IP configuration of the wg0 device:

    # ip address show wg0
    10: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
        link/none
        inet 192.0.2.2/24 scope global wg0
           valid_lft forever preferred_lft forever
        inet6 2001:db8:1::2/32__ scope global
           valid_lft forever preferred_lft forever

Additional resources

  • The wg(8) man page
  • The wg-quick(8) man page

Chapter 13. Configuring a VPN connection

This section explains how to configure a virtual private network (VPN) connection.

A VPN is a way of connecting to a local network over the Internet. IPsec provided by Libreswan is the preferred method for creating a VPN. Libreswan is an user-space IPsec implementation for VPN. A VPN enables the communication between your LAN, and another, remote LAN by setting up a tunnel across an intermediate network such as the Internet. For security reasons, a VPN tunnel always uses authentication and encryption. For cryptographic operations, Libreswan uses the NSS library.

13.1. Configuring a VPN connection with control-center

This procedure describes how to configure a VPN connection using control-center.

Prerequisites

  • The NetworkManager-libreswan-gnome package is installed.

Procedure

  1. Press the Super key, type Settings, and press Enter to open the control-center application.
  2. Select the Network entry on the left.
  3. Click the + icon.
  4. Select VPN.
  5. Select the Identity menu entry to see the basic configuration options:

    General

    Gateway — The name or IP address of the remote VPN gateway.

    Authentication

    Type

    • IKEv2 (Certificate)- client is authenticated by certificate. It is more secure (default).
    • IKEv1 (XAUTH) - client is authenticated by user name and password, or a pre-shared key (PSK).

      The following configuration settings are available under the Advanced section:

      Figure 13.1. Advanced options of a VPN connection

      networking vpn advanced options
      Warning

      When configuring an IPsec-based VPN connection using the gnome-control-center application, the Advanced dialog displays the configuration, but it does not allow any changes. As a consequence, users cannot change any advanced IPsec options. Use the nm-connection-editor or nmcli tools instead to perform configuration of the advanced properties.

      Identification

    • Domain — If required, enter the Domain Name.

      Security

    • Phase1 Algorithms — corresponds to the ike Libreswan parameter — enter the algorithms to be used to authenticate and set up an encrypted channel.
    • Phase2 Algorithms — corresponds to the esp Libreswan parameter — enter the algorithms to be used for the IPsec negotiations.

      Check the Disable PFS field to turn off Perfect Forward Secrecy (PFS) to ensure compatibility with old servers that do not support PFS.

    • Phase1 Lifetime — corresponds to the ikelifetime Libreswan parameter — how long the key used to encrypt the traffic will be valid.
    • Phase2 Lifetime — corresponds to the salifetime Libreswan parameter — how long a particular instance of a connection should last before expiring.

      Note that the encryption key should be changed from time to time for security reasons.

    • Remote network — corresponds to the rightsubnet Libreswan parameter — the destination private remote network that should be reached through the VPN.

      Check the narrowing field to enable narrowing. Note that it is only effective in IKEv2 negotiation.

    • Enable fragmentation — corresponds to the fragmentation Libreswan parameter — whether or not to allow IKE fragmentation. Valid values are yes (default) or no.
    • Enable Mobike — corresponds to the mobike Libreswan parameter — whether to allow Mobility and Multihoming Protocol (MOBIKE, RFC 4555) to enable a connection to migrate its endpoint without needing to restart the connection from scratch. This is used on mobile devices that switch between wired, wireless, or mobile data connections. The values are no (default) or yes.
  6. Select the IPv4 menu entry:

    IPv4 Method

    • Automatic (DHCP) — Choose this option if the network you are connecting to uses Router Advertisements (RA) or a DHCP server to assign dynamic IP addresses.
    • Link-Local Only — Choose this option if the network you are connecting to does not have a DHCP server and you do not want to assign IP addresses manually. Random addresses will be assigned as per RFC 3927 with prefix 169.254/16.
    • Manual — Choose this option if you want to assign IP addresses manually.
    • DisableIPv4 is disabled for this connection.

      DNS

      In the DNS section, when Automatic is ON, switch it to OFF to enter the IP address of a DNS server you want to use separating the IPs by comma.

      Routes

      Note that in the Routes section, when Automatic is ON, routes from DHCP are used, but you can also add additional static routes. When OFF, only static routes are used.

    • Address — Enter the IP address of a remote network or host.
    • Netmask — The netmask or prefix length of the IP address entered above.
    • Gateway — The IP address of the gateway leading to the remote network or host entered above.
    • Metric — A network cost, a preference value to give to this route. Lower values will be preferred over higher values.

      Use this connection only for resources on its network

      Select this check box to prevent the connection from becoming the default route. Selecting this option means that only traffic specifically destined for routes learned automatically over the connection or entered here manually is routed over the connection.

  7. To configure IPv6 settings in a VPN connection, select the IPv6 menu entry:

    IPv6 Method

    • Automatic — Choose this option to use IPv6 Stateless Address AutoConfiguration (SLAAC) to create an automatic, stateless configuration based on the hardware address and Router Advertisements (RA).
    • Automatic, DHCP only — Choose this option to not use RA, but request information from DHCPv6 directly to create a stateful configuration.
    • Link-Local Only — Choose this option if the network you are connecting to does not have a DHCP server and you do not want to assign IP addresses manually. Random addresses will be assigned as per RFC 4862 with prefix FE80::0.
    • Manual — Choose this option if you want to assign IP addresses manually.
    • DisableIPv6 is disabled for this connection.

      Note that DNS, Routes, Use this connection only for resources on its network are common to IPv4 settings.

  8. Once you have finished editing the VPN connection, click the Add button to customize the configuration or the Apply button to save it for the existing one.
  9. Switch the profile to ON to active the VPN connection.

Additional resources

  • nm-settings-libreswan(5)

13.2. Configuring a VPN connection using nm-connection-editor

This procedure describes how to configure a VPN connection using nm-connection-editor.

Prerequisites

  • The NetworkManager-libreswan-gnome package is installed.
  • If you configure an Internet Key Exchange version 2 (IKEv2) connection:

    • The certificate is imported into the IPsec network security services (NSS) database.
    • The nickname of the certificate in the NSS database is known.

Procedure

  1. Open a terminal, and enter:

    $ nm-connection-editor
  2. Click the + button to add a new connection.
  3. Select the IPsec based VPN connection type, and click Create.
  4. On the VPN tab:

    1. Enter the host name or IP address of the VPN gateway into the Gateway field, and select an authentication type. Based on the authentication type, you must enter different additional information:

      • IKEv2 (Certifiate) authenticates the client by using a certificate, which is more secure. This setting requires the nickname of the certificate in the IPsec NSS database
      • IKEv1 (XAUTH) authenticates the user by using a user name and password (pre-shared key). This setting requires that you enter the following values:

        • User name
        • Password
        • Group name
        • Secret
    2. If the remote server specifies a local identifier for the IKE exchange, enter the exact string in the Remote ID field. In the remote server runs Libreswan, this value is set in the server’s leftid parameter.

      nm connection editor vpn tab

    3. Optionally, configure additional settings by clicking the Advanced button. You can configure the following settings:

      • Identification

        • Domain — If required, enter the domain name.
      • Security

        • Phase1 Algorithms corresponds to the ike Libreswan parameter. Enter the algorithms to be used to authenticate and set up an encrypted channel.
        • Phase2 Algorithms corresponds to the esp Libreswan parameter. Enter the algorithms to be used for the IPsec negotiations.

          Check the Disable PFS field to turn off Perfect Forward Secrecy (PFS) to ensure compatibility with old servers that do not support PFS.

        • Phase1 Lifetime corresponds to the ikelifetime Libreswan parameter. This parameter defines how long the key used to encrypt the traffic is valid.
        • Phase2 Lifetime corresponds to the salifetime Libreswan parameter. This parameter defines how long a security association is valid.
      • Connectivity

        • Remote network corresponds to the rightsubnet Libreswan parameter and defines the destination private remote network that should be reached through the VPN.

          Check the narrowing field to enable narrowing. Note that it is only effective in the IKEv2 negotiation.

        • Enable fragmentation corresponds to the fragmentation Libreswan parameter and defines whether or not to allow IKE fragmentation. Valid values are yes (default) or no.
        • Enable Mobike corresponds to the mobike Libreswan parameter. The parameter defines whether to allow Mobility and Multihoming Protocol (MOBIKE) (RFC 4555) to enable a connection to migrate its endpoint without needing to restart the connection from scratch. This is used on mobile devices that switch between wired, wireless or mobile data connections. The values are no (default) or yes.
  5. On the IPv4 Settings tab, select the IP assignment method and, optionally, set additional static addresses, DNS servers, search domains, and routes.

    IPsec IPv4 tab

  6. Save the connection.
  7. Close nm-connection-editor.
Note

When you add a new connection by clicking the + button, NetworkManager creates a new configuration file for that connection and then opens the same dialog that is used for editing an existing connection. The difference between these dialogs is that an existing connection profile has a Details menu entry.

Additional resources

  • nm-settings-libreswan(5) man page

13.3. Configuring ESP hardware offload on a bond to accelerate an IPsec connection

Offloading Encapsulating Security Payload (ESP) to the hardware accelerates IPsec connections. If you use a network bond for fail-over reasons, the requirements and the procedure to configure ESP hardware offload are different from those using a regular Ethernet device. For example, in this scenario, you enable the offload support on the bond, and the kernel applies the settings to the ports of the bond.

Prerequisites

  • All network cards in the bond support ESP hardware offload.
  • The network driver supports ESP hardware offload on a bond device. In RHEL, only the ixgbe driver supports this feature.
  • The bond is configured and works.
  • The bond uses the active-backup mode. The bonding driver does not support any other modes for this feature.
  • The IPsec connection is configured and works.

Procedure

  1. Enable ESP hardware offload support on the network bond:

    # nmcli connection modify bond0 ethtool.feature-esp-hw-offload on

    This command enables ESP hardware offload support on the bond0 connection.

  2. Reactivate the bond0 connection:

    # nmcli connection up bond0
  3. Edit the Libreswan configuration file in the /etc/ipsec.d/ directory of the connection that should use ESP hardware offload, and append the nic-offload=yes statement to the connection entry:

    conn example
        ...
        nic-offload=yes
  4. Restart the ipsec service:

    # systemctl restart ipsec

Verification

  1. Display the active port of the bond:

    # grep "Currently Active Slave" /proc/net/bonding/bond0
    Currently Active Slave: enp1s0
  2. Display the tx_ipsec and rx_ipsec counters of the active port:

    # ethtool enp1s0 | egrep "_ipsec"
         tx_ipsec: 10
         rx_ipsec: 10
  3. Send traffic through the IPsec tunnel. For example, ping a remote IP address:

    # ping -c 5 remote_ip_address
  4. Display the tx_ipsec and rx_ipsec counters of the active port again:

    # ethtool enp1s0 | egrep "_ipsec"
         tx_ipsec: 15
         rx_ipsec: 15

    If the counter values have increased, ESP hardware offload works.

Additional resources

Chapter 14. Configuring IP tunnels

Similar to a VPN, an IP tunnel directly connects two networks over a third network, such as the Internet. However, not all tunnel protocols support encryption.

The routers in both networks that establish the tunnel requires at least two interfaces:

  • One interface that is connected to the local network
  • One interface that is connected to the network through which the tunnel is established.

To establish the tunnel, you create a virtual interface on both routers with an IP address from the remote subnet.

NetworkManager supports the following IP tunnels:

  • Generic Routing Encapsulation (GRE)
  • Generic Routing Encapsulation over IPv6 (IP6GRE)
  • Generic Routing Encapsulation Terminal Access Point (GRETAP)
  • Generic Routing Encapsulation Terminal Access Point over IPv6 (IP6GRETAP)
  • IPv4 over IPv4 (IPIP)
  • IPv4 over IPv6 (IPIP6)
  • IPv6 over IPv6 (IP6IP6)
  • Simple Internet Transition (SIT)

Depending on the type, these tunnels act either on layer 2 or 3 of the Open Systems Interconnection (OSI) model.

14.1. Configuring an IPIP tunnel using nmcli to encapsulate IPv4 traffic in IPv4 packets

An IP over IP (IPIP) tunnel operates on OSI layer 3 and encapsulates IPv4 traffic in IPv4 packets as described in RFC 2003.

Important

Data sent through an IPIP tunnel is not encrypted. For security reasons, use the tunnel only for data that is already encrypted, for example, by other protocols, such as HTTPS.

Note that IPIP tunnels support only unicast packets. If you require an IPv4 tunnel that supports multicast, see Configuring a GRE tunnel using nmcli to encapsulate layer-3 traffic in IPv4 packets.

This procedure describes how to create an IPIP tunnel between two RHEL routers to connect two internal subnets over the Internet as shown in the following diagram:

IPIP tunnel

Prerequisites

  • Each RHEL router has a network interface that is connected to its local subnet.
  • Each RHEL router has a network interface that is connected to the Internet.
  • The traffic you want to send through the tunnel is IPv4 unicast.

Procedure

  1. On the RHEL router in network A:

    1. Create an IPIP tunnel interface named tun0:

      # nmcli connection add type ip-tunnel ip-tunnel.mode ipip con-name tun0 ifname tun0 remote 198.51.100.5 local 203.0.113.10

      The remote and local parameters set the public IP addresses of the remote and the local routers.

    2. Set the IPv4 address to the tun0 device:

      # nmcli connection modify tun0 ipv4.addresses '10.0.1.1/30'

      Note that a /30 subnet with two usable IP addresses is sufficient for the tunnel.

    3. Configure the tun0 connection to use a manual IPv4 configuration:

      # nmcli connection modify tun0 ipv4.method manual
    4. Add a static route that routes traffic to the 172.16.0.0/24 network to the tunnel IP on router B:

      # nmcli connection modify tun0 +ipv4.routes "172.16.0.0/24 10.0.1.2"
    5. Enable the tun0 connection.

      # nmcli connection up tun0
    6. Enable packet forwarding:

      # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
      # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
  2. On the RHEL router in network B:

    1. Create an IPIP tunnel interface named tun0:

      # nmcli connection add type ip-tunnel ip-tunnel.mode ipip con-name tun0 ifname tun0 remote 203.0.113.10 local 198.51.100.5

      The remote and local parameters set the public IP addresses of the remote and local routers.

    2. Set the IPv4 address to the tun0 device:

      # nmcli connection modify tun0 ipv4.addresses '10.0.1.2/30'
    3. Configure the tun0 connection to use a manual IPv4 configuration:

      # nmcli connection modify tun0 ipv4.method manual
    4. Add a static route that routes traffic to the 192.0.2.0/24 network to the tunnel IP on router A:

      # nmcli connection modify tun0 +ipv4.routes "192.0.2.0/24 10.0.1.1"
    5. Enable the tun0 connection.

      # nmcli connection up tun0
    6. Enable packet forwarding:

      # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
      # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

Verification steps

  • From each RHEL router, ping the IP address of the internal interface of the other router:

    1. On Router A, ping 172.16.0.1:

      # ping 172.16.0.1
    2. On Router B, ping 192.0.2.1:

      # ping 192.0.2.1

Additional resources

  • nmcli man page
  • The ip-tunnel settings section in the nm-settings(5) man page

14.2. Configuring a GRE tunnel using nmcli to encapsulate layer-3 traffic in IPv4 packets

A Generic Routing Encapsulation (GRE) tunnel encapsulates layer-3 traffic in IPv4 packets as described in RFC 2784. A GRE tunnel can encapsulate any layer 3 protocol with a valid Ethernet type.

Important

Data sent through a GRE tunnel is not encrypted. For security reasons, use the tunnel only for data that is already encrypted, for example, by other protocols, such as HTTPS.

This procedure describes how to create a GRE tunnel between two RHEL routers to connect two internal subnets over the Internet as shown in the following diagram:

GRE tunnel
Note

The gre0 device name is reserved. Use gre1 or a different name for the device.

Prerequisites

  • Each RHEL router has a network interface that is connected to its local subnet.
  • Each RHEL router has a network interface that is connected to the Internet.

Procedure

  1. On the RHEL router in network A:

    1. Create a GRE tunnel interface named gre1:

      # nmcli connection add type ip-tunnel ip-tunnel.mode gre con-name gre1 ifname gre1 remote 198.51.100.5 local 203.0.113.10

      The remote and local parameters set the public IP addresses of the remote and the local routers.

    2. Set the IPv4 address to the gre1 device:

      # nmcli connection modify gre1 ipv4.addresses '10.0.1.1/30'

      Note that a /30 subnet with two usable IP addresses is sufficient for the tunnel.

    3. Configure the gre1 connection to use a manual IPv4 configuration:

      # nmcli connection modify gre1 ipv4.method manual
    4. Add a static route that routes traffic to the 172.16.0.0/24 network to the tunnel IP on router B:

      # nmcli connection modify tun0 +ipv4.routes "172.16.0.0/24 10.0.1.2"
    5. Enable the gre1 connection.

      # nmcli connection up gre1
    6. Enable packet forwarding:

      # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
      # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
  2. On the RHEL router in network B:

    1. Create a GRE tunnel interface named gre1:

      # nmcli connection add type ip-tunnel ip-tunnel.mode ipip con-name gre1 ifname gre1 remote 203.0.113.10 local 198.51.100.5

      The remote and local parameters set the public IP addresses of the remote and the local routers.

    2. Set the IPv4 address to the gre1 device:

      # nmcli connection modify gre1 ipv4.addresses '10.0.1.2/30'
    3. Configure the gre1 connection to use a manual IPv4 configuration:

      # nmcli connection modify gre1 ipv4.method manual
    4. Add a static route that routes traffic to the 192.0.2.0/24 network to the tunnel IP on router A:

      # nmcli connection modify tun0 +ipv4.routes "192.0.2.0/24 10.0.1.1"
    5. Enable the gre1 connection.

      # nmcli connection up gre1
    6. Enable packet forwarding:

      # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
      # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

Verification steps

  1. From each RHEL router, ping the IP address of the internal interface of the other router:

    1. On Router A, ping 172.16.0.1:

      # ping 172.16.0.1
    2. On Router B, ping 192.0.2.1:

      # ping 192.0.2.1

Additional resources

  • nmcli man page
  • The ip-tunnel settings section in the nm-settings(5) man page

14.3. Configuring a GRETAP tunnel to transfer Ethernet frames over IPv4

A Generic Routing Encapsulation Terminal Access Point (GRETAP) tunnel operates on OSI level 2 and encapsulates Ethernet traffic in IPv4 packets as described in RFC 2784.

Important

Data sent through a GRETAP tunnel is not encrypted. For security reasons, establish the tunnel over a VPN or a different encrypted connection.

This procedure describes how to create a GRETAP tunnel between two RHEL routers to connect two networks using a bridge as shown in the following diagram:

GRETAP tunnel
Note

The gretap0 device name is reserved. Use gretap1 or a different name for the device.

Prerequisites

  • Each RHEL router has a network interface that is connected to its local network, and the interface has no IP configuration assigned.
  • Each RHEL router has a network interface that is connected to the Internet.

Procedure

  1. On the RHEL router in network A:

    1. Create a bridge interface named bridge0:

      # nmcli connection add type bridge con-name bridge0 ifname bridge0
    2. Configure the IP settings of the bridge:

      # nmcli connection modify bridge0 ipv4.addresses '192.0.2.1/24'
      # nmcli connection modify bridge0 ipv4.method manual
    3. Add a new connection profile for the interface that is connected to local network to the bridge:

      # nmcli connection add type ethernet slave-type bridge con-name bridge0-port1 ifname enp1s0 master bridge0
    4. Add a new connection profile for the GRETAP tunnel interface to the bridge:

      # nmcli connection add type ip-tunnel ip-tunnel.mode gretap slave-type bridge con-name bridge0-port2 ifname gretap1 remote 198.51.100.5 local 203.0.113.10 master bridge0

      The remote and local parameters set the public IP addresses of the remote and the local routers.

    5. Optional: Disable the Spanning Tree Protocol (STP) if you do not need it:

      # nmcli connection modify bridge0 bridge.stp no

      By default, STP is enabled and causes a delay before you can use the connection.

    6. Configure that activating the bridge0 connection automatically activates the ports of the bridge:

      # nmcli connection modify bridge0 connection.autoconnect-slaves 1
    7. Active the bridge0 connection:

      # nmcli connection up bridge0
  2. On the RHEL router in network B:

    1. Create a bridge interface named bridge0:

      # nmcli connection add type bridge con-name bridge0 ifname bridge0
    2. Configure the IP settings of the bridge:

      # nmcli connection modify bridge0 ipv4.addresses '192.0.2.2/24'
      # nmcli connection modify bridge0 ipv4.method manual
    3. Add a new connection profile for the interface that is connected to local network to the bridge:

      # nmcli connection add type ethernet slave-type bridge con-name bridge0-port1 ifname enp1s0 master bridge0
    4. Add a new connection profile for the GRETAP tunnel interface to the bridge:

      # nmcli connection add type ip-tunnel ip-tunnel.mode gretap slave-type bridge con-name bridge0-port2 ifname gretap1 remote 203.0.113.10 local 198.51.100.5 master bridge0

      The remote and local parameters set the public IP addresses of the remote and the local routers.

    5. Optional: Disable the Spanning Tree Protocol (STP) if you do not need it:

      # nmcli connection modify bridge0 bridge.stp no
    6. Configure that activating the bridge0 connection automatically activates the ports of the bridge:

      # nmcli connection modify bridge0 connection.autoconnect-slaves 1
    7. Active the bridge0 connection:

      # nmcli connection up bridge0

Verification steps

  1. On both routers, verify that the enp1s0 and gretap1 connections are connected and that the CONNECTION column displays the connection name of the port:

    # nmcli device
    nmcli device
    DEVICE   TYPE      STATE      CONNECTION
    ...
    bridge0  bridge    connected  bridge0
    enp1s0   ethernet  connected  bridge0-port1
    gretap1  iptunnel  connected  bridge0-port2
  2. From each RHEL router, ping the IP address of the internal interface of the other router:

    1. On Router A, ping 192.0.2.2:

      # ping 192.0.2.2
    2. On Router B, ping 192.0.2.1:

      # ping 192.0.2.1

Additional resources

  • nmcli man page
  • The ip-tunnel settings section in the nm-settings(5) man page

14.4. Additional resources

  • ip-link(8) man page

Chapter 15. Configuring Fibre Channel over Ethernet

Based on the IEEE T11 FC-BB-5 standard, Fibre Channel over Ethernet (FCoE) is a protocol to transmit Fibre Channel frames over Ethernet networks. Typically, data centers have a dedicated LAN and Storage Area Network (SAN) that are separated from each other with their own specific configuration. FCoE combines these networks into a single and converged network structure. Benefits of FCoE are, for example, lower hardware and energy costs.

15.1. Using hardware FCoE HBAs in RHEL

In Red Hat Enterprise Linux you can use hardware FCoE Host Bus Adapter (HBA) supported by the following drivers:

  • qedf
  • bnx2fc
  • fnic

If you use such a HBA, you configure the FCoE settings in the setup of the HBA. For details, see the documentation of the adapter.

After you configured the HBA in its setup, the exported Logical Unit Numbers (LUN) from the Storage Area Network (SAN) are automatically available to RHEL as /dev/sd* devices. You can use these devices similar to local storage devices.

15.2. Setting up a software FCoE device

A software FCoE device enables you to access Logical Unit Numbers (LUN) over FCoE using an Ethernet adapter that partially supports FCoE offload.

Important

RHEL does not support software FCoE devices that require the fcoe.ko kernel module.

After you complete this procedure, the exported LUNs from the Storage Area Network (SAN) are automatically available to RHEL as /dev/sd* devices. You can use these devices similar to local storage devices.

Prerequisites

  • The Host Bus Adapter (HBA) uses the qedf, bnx2fc, or fnic driver and does not require the fcoe.ko kernel module.
  • The SAN uses a VLAN to separate the storage traffic from normal Ethernet traffic.
  • The network switch has been configured to support the VLAN.
  • The HBA of the server is configured in its BIOS. For details, see the documentation of your HBA.
  • The HBA is connected to the network and the link is up.

Procedure

  1. Install the fcoe-utils package:

    # yum install fcoe-utils
  2. Copy the /etc/fcoe/cfg-ethx template file to /etc/fcoe/cfg-interface_name. For example, if you want to configure the enp1s0 interface to use FCoE, enter:

    # cp /etc/fcoe/cfg-ethx /etc/fcoe/cfg-enp1s0
  3. Enable and start the fcoe service:

    # systemctl enable --now fcoe
  4. Discover the FCoE VLAN ID, start the initiator, and create a network device for the discovered VLAN:

    # fipvlan -s -c enp1s0
    Created VLAN device enp1s0.200
    Starting FCoE on interface enp1s0.200
    Fibre Channel Forwarders Discovered
    interface       | VLAN | FCF MAC
    ------------------------------------------
    enp1s0          | 200  | 00:53:00:a7:e7:1b
  5. Optional: To display details about the discovered targets, the LUNs, and the devices associated with the LUNs, enter:

    # fcoeadm -t
    Interface:        enp1s0.200
    Roles:            FCP Target
    Node Name:        0x500a0980824acd15
    Port Name:        0x500a0982824acd15
    Target ID:        0
    MaxFrameSize:     2048 bytes
    OS Device Name:   rport-11:0-1
    FC-ID (Port ID):  0xba00a0
    State:            Online
    
    LUN ID  Device Name   Capacity   Block Size  Description
    ------  -----------  ----------  ----------  ---------------------
         0  sdb           28.38 GiB      512     NETAPP LUN (rev 820a)
         ...

    This example shows that LUN 0 from the SAN has been attached to the host as the /dev/sdb device.

Verification steps

  • Use the fcoeadm -i command to display information about all active FCoE interfaces:

    # fcoeadm -i
    Description:      BCM57840 NetXtreme II 10 Gigabit Ethernet
    Revision:         11
    Manufacturer:     Broadcom Inc. and subsidiaries
    Serial Number:    000AG703A9B7
    
    Driver:           bnx2x Unknown
    Number of Ports:  1
    
        Symbolic Name:     bnx2fc (QLogic BCM57840) v2.12.13 over enp1s0.200
        OS Device Name:    host11
        Node Name:         0x2000000af70ae935
        Port Name:         0x2001000af70ae935
        Fabric Name:       0x20c8002a6aa7e701
        Speed:             10 Gbit
        Supported Speed:   1 Gbit, 10 Gbit
        MaxFrameSize:      2048 bytes
        FC-ID (Port ID):   0xba02c0
        State:             Online

Additional resources

  • fcoeadm(8) man page
  • /usr/share/doc/fcoe-utils/README

15.3. Additional resources

Chapter 16. Port mirroring

Network administrators can use port mirroring to replicate inbound and outbound network traffic being communicated from one network device to another. Administrators use port mirroring to monitor network traffic and collect network data to:

  • Debug networking issues and tune the network flow
  • Inspect and analyze the network traffic to troubleshoot networking problems
  • Detect an intrusion

16.1. Mirroring a network interface using nmcli

You can configure port mirroring using NetworkManager. The following procedure mirrors the network traffic from enp1s0 to enp7s0 by adding Traffic Control (tc) rules and filters to the enp1s0 network interface.

Prerequisites

  • A network interface to mirror the network traffic to.

Procedure

  1. Add a network connection profile you want to mirror the network traffic from:

    # nmcli connection add type ethernet ifname enp1s0 con-name enp1s0 autoconnect no
  2. Attach prio qdisc to enp1s0 for the egress (outgoing) traffic with handle '10:'. The 'prio' qdisc attached without children allows attaching filters.

    # nmcli connection modify enp1s0 +tc.qdisc "root prio handle 10:"
  3. Add a qdisc for the ingress traffic, with handle 'ffff:'.

    # nmcli connection modify enp1s0 +tc.qdisc "ingress handle ffff:"
  4. To match packets on the ingress and egress qdiscs and to mirror them to another interface, add the following filters.

    # nmcli connection modify enp1s0 +tc.tfilter "parent ffff: matchall action mirred egress mirror dev mirror-of-enp1s0"
    
    # nmcli connection modify enp1s0 +tc.tfilter "parent 10: matchall action mirred egress mirror dev mirror-of-enp1s0"

    The matchall filter matches all packets and the mirred action redirects packets to destination.

  5. Activate the connection:

    # nmcli connection up enp1s0

Verification steps

  1. Install the tcpdump utility:

    # yum install tcpdump
  2. View the traffic mirrored on the target device (mirror-of-enp1s0):

    # tcpdump -i enp7s0

16.2. Additional resources (or Next steps)

Chapter 17. Configuring network devices to accept traffic from all MAC addresses

Network devices usually intercept and read packets that their controller is programmed to receive. You can configure the network devices to accept traffic from all MAC addresses in a virtual switch or at the port group level.

You can use this network mode to:

  • diagnose network connectivity issues,
  • monitor network activity for security reasons,
  • intercept private data-in-transit or intrusion in the network.

This section describes how to configure a network device to accept traffic from all the MAC addresses using iproute2, nmcli, or nmstatectl utilities. You can enable this mode for any kind of network device except InfiniBand.

17.1. Temporarily configuring a network network device to accept all traffic using iproute2

This procedure describes how to configure a network device to accept all traffic regardless of the MAC addresses. Any change made using the iproute2 utility is temporary and lost after the machine reboots.

Procedure

  1. Optional: Display the network interfaces to identify the one for which you want to receive all traffic:

    # ip a
    1: enp1s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
        link/ether 98:fa:9b:a4:34:09 brd ff:ff:ff:ff:ff:ff
    2: bond0: <NO-CARRIER,BROADCAST,MULTICAST,MASTER,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
        link/ether 6a:fd:16:b0:83:5c brd ff:ff:ff:ff:ff:ff
    3: wlp61s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    ...
  2. Modify the device to enable or disable this property.

    • To enable the accept-all-mac-address mode for enp1s0:

      # ip link set enp1s0 promisc on
    • To disable the accept-all-mac-address mode for enp1s0:

      # ip link set enp1s0 promisc off

Verification steps

  • To verify that the accept-all-mac-address mode is enabled:

    # ip link show enp1s0
    1: enp1s0: <NO-CARRIER,BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc fq_codel state DOWN mode DEFAULT group default qlen 1000
        link/ether 98:fa:9b:a4:34:09 brd ff:ff:ff:ff:ff:ff

The PROMISC flag in the device description indicates that the mode is enabled.

17.2. Permanently configuring a network device to accept all traffic using nmcli

This procedure describes how to configure a network device to accept traffic regardless of MAC addresses using the nmcli commands.

Procedure

  1. Optional: Display the network interfaces to identify the one for which you want to receive all traffic:

    # ip a
    1: enp1s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
        link/ether 98:fa:9b:a4:34:09 brd ff:ff:ff:ff:ff:ff
    2: bond0: <NO-CARRIER,BROADCAST,MULTICAST,MASTER,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
        link/ether 6a:fd:16:b0:83:5c brd ff:ff:ff:ff:ff:ff
    3: wlp61s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    ...

    You can create a new connection, if you do not have any.

  2. Modify the network device to enable or disable this property.

    • To enable the 802-3-ethernet.accept-all-mac-address mode for enp1s0:

      # nmcli connection modify enp1s0 802-3-ethernet.accept-all-mac-addresses yes
    • To disable the accept-all-mac-address mode for enp1s0:

      # nmcli connection modify enp1s0 802-3-ethernet.accept-all-mac-addresses no
  3. To apply the changes, reactivate the connection:

    # nmcli connection up enp1s0

Verification steps

  • To verify that the 802-3-ethernet.accept-all-mac-addresses mode is enabled:

    # nmcli connection show enp1s0
    ...
    802-3-ethernet.accept-all-mac-addresses:1     (true)

The 802-3-ethernet.accept-all-mac-addresses: true indicates that the mode is enabled.

17.3. Permanently configuring a network network device to accept all traffic using nmstatectl

This procedure describes how to configure a network device to accept all traffic regardless of MAC addresses using the nmstatectl utility.

Prerequisites

  • The nmstate package is installed.
  • The .yml file that you used to configure the device is available.

Procedure

  1. Edit the existing enp1s0.yml file for the enp1s0 connection and add the following content to it.

    ---
    interfaces:
      - name: enp1s0
        type: ethernet
        state: up
        accept -all-mac-address: true
  2. Apply the network settings.

    # nmstatectl apply ~/enp1s0.yml

Verification steps

  • To verify that the 802-3-ethernet.accept-all-mac-addresses mode is enabled:

    # nmstatectl show enp1s0
    interfaces:
      - name: enp1s0
        type: ethernet
        state: up
        accept-all-mac-addresses:     true
    ...

The 802-3-ethernet.accept-all-mac-addresses: true indicates that the mode is enabled.

Additional resources

  • For further details about nmstatectl, see the nmstatectl(8) man page.
  • For more configuration examples, see the /usr/share/doc/nmstate/examples/ directory.

Chapter 18. Authenticating a RHEL client to the network using the 802.1X standard with a certificate stored on the file system

Administrators frequently use port-based Network Access Control (NAC) based on the IEEE 802.1X standard to protect a network from unauthorized LAN and Wi-Fi clients. The procedures in this section describe different options to configure network authentication.

18.1. Configuring 802.1X network authentication on an existing Ethernet connection using nmcli

Using the nmcli utility, you can configure the client to authenticate itself to the network. This procedure describes how to configure Protected Extensible Authentication Protocol (PEAP) authentication with the Microsoft Challenge-Handshake Authentication Protocol version 2 (MSCHAPv2) in an existing NetworkManager Ethernet connection profile named enp1s0.

Prerequisites

  1. The network must have 802.1X network authentication.
  2. The Ethernet connection profile exists in NetworkManager and has a valid IP configuration.
  3. If the client is required to verify the certificate of the authenticator, the Certificate Authority (CA) certificate must be stored in the /etc/pki/ca-trust/source/anchors/ directory.
  4. The wpa_supplicant package is installed.

Procedure

  1. Set the Extensible Authentication Protocol (EAP) to peap, the inner authentication protocol to mschapv2, and the user name:

    # nmcli connection modify enp1s0 802-1x.eap peap 802-1x.phase2-auth mschapv2 802-1x.identity user_name

    Note that you must set the 802-1x.eap, 802-1x.phase2-auth, and 802-1x.identity parameters in a single command.

  2. Optionally, store the password in the configuration:

    # nmcli connection modify enp1s0 802-1x.password password
    Important

    By default, NetworkManager stores the password in clear text in the /etc/sysconfig/network-scripts/keys-connection_name file, that is readable only by the root user. However, clear text passwords in a configuration file can be a security risk.

    To increase the security, set the 802-1x.password-flags parameter to 0x1. With this setting, on servers with the GNOME desktop environment or the nm-applet running, NetworkManager retrieves the password from these services. In other cases, NetworkManager prompts for the password.

  3. If the client is required to verify the certificate of the authenticator, set the 802-1x.ca-cert parameter in the connection profile to the path of the CA certificate:

    # nmcli connection modify enp1s0 802-1x.ca-cert /etc/pki/ca-trust/source/anchors/ca.crt
    Note

    For security reasons, Red Hat recommends using the certificate of the authenticator to enable clients to validate the identity of the authenticator.

  4. Activate the connection profile:

    # nmcli connection up enp1s0

Verification steps

  • Access resources on the network that require network authentication.

Additional resources

18.2. Configuring a static Ethernet connection with 802.1X network authentication using nmstatectl

Using the nmstate utility, you can create an Ethernet connection that uses the 802.1X standard to authenticate the client. This procedure describes how to add an Ethernet connection for the enp1s0 interface with the following settings:

  • A static IPv4 address - 192.0.2.1 with a /24 subnet mask
  • A static IPv6 address - 2001:db8:1::1 with a /64 subnet mask
  • An IPv4 default gateway - 192.0.2.254
  • An IPv6 default gateway - 2001:db8:1::fffe
  • An IPv4 DNS server - 192.0.2.200
  • An IPv6 DNS server - 2001:db8:1::ffbb
  • A DNS search domain - example.com
  • 802.1X network authentication using the TLS Extensible Authentication Protocol (EAP)
Note

The nmstate library only supports the TLS EAP method.

Prerequisites

  • The network supports 802.1X network authentication.
  • The managed node uses NetworkManager.
  • The following files required for TLS authentication exist on the client:

    • The client key stored is in the /etc/pki/tls/private/client.key file, and the file is owned and only readable by the root user.
    • The client certificate is stored in the /etc/pki/tls/certs/client.crt file.
    • The Certificate Authority (CA) certificate is stored in the /etc/pki/tls/certs/ca.crt file.

Procedure

  1. Create a YAML file, for example ~/create-ethernet-profile.yml, with the following contents:

    ---
    interfaces:
    - name: enp1s0
      type: ethernet
      state: up
      ipv4:
        enabled: true
        address:
        - ip: 192.0.2.1
          prefix-length: 24
        dhcp: false
      ipv6:
        enabled: true
        address:
        - ip: 2001:db8:1::1
          prefix-length: 64
        autoconf: false
        dhcp: false
      802.1x:
        ca-cert: /etc/pki/tls/certs/ca.crt
        client-cert: /etc/pki/tls/certs/client.crt
        eap-methods:
          - tls
        identity: client.example.org
        private-key: /etc/pki/tls/private/client.key
        private-key-password: password
    routes:
      config:
      - destination: 0.0.0.0/0
        next-hop-address: 192.0.2.254
        next-hop-interface: enp1s0
      - destination: ::/0
        next-hop-address: 2001:db8:1::fffe
        next-hop-interface: enp1s0
    dns-resolver:
      config:
        search:
        - example.com
        server:
        - 192.0.2.200
        - 2001:db8:1::ffbb
  2. Apply the settings to the system:

    # nmstatectl apply ~/create-ethernet-profile.yml

Verification

  • Access resources on the network that require network authentication.

18.3. Configuring a static Ethernet connection with 802.1X network authentication using RHEL System Roles

Using RHEL System Roles, you can automate the creation of an Ethernet connection that uses the 802.1X standard to authenticate the client. This procedure describes how to remotely add an Ethernet connection for the enp1s0 interface with the following settings by running an Ansible playbook:

  • A static IPv4 address - 192.0.2.1 with a /24 subnet mask
  • A static IPv6 address - 2001:db8:1::1 with a /64 subnet mask
  • An IPv4 default gateway - 192.0.2.254
  • An IPv6 default gateway - 2001:db8:1::fffe
  • An IPv4 DNS server - 192.0.2.200
  • An IPv6 DNS server - 2001:db8:1::ffbb
  • A DNS search domain - example.com
  • 802.1X network authentication using the TLS Extensible Authentication Protocol (EAP)

Run this procedure on the Ansible control node.

Prerequisites

  • The ansible-core and rhel-system-roles packages are installed on the control node.
  • If you use a different remote user than root when you run the playbook, you must have appropriate sudo permissions on the managed node.
  • The network supports 802.1X network authentication.
  • The managed node uses NetworkManager.
  • The following files required for TLS authentication exist on the control node:

    • The client key is stored in the /srv/data/client.key file.
    • The client certificate is stored in the /srv/data/client.crt file.
    • The Certificate Authority (CA) certificate is stored in the /srv/data/ca.crt file.

Procedure

  1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

    node.example.com
  2. Create the ~/enable-802.1x.yml playbook with the following content:

    ---
    - name: Configure an Ethernet connection with 802.1X authentication
      hosts: node.example.com
      become: true
      tasks:
        - name: Copy client key for 802.1X authentication
          copy:
            src: "/srv/data/client.key"
            dest: "/etc/pki/tls/private/client.key"
            mode: 0600
    
        - name: Copy client certificate for 802.1X authentication
          copy:
            src: "/srv/data/client.crt"
            dest: "/etc/pki/tls/certs/client.crt"
    
        - name: Copy CA certificate for 802.1X authentication
          copy:
            src: "/srv/data/ca.crt"
            dest: "/etc/pki/ca-trust/source/anchors/ca.crt"
    
        - include_role:
            name: linux-system-roles.network
          vars:
            network_connections:
              - name: enp1s0
                type: ethernet
                autoconnect: yes
                ip:
                  address:
                    - 192.0.2.1/24
                    - 2001:db8:1::1/64
                  gateway4: 192.0.2.254
                  gateway6: 2001:db8:1::fffe
                  dns:
                    - 192.0.2.200
                    - 2001:db8:1::ffbb
                  dns_search:
                    - example.com
                ieee802_1x:
                  identity: user_name
                  eap: tls
                  private_key: "/etc/pki/tls/private/client.key"
                  private_key_password: "password"
                  client_cert: "/etc/pki/tls/certs/client.crt"
                  ca_cert: "/etc/pki/ca-trust/source/anchors/ca.crt"
                  domain_suffix_match: example.com
                state: up
  3. Run the playbook:

    • To connect as root user to the managed host, enter:

      # ansible-playbook -u root ~/enable-802.1x.yml
    • To connect as a user to the managed host, enter:

      # ansible-playbook -u user_name --ask-become-pass ~/ethernet-static-IP.yml

      The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

    If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Additional resources

  • /usr/share/ansible/roles/rhel-system-roles.network/README.md file
  • /usr/share/ansible/roles/rhel-system-roles.network/README.md file
  • ansible-playbook(1) man page

18.4. Configuring 802.1X network authentication on an existing Wi-Fi connection using nmcli

Using the nmcli utility, you can configure the client to authenticate itself to the network. This procedure describes how to configure Protected Extensible Authentication Protocol (PEAP) authentication with the Microsoft Challenge-Handshake Authentication Protocol version 2 (MSCHAPv2) in an existing NetworkManager Wi-Fi connection profile named wlp1s0.

Prerequisites

  1. The network must have 802.1X network authentication.
  2. The Wi-Fi connection profile exists in NetworkManager and has a valid IP configuration.
  3. If the client is required to verify the certificate of the authenticator, the Certificate Authority (CA) certificate must be stored in the /etc/pki/ca-trust/source/anchors/ directory.
  4. The wpa_supplicant package is installed.

Procedure

  1. Set the Wi-Fi security mode to wpa-eap, the Extensible Authentication Protocol (EAP) to peap, the inner authentication protocol to mschapv2, and the user name:

    # nmcli connection modify wpl1s0 802-11-wireless-security.key-mgmt wpa-eap 802-1x.eap peap 802-1x.phase2-auth mschapv2 802-1x.identity user_name

    Note that you must set the 802-11-wireless-security.key-mgmt, 802-1x.eap, 802-1x.phase2-auth, and 802-1x.identity parameters in a single command.

  2. Optionally, store the password in the configuration:

    # nmcli connection modify wpl1s0 802-1x.password password
    Important

    By default, NetworkManager stores the password in clear text in the /etc/sysconfig/network-scripts/keys-connection_name file, that is readable only by the root user. However, clear text passwords in a configuration file can be a security risk.

    To increase the security, set the 802-1x.password-flags parameter to 0x1. With this setting, on servers with the GNOME desktop environment or the nm-applet running, NetworkManager retrieves the password from these services. In other cases, NetworkManager prompts for the password.

  3. If the client is required to verify the certificate of the authenticator, set the 802-1x.ca-cert parameter in the connection profile to the path of the CA certificate:

    # nmcli connection modify wpl1s0 802-1x.ca-cert /etc/pki/ca-trust/source/anchors/ca.crt
    Note

    For security reasons, Red Hat recommends using the certificate of the authenticator to enable clients to validate the identity of the authenticator.

  4. Activate the connection profile:

    # nmcli connection up wpl1s0

Verification steps

  • Access resources on the network that require network authentication.

Additional resources

Chapter 19. Managing the default gateway setting

The default gateway is a router that forwards network packets when no other route matches the destination of a packet. In a local network, the default gateway is typically the host that is one hop closer to the internet.

19.1. Setting the default gateway on an existing connection using nmcli

In most situations, administrators set the default gateway when they create a connection as explained in, for example, Configuring a static Ethernet connection using nmcli.

This section describes how to set or update the default gateway on a previously created connection using the nmcli utility.

Prerequisites

  • At least one static IP address must be configured on the connection on which the default gateway will be set.
  • If the user is logged in on a physical console, user permissions are sufficient. Otherwise, user must have root permissions.

Procedure

  1. Set the IP address of the default gateway.

    For example, to set the IPv4 address of the default gateway on the example connection to 192.0.2.1:

    $ sudo nmcli connection modify example ipv4.gateway "192.0.2.1"

    For example, to set the IPv6 address of the default gateway on the example connection to 2001:db8:1::1:

    $ sudo nmcli connection modify example ipv6.gateway "2001:db8:1::1"
  2. Restart the network connection for changes to take effect. For example, to restart the example connection using the command line:

    $ sudo nmcli connection up example
    Warning

    All connections currently using this network connection are temporarily interrupted during the restart.

  3. Optionally, verify that the route is active.

    To display the IPv4 default gateway:

    $ ip -4 route
    default via 192.0.2.1 dev example proto static metric 100

    To display the IPv6 default gateway:

    $ ip -6 route
    default via 2001:db8:1::1 dev example proto static metric 100 pref medium

19.2. Setting the default gateway on an existing connection using the nmcli interactive mode

In most situations, administrators set the default gateway when they create a connection as explained in, for example, Configuring a dynamic Ethernet connection using the nmcli interactive editor.

This section describes how to set or update the default gateway on a previously created connection using the interactive mode of the nmcli utility.

Prerequisites

  • At least one static IP address must be configured on the connection on which the default gateway will be set.
  • If the user is logged in on a physical console, user permissions are sufficient. Otherwise, the user must have root permissions.

Procedure

  1. Open the nmcli interactive mode for the required connection. For example, to open the nmcli interactive mode for the example connection:

    $ sudo nmcli connection edit example
  2. Set the default gateway.

    For example, to set the IPv4 address of the default gateway on the example connection to 192.0.2.1:

    nmcli> set ipv4.gateway 192.0.2.1

    For example, to set the IPv6 address of the default gateway on the example connection to 2001:db8:1::1:

    nmcli> set ipv6.gateway 2001:db8:1::1
  3. Optionally, verify that the default gateway was set correctly:

    nmcli> print
    ...
    ipv4.gateway:                           192.0.2.1
    ...
    ipv6.gateway:                           2001:db8:1::1
    ...
  4. Save the configuration:

    nmcli> save persistent
  5. Restart the network connection for changes to take effect:

    nmcli> activate example
    Warning

    All connections currently using this network connection are temporarily interrupted during the restart.

  6. Leave the nmcli interactive mode:

    nmcli> quit
  7. Optionally, verify that the route is active.

    To display the IPv4 default gateway:

    $ ip -4 route
    default via 192.0.2.1 dev example proto static metric 100

    To display the IPv6 default gateway:

    $ ip -6 route
    default via 2001:db8:1::1 dev example proto static metric 100 pref medium

19.3. Setting the default gateway on an existing connection using nm-connection-editor

In most situations, administrators set the default gateway when they create a connection. This section describes how to set or update the default gateway on a previously created connection using the nm-connection-editor application.

Prerequisites

  • At least one static IP address must be configured on the connection on which the default gateway will be set.

Procedure

  1. Open a terminal, and enter nm-connection-editor:

    $ nm-connection-editor
  2. Select the connection to modify, and click the gear wheel icon to edit the existing connection.
  3. Set the IPv4 default gateway. For example, to set the IPv4 address of the default gateway on the connection to 192.0.2.1:

    1. Open the IPv4 Settings tab.
    2. Enter the address in the gateway field next to the IP range the gateway’s address is within:

      set default gw in nm connection editor ipv4

  4. Set the IPv6 default gateway. For example, to set the IPv6 address of the default gateway on the connection to 2001:db8:1::1:

    1. Open the IPv6 tab.
    2. Enter the address in the gateway field next to the IP range the gateway’s address is within:

      set default gw in nm connection editor ipv6

  5. Click OK.
  6. Click Save.
  7. Restart the network connection for changes to take effect. For example, to restart the example connection using the command line:

    $ sudo nmcli connection up example
    Warning

    All connections currently using this network connection are temporarily interrupted during the restart.

  8. Optionally, verify that the route is active.

    To display the IPv4 default gateway:

    $ ip -4 route
    default via 192.0.2.1 dev example proto static metric 100

    To display the IPv6 default gateway:

    $ ip -6 route
    default via 2001:db8:1::1 dev example proto static metric 100 pref medium

19.4. Setting the default gateway on an existing connection using control-center

In most situations, administrators set the default gateway when they create a connection. This section describes how to set or update the default gateway on a previously created connection using the control-center application.

Prerequisites

  • At least one static IP address must be configured on the connection on which the default gateway will be set.
  • The network configuration of the connection is open in the control-center application.

Procedure

  1. Set the IPv4 default gateway. For example, to set the IPv4 address of the default gateway on the connection to 192.0.2.1:

    1. Open the IPv4 tab.
    2. Enter the address in the gateway field next to the IP range the gateway’s address is within:

      set default gw in control center ipv4

  2. Set the IPv6 default gateway. For example, to set the IPv6 address of the default gateway on the connection to 2001:db8:1::1:

    1. Open the IPv6 tab.
    2. Enter the address in the gateway field next to the IP range the gateway’s address is within:

      set default gw in control center ipv6

  3. Click Apply.
  4. Back in the Network window, disable and re-enable the connection by switching the button for the connection to Off and back to On for changes to take effect.

    Warning

    All connections currently using this network connection are temporarily interrupted during the restart.

  5. Optionally, verify that the route is active.

    To display the IPv4 default gateway:

    $ ip -4 route
    default via 192.0.2.1 dev example proto static metric 100

    To display the IPv6 default gateway:

    $ ip -6 route
    default via 2001:db8:1::1 dev example proto static metric 100 pref medium

19.5. Setting the default gateway on an existing connection using nmstatectl

You can set the default gateway of a network connection using the nmstatectl utility. This procedure describes how to set the default gateway of the existing enp1s0 connection to 192.0.2.1.

Prerequisites

  • At least one static IP address must be configured on the connection on which the default gateway will be set.
  • The enp1s0 interface is configured, and the IP address of the default gateway is within the subnet of the IP configuration of this interface.
  • The nmstate package is installed.

Procedure

  1. Create a YAML file, for example ~/set-default-gateway.yml, with the following contents:

    ---
    routes:
      config:
      - destination: 0.0.0.0/0
        next-hop-address: 192.0.2.1
        next-hop-interface: enp1s0
  2. Apply the settings to the system:

    # nmstatectl apply ~/set-default-gateway.yml

Additional resources

  • For further details about nmstatectl, see the nmstatectl(8) man page.
  • For more configuration examples, see the /usr/share/doc/nmstate/examples/ directory.

19.6. Setting the default gateway on an existing connection using System Roles

You can use the networking RHEL System Role to set the default gateway.

Important

When you run a play that uses the networking RHEL System Role, the System Role overrides an existing connection profile with the same name if the settings do not match the ones specified in the play. Therefore, always specify the whole configuration of the network connection profile in the play, even if, for example, the IP configuration already exists. Otherwise, the role resets these values to their defaults.

Depending on whether it already exists, the procedure creates or updates the enp1s0 connection profile with the following settings:

  • A static IPv4 address - 198.51.100.20 with a /24 subnet mask
  • A static IPv6 address - 2001:db8:1::1 with a /64 subnet mask
  • An IPv4 default gateway - 198.51.100.254
  • An IPv6 default gateway - 2001:db8:1::fffe
  • An IPv4 DNS server - 198.51.100.200
  • An IPv6 DNS server - 2001:db8:1::ffbb
  • A DNS search domain - example.com

Prerequisites

  • The ansible-core and rhel-system-roles packages are installed on the control node.
  • If you use a different remote user than root when you run the playbook, this user has appropriate sudo permissions on the managed node.

Procedure

  1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

    node.example.com
  2. Create the ~/ethernet-connection.yml playbook with the following content:

    ---
    - name: Configure an Ethernet connection with static IP and default gateway
      hosts: node.example.com
      become: true
      tasks:
      - include_role:
          name: linux-system-roles.network
    
        vars:
          network_connections:
            - name: enp1s0
              type: ethernet
              autoconnect: yes
              ip:
                address:
                  - 198.51.100.20/24
                  - 2001:db8:1::1/64
                gateway4: 198.51.100.254
                gateway6: 2001:db8:1::fffe
                dns:
                  - 198.51.100.200
                  - 2001:db8:1::ffbb
                dns_search:
                  - example.com
              state: up
  3. Run the playbook:

    • To connect as root user to the managed host, enter:

      # ansible-playbook -u root ~/ethernet-connection.yml
    • To connect as a user to the managed host, enter:

      # ansible-playbook -u user_name --ask-become-pass ~/ethernet-connection.yml

      The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

    If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Additional resources

  • /usr/share/ansible/roles/rhel-system-roles.network/README.md
  • ansible-playbook(1) man page

19.7. How NetworkManager manages multiple default gateways

In certain situations, for example for fallback reasons, you set multiple default gateways on a host. However, to avoid asynchronous routing issues, each default gateway of the same protocol requires a separate metric value. Note that RHEL only uses the connection to the default gateway that has the lowest metric set.

You can set the metric for both the IPv4 and IPv6 gateway of a connection using the following command:

# nmcli connection modify connection-name ipv4.route-metric value ipv6.route-metric value
Important

Do not set the same metric value for the same protocol in multiple connection profiles to avoid routing issues.

If you set a default gateway without a metric value, NetworkManager automatically sets the metric value based on the interface type. For that, NetworkManager assigns the default value of this network type to the first connection that is activated, and sets an incremented value to each other connection of the same type in the order they are activated. For example, if two Ethernet connections with a default gateway exist, NetworkManager sets a metric of 100 on the route to the default gateway of the connection that you activate first. For the second connection, NetworkManager sets 101.

The following is an overview of frequently-used network types and their default metrics:

Connection typeDefault metric value

VPN

50

Ethernet

100

MACsec

125

InfiniBand

150

Bond

300

Team

350

VLAN

400

Bridge

425

TUN

450

Wi-Fi

600

IP tunnel

675

19.8. Configuring NetworkManager to avoid using a specific profile to provide a default gateway

You can configure that NetworkManager never uses a specific profile to provide the default gateway. Follow this procedure for connection profiles that are not connected to the default gateway.

Prerequisites

  • The NetworkManager connection profile for the connection that is not connected to the default gateway exists.

Procedure

  1. If the connection uses a dynamic IP configuration, configure that NetworkManager does not use the connection as the default route for IPv4 and IPv6 connections:

    # nmcli connection modify connection_name ipv4.never-default yes ipv6.never-default yes

    Note that setting ipv4.never-default and ipv6.never-default to yes, automatically removes the default gateway’s IP address for the corresponding protocol from the connection profile.

  2. Activate the connection:

    # nmcli connection up connection_name

Verification steps

  • Use the ip -4 route and ip -6 route commands to verify that RHEL does not use the network interface for the default route for the IPv4 and IPv6 protocol.

19.9. Fixing unexpected routing behavior due to multiple default gateways

There are only a few scenarios, such as when using multipath TCP, in which you require multiple default gateways on a host. In most cases, you configure only a single default gateway to avoid unexpected routing behavior or asynchronous routing issues.

Note

To route traffic to different internet providers, use policy-based routing instead of multiple default gateways.

Prerequisites

  • The host uses NetworkManager to manage network connections, which is the default.
  • The host has multiple network interfaces.
  • The host has multiple default gateways configured.

Procedure

  1. Display the routing table:

    • For IPv4, enter:

      # ip -4 route
      default via 192.0.2.1 dev enp1s0 proto static metric 101
      default via 198.51.100.1 dev enp7s0 proto static metric 102
      ...
    • For IPv6, enter:

      # ip -6 route
      default via 2001:db8:1::1 dev enp1s0 proto static metric 101 pref medium
      default via 2001:db8:2::1 dev enp7s0 proto static metric 102 pref medium
      ...

    Entries starting with default indicate a default route. Note the interface names of these entries displayed next to dev.

  2. Use the following commands to display the NetworkManager connections that use the interfaces you identified in the previous step:

    # nmcli -f GENERAL.CONNECTION,IP4.GATEWAY,IP6.GATEWAY device show enp1s0
    GENERAL.CONNECTION:      Corporate-LAN
    IP4.GATEWAY:             192.168.122.1
    IP6.GATEWAY:             2001:db8:1::1
    
    # nmcli -f GENERAL.CONNECTION,IP4.GATEWAY,IP6.GATEWAY device show enp7s0
    GENERAL.CONNECTION:      Internet-Provider
    IP4.GATEWAY:             198.51.100.1
    IP6.GATEWAY:             2001:db8:2::1

    In these examples, the profiles named Corporate-LAN and Internet-Provider have the default gateways set. Because, in a local network, the default gateway is typically the host that is one hop closer to the internet, the rest of this procedure assumes that the default gateways in the Corporate-LAN are incorrect.

  3. Configure that NetworkManager does not use the Corporate-LAN connection as the default route for IPv4 and IPv6 connections:

    # nmcli connection modify Corporate-LAN ipv4.never-default yes ipv6.never-default yes

    Note that setting ipv4.never-default and ipv6.never-default to yes, automatically removes the default gateway’s IP address for the corresponding protocol from the connection profile.

  4. Activate the Corporate-LAN connection:

    # nmcli connection up Corporate-LAN

Verification steps

  • Display the IPv4 and IPv6 routing tables and verify that only one default gateway is available for each protocol:

    • For IPv4, enter:

      # ip -4 route
      default via 192.0.2.1 dev enp1s0 proto static metric 101
      ...
    • For IPv6, enter:

      # ip -6 route
      default via 2001:db8:1::1 dev enp1s0 proto static metric 101 pref medium
      ...

Chapter 20. Configuring static routes

By default, and if a default gateway is configured, Red Hat Enterprise Linux forwards traffic for networks that are not directly connected to the host to the default gateway. Using a static route, you can configure that Red Hat Enterprise Linux forwards the traffic for a specific host or network to a different router than the default gateway. This section describes different options how to configure static routes.

20.1. How to use the nmcli command to configure a static route

To configure a static route, use the nmcli utility with the following syntax:

$ nmcli connection modify connection_name ipv4.routes "ip[/prefix] [next_hop] [metric] [attribute=value] [attribute=value] ..."

The command supports the following route attributes:

  • table=n
  • src=address
  • tos=n
  • onlink=true|false
  • window=n
  • cwnd=n
  • mtu=n
  • lock-window=true|false
  • lock-cwdn=true|false
  • lock-mtu=true|false

If you use the ipv4.routes sub-command, nmcli overrides all current settings of this parameter. To add an additional route, use the nmcli connection modify connection_name +ipv4.routes "…​" command. In a similar way, you can use nmcli connection modify connection_name -ipv4.routes "…​" to remove a specific route.

20.2. Configuring a static route using an nmcli command

You can add a static route to the configuration of a network connection using the nmcli connection modify command.

The procedure in this section describes how to add a route to the 192.0.2.0/24 network that uses the gateway running on 198.51.100.1, which is reachable through the example connection.

Prerequisites

  • The network is configured
  • The gateway for the static route must be directly reachable on the interface.
  • If the user is logged in on a physical console, user permissions are sufficient. Otherwise, the command requires root permissions.

Procedure

  1. Add the static route to the example connection:

    $ sudo nmcli connection modify example +ipv4.routes "192.0.2.0/24 198.51.100.1"

    To set multiple routes in one step, pass the individual routes comma-separated to the command. For example, to add a route to the 192.0.2.0/24 and 203.0.113.0/24 networks, both routed through the 198.51.100.1 gateway, enter:

    $ sudo nmcli connection modify example +ipv4.routes "192.0.2.0/24 198.51.100.1, 203.0.113.0/24 198.51.100.1"
  2. Optionally, verify that the routes were added correctly to the configuration:

    $ nmcli connection show example
    ...
    ipv4.routes:        { ip = 192.0.2.1/24, nh = 198.51.100.1 }
    ...
  3. Restart the network connection:

    $ sudo nmcli connection up example
    Warning

    Restarting the connection briefly disrupts connectivity on that interface.

  4. Optionally, verify that the route is active:

    $ ip route
    ...
    192.0.2.0/24 via 198.51.100.1 dev example proto static metric 100

Additional resources

  • nmcli(1) man page

20.3. Configuring a static route using control-center

You can use control-center in GNOME to add a static route to the configuration of a network connection.

The procedure in this section describes how to add a route to the 192.0.2.0/24 network that uses the gateway running on 198.51.100.1.

Prerequisites

Procedure

  1. Open the IPv4 tab.
  2. Optionally, disable automatic routes by clicking the On button in the Routes section of the IPv4 tab to use only static routes. If automatic routes are enabled, Red Hat Enterprise Linux uses static routes and routes received from a DHCP server.
  3. Enter the address, netmask, gateway, and optionally a metric value:

    IPv4 static route in control center

  4. Click Apply.
  5. Back in the Network window, disable and re-enable the connection by switching the button for the connection to Off and back to On for changes to take effect.

    Warning

    Restarting the connection briefly disrupts connectivity on that interface.

  6. Optionally, verify that the route is active:

    $ ip route
    ...
    192.0.2.0/24 via 198.51.100.1 dev example proto static metric 100

20.4. Configuring a static route using nm-connection-editor

You can use the nm-connection-editor application to add a static route to the configuration of a network connection.

The procedure in this section describes how to add a route to the 192.0.2.0/24 network that uses the gateway running on 198.51.100.1, which is reachable trough the example connection.

Prerequisites

  • The network is configured.
  • The gateway for the static route must be directly reachable on the interface.

Procedure

  1. Open a terminal and enter nm-connection-editor:

    $ nm-connection-editor
  2. Select the example connection and click the gear wheel icon to edit the existing connection.
  3. Open the IPv4 tab.
  4. Click the Routes button.
  5. Click the Add button and enter the address, netmask, gateway, and optionally a metric value.

    IPv4 static route in nm connection editor

  6. Click OK.
  7. Click Save.
  8. Restart the network connection for changes to take effect. For example, to restart the example connection using the command line:

    $ sudo nmcli connection up example
  9. Optionally, verify that the route is active:

    $ ip route
    ...
    192.0.2.0/24 via 198.51.100.1 dev example proto static metric 100

20.5. Configuring a static route using the nmcli interactive mode

You can use the interactive mode of the nmcli utility to add a static route to the configuration of a network connection.

The procedure in this section describes how to add a route to the 192.0.2.0/24 network that uses the gateway running on 198.51.100.1, which is reachable trough the example connection.

Prerequisites

  • The network is configured
  • The gateway for the static route must be directly reachable on the interface.
  • If the user is logged in on a physical console, user permissions are sufficient. Otherwise, the command requires root permissions.

Procedure

  1. Open the nmcli interactive mode for the example connection:

    $ sudo nmcli connection edit example
  2. Add the static route:

    nmcli> set ipv4.routes 192.0.2.0/24 198.51.100.1
  3. Optionally, verify that the routes were added correctly to the configuration:

    nmcli> print
    ...
    ipv4.routes:        { ip = 192.0.2.1/24, nh = 198.51.100.1 }
    ...

    The ip attribute displays the network to route and the nh attribute the gateway (next hop).

  4. Save the configuration:

    nmcli> save persistent
  5. Restart the network connection:

    nmcli> activate example
    Warning

    When you restart the connection, all connections currently using this connection will be temporarily interrupted.

  6. Leave the nmcli interactive mode:

    nmcli> quit
  7. Optionally, verify that the route is active:

    $ ip route
    ...
    192.0.2.0/24 via 198.51.100.1 dev example proto static metric 100

20.6. Configuring a static route using nmstatectl

You can add a static route to the configuration of a network connection using the nmstatectl utility.

The procedure in this section describes how to add a route to the 192.0.2.0/24 network that uses the gateway running on 198.51.100.1, which is reachable through the enp1s0 interface.

Prerequisites

  • The enp1s0 network interface is configured.
  • The gateway for the static route must be directly reachable on the interface.
  • The nmstate package is installed.

Procedure

  1. Create a YAML file, for example ~/add-static-route-to-enp1s0.yml, with the following contents:

    ---
    routes:
      config:
      - destination: 192.0.2.0/24
        next-hop-address: 198.51.100.1
        next-hop-interface: enp1s0
  2. Apply the settings to the system:

    # nmstatectl apply ~/add-static-route-to-enp1s0.yml

Additional resources

  • nmstatectl(8) man page
  • /usr/share/doc/nmstate/examples/

20.7. Configuring a static route using RHEL System Roles

You can use the networking RHEL System Role to configure static routes.

Important

When you run a play that uses the networking RHEL System Role, the System Role overrides an existing connection profile with the same name if the settings do not match the ones specified in the play. Therefore, always specify the whole configuration of the network connection profile in the play, even if, for example, the IP configuration already exists. Otherwise, the role resets these values to their defaults.

Depending on whether it already exists, the procedure creates or updates the enp7s0 connection profile with the following settings:

  • A static IPv4 address - 198.51.100.20 with a /24 subnet mask
  • A static IPv6 address - 2001:db8:1::1 with a /64 subnet mask
  • An IPv4 default gateway - 198.51.100.254
  • An IPv6 default gateway - 2001:db8:1::fffe
  • An IPv4 DNS server - 198.51.100.200
  • An IPv6 DNS server - 2001:db8:1::ffbb
  • A DNS search domain - example.com
  • Static routes:

    • 192.0.2.0/24 with gateway 198.51.100.1
    • 203.0.113.0/24 with gateway 198.51.100.2

Prerequisites

  • The ansible-core and rhel-system-roles packages are installed on the control node.
  • If you use a different remote user than root when you run the playbook, this user has appropriate sudo permissions on the managed node.

Procedure

  1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

    node.example.com
  2. Create the ~/add-static-routes.yml playbook with the following content:

    ---
    - name: Configure an Ethernet connection with static IP and additional routes
      hosts: node.example.com
      become: true
      tasks:
      - include_role:
          name: linux-system-roles.network
    
        vars:
          network_connections:
            - name: enp7s0
              type: ethernet
              autoconnect: yes
              ip:
                address:
                  - 198.51.100.20/24
                  - 2001:db8:1::1/64
                gateway4: 198.51.100.254
                gateway6: 2001:db8:1::fffe
                dns:
                  - 198.51.100.200
                  - 2001:db8:1::ffbb
                dns_search:
                  - example.com
                route:
                  - network: 192.0.2.0
                    prefix: 24
                    gateway: 198.51.100.1
                  - network: 203.0.113.0
                    prefix: 24
                    gateway: 198.51.100.2
              state: up
  3. Run the playbook:

    • To connect as root user to the managed host, enter:

      # ansible-playbook -u root ~/add-static-routes.yml
    • To connect as a user to the managed host, enter:

      # ansible-playbook -u user_name --ask-become-pass ~/add-static-routes.yml

      The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

    If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Verification steps

  • Display the routing table:

    # ip -4 route
    default via 198.51.100.254 dev enp7s0 proto static metric 100
    192.0.2.0/24 via 198.51.100.1 dev enp7s0 proto static metric 100
    203.0.113.0/24 via 198.51.100.2 dev enp7s0 proto static metric 100
    ...

Additional resources

  • /usr/share/ansible/roles/rhel-system-roles.network/README.md file
  • ansible-playbook(1) man page

Chapter 21. Configuring policy-based routing to define alternative routes

By default, the kernel in RHEL decides where to forward network packets based on the destination address using a routing table. Policy-based routing enables you to configure complex routing scenarios. For example, you can route packets based on various criteria, such as the source address, packet metadata, or protocol.

This section describes of how to configure policy-based routing using NetworkManager.

Note

On systems that use NetworkManager, only the nmcli utility supports setting routing rules and assigning routes to specific tables.

21.1. Routing traffic from a specific subnet to a different default gateway using NetworkManager

This section describes how to configure RHEL as a router that, by default, routes all traffic to Internet provider A using the default route. Using policy-based routing, RHEL routes traffic received from the internal workstations subnet to provider B.

The procedure assumes the following network topology:

policy based routing

Prerequisites

  • The system uses NetworkManager to configure the network, which is the default.
  • The RHEL router you want to set up in the procedure has four network interfaces:

    • The enp7s0 interface is connected to the network of provider A. The gateway IP in the provider’s network is 198.51.100.2, and the network uses a /30 network mask.
    • The enp1s0 interface is connected to the network of provider B. The gateway IP in the provider’s network is 192.0.2.2, and the network uses a /30 network mask.
    • The enp8s0 interface is connected to the 10.0.0.0/24 subnet with internal workstations.
    • The enp9s0 interface is connected to the 203.0.113.0/24 subnet with the company’s servers.
  • Hosts in the internal workstations subnet use 10.0.0.1 as the default gateway. In the procedure, you assign this IP address to the enp8s0 network interface of the router.
  • Hosts in the server subnet use 203.0.113.1 as the default gateway. In the procedure, you assign this IP address to the enp9s0 network interface of the router.
  • The firewalld service is enabled and active.

Procedure

  1. Configure the network interface to provider A:

    # nmcli connection add type ethernet con-name Provider-A ifname enp7s0 ipv4.method manual ipv4.addresses 198.51.100.1/30 ipv4.gateway 198.51.100.2 ipv4.dns 198.51.100.200 connection.zone external

    The nmcli connection add command creates a NetworkManager connection profile. The following list describes the options of the command:

    • type ethernet: Defines that the connection type is Ethernet.
    • con-name connection_name: Sets the name of the profile. Use a meaningful name to avoid confusion.
    • ifname network_device: Sets the network interface.
    • ipv4.method manual: Enables to configure a static IP address.
    • ipv4.addresses IP_address/subnet_mask: Sets the IPv4 addresses and subnet mask.
    • ipv4.gateway IP_address: Sets the default gateway address.
    • ipv4.dns IP_of_DNS_server: Sets the IPv4 address of the DNS server.
    • connection.zone firewalld_zone: Assigns the network interface to the defined firewalld zone. Note that firewalld automatically enables masquerading for interfaces assigned to the external zone.
  2. Configure the network interface to provider B:

    # nmcli connection add type ethernet con-name Provider-B ifname enp1s0 ipv4.method manual ipv4.addresses 192.0.2.1/30 ipv4.routes "0.0.0.0/0 192.0.2.2 table=5000" connection.zone external

    This command uses the ipv4.routes parameter instead of ipv4.gateway to set the default gateway. This is required to assign the default gateway for this connection to a different routing table (5000) than the default. NetworkManager automatically creates this new routing table when the connection is activated.

  3. Configure the network interface to the internal workstations subnet:

    # nmcli connection add type ethernet con-name Internal-Workstations ifname enp8s0 ipv4.method manual ipv4.addresses 10.0.0.1/24 ipv4.routes "10.0.0.0/24 src=192.0.2.1 table=5000" ipv4.routing-rules "priority 5 from 10.0.0.0/24 table 5000" connection.zone trusted

    This command uses the ipv4.routes parameter to add a static route to the routing table with ID 5000. This static route for the 10.0.0.0/24 subnet uses the IP of the local network interface to provider B (192.0.2.1) as next hop.

    Additionally, the command uses the ipv4.routing-rules parameter to add a routing rule with priority 5 that routes traffic from the 10.0.0.0/24 subnet to table 5000. Low values have a high priority.

    Note that the syntax in the ipv4.routing-rules parameter is the same as in an ip route add command, except that ipv4.routing-rules always requires specifying a priority.

  4. Configure the network interface to the server subnet:

    # nmcli connection add type ethernet con-name Servers ifname enp9s0 ipv4.method manual ipv4.addresses 203.0.113.1/24 connection.zone trusted

Verification steps

  1. On a RHEL host in the internal workstation subnet:

    1. Install the traceroute package:

      # yum install traceroute
    2. Use the traceroute utility to display the route to a host on the Internet:

      # traceroute redhat.com
      traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets
       1  10.0.0.1 (10.0.0.1)     0.337 ms  0.260 ms  0.223 ms
       2  192.0.2.1 (192.0.2.1)   0.884 ms  1.066 ms  1.248 ms
       ...

      The output of the command displays that the router sends packets over 192.0.2.1, which is the network of provider B.

  2. On a RHEL host in the server subnet:

    1. Install the traceroute package:

      # yum install traceroute
    2. Use the traceroute utility to display the route to a host on the Internet:

      # traceroute redhat.com
      traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets
       1  203.0.113.1 (203.0.113.1)    2.179 ms  2.073 ms  1.944 ms
       2  198.51.100.2 (198.51.100.2)  1.868 ms  1.798 ms  1.549 ms
       ...

      The output of the command displays that the router sends packets over 198.51.100.2, which is the network of provider A.

Troubleshooting steps

On the RHEL router:

  1. Display the rule list:

    # ip rule list
    0:	from all lookup local
    5:	from 10.0.0.0/24 lookup 5000
    32766:	from all lookup main
    32767:	from all lookup default

    By default, RHEL contains rules for the tables local, main, and default.

  2. Display the routes in table 5000:

    # ip route list table 5000
    0.0.0.0/0 via 192.0.2.2 dev enp1s0 proto static metric 100
    10.0.0.0/24 dev enp8s0 proto static scope link src 192.0.2.1 metric 102
  3. Display the interfaces and firewall zones:

    # firewall-cmd --get-active-zones
    external
      interfaces: enp1s0 enp7s0
    trusted
      interfaces: enp8s0 enp9s0
  4. Verify that the external zone has masquerading enabled:

    # firewall-cmd --info-zone=external
    external (active)
      target: default
      icmp-block-inversion: no
      interfaces: enp1s0 enp7s0
      sources:
      services: ssh
      ports:
      protocols:
      masquerade: yes
      ...

Additional resources

Chapter 22. Creating a dummy interface

As a Red Hat Enterprise Linux user, you can create and use dummy network interfaces for debugging and testing purposes. A dummy interface provides a device to route packets without actually transmitting them. It enables you to create additional loopback-like devices managed by NetworkManager and makes an inactive SLIP (Serial Line Internet Protocol) address look like a real address for local programs.

22.1. Creating a dummy interface with both an IPv4 and IPv6 address using nmcli

You can create a dummy interface with various settings. This procedure describes how to create a dummy interface with both an IPv4 and IPv6 address. After creating the dummy interface, NetworkManager automatically assigns it to the default public firewall zone.

Note

To configure a dummy interface without IPv4 or IPv6 address, set the ipv4.method and ipv6.method parameters to disabled. Otherwise, IP auto-configuration fails, and NetworkManager deactivates the connection and removes the dummy device.

Procedure

  1. To create a dummy interface named dummy0 with static IPv4 and IPv6 addresses, enter:

    # nmcli connection add type dummy ifname dummy0 ipv4.method manual ipv4.addresses 192.0.2.1/24 ipv6.method manual ipv6.addresses 2001:db8:2::1/64
  2. Optional:To view the dummy interface, enter:

    # nmcli connection show
    NAME            UUID                                  TYPE      DEVICE
    enp1s0          db1060e9-c164-476f-b2b5-caec62dc1b05  ethernet    ens3
    dummy-dummy0    aaf6eb56-73e5-4746-9037-eed42caa8a65  dummy    dummy0

Additional resources

  • The nm-settings(5) man page

Chapter 23. Using nmstate-autoconf to automatically configure the network state using LLDP

Network devices can use the Link Layer Discovery Protocol (LLDP) to advertise their identity, capabilities, and neighbors in a LAN. The nmstate-autoconf utility can use this information to automatically configure local network interfaces.

Important

The nmstate-autoconf utility is provided as a Technology Preview only. Technology Preview features are not supported with Red Hat production Service Level Agreements (SLAs), might not be functionally complete, and Red Hat does not recommend using them for production. These previews provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

See Technology Preview Features Support Scope on the Red Hat Customer Portal for information about the support scope for Technology Preview features.

23.1. Using nmstate-autoconf to automatically configure network interfaces

The nmstate-autoconf utility uses LLDP to identify the VLAN settings of interfaces connected to a switch to configure local devices.

This procedure assumes the following scenario and that the switch broadcasts the VLAN settings using LLDP:

  • The enp1s0 and enp2s0 interfaces of the RHEL server are connected to switch ports that are configured with VLAN ID 100 and VLAN name prod-net.
  • The enp3s0 interface of the RHEL server is connected to a switch port that is configured with VLAN ID 200 and VLAN name mgmt-net.

The nmstate-autoconf utility then uses this information to create the following interfaces on the server:

  • bond100 - A bond interface with enp1s0 and enp2s0 as ports.
  • prod-net - A VLAN interface on top of bond100 with VLAN ID 100.
  • mgmt-net - A VLAN interface on top of enp3s0 with VLAN ID 200

If you connect multiple network interfaces to different switch ports for which LLDP broadcasts the same VLAN ID, nmstate-autoconf creates a bond with these interfaces and, additionally, configures the common VLAN ID on top of it.

Prerequisites

  • The nmstate package is installed.
  • LLDP is enabled on the network switch.
  • The Ethernet interfaces are up.

Procedure

  1. Enable LLDP on the Ethernet interfaces:

    1. Create a YAML file, for example ~/enable-lldp.yml, with the following contents:

      interfaces:
        - name: enp1s0
          type: ethernet
          lldp:
            enabled: true
        - name: enp2s0
          type: ethernet
          lldp:
            enabled: true
        - name: enp3s0
          type: ethernet
          lldp:
            enabled: true
    2. Apply the settings to the system:

      # nmstatectl apply ~/enable-lldp.yml
  2. Configure the network interfaces using LLDP:

    1. Optional, start a dry-run to display and verify the YAML configuration that nmstate-autoconf generates:

      # nmstate-autoconf -d enp1s0,enp2s0,enp3s0
      ---
      interfaces:
      - name: prod-net
        type: vlan
        state: up
        vlan:
          base-iface: bond100
          id: 100
      - name: mgmt-net
        type: vlan
        state: up
        vlan:
          base-iface: enp3s0
          id: 200
      - name: bond100
        type: bond
        state: up
        link-aggregation:
          mode: balance-rr
          port:
          - enp1s0
          - enp2s0
    2. Use nmstate-autoconf to generate the configuration based on information received from LLDP, and apply the settings to the system:

      # nmstate-autoconf enp1s0,enp2s0,enp3s0

Next steps

Verification

  1. Display the settings of the individual interfaces:

    # nmstatectl show <interface_name>

Additional resources

  • The nmstate-autoconf(8) man page

Chapter 24. Manually creating NetworkManager profiles in key file format

NetworkManager supports profiles stored in the key file format. However, by default, if you use NetworkManager utilities, such as nmcli, the networking RHEL System Role, or the nmstate API to manage profiles, NetworkManager still uses profiles in the ifcfg format.

In the next major RHEL release, the key file format will be the default.

24.1. The key file format of NetworkManager profiles

NetworkManager uses the INI-style key file format when it stores connection profiles on disk.

Example of an Ethernet connection profile in key file format

[connection]
id=example_connection
uuid=82c6272d-1ff7-4d56-9c7c-0eb27c300029
type=802-3-ethernet
autoconnect=true

[ipv4]
method=auto

[ipv6]
method=auto

[802-3-ethernet]
mac-address=00:53:00:8f:fa:66

Each section corresponds to a NetworkManager setting name as described in the nm-settings(5) and nm-settings-keyfile(5) man pages. Each key-value-pair in a section is one of the properties listed in the settings specification of the man page.

Most variables in NetworkManager key files have a one-to-one mapping. This means that a NetworkManager property is stored in the key file as a variable of the same name and in the same format. However, there are exceptions, mainly to make the key file syntax easier to read. For a list of these exceptions, see the nm-settings-keyfile(5) man page.

Important

For security reasons, because connection profiles can contain sensitive information, such as private keys and passphrases, NetworkManager uses only configuration files owned by the root and that are only readable and writable by root.

Depending on the purpose of the connection profile, save it in one of the following directories:

  • /etc/NetworkManager/system-connections/: The general location for persistent profiles created by the user that can also be edited. NetworkManager copies them automatically to /etc/NetworkManager/system-connections/.
  • /run/NetworkManager/system-connections/: For temporary profiles that are automatically removed when you reboot the system.
  • /usr/lib/NetworkManager/system-connections/: For pre-deployed immutable profiles. When you edit such a profile using the NetworkManager API, NetworkManager copies this profile to either the persistent or temporary storage.

NetworkManager does not automatically reload profiles from disk. When you create or update a connection profile in key file format, use the nmcli connection reload command to inform NetworkManager about the changes.

24.2. Creating a NetworkManager profile in key file format

This section explains a general procedure on how to manually create a NetworkManager connection profile in key file format.

Note

Manually creating or updating the configuration files can result in an unexpected or non-functional network configuration. Red Hat recommends that you use NetworkManager utilities, such as nmcli, the network RHEL System Role, or the nmstate API to manage NetworkManager connections.

Procedure

  1. If you create a profile for a hardware interface, such as Ethernet, display the MAC address of this interface:

    # ip address show enp1s0
    2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
        link/ether 00:53:00:8f:fa:66 brd ff:ff:ff:ff:ff:ff
  2. Create a connection profile. For example, for a connection profile of an Ethernet device that uses DHCP, create the /etc/NetworkManager/system-connections/example.nmconnection file with the following content:

    [connection]
    id=example_connection
    type=802-3-ethernet
    autoconnect=true
    
    [ipv4]
    method=auto
    
    [ipv6]
    method=auto
    
    [802-3-ethernet]
    mac-address=00:53:00:8f:fa:66
    Note

    You can use any file name with a .nmconnection suffix. However, when you later use nmcli commands to manage the connection, you must use the connection name set in the id variable when you refer to this connection. When you omit the id variable, use the file name without the .nmconnection to refer to this connection.

  3. Set permissions on the configuration file so that only the root user can read and update it:

    # chown root:root /etc/NetworkManager/system-connections/example.nmconnection
    # chmod 600 /etc/NetworkManager/system-connections/example.nmconnection
  4. Reload the connection profiles:

    # nmcli connection reload
  5. Verify that NetworkManager read the profile from the configuration file:

    # nmcli -f NAME,UUID,FILENAME connection
    NAME                UUID                                  FILENAME
    example-connection  86da2486-068d-4d05-9ac7-957ec118afba  /etc/NetworkManager/system-connections/example.nmconnection
    ...

    If the command does not show the newly added connection, verify that the file permissions and the syntax you used in the file are correct.

  6. Optional: If you set the autoconnect variable in the profile to false, activate the connection:

    # nmcli connection up example_connection

Verification

  1. Display the connection profile:

    # nmcli connection show example_connection
  2. Display the IP settings of the interface:

    # ip address show enp1s0

Additional resources

  • nm-settings-keyfile (5)

Chapter 25. Using netconsole to log kernel messages over a network

Using the netconsole kernel module and the same-named service, you can log kernel messages over a network to debug the kernel when logging to disk fails or when using a serial console is not possible.

25.1. Configuring the netconsole service to log kernel messages to a remote host

Using the netconsole kernel module, you can log kernel messages to a remote system log service.

Prerequisites

  • A system log service, such as rsyslog is installed on the remote host.
  • The remote system log service is configured to receive incoming log entries from this host.

Procedure

  1. Install the netconsole-service package:

    # yum install netconsole-service
  2. Edit the /etc/sysconfig/netconsole file and set the SYSLOGADDR parameter to the IP address of the remote host:

    # SYSLOGADDR=192.0.2.1
  3. Enable and start the netconsole service:

    # systemctl enable --now netconsole

Verification steps

  • Display the /var/log/messages file on the remote system log server.

Chapter 26. Systemd network targets and services

NetworkManager configures the network during the system boot process. However, when booting with a remote root (/), such as if the root directory is stored on an iSCSI device, the network settings are applied in the initial RAM disk (initrd) before RHEL is started. For example, if the network configuration is specified on the kernel command line using rd.neednet=1 or a configuration is specified to mount remote file systems, then the network settings are applied on initrd.

This section describes different targets such as network, network-online, and NetworkManager-wait-online service that are used while applying network settings, and how to configure the systemd service to start after the network-online service is started.

26.1. Differences between the network and network-online systemd target

Systemd maintains the network and network-online target units. The special units such as NetworkManager-wait-online.service, have WantedBy=network-online.target and Before=network-online.target parameters. If enabled, these units get started with network-online.target and delay the target to be reached until some form of network connectivity is established. They delay the network-online target until the network is connected.

The network-online target starts a service, which adds substantial delays to further execution. Systemd automatically adds dependencies with Wants and After parameters for this target unit to all the System V (SysV) init script service units with a Linux Standard Base (LSB) header referring to the $network facility. The LSB header is metadata for init scripts. You can use it to specify dependencies. This is similar to the systemd target.

The network target does not significantly delay the execution of the boot process. Reaching the network target means that the service that is responsible for setting up the network has started. However, it does not mean that a network device was configured. This target is important during the shutdown of the system. For example, if you have a service that was ordered after the network target during bootup, then this dependency is reversed during the shutdown. The network does not get disconnected until your service has been stopped. All mount units for remote network file systems automatically start the network-online target unit and order themselves after it.

Note

The network-online target unit is only useful during the system starts. After the system has completed booting up, this target does not track the online state of the network. Therefore, you cannot use network-online to monitor the network connection. This target provides a one-time system startup concept.

26.2. Overview of NetworkManager-wait-online

The NetworkManager-wait-online service waits with a timeout for the network to be configured. This network configuration involves plugging-in an Ethernet device, scanning for a Wi-Fi device, and so forth. NetworkManager automatically activates suitable profiles that are configured to start automatically. The failure of the automatic activation process due to a DHCP timeout or similar event might keep NetworkManager busy for an extended period of time. Depending on the configuration, NetworkManager retries activating the same profile or a different profile.

When the startup completes, either all profiles are in a disconnected state or are successfully activated. You can configure profiles to auto-connect. The following are a few examples of parameters that set timeouts or define when the connection is considered active:

  • connection.wait-device-timeout - sets the timeout for the driver to detect the device
  • ipv4.may-fail and ipv6.may-fail - sets activation with one IP address family ready, or whether a particular address family must have completed configuration.
  • ipv4.gateway-ping-timeout - delays activation.

Additional resources

  • The nm-settings(5) man page

26.3. Configuring a systemd service to start after the network has been started

Red Hat Enterprise Linux installs systemd service files in the /usr/lib/systemd/system/ directory. This procedure creates a drop-in snippet for a service file in /etc/systemd/system/service_name.service.d/ that is used together with the service file in /usr/lib/systemd/system/ to start a particular service after the network is online. It has a higher priority if settings in the drop-in snippet overlap with the ones in the service file in /usr/lib/systemd/system/.

Procedure

  1. To open the service file in the editor, enter:

    # systemctl edit service_name

  2. Enter the following, and save the changes:

    [Unit]
    After=network-online.target
  3. Reload the systemd service.

    # systemctl daemon-reload

Chapter 27. Linux traffic control

Linux offers tools for managing and manipulating the transmission of packets. The Linux Traffic Control (TC) subsystem helps in policing, classifying, shaping, and scheduling network traffic. TC also mangles the packet content during classification by using filters and actions. The TC subsystem achieves this by using queuing disciplines (qdisc), a fundamental element of the TC architecture.

The scheduling mechanism arranges or rearranges the packets before they enter or exit different queues. The most common scheduler is the First-In-First-Out (FIFO) scheduler. You can do the qdiscs operations temporarily using the tc utility or permanently using NetworkManager.

This section explains queuing disciplines and describes how to update the default qdiscs in RHEL.

27.1. Overview of queuing disciplines

Queuing disciplines (qdiscs) help with queuing up and, later, scheduling of traffic transmission by a network interface. A qdisc has two operations;

  • enqueue requests so that a packet can be queued up for later transmission and
  • dequeue requests so that one of the queued-up packets can be chosen for immediate transmission.

Every qdisc has a 16-bit hexadecimal identification number called a handle, with an attached colon, such as 1: or abcd:. This number is called the qdisc major number. If a qdisc has classes, then the identifiers are formed as a pair of two numbers with the major number before the minor, <major>:<minor>, for example abcd:1. The numbering scheme for the minor numbers depends on the qdisc type. Sometimes the numbering is systematic, where the first-class has the ID <major>:1, the second one <major>:2, and so on. Some qdiscs allow the user to set class minor numbers arbitrarily when creating the class.

Classful qdiscs

Different types of qdiscs exist and help in the transfer of packets to and from a networking interface. You can configure qdiscs with root, parent, or child classes. The point where children can be attached are called classes. Classes in qdisc are flexible and can always contain either multiple children classes or a single child, qdisc. There is no prohibition against a class containing a classful qdisc itself, this facilitates complex traffic control scenarios.

Classful qdiscs do not store any packets themselves. Instead, they enqueue and dequeue requests down to one of their children according to criteria specific to the qdisc. Eventually, this recursive packet passing ends up where the packets are stored (or picked up from in the case of dequeuing).

Classless qdiscs
Some qdiscs contain no child classes and they are called classless qdiscs. Classless qdiscs require less customization compared to classful qdiscs. It is usually enough to attach them to an interface.

Additional resources

  • tc(8) man page
  • tc-actions.8 man page

27.2. Available qdiscs in RHEL

Each qdisc addresses unique networking-related issues. The following is the list of qdiscs available in RHEL. You can use any of the following qdisc to shape network traffic based on your networking requirements.

Table 27.1. Available schedulers in RHEL

qdisc nameIncluded inOffload support

Asynchronous Transfer Mode (ATM)

kernel-modules-extra

 

Class-Based Queueing

kernel-modules-extra

 

Credit-Based Shaper

kernel-modules-extra

Yes

CHOose and Keep for responsive flows, CHOose and Kill for unresponsive flows (CHOKE)

kernel-modules-extra

 

Controlled Delay (CoDel)

kernel-core

 

Deficit Round Robin (DRR)

kernel-modules-extra

 

Differentiated Services marker (DSMARK)

kernel-modules-extra

 

Enhanced Transmission Selection (ETS)

kernel-modules-extra

Yes

Fair Queue (FQ)

kernel-core

 

Fair Queuing Controlled Delay (FQ_CODel)

kernel-core

 

Generalized Random Early Detection (GRED)

kernel-modules-extra

 

Hierarchical Fair Service Curve (HSFC)

kernel-core

 

Heavy-Hitter Filter (HHF)

kernel-core

 

Hierarchy Token Bucket (HTB)

kernel-core

 

INGRESS

kernel-core

Yes

Multi Queue Priority (MQPRIO)

kernel-modules-extra

Yes

Multiqueue (MULTIQ)

kernel-modules-extra

Yes

Network Emulator (NETEM)

kernel-modules-extra

 

Proportional Integral-controller Enhanced (PIE)

kernel-core

 

PLUG

kernel-core

 

Quick Fair Queueing (QFQ)

kernel-modules-extra

 

Random Early Detection (RED)

kernel-modules-extra

Yes

Stochastic Fair Blue (SFB)

kernel-modules-extra

 

Stochastic Fairness Queueing (SFQ)

kernel-core

 

Token Bucket Filter (TBF)

kernel-core

Yes

Trivial Link Equalizer (TEQL)

kernel-modules-extra

 
Important

The qdisc offload requires hardware and driver support on NIC.

Additional resources

  • The tc(8), cbq, cbs, choke, CoDel, drr, fq, htb, mqprio, netem, pie, sfb, pfifo, tc-red, sfq, tbf, and prio man pages.

27.3. Inspecting qdiscs of a network interface using the tc utility

By default, Red Hat Enterprise Linux systems use fq_codel qdisc. This procedure describes how to inspect qdisc counters.

Procedure

  1. Optional: View your current qdisc:

    # tc qdisc show dev enp0s1

  2. Inspect the current qdisc counters:

    # tc -s qdisc show dev enp0s1
    qdisc fq_codel 0: root refcnt 2 limit 10240p flows 1024 quantum 1514 target 5.0ms interval 100.0ms memory_limit 32Mb ecn
    Sent 1008193 bytes 5559 pkt (dropped 233, overlimits 55 requeues 77)
    backlog 0b 0p requeues 0
    ....
  • dropped - the number of times a packet is dropped because all queues are full
  • overlimits - the number of times the configured link capacity is filled
  • sent - the number of dequeues

27.4. Updating the default qdisc

If you observe networking packet losses with the current qdisc, you can change the qdisc based on your network-requirements. You can select the qdisc, which meets your network requirements. This procedure describes how to change the default qdisc in Red Hat Enterprise Linux.

Procedure

  1. View the current default qdisc:

    # sysctl -a | grep qdisc
    net.core.default_qdisc = fq_codel
  2. View the qdisc of current Ethernet connection:

    # tc -s qdisc show dev enp0s1
    qdisc fq_codel 0: root refcnt 2 limit 10240p flows 1024 quantum 1514 target 5.0ms interval 100.0ms memory_limit 32Mb ecn
    Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
    backlog 0b 0p requeues 0
    maxpacket 0 drop_overlimit 0 new_flow_count 0 ecn_mark 0
    new_flows_len 0 old_flows_len 0
  3. Update the existing qdisc:

    # sysctl -w net.core.default_qdisc=pfifo_fast

  4. To apply the changes, reload the network driver:

    # rmmod NETWORKDRIVERNAME

    # modprobe NETWORKDRIVERNAME

  5. Start the network interface:

    # ip link set enp0s1 up

Verification steps

  • View the qdisc of the Ethernet connection:

    # tc -s qdisc show dev enp0s1
    qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
     Sent 373186 bytes 5333 pkt (dropped 0, overlimits 0 requeues 0)
     backlog 0b 0p requeues 0
    ....

27.5. Temporarily setting the current qdisk of a network interface using the tc utility

You can update the current qdisc without changing the default one. This procedure describes how to change the current qdisc in Red Hat Enterprise Linux.

Procedure

  1. Optional: View the current qdisc:

    # tc -s qdisc show dev enp0s1

  2. Update the current qdisc:

    # tc qdisc replace dev enp0s1 root htb

Verification step

  • View the updated current qdisc:

    # tc -s qdisc show dev enp0s1
    qdisc htb 8001: root refcnt 2 r2q 10 default 0 direct_packets_stat 0 direct_qlen 1000
    Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
    backlog 0b 0p requeues 0

27.6. Permanently setting the current qdisk of a network interface using NetworkManager

You can update the current qdisc value of a NetworkManager connection.

Procedure

  1. Optional: View the current qdisc:

    # tc qdisc show dev enp0s1
      qdisc fq_codel 0: root refcnt 2
  2. Update the current qdisc:

    # nmcli connection modify enp0s1 tc.qdiscs ‘root pfifo_fast’

  3. Optional: To add another qdisc over the existing qdisc, use the +tc.qdisc option:

    # nmcli connection modify enp0s1 +tc.qdisc ‘ingress handle ffff:’

  4. Activate the changes:

    # nmcli connection up enp0s1

Verification steps

  • View current qdisc the network interface:

    # tc qdisc show dev enp0s1
    qdisc pfifo_fast 8001: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
    qdisc ingress ffff: parent ffff:fff1 ----------------

Additional resources

  • nm-settings(5) man page

Chapter 28. Getting started with Multipath TCP

Multipath TCP (MPTCP) is an extension to the Transmission Control Protocol (TCP). Using Internet Protocol (IP), a host can send packets to a destination. TCP ensures reliable delivery of the data through the Internet and automatically adjusts its bandwidth in response to network load.

This section describes how to:

  • Create a new MPTCP connection
  • Enable the server to use MPTCP
  • Disable MPTCP in the kernel

It also includes the advantages of using MPTCP.

28.1. MPTCP benefits

The Multipath TCP (MPTCP) design improves connection stability. Note, that in MPTCP terminology, links are considered as paths.

The following are the advantages of MPTCP:

  • It allows a connection to simultaneously use multiple network interfaces.
  • In case a connection is bound to a link speed, the usage of multiple links can increase the connection throughput. Note, that in case of the connection is bound to a CPU, the usage of multiple links causes the connection slowdown.
  • It increases the resilience to link failures.

28.2. Preparing RHEL to enable MPTCP support

By default the MPTCP support is disabled in RHEL. Enable MPTCP so that applications that support this feature can use it. Additionally, you have to configure user space applications to force use MPTCP sockets if those applications have TCP sockets by default.

This procedure describes how to use the sysctl tool to enable MPTCP support and prepare RHEL for enabling MPTCP for applications system-wide using a SystemTap script.

Prerequisites

The following packages are installed:

  • kernel-debuginfo
  • kernel-debuginfo-common
  • systemtap
  • systemtap-devel
  • kernel-devel
  • iperf3

Procedure

  1. Enable MPTCP sockets in the kernel:

    # echo "net.mptcp.enabled=1" > /etc/sysctl.d/90-enable-MPTCP.conf
    # sysctl -p /etc/sysctl.d/90-enable-MPTCP.conf
  2. Verify that MPTCP is enabled in the kernel:

    # sysctl -a | grep mptcp.enabled
    net.mptcp.enabled = 1
  3. Create a mptcp-app.stap file with the following content:

    #!/usr/bin/env stap
    
    %{
    #include <linux/in.h>
    #include <linux/ip.h>
    %}
    
    /* according to [1], RSI contains 'type' and RDX
     * contains 'protocol'.
     * [1] https://github.com/torvalds/linux/blob/master/arch/x86/entry/entry_64.S#L79
     */
    
    function mptcpify () %{
        if (CONTEXT->kregs->si == SOCK_STREAM &&
            (CONTEXT->kregs->dx == IPPROTO_TCP ||
             CONTEXT->kregs->dx == 0)) {
                    CONTEXT->kregs->dx = IPPROTO_MPTCP;
                    STAP_RETVALUE = 1;
        } else {
               STAP_RETVALUE = 0;
        }
    %}
    
    probe kernel.function("__sys_socket") {
            if (mptcpify() == 1) {
                    printf("command %16s mptcpified\n", execname());
            }
    }
  4. Force user space applications to create MPTCP sockets instead of TCP ones:

    # stap -vg mptcp-app.stap

    Note: This operation affects all TCP sockets which are started after the command. The applications will continue using TCP sockets after you interrupt the command above with Ctrl+C.

  5. Alternatively, to allow MPTCP usage to only specific application, you can modify the mptcp-app.stap file with the following content:

    #!/usr/bin/env stap
    
    %{
    #include <linux/in.h>
    #include <linux/ip.h>
    %}
    
    /* according to [1], RSI contains 'type' and RDX
     * contains 'protocol'.
     * [1] https://github.com/torvalds/linux/blob/master/arch/x86/entry/entry_64.S#L79
     */
    
    function mptcpify () %{
    	if (CONTEXT->kregs->si == SOCK_STREAM &&
    	    (CONTEXT->kregs->dx == IPPROTO_TCP ||
    	     CONTEXT->kregs->dx == 0)) {
    		CONTEXT->kregs->dx = IPPROTO_MPTCP;
    		STAP_RETVALUE = 1;
    	} else {
    		STAP_RETVALUE = 0;
    	}
    %}
    
    probe kernel.function("__sys_socket") {
    	cur_proc = execname()
    	if ((cur_proc == @1) && (mptcpify() == 1)) {
    		printf("command %16s mptcpified\n", cur_proc);
    	}
    }
  6. In case of alternative choice, assuming, you want to force the iperf3 tool to use MPTCP instead of TCP. To do so, enter the following command:

    # stap -vg mptcp-app.stap iperf3

  7. After the mptcp-app.stap script installs the kernel probe, the following warnings appear in the kernel dmesg output

    # dmesg
    ...
    [ 1752.694072] Kprobes globally unoptimized
    [ 1752.730147] stap_1ade3b3356f3e68765322e26dec00c3d_1476: module_layout: kernel tainted.
    [ 1752.732162] Disabling lock debugging due to kernel taint
    [ 1752.733468] stap_1ade3b3356f3e68765322e26dec00c3d_1476: loading out-of-tree module taints kernel.
    [ 1752.737219] stap_1ade3b3356f3e68765322e26dec00c3d_1476: module verification failed: signature and/or required key missing - tainting kernel
    [ 1752.737219] stap_1ade3b3356f3e68765322e26dec00c3d_1476 (mptcp-app.stap): systemtap: 4.5/0.185, base: ffffffffc0550000, memory: 224data/32text/57ctx/65638net/367alloc kb, probes: 1
  8. Start the iperf3 server:

    # iperf3 -s
    
    Server listening on 5201
  9. Connect the client to the server:

    # iperf3 -c 127.0.0.1 -t 3

  10. After the connection is established, verify the ss output to see the subflow-specific status:

    # ss -nti '( dport :5201 )'
    
    State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
    ESTAB 0      0      127.0.0.1:41842    127.0.0.1:5201
    cubic wscale:7,7 rto:205 rtt:4.455/8.878 ato:40 mss:21888 pmtu:65535 rcvmss:536 advmss:65483 cwnd:10 bytes_sent:141 bytes_acked:142 bytes_received:4 segs_out:8 segs_in:7 data_segs_out:3 data_segs_in:3 send 393050505bps lastsnd:2813 lastrcv:2772 lastack:2772 pacing_rate 785946640bps delivery_rate 10944000000bps delivered:4 busy:41ms rcv_space:43690 rcv_ssthresh:43690 minrtt:0.008 tcp-ulp-mptcp flags:Mmec token:0000(id:0)/2ff053ec(id:0) seq:3e2cbea12d7673d4 sfseq:3 ssnoff:ad3d00f4 maplen:2
  11. Verify MPTCP counters by using nstat MPTcp* command:

    # nstat MPTcp*
    
    #kernel
    MPTcpExtMPCapableSYNRX          2                  0.0
    MPTcpExtMPCapableSYNTX          2                  0.0
    MPTcpExtMPCapableSYNACKRX       2                  0.0
    MPTcpExtMPCapableACKRX          2                  0.0

28.3. Using iproute2 to configure and enable multiple paths for MPTCP applications

Each MPTCP connection uses a single subflow similar to plain TCP. To leverage the MPTCP benefits specify a higher limit for maximum number of subflows for each MPTCP connection and configure additional endpoints to create those subflows.

Note that MPTCP does not yet support mixed IPv6 and IPv4 endpoints for the same socket. Use endpoints belonging to the same address family.

Prerequisites

  • Application must support MPTCP
  • Server network interface settings:

    • enp4s0: 192.0.2.1/24
    • enp1s0: 198.51.100.1/24
  • Client network interface settings:

    • enp4s0f0: 192.0.2.2/24
    • enp4s0f1: 198.51.100.2/24

Procedure

  1. Set the per connection additional subflow limits to 1 on the server:

    # ip mptcp limits set subflow 1

    Note, that sets a maximum number of additional subflows which each connection can have, excluding the initial one.

  2. Set the per connection and additional subflow limits to 1 on the client:

    # ip mptcp limits set subflow 1 add_addr_accepted 1

  3. Add IP address 198.51.100.1 as a new MPTCP endpoint on the server:

    # ip mptcp endpoint add 198.51.100.1 dev enp1s0 signal

    Important

    You can set the following values for flags to subflow, backup, signal. Setting the flag to;

    • signal, sends an ADD_ADDR packet after the three-way-handshake is completed
    • subflow, sends an MP_JOIN SYN by the client
    • backup, sets the endpoint as a backup address
  4. Start the iperf3 server:

    # iperf3 -s
    
    Server listening on 5201
  5. Connect the client to the server:

    # iperf3 -c 192.0.2.1 -t 3

Verification steps

  1. Verify the connection is established:

    # ss -nti '( sport :5201 )'

  2. Verify the connection and IP address limit:

    # ip mptcp limit show

  3. Verify the newly added endpoint:

    # ip mptcp endpoint show

  4. Verify MPTCP counters by using the nstat MPTcp* command on a server:

    # nstat MPTcp*
    
    #kernel
    MPTcpExtMPCapableSYNRX          2                  0.0
    MPTcpExtMPCapableACKRX          2                  0.0
    MPTcpExtMPJoinSynRx             2                  0.0
    MPTcpExtMPJoinAckRx             2                  0.0
    MPTcpExtEchoAdd                 2                  0.0

Additional resources

  • ip-mptcp(8) man page

28.4. Disabling Multipath TCP in the kernel

This procedure describes how to disable the MPTCP option in the kernel.

Procedure

  • Disable the mptcp.enabled option.

    # echo "net.mptcp.enabled=0" > /etc/sysctl.d/90-enable-MPTCP.conf
    # sysctl -p /etc/sysctl.d/90-enable-MPTCP.conf

Verification steps

  • Verify whether the mptcp.enabled is disabled in the kernel.

    # sysctl -a | grep mptcp.enabled
    net.mptcp.enabled = 0

Chapter 29. Configuring the order of DNS servers

Most applications use the getaddrinfo() function of the glibc library to resolve DNS requests. By default, glibc sends all DNS requests to the first DNS server specified in the /etc/resolv.conf file. If this server does not reply, Red Hat Enterprise Linux uses the next server in this file.

This section describes how to customize the order of DNS servers.

29.1. How NetworkManager orders DNS servers in /etc/resolv.conf

NetworkManager orders DNS servers in the /etc/resolv.conf file based on the following rules:

  • If only one connection profile exists, NetworkManager uses the order of IPv4 and IPv6 DNS server specified in that connection.
  • If multiple connection profiles are activated, NetworkManager orders DNS servers based on a DNS priority value. If you set DNS priorities, the behavior of NetworkManager depends on the value set in the dns parameter. You can set this parameter in the [main] section in the /etc/NetworkManager/NetworkManager.conf file:

    • dns=default or if the dns parameter is not set:

      NetworkManager orders the DNS servers from different connections based on the ipv4.dns-priority and ipv6.dns-priority parameter in each connection.

      If you set no value or you set ipv4.dns-priority and ipv6.dns-priority to 0, NetworkManager uses the global default value. See Default values of DNS priority parameters.

    • dns=dnsmasq or dns=systemd-resolved:

      When you use one of these settings, NetworkManager sets either 127.0.0.1 for dnsmasq or 127.0.0.53 as nameserver entry in the /etc/resolv.conf file.

      Both the dnsmasq and systemd-resolved services forward queries for the search domain set in a NetworkManager connection to the DNS server specified in that connection, and forwardes queries to other domains to the connection with the default route. When multiple connections have the same search domain set, dnsmasq and systemd-resolved forward queries for this domain to the DNS server set in the connection with the lowest priority value.

Default values of DNS priority parameters

NetworkManager uses the following default values for connections:

  • 50 for VPN connections
  • 100 for other connections

Valid DNS priority values:

You can set both the global default and connection-specific ipv4.dns-priority and ipv6.dns-priority parameters to a value between -2147483647 and 2147483647.

  • A lower value has a higher priority.
  • Negative values have the special effect of excluding other configurations with a greater value. For example, if at least one connection with a negative priority value exists, NetworkManager uses only the DNS servers specified in the connection profile with the lowest priority.
  • If multiple connections have the same DNS priority, NetworkManager prioritizes the DNS in the following order:

    1. VPN connections
    2. Connection with an active default route. The active default route is the default route with the lowest metric.

Additional resources

29.2. Setting a NetworkManager-wide default DNS server priority value

NetworkManager uses the following DNS priority default values for connections:

  • 50 for VPN connections
  • 100 for other connections

This section describes how to override these system-wide defaults with a custom default value for IPv4 and IPv6 connections.

Procedure

  1. Edit the /etc/NetworkManager/NetworkManager.conf file:

    1. Add the [connection] section, if it does not exist:

      [connection]
    2. Add the custom default values to the [connection] section. For example, to set the new default for both IPv4 and IPv6 to 200, add:

      ipv4.dns-priority=200
      ipv6.dns-priority=200

      You can set the parameters to a value between -2147483647 and 2147483647. Note that setting the parameters to 0 enables the built-in defaults (50 for VPN connections and 100 for other connections).

  2. Reload the NetworkManager service:

    # systemctl reload NetworkManager

Additional resources

  • Connection Section in the NetworkManager.conf(5) man page

29.3. Setting the DNS priority of a NetworkManager connection

This section describes how to define the order of DNS servers when NetworkManager creates or updates the /etc/resolv.conf file.

Note that setting DNS priorities makes only sense if you have multiple connections with different DNS servers configured. If you have only one connection with multiple DNS servers configured, manually set the DNS servers in the preferred order in the connection profile.

Prerequisites

  • The system has multiple NetworkManager connections configured.
  • The system either has no dns parameter set in the /etc/NetworkManager/NetworkManager.conf file or the parameter is set to default.

Procedure

  1. Optionally, display the available connections:

    # nmcli connection show
    NAME           UUID                                  TYPE      DEVICE
    Example_con_1  d17ee488-4665-4de2-b28a-48befab0cd43  ethernet  enp1s0
    Example_con_2  916e4f67-7145-3ffa-9f7b-e7cada8f6bf7  ethernet  enp7s0
    ...
  2. Set the ipv4.dns-priority and ipv6.dns-priority parameters. For example, to set both parameters to 10 for the Example_con_1 connection:

    # nmcli connection modify Example_con_1 ipv4.dns-priority 10 ipv6.dns-priority 10
  3. Optionally, repeat the previous step for other connections.
  4. Re-activate the connection you updated:

    # nmcli connection up Example_con_1

Verification steps

  • Display the contents of the /etc/resolv.conf file to verify that the DNS server order is correct:

    # cat /etc/resolv.conf

Chapter 30. Using NetworkManager to disable IPv6 for a specific connection

This section describes how to disable the IPv6 protocol on a system that uses NetworkManager to manage network interfaces. If you disable IPv6, NetworkManager automatically sets the corresponding sysctl values in the Kernel.

Note

If disabling IPv6 using kernel tunables or kernel boot parameters, additional consideration must be given to system configuration. For more information, see the How do I disable or enable the IPv6 protocol in RHEL? article.

Prerequisites

  • The system uses NetworkManager to manage network interfaces, which is the default on Red Hat Enterprise Linux.

30.1. Disabling IPv6 on a connection using nmcli

This procedure describes how to disable the IPv6 protocol using the nmcli utility.

Procedure

  1. Optionally, display the list of network connections:

    # nmcli connection show
    NAME    UUID                                  TYPE      DEVICE
    Example 7a7e0151-9c18-4e6f-89ee-65bb2d64d365  ethernet  enp1s0
    ...
  2. Set the ipv6.method parameter of the connection to disabled:

    # nmcli connection modify Example ipv6.method "disabled"
  3. Restart the network connection:

    # nmcli connection up Example

Verification steps

  1. Enter the ip address show command to display the IP settings of the device:

    # ip address show enp1s0
    2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
        link/ether 52:54:00:6b:74:be brd ff:ff:ff:ff:ff:ff
        inet 192.0.2.1/24 brd 192.10.2.255 scope global noprefixroute enp1s0
           valid_lft forever preferred_lft forever

    If no inet6 entry is displayed, IPv6 is disabled on the device.

  2. Verify that the /proc/sys/net/ipv6/conf/enp1s0/disable_ipv6 file now contains the value 1:

    # cat /proc/sys/net/ipv6/conf/enp1s0/disable_ipv6
    1

    The value 1 means that IPv6 is disabled for the device.

Chapter 31. Monitoring and tuning the RX ring buffer

Receive (RX) ring buffers are shared buffers between the device driver and network interface card (NIC), and store incoming packets until the device driver can process them.

You can increase the size of the Ethernet device RX ring buffer if the packet drop rate causes applications to report:

  • a loss of data,
  • cluster fence,
  • slow performance,
  • timeouts, and
  • failed backups.

This section describes how to identify the number of dropped packets and increase the RX ring buffer to reduce a high packet drop rate.

31.1. Displaying the number of dropped packets

The ethtool utility enables administrators to query, configure, or control network driver settings.

The exhaustion of the RX ring buffer causes an increment in the counters, such as "discard" or "drop" in the output of ethtool -S interface_name. The discarded packets indicate that the available buffer is filling up faster than the kernel can process the packets.

This procedure describes how to display drop counters using ethtool.

Procedure

  • To view drop counters for the enp1s0 interface, enter:

    $ ethtool -S enp1s0

31.2. Increasing the RX ring buffer to reduce a high packet drop rate

The ethtool utility helps to increase the RX buffer to reduce a high packet drop rate.

Procedure

  1. To view the maximum RX ring buffer size:

    # ethtool -g enp1s0
     Ring parameters for enp1s0:
     Pre-set maximums:
     RX:             4080
     RX Mini:        0
     RX Jumbo:       16320
     TX:             255
     Current hardware settings:
     RX:             255
     RX Mini:        0
     RX Jumbo:       0
     TX:             255
  2. If the values in the Pre-set maximums section are higher than in the Current hardware settings section, increase RX ring buffer:

Important

Depending on the driver your network interface card uses, changing in the ring buffer can shortly interrupt the network connection.

Chapter 33. Configuring ethtool offload features

Network interface cards can use the TCP offload engine (TOE) to offload processing certain operations to the network controller to improve the network throughput.

This section describes how to set offload features.

33.1. Offload features supported by NetworkManager

You can set the following ethtool offload features using NetworkManager:

  • ethtool.feature-esp-hw-offload
  • ethtool.feature-esp-tx-csum-hw-offload
  • ethtool.feature-fcoe-mtu
  • ethtool.feature-gro
  • ethtool.feature-gso
  • ethtool.feature-highdma
  • ethtool.feature-hw-tc-offload
  • ethtool.feature-l2-fwd-offload
  • ethtool.feature-loopback
  • ethtool.feature-lro
  • ethtool.feature-macsec-hw-offload
  • ethtool.feature-ntuple
  • ethtool.feature-rx
  • ethtool.feature-rx-all
  • ethtool.feature-rx-fcs
  • ethtool.feature-rx-gro-hw
  • ethtool.feature-rx-gro-list
  • ethtool.feature-rx-udp_tunnel-port-offload
  • ethtool.feature-rx-udp-gro-forwarding
  • ethtool.feature-rx-vlan-filter
  • ethtool.feature-rx-vlan-stag-filter
  • ethtool.feature-rx-vlan-stag-hw-parse
  • ethtool.feature-rxhash
  • ethtool.feature-rxvlan
  • ethtool.feature-sg
  • ethtool.feature-tls-hw-record
  • ethtool.feature-tls-hw-rx-offload
  • ethtool.feature-tls-hw-tx-offload
  • ethtool.feature-tso
  • ethtool.feature-tx
  • ethtool.feature-tx-checksum-fcoe-crc
  • ethtool.feature-tx-checksum-ip-generic
  • ethtool.feature-tx-checksum-ipv4
  • ethtool.feature-tx-checksum-ipv6
  • ethtool.feature-tx-checksum-sctp
  • ethtool.feature-tx-esp-segmentation
  • ethtool.feature-tx-fcoe-segmentation
  • ethtool.feature-tx-gre-csum-segmentation
  • ethtool.feature-tx-gre-segmentation
  • ethtool.feature-tx-gso-list
  • ethtool.feature-tx-gso-partial
  • ethtool.feature-tx-gso-robust
  • ethtool.feature-tx-ipxip4-segmentation
  • ethtool.feature-tx-ipxip6-segmentation
  • ethtool.feature-tx-nocache-copy
  • ethtool.feature-tx-scatter-gather
  • ethtool.feature-tx-scatter-gather-fraglist
  • ethtool.feature-tx-sctp-segmentation
  • ethtool.feature-tx-tcp-ecn-segmentation
  • ethtool.feature-tx-tcp-mangleid-segmentation
  • ethtool.feature-tx-tcp-segmentation
  • ethtool.feature-tx-tcp6-segmentation
  • ethtool.feature-tx-tunnel-remcsum-segmentation
  • ethtool.feature-tx-udp-segmentation
  • ethtool.feature-tx-udp_tnl-csum-segmentation
  • ethtool.feature-tx-udp_tnl-segmentation
  • ethtool.feature-tx-vlan-stag-hw-insert
  • ethtool.feature-txvlan

For details about the individual offload features, see the documentation of the ethtool utility and the kernel documentation.

33.2. Configuring an ethtool offload feature using NetworkManager

This section describes how to enable and disable ethtool offload features using NetworkManager, as well as how to remove the setting for a feature from a NetworkManager connection profile.

Procedure

  1. For example, to enable the RX offload feature and disable TX offload in the enp1s0 connection profile, enter:

    # nmcli con modify enp1s0 ethtool.feature-rx on ethtool.feature-tx off

    This command explicitly enables RX offload and disables TX offload.

  2. To remove the setting of an offload feature that you previously enabled or disabled, set the feature’s parameter to ignore. For example, to remove the configuration for TX offload, enter:

    # nmcli con modify enp1s0 ethtool.feature-tx ignore
  3. Reactivate the network profile:

    # nmcli connection up enp1s0

Verification steps

  • Use the ethtool -k command to display the current offload features of a network device:

    # ethtool -k network_device

33.3. Using System Roles to set ethtool features

You can use the networking RHEL System Role to configure ethtool features of a NetworkManager connection.

Important

When you run a play that uses the networking RHEL System Role, the System Role overrides an existing connection profile with the same name if the settings do not match the ones specified in the play. Therefore, always specify the whole configuration of the network connection profile in the play, even if, for example the IP configuration, already exists. Otherwise the role resets these values to their defaults.

Depending on whether it already exists, the procedure creates or updates the enp1s0 connection profile with the following settings:

  • A static IPv4 address - 198.51.100.20 with a /24 subnet mask
  • A static IPv6 address - 2001:db8:1::1 with a /64 subnet mask
  • An IPv4 default gateway - 198.51.100.254
  • An IPv6 default gateway - 2001:db8:1::fffe
  • An IPv4 DNS server - 198.51.100.200
  • An IPv6 DNS server - 2001:db8:1::ffbb
  • A DNS search domain - example.com
  • ethtool features:

    • Generic receive offload (GRO): disabled
    • Generic segmentation offload (GSO): enabled
    • TX stream control transmission protocol (SCTP) segmentation: disabled

Prerequisites

  • The ansible-core package and rhel-system-roles packages are installed on the control node.
  • If you use a different remote user than root when you run the playbook, this user has appropriate sudo permissions on the managed node.

Procedure

  1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

    node.example.com
  2. Create the ~/configure-ethernet-device-with-ethtool-features.yml playbook with the following content:

    ---
    - name. Configure an Ethernet connection with ethtool features
      hosts: node.example.com
      become: true
      tasks:
      - include_role:
          name: linux-system-roles.network
    
        vars:
          network_connections:
            - name: enp1s0
              type: ethernet
              autoconnect: yes
              ip:
                address:
                  - 198.51.100.20/24
                  - 2001:db8:1::1/64
                gateway4: 198.51.100.254
                gateway6: 2001:db8:1::fffe
                dns:
                  - 198.51.100.200
                  - 2001:db8:1::ffbb
                dns_search:
                  - example.com
              ethtool:
                feature:
                  gro: "no"
                  gso: "yes"
                  tx_sctp_segmentation: "no"
              state: up
  3. Run the playbook:

    • To connect as root user to the managed host, enter:

      # ansible-playbook -u root ~/configure-ethernet-device-with-ethtool-features.yml
    • To connect as a user to the managed host, enter:

      # ansible-playbook -u user_name --ask-become-pass ~/configure-ethernet-device-with-ethtool-features.yml

      The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

    If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Additional resources

  • /usr/share/ansible/roles/rhel-system-roles.network/README.md file
  • ansible-playbook(1) man page

Chapter 34. Configuring ethtool coalesce settings

Using interrupt coalescing, the system collects network packets and generates a single interrupt for multiple packets. This increases the amount of data sent to the kernel with one hardware interrupt, which reduces the interrupt load, and maximizes the throughput.

This section provides different options to set the ethtool coalesce settings.

34.1. Coalesce settings supported by NetworkManager

You can set the following ethtool coalesce settings using NetworkManager:

  • coalesce-adaptive-rx
  • coalesce-adaptive-tx
  • coalesce-pkt-rate-high
  • coalesce-pkt-rate-low
  • coalesce-rx-frames
  • coalesce-rx-frames-high
  • coalesce-rx-frames-irq
  • coalesce-rx-frames-low
  • coalesce-rx-usecs
  • coalesce-rx-usecs-high
  • coalesce-rx-usecs-irq
  • coalesce-rx-usecs-low
  • coalesce-sample-interval
  • coalesce-stats-block-usecs
  • coalesce-tx-frames
  • coalesce-tx-frames-high
  • coalesce-tx-frames-irq
  • coalesce-tx-frames-low
  • coalesce-tx-usecs
  • coalesce-tx-usecs-high
  • coalesce-tx-usecs-irq
  • coalesce-tx-usecs-low

34.2. Configuring ethtool coalesce settings using NetworkManager

This section describes how to set ethtool coalesce settings using NetworkManager, as well as how you remove the setting from a NetworkManager connection profile.

Procedure

  1. For example, to set the maximum number of received packets to delay to 128 in the enp1s0 connection profile, enter:

    # nmcli connection modify enp1s0 ethtool.coalesce-rx-frames 128
  2. To remove a coalesce setting, set the setting to ignore. For example, to remove the ethtool.coalesce-rx-frames setting, enter:

    # nmcli connection modify enp1s0 ethtool.coalesce-rx-frames ignore
  3. To reactivate the network profile:

    # nmcli connection up enp1s0

Verification steps

  1. Use the ethtool -c command to display the current offload features of a network device:

    # ethtool -c network_device

34.3. Using System Roles to configure ethtool coalesce settings

You can use the networking RHEL System Role to configure ethtool coalesce settings of a NetworkManager connection.

Important

When you run a play that uses the networking RHEL System Role, the System Role overrides an existing connection profile with the same name if the settings do not match the ones specified in the play. Therefore, always specify the whole configuration of the network connection profile in the play, even if, for example the IP configuration, already exists. Otherwise the role resets these values to their defaults.

Depending on whether it already exists, the procedure creates or updates the enp1s0 connection profile with the following settings:

  • A static IPv4 address - 198.51.100.20 with a /24 subnet mask
  • A static IPv6 address - 2001:db8:1::1 with a /64 subnet mask
  • An IPv4 default gateway - 198.51.100.254
  • An IPv6 default gateway - 2001:db8:1::fffe
  • An IPv4 DNS server - 198.51.100.200
  • An IPv6 DNS server - 2001:db8:1::ffbb
  • A DNS search domain - example.com
  • ethtool coalesce settings:

    • RX frames: 128
    • TX frames: 128

Prerequisites

  • The ansible-core and rhel-system-roles packages are installed on the control node.
  • If you use a different remote user than root when you run the playbook, this user has appropriate sudo permissions on the managed node.

Procedure

  1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

    node.example.com
  2. Create the ~/configure-ethernet-device-with-ethtoolcoalesce-settings.yml playbook with the following content:

    ---
    - name: Configure an Ethernet connection with ethtool coalesce settings
      hosts: node.example.com
      become: true
      tasks:
      - include_role:
          name: linux-system-roles.network
    
        vars:
          network_connections:
            - name: enp1s0
              type: ethernet
              autoconnect: yes
              ip:
                address:
                  - 198.51.100.20/24
                  - 2001:db8:1::1/64
                gateway4: 198.51.100.254
                gateway6: 2001:db8:1::fffe
                dns:
                  - 198.51.100.200
                  - 2001:db8:1::ffbb
                dns_search:
                  - example.com
              ethtool:
                coalesce:
                  rx_frames: 128
                  tx_frames: 128
              state: up
  3. Run the playbook:

    • To connect as root user to the managed host, enter:

      # ansible-playbook -u root ~/configure-ethernet-device-with-ethtoolcoalesce-settings.yml
    • To connect as a user to the managed host, enter:

      # ansible-playbook -u user_name --ask-become-pass ~/configure-ethernet-device-with-ethtoolcoalesce-settings.yml

      The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

    If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Additional resources

  • /usr/share/ansible/roles/rhel-system-roles.network/README.md
  • ansible-playbook(1) man page

Chapter 35. Using MACsec to encrypt layer-2 traffic in the same physical network

This section describes how to configure MACsec for secure communication for all traffic on Ethernet links.

Media Access Control security (MACsec) is a layer 2 protocol that secures different traffic types over the Ethernet links including:

  • dynamic host configuration protocol (DHCP)
  • address resolution protocol (ARP)
  • Internet Protocol version 4 / 6 (IPv4 / IPv6) and
  • any traffic over IP such as TCP or UDP

MACsec encrypts and authenticates all traffic in LANs, by default with the GCM-AES-128 algorithm, and uses a pre-shared key to establish the connection between the participant hosts. If you want to change the pre-shared key, you need to update the NM configuration on all hosts in the network that uses MACsec.

A MACsec connection uses an Ethernet device, such as an Ethernet network card, VLAN, or tunnel device, as parent. You can either set an IP configuration only on the MACsec device to communicate with other hosts only using the encrypted connection, or you can also set an IP configuration on the parent device. In the latter case, you can use the parent device to communicate with other hosts using an unencrypted connection and the MACsec device for encrypted connections.

MACsec does not require any special hardware. For example, you can use any switch, except if you want to encrypt traffic only between a host and a switch. In this scenario, the switch must also support MACsec.

In other words, there are 2 common methods to configure MACsec;

  • host to host and
  • host to switch then switch to other host(s)
Important

You can use MACsec only between hosts that are in the same (physical or virtual) LAN.

The following example shows how to configure MACsec between 2 hosts using a pre-shared key.

35.1. Configuring a MACsec connection using nmcli

You can configure Ethernet interfaces to use MACsec using the nmcli tool. This procedure describes how to create a MACsec connection that uses an Ethernet interface to encrypt the network traffic.

Run this procedure on all the hosts that should communicate in this MACsec-protected network.

Procedure

On Host A:

  • On the first host on which you configure MACsec, create the connectivity association key (CAK) and connectivity-association key name (CKN) for the pre-shared key:

    1. Create 16-byte hexadecimal CAK:

      dd if=/dev/urandom count=16 bs=1 2> /dev/null | hexdump -e '1/2 "%04x"'
      50b71a8ef0bd5751ea76de6d6c98c03a
    2. Create 32-byte hexadecimal CKN:

      dd if=/dev/urandom count=32 bs=1 2> /dev/null | hexdump -e '1/2 "%04x"'
      f2b4297d39da7330910a74abc0449feb45b5c0b9fc23df1430e1898fcf1c4550

On Host A and B:

  1. Create the MACsec connection:

    # nmcli connection add type macsec con-name macsec0 ifname macsec0 connection.autoconnect yes macsec.parent enp1s0 macsec.mode psk macsec.mka-cak 50b71a8ef0bd5751ea76de6d6c98c03a  macsec.mka-ckn f2b4297d39da7330910a7abc0449feb45b5c0b9fc23df1430e1898fcf1c4550

    Use the CAK and CKN generated in the previous step in the macsec.mka-cak and macsec.mka-ckn parameters. The values must be the same on every host in the MACsec-protected network.

  2. Configure the IP settings on the MACsec connection.

    1. Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, and DNS server to the macsec0 connection, enter:

      # nmcli connection modify macsec0 ipv4.method manual ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '192.0.2.253'
    2. Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, and DNS server to the macsec0 connection, enter:

      # nmcli connection modify macsec0 ipv6.method manual ipv6.addresses '2001:db8:1::1/32' ipv6.gateway '2001:db8:1::fffe' ipv6.dns '2001:db8:1::fffd'
  3. Activate the connection:

    # nmcli connection up macsec0

Verification steps

  1. To verify the traffic is encrypted, enter:

    tcpdump -nn -i enp1s0
  2. To view the unencrypted traffic, enter:

    tcpdump -nn -i macsec0
  3. To display MACsec statistics:

    # ip macsec show
  4. To display individual counters for each type of protection: integrity-only (encrypt off) and encryption (encrypt on)

    # ip -s macsec show

35.2. Additional resources

Chapter 36. Using different DNS servers for different domains

By default, Red Hat Enterprise Linux (RHEL) sends all DNS requests to the first DNS server specified in the /etc/resolv.conf file. If this server does not reply, RHEL uses the next server in this file.

In environments where one DNS server cannot resolve all domains, administrators can configure RHEL to send DNS requests for a specific domain to a selected DNS server. For example, you can configure one DNS server to resolve queries for example.com and another DNS server to resolve queries for example.net. For all other DNS requests, RHEL uses the DNS server configured in the connection with the default gateway.

Important

The systemd-resolved service is provided as a Technology Preview only. Technology Preview features are not supported with Red Hat production Service Level Agreements (SLAs), might not be functionally complete, and Red Hat does not recommend using them for production. These previews provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

See Technology Preview Features Support Scope on the Red Hat Customer Portal for information about the support scope for Technology Preview features.

36.1. Sending DNS requests for a specific domain to a selected DNS server

This section configures systemd-resolved service and NetworkManager to send DNS queries for a specific domain to a selected DNS server.

If you complete the procedure in this section, RHEL uses the DNS service provided by systemd-resolved in the /etc/resolv.conf file. The systemd-resolved service starts a DNS service that listens on port 53 IP address 127.0.0.53. The service dynamically routes DNS requests to the corresponding DNS servers specified in NetworkManager.

Note

The 127.0.0.53 address is only reachable from the local system and not from the network.

Prerequisites

  • The system has multiple NetworkManager connections configured.
  • A DNS server and search domain are configured in the NetworkManager connections that are responsible for resolving a specific domain

    For example, if the DNS server specified in a VPN connection should resolve queries for the example.com domain, the VPN connection profile must have:

    • Configured a DNS server that can resolve example.com
    • Configured the search domain to example.com in the ipv4.dns-search and ipv6.dns-search parameters

Procedure

  1. Start and enable the systemd-resolved service:

    # systemctl --now enable systemd-resolved
  2. Edit the /etc/NetworkManager/NetworkManager.conf file, and set the following entry in the [main] section:

    dns=systemd-resolved
  3. Reload the NetworkManager service:

    # systemctl reload NetworkManager

Verification steps

  1. Verify that the nameserver entry in the /etc/resolv.conf file refers to 127.0.0.53:

    # cat /etc/resolv.conf
    nameserver 127.0.0.53
  2. Verify that the systemd-resolved service listens on port 53 on the local IP address 127.0.0.53:

    # ss -tulpn | grep "127.0.0.53"
    udp  UNCONN 0  0      127.0.0.53%lo:53   0.0.0.0:*    users:(("systemd-resolve",pid=1050,fd=12))
    tcp  LISTEN 0  4096   127.0.0.53%lo:53   0.0.0.0:*    users:(("systemd-resolve",pid=1050,fd=13))

Additional resources

  • The dns parameter description in the NetworkManager.conf(5) man page

Chapter 37. Getting started with IPVLAN

This document describes the IPVLAN driver.

37.1. IPVLAN overview

IPVLAN is a driver for a virtual network device that can be used in container environment to access the host network. IPVLAN exposes a single MAC address to the external network regardless the number of IPVLAN device created inside the host network. This means that a user can have multiple IPVLAN devices in multiple containers and the corresponding switch reads a single MAC address. IPVLAN driver is useful when the local switch imposes constraints on the total number of MAC addresses that it can manage.

37.2. IPVLAN modes

The following modes are available for IPVLAN:

  • L2 mode

    In IPVLAN L2 mode, virtual devices receive and respond to address resolution protocol (ARP) requests. The netfilter framework runs only inside the container that owns the virtual device. No netfilter chains are executed in the default namespace on the containerized traffic. Using L2 mode provides good performance, but less control on the network traffic.

  • L3 mode

    In L3 mode, virtual devices process only L3 traffic and above. Virtual devices do not respond to ARP request and users must configure the neighbour entries for the IPVLAN IP addresses on the relevant peers manually. The egress traffic of a relevant container is landed on the netfilter POSTROUTING and OUTPUT chains in the default namespace while the ingress traffic is threaded in the same way as L2 mode. Using L3 mode provides good control but decreases the network traffic performance.

  • L3S mode

    In L3S mode, virtual devices process the same way as in L3 mode, except that both egress and ingress traffics of a relevant container are landed on netfilter chain in the default namespace. L3S mode behaves in a similar way to L3 mode but provides greater control of the network.

Note

The IPVLAN virtual device does not receive broadcast and multicast traffic in case of L3 and L3S modes.

37.3. Overview of MACVLAN

The MACVLAN driver allows to create multiple virtual network devices on top of a single NIC, each of them identified by its own unique MAC address. Packets which land on the physical NIC are demultiplexed towards the relevant MACVLAN device via MAC address of the destination. MACVLAN devices do not add any level of encapsulation.

37.4. Comparison of IPVLAN and MACVLAN

The following table shows the major differences between MACVLAN and IPVLAN.

MACVLANIPVLAN

Uses MAC address for each MACVLAN device. The overlimit of MAC addresses of MAC table in switch might cause loosing the connectivity.

Uses single MAC address which does not limit the number of IPVLAN devices.

Netfilter rules for global namespace cannot affect traffic to or from MACVLAN device in a child namespace.

It is possible to control traffic to or from IPVLAN device in L3 mode and L3S mode.

Note that both IPVLAN and MACVLAN do not require any level of encapsulation.

37.5. Creating and configuring the IPVLAN device using iproute2

This procedure shows how to set up the IPVLAN device using iproute2.

Procedure

  1. To create an IPVLAN device, enter the following command:

    ~]# ip link add link real_NIC_device name IPVLAN_device type ipvlan mode l2

    Note that network interface controller (NIC) is a hardware component which connects a computer to a network.

    Example 37.1. Creating an IPVLAN device

    ~]# ip link add link enp0s31f6 name my_ipvlan type ipvlan mode l2
    ~]# ip link
    47: my_ipvlan@enp0s31f6: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether e8:6a:6e:8a:a2:44 brd ff:ff:ff:ff:ff:ff
  2. To assign an IPv4 or IPv6 address to the interface, enter the following command:

    ~]# ip addr add dev IPVLAN_device IP_address/subnet_mask_prefix
  3. In case of configuring an IPVLAN device in L3 mode or L3S mode, make the following setups:

    1. Configure the neighbor setup for the remote peer on the remote host:

      ~]# ip neigh add dev peer_device IPVLAN_device_IP_address lladdr MAC_address

      where MAC_address is the MAC address of the real NIC on which an IPVLAN device is based on.

    2. Configure an IPVLAN device for L3 mode with the following command:

      ~]# ip route add dev <real_NIC_device> <peer_IP_address/32>

      For L3S mode:

      ~]# ip route dev add real_NIC_device peer_IP_address/32

      where IP-address represents the address of the remote peer.

  4. To set an IPVLAN device active, enter the following command:

    ~]# ip link set dev IPVLAN_device up
  5. To check if the IPVLAN device is active, execute the following command on the remote host:

    ~]# ping IP_address

    where the IP_address uses the IP address of the IPVLAN device.

Chapter 38. Reusing the same IP address on different interfaces

With Virtual routing and forwarding (VRF), administrators can use multiple routing tables simultaneously on the same host. For that, VRF partitions a network at layer 3. This enables the administrator to isolate traffic using separate and independent route tables per VRF domain. This technique is similar to virtual LANs (VLAN), which partitions a network at layer 2, where the operating system uses different VLAN tags to isolate traffic sharing the same physical medium.

One benefit of VRF over partitioning on layer 2 is that routing scales better considering the number of peers involved.

Red Hat Enterprise Linux uses a virtual vrt device for each VRF domain and adds routes to a VRF domain by adding existing network devices to a VRF device. Addresses and routes previously attached to the original device will be moved inside the VRF domain.

Note that each VRF domain is isolated from each other.

38.1. Permanently reusing the same IP address on different interfaces

This procedure describes how to permanently use the same IP address on different interfaces in one server by using the VRF feature.

Important

To enable remote peers to contact both VRF interfaces while reusing the same IP address, the network interfaces must belong to different broadcasting domains. A broadcast domain in a network is a set of nodes, which receive broadcast traffic sent by any of them. In most configurations, all nodes connected to the same switch belong to the same broadcasting domain.

Prerequisites

  • You are logged in as the root user.
  • The network interfaces are not configured.

Procedure

  1. Create and configure the first VRF device:

    1. Create a connection for the VRF device and assign it to a routing table. For example, to create a VRF device named vrf0 that is assigned to the 1001 routing table:

      # nmcli connection add type vrf ifname vrf0 con-name vrf0 table 1001 ipv4.method disabled ipv6.method disabled
    2. Enable the vrf0 device:

      # nmcli connection up vrf0
    3. Assign a network device to the VRF just created. For example, to add the enp1s0 Ethernet device to the vrf0 VRF device and assign an IP address and the subnet mask to enp1s0, enter:

      # nmcli connection add type ethernet con-name vrf.enp1s0 ifname enp1s0 master vrf0 ipv4.method manual ipv4.address 192.0.2.1/24
    4. Activate the vrf.enp1s0 connection:

      # nmcli connection up vrf.enp1s0
  2. Create and configure the next VRF device:

    1. Create the VRF device and assign it to a routing table. For example, to create a VRF device named vrf1 that is assigned to the 1002 routing table, enter:

      # nmcli connection add type vrf ifname vrf1 con-name vrf1 table 1002 ipv4.method disabled ipv6.method disabled
    2. Activate the vrf1 device:

      # nmcli connection up vrf1
    3. Assign a network device to the VRF just created. For example, to add the enp7s0 Ethernet device to the vrf1 VRF device and assign an IP address and the subnet mask to enp7s0, enter:

      # nmcli connection add type ethernet con-name vrf.enp7s0 ifname enp7s0 master vrf1 ipv4.method manual ipv4.address 192.0.2.1/24
    4. Activate the vrf.enp7s0 device:

      # nmcli connection up vrf.enp7s0

38.2. Temporarily reusing the same IP address on different interfaces

The procedure in this section describes how to temporarily use the same IP address on different interfaces in one server by using the virtual routing and forwarding (VRF) feature. Use this procedure only for testing purposes, because the configuration is temporary and lost after you reboot the system.

Important

To enable remote peers to contact both VRF interfaces while reusing the same IP address, the network interfaces must belong to different broadcasting domains. A broadcast domain in a network is a set of nodes which receive broadcast traffic sent by any of them. In most configurations, all nodes connected to the same switch belong to the same broadcasting domain.

Prerequisites

  • You are logged in as the root user.
  • The network interfaces are not configured.

Procedure

  1. Create and configure the first VRF device:

    1. Create the VRF device and assign it to a routing table. For example, to create a VRF device named blue that is assigned to the 1001 routing table:

      # ip link add dev blue type vrf table 1001
    2. Enable the blue device:

      # ip link set dev blue up
    3. Assign a network device to the VRF device. For example, to add the enp1s0 Ethernet device to the blue VRF device:

      # ip link set dev enp1s0 master blue
    4. Enable the enp1s0 device:

      # ip link set dev enp1s0 up
    5. Assign an IP address and subnet mask to the enp1s0 device. For example, to set it to 192.0.2.1/24:

      # ip addr add dev enp1s0 192.0.2.1/24
  2. Create and configure the next VRF device:

    1. Create the VRF device and assign it to a routing table. For example, to create a VRF device named red that is assigned to the 1002 routing table:

      # ip link add dev red type vrf table 1002
    2. Enable the red device:

      # ip link set dev red up
    3. Assign a network device to the VRF device. For example, to add the enp7s0 Ethernet device to the red VRF device:

      # ip link set dev enp7s0 master red
    4. Enable the enp7s0 device:

      # ip link set dev enp7s0 up
    5. Assign the same IP address and subnet mask to the enp7s0 device as you used for enp1s0 in the blue VRF domain:

      # ip addr add dev enp7s0 192.0.2.1/24
  3. Optionally, create further VRF devices as described above.

38.3. Additional resources

  • /usr/share/doc/kernel-doc-<kernel_version>/Documentation/networking/vrf.txt from the kernel-doc package

Chapter 39. Starting a service within an isolated VRF network

With virtual routing and forwarding (VRF), you can create isolated networks with a routing table that is different to the main routing table of the operating system. You can then start services and applications so that they have only access to the network defined in that routing table.

39.1. Configuring a VRF device

To use virtual routing and forwarding (VRF), you create a VRF device and attach a physical or virtual network interface and routing information to it.

Warning

To prevent that you lock out yourself out remotely, perform this procedure on the local console or remotely over a network interface that you do not want to assign to the VRF device.

Prerequisites

  • You are logged in locally or using a network interface that is different to the one you want to assign to the VRF device.

Procedure

  1. Create the vrf0 connection with a same-named virtual device, and attach it to routing table 1000:

    # nmcli connection add type vrf ifname vrf0 con-name vrf0 table 1000 ipv4.method disabled ipv6.method disabled
  2. Add the enp1s0 device to the vrf0 connection, and configure the IP settings:

    # nmcli connection add type ethernet con-name enp1s0 ifname enp1s0 master vrf0 ipv4.method manual ipv4.address 192.0.2.1/24 ipv4.gateway 192.0.2.254

    This command creates the enp1s0 connection as a port of the vrf0 connection. Due to this configuration, the routing information are automatically assigned to the routing table 1000 that is associated with the vrf0 device.

  3. If you require static routes in the isolated network:

    1. Add the static routes:

      # nmcli connection modify enp1s0 +ipv4.routes "198.51.100.0/24 192.0.2.2"

      This adds a route to the 198.51.100.0/24 network that uses 192.0.2.2 as the router.

    2. Reload the connection:

      # nmcli connection up enp1s0

Verification

  1. Display the IP settings of the device that is associated with vrf0:

    # ip -br addr show vrf vrf0
    enp1s0    UP    192.0.2.15/24
  2. Display the VRF devices and their associated routing table:

    # ip vrf show
    Name              Table
    -----------------------
    vrf0              1000
  3. Display the main routing table:

    # ip route show
    default via 192.168.0.1 dev enp1s0 proto static metric 100
  4. Display the routing table 1000:

    # ip route show table 1000
    default via 192.0.2.254 dev enp1s0 proto static metric 101
    broadcast 192.0.2.0 dev enp1s0 proto kernel scope link src 192.0.2.1
    192.0.2.0/24 dev enp1s0 proto kernel scope link src 192.0.2.1 metric 101
    local 192.0.2.1 dev enp1s0 proto kernel scope host src 192.0.2.1
    broadcast 192.0.2.255 dev enp1s0 proto kernel scope link src 192.0.2.1
    198.51.100.0/24 via 192.0.2.2 dev enp1s0 proto static metric 101

    The default entry indicates that services that use this routing table, use 192.0.2.254 as their default gateway and not the default gateway in the main routing table.

  5. Execute the traceroute utility in the network associated with vrf0 to verify that the utility uses the route from table 1000:

    # ip vrf exec vrf0 traceroute 203.0.113.1
    traceroute to 203.0.113.1 (203.0.113.1), 30 hops max, 60 byte packets
     1  192.0.2.254 (192.0.2.254)  0.516 ms  0.459 ms  0.430 ms
    ...

    The first hop is the default gateway that is assigned to the routing table 1000 and not the default gateway from the system’s main routing table.

Additional resources

  • ip-vrf(8)

39.2. Starting a service within an isolated VRF network

You can configure a service, such as the Apache HTTP Server, to start within an isolated virtual routing and forwarding (VRF) network.

Important

Services can only bind to local IP addresses that are in the same VRF network.

Prerequisites

  • You configured the vrf0 device.
  • You configured Apache HTTP Server to listen only on the IP address that is assigned to the interface associated with the vrf0 device.

Procedure

  1. Display the content of the httpd systemd service:

    # systemctl cat httpd
    ...
    [Service]
    ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND
    ...

    You require the content of the ExecStart parameter in a later step to run the same command within the isolated VRF network.

  2. Create the /etc/systemd/system/httpd.service.d/ directory:

    # mkdir /etc/systemd/system/httpd.service.d/
  3. Create the /etc/systemd/system/httpd.service.d/override.conf file with the following content:

    [Service]
    ExecStart=
    ExecStart=/usr/sbin/ip vrf exec vrf0 /usr/sbin/httpd $OPTIONS -DFOREGROUND

    To override the ExecStart parameter, you first need to unset it and then set it to the new value as shown.

  4. Reload systemd.

    # systemctl daemon-reload
  5. Restart the httpd service.

    # systemctl restart httpd

Verification

  1. Display the process IDs (PID) of httpd processes:

    # pidof -c httpd
    1904 ...
  2. Display the VRF association for the PIDs, for example:

    # ip vrf identify 1904
    vrf0
  3. Display all PIDs associated with the vrf0 device:

    # ip vrf pids vrf0
    1904  httpd
    ...

Additional resources

  • ip-vrf(8)

Chapter 40. Setting the routing protocols for your system

This section describes how to use the Free Range Routing (FRRouting, or FRR) feature to enable and set the required routing protocols for your system.

40.1. Introduction to FRRouting

Free Range Routing (FRRouting, or FRR) is a routing protocol stack, which is provided by the frr package available in the AppStream repository.

FRR replaces Quagga that was used on previous RHEL versions. As such, FRR provides TCP/IP-based routing services with support for multiple IPv4 and IPv6 routing protocols.

The supported protocols are:

  • Border Gateway Protocol (BGP)
  • Intermediate System to Intermediate System (IS-IS)
  • Open Shortest Path First (OSPF)
  • Protocol-Independent Multicast (PIM)
  • Routing Information Protocol (RIP)
  • Routing Information Protocol next generation (RIPng)
  • Enhanced Interior Gateway Routing Protocol (EIGRP)
  • Next Hop Resolution Protocol (NHRP)
  • Bidirectional Forwarding Detection (BFD)
  • Policy-based Routing (PBR)

FRR is a collection of the following services:

  • zebra
  • bgpd
  • isisd
  • ospfd
  • ospf6d
  • pimd
  • ripd
  • ripngd
  • eigrpd
  • nhrpd
  • bfdd
  • pbrd
  • staticd
  • fabricd

If frr is installed, the system can act as a dedicated router, which exchanges routing information with other routers in either internal or external network using the routing protocols.

40.2. Setting up FRRouting

This section explains how you set up Free Range Routing (FRRouting, or FRR).

Prerequisites

  • Make sure that the frr package is installed on your system:
# yum install frr

Procedure

  1. Edit the /etc/frr/daemons configuration file, and enable the required daemons for your system.

    For example, to enable the ripd daemon, include the following line:

    ripd=yes
    Warning

    The zebra daemon must always be enabled, so that you must set zebra=yes to be able to use FRR.

    Important

    By default, /etc/frr/daemons contains [daemon_name]=no entries for all daemons. Therefore, all daemons are disabled, and starting FRR after a new installation of the system has no effect.

  2. Start the frr service:

    # systemctl start frr
  3. Optionally, you can also set FRR to start automatically on boot:

    # systemctl enable frr

40.3. Modifying the configuration of FRR

This section describes:

  • How to enable an additional daemon after you set up FRR
  • How to disable a daemon after you set up FRR

Prerequisites

Procedure

  1. Edit the /etc/frr/daemons configuration file, and modify the line for the required daemons to state yes instead of no.

    For example, to enable the ripd daemon:

    ripd=yes
  2. Reload the frr service:

    # systemctl reload frr

40.4. Modifying a configuration of a particular daemon

With the default configuration, every routing daemon in FRR can only act as a plain router.

For any additional configuration of a daemon, use the following procedure.

Procedure

  1. Within the /etc/frr/ directory, create a configuration file for the required daemon, and name the file as follows:

    [daemon_name].conf

    For example, to further configure the eigrpd daemon, create the eigrpd.conf file in the mentioned directory.

  2. Populate the new file with the required content.

    For configuration examples of particular FRR daemons, see the /usr/share/doc/frr/ directory.

  3. Reload the frr service:

    # systemctl reload frr

Chapter 41. Testing basic network settings

This section describes how to perform basic network testing.

41.1. Using the ping utility to verify the IP connection to other hosts

The ping utility sends ICMP packets to a remote host. You can use this functionality to test if the IP connection to a different host works.

Procedure

  • Ping the IP address of a host in the same subnet, such as your default gateway:

    # ping 192.0.2.3

    If the command fails, verify the default gateway settings.

  • Ping an IP address of a host in a remote subnet:

    # ping 198.162.3.1

If the command fails, verify the default gateway settings, and ensure that the gateway forwards packets between the connected networks.

41.2. Using the host utility to verify name resolution

This procedure describes how to verify name resolution in Red Hat Enterprise Linux.

Procedure

  • Use the host utility to verify that name resolution works. For example, to resolve the client.example.com hostname to an IP address, enter:

    # host client.example.com

If the command returns an error, such as connection timed out or no servers could be reached, verify your DNS settings.

Chapter 42. Running dhclient exit hooks using NetworkManager a dispatcher script

You can use a NetworkManager dispatcher script to execute dhclient exit hooks.

42.1. The concept of NetworkManager dispatcher scripts

The NetworkManager-dispatcher service executes user-provided scripts in alphabetical order when network events happen. These scripts are typically shell scripts, but can be any executable script or application. You can use dispatcher scripts, for example, to adjust network-related settings that you cannot manage with NetworkManager.

You can store dispatcher scripts in the following directories:

  • /etc/NetworkManager/dispatcher.d/: The general location for dispatcher scripts the root user can edit.
  • /usr/lib/NetworkManager/dispatcher.d/: For pre-deployed immutable dispatcher scripts.

For security reasons, the NetworkManager-dispatcher service executes scripts only if the following conditions met:

  • The script is owned by the root user.
  • The script is only readable and writable by root.
  • The setuid bit is not set on the script.

The NetworkManager-dispatcher service runs each script with two arguments:

  1. The interface name of the device the operation happened on.
  2. The action, such as up, when the interface has been activated.

The Dispatcher scripts section in the NetworkManager(8) man page provides an overview of actions and environment variables you can use in scripts.

The NetworkManager-dispatcher service runs one script at a time, but asynchronously from the main NetworkManager process. Note that, if a script is queued, the service will always run it, even if a later event makes it obsolete. However, the NetworkManager-dispatcher service runs scripts that are symbolic links referring to files in /etc/NetworkManager/dispatcher.d/no-wait.d/ immediately, without waiting for the termination of previous scripts, and in parallel.

Additional resources

  • The Dispatcher scripts section in the NetworkManager(8) man page

42.2. Creating a NetworkManager dispatcher script that runs dhclient exit hooks

This section explains how to write a NetworkManager dispatcher script that runs dhclient exit hooks stored in the /etc/dhcp/dhclient-exit-hooks.d/ directory when an IPv4 address is assigned or updated from a DHCP server.

Prerequisites

  • The dhclient exit hooks are stored in the /etc/dhcp/dhclient-exit-hooks.d/ directory.

Procedure

  1. Create the /etc/NetworkManager/dispatcher.d/12-dhclient-down file with the following content:

    #!/bin/bash
    # Run dhclient.exit-hooks.d scripts
    
    if [ -n "$DHCP4_DHCP_LEASE_TIME" ] ; then
      if [ "$2" = "dhcp4-change" ] || [ "$2" = "up" ] ; then
        if [ -d /etc/dhcp/dhclient-exit-hooks.d ] ; then
          for f in /etc/dhcp/dhclient-exit-hooks.d/*.sh ; do
            if [ -x "${f}" ]; then
              . "${f}"
            fi
          done
        fi
      fi
    fi
  2. Set the root user as owner of the file:

    # chown root:root /etc/NetworkManager/dispatcher.d/12-dhclient-down
  3. Set the permissions so that only the root user can execute it:

    # chmod 0700 /etc/NetworkManager/dispatcher.d/12-dhclient-down
  4. Restore the SELinux context:

    # restorecon /etc/NetworkManager/dispatcher.d/12-dhclient-down

Additional resources

  • The Dispatcher scripts section in the NetworkManager(8) man page.

Chapter 43. Introduction to NetworkManager Debugging

Increasing the log levels for all or certain domains helps to log more details of the operations NetworkManager performs. Administrators can use this information to troubleshoot problems. NetworkManager provides different levels and domains to produce logging information. The /etc/NetworkManager/NetworkManager.conf file is the main configuration file for NetworkManager. The logs are stored in the journal.

This section provides information on enabling debug logging for NetworkManager and using different logging levels and domains to configure the amount of logging details.

43.1. Debugging levels and domains

You can use the levels and domains parameters to manage the debugging for NetworkManager. The level defines the verbosity level, whereas the domains define the category of the messages to record the logs with given severity (level).

Log levelsDescription

OFF

Does not log any messages about NetworkManager

ERR

Logs only critical errors

WARN

Logs warnings that can reflect the operation

INFO

Logs various informational messages that are useful for tracking state and operations

DEBUG

Enables verbose logging for debugging purposes

TRACE

Enables more verbose logging than the DEBUG level

Note that subsequent levels log all messages from earlier levels. For example, setting the log level to INFO also logs messages contained in the ERR and WARN log level.

Additional resources

  • NetworkManager.conf(5) man page

43.2. Setting the NetworkManager log level

By default, all the log domains are set to record the INFO log level. Disable rate-limiting before collecting debug logs. With rate-limiting, systemd-journald drops messages if there are too many of them in a short time. This can occur when the log level is TRACE.

This procedure disables rate-limiting and enables recording debug logs for the all (ALL) domains.

Procedure

  1. To disable rate-limiting, edit the /etc/systemd/journald.conf file, uncomment the RateLimitBurst parameter in the [Journal] section, and set its value as 0:

    RateLimitBurst=0
  2. Restart the systemd-journald service.

    # systemctl restart systemd-journald
  3. Create the /etc/NetworkManager/conf.d/95-nm-debug.conf file with the following content:

    [logging]
    domains=ALL:DEBUG

    The domains parameter can contain multiple comma-separated domain:level pairs.

  4. Restart the NetworkManager service.

    # systemctl restart NetworkManager

43.3. Temporarily setting log levels at run time using nmcli

You can change the log level at run time using nmcli. However, Red Hat recommends to enable debugging using configuration files and restart NetworkManager. Updating debugging levels and domains using the .conf file helps to debug boot issues and captures all the logs from the initial state.

Procedure

  1. Optional: Display the current logging settings:

    # nmcli general logging
      LEVEL  DOMAINS
      INFO   PLATFORM,RFKILL,ETHER,WIFI,BT,MB,DHCP4,DHCP6,PPP,WIFI_SCAN,IP4,IP6,A
    UTOIP4,DNS,VPN,SHARING,SUPPLICANT,AGENTS,SETTINGS,SUSPEND,CORE,DEVICE,OLPC,
    WIMAX,INFINIBAND,FIREWALL,ADSL,BOND,VLAN,BRIDGE,DBUS_PROPS,TEAM,CONCHECK,DC
    B,DISPATCH
  2. To modify the logging level and domains, use the following options:

    • To set the log level for all domains to the same LEVEL, enter:

      # nmcli general logging level LEVEL domains ALL
    • To change the level for specific domains, enter:

      # nmcli general logging level LEVEL domains DOMAINS

      Note that updating the logging level using this command disables logging for all the other domains.

    • To change the level of specific domains and preserve the level of all other domains, enter:

      # nmcli general logging level KEEP domains DOMAIN:LEVEL,DOMAIN:LEVEL

43.4. Viewing NetworkManager logs

You can view the NetworkManager logs for troubleshooting.

Procedure

  • To view the logs, enter:

    # journalctl -u NetworkManager -b

Additional resources

  • The NetworkManager.conf(5) man page.
  • The journalctl man page.

Chapter 44. Capturing network packets

To debug network issues and communications, you can capture network packets. The following sections provide instructions and additional information about capturing network packets.

44.1. Using xdpdump to capture network packets including packets dropped by XDP programs

The xdpdump utility captures network packets. Unlike the tcpdump utility, xdpdump uses an extended Berkeley Packet Filter(eBPF) program for this task. This enables xdpdump to also capture packets dropped by Express Data Path (XDP) programs. User-space utilities, such as tcpdump, are not able to capture these dropped packages, as well as original packets modified by an XDP program.

You can use xdpdump to debug XDP programs that are already attached to an interface. Therefore, the utility can capture packets before an XDP program is started and after it has finished. In the latter case, xdpdump also captures the XDP action. By default, xdpdump captures incoming packets at the entry of the XDP program.

Important

On other architectures than AMD and Intel 64-bit, the xdpdump utility is provided as a Technology Preview only. Technology Preview features are not supported with Red Hat production Service Level Agreements (SLAs), might not be functionally complete, and Red Hat does not recommend using them for production. These previews provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

See Technology Preview Features Support Scope on the Red Hat Customer Portal for information about the support scope for Technology Preview features.

Note that xdpdump has no packet filter or decode capabilities. However, you can use it in combination with tcpdump for packet decoding.

The procedure describes how to capture all packets on the enp1s0 interface and write them to the /root/capture.pcap file.

Prerequisites

  • A network driver that supports XDP programs.
  • An XDP program is loaded to the enp1s0 interface. If no program is loaded, xdpdump captures packets in a similar way tcpdump does, for backward compatibility.

Procedure

  1. To capture packets on the enp1s0 interface and write them to the /root/capture.pcap file, enter:

    # xdpdump -i enp1s0 -w /root/capture.pcap
  2. To stop capturing packets, press Ctrl+C.

Additional resources

  • xdpdump(8) man page
  • If you are a developer and you are interested in the source code of xdpdump, download and install the corresponding source RPM (SRPM) from the Red Hat Customer Portal.

44.2. Additional resources

Chapter 45. Providing DHCP services

The dynamic host configuration protocol (DHCP) is a network protocol that automatically assigns IP information to clients.

This section explains general information on the dhcpd service, as well as how to set up a DHCP server and DHCP relay.

If a procedure requires different steps for providing DHCP in IPv4 and IPv6 networks, the sections in this chapter contain procedures for both protocols.

45.1. The difference between static and dynamic IP addressing

Static IP addressing

When you assign a static IP address to a device, the address does not change over time unless you change it manually. Use static IP addressing if you want:

  • To ensure network address consistency for servers such as DNS, and authentication servers.
  • To use out-of-band management devices that work independently of other network infrastructure.
Dynamic IP addressing

When you configure a device to use a dynamic IP address, the address can change over time. For this reason, dynamic addresses are typically used for devices that connect to the network occasionally because the IP address can be different after rebooting the host.

Dynamic IP addresses are more flexible, easier to set up, and administer. The Dynamic Host Control Protocol (DHCP) is a traditional method of dynamically assigning network configurations to hosts.

Note

There is no strict rule defining when to use static or dynamic IP addresses. It depends on user’s needs, preferences, and the network environment.

45.2. DHCP transaction phases

The DHCP works in four phases: Discovery, Offer, Request, Acknowledgement, also called the DORA process. DHCP uses this process to provide IP addresses to clients.

Discovery
The DHCP client sends a message to discover the DHCP server in the network. This message is broadcasted at the network and data link layer.
Offer
The DHCP server receives messages from the client and offers an IP address to the DHCP client. This message is unicast at the data link layer but broadcast at the network layer.
Request
The DHCP client requests the DHCP server for the offered IP address. This message is unicast at the data link layer but broadcast at the network layer.
Acknowledgment
The DHCP server sends an acknowledgment to the DHCP client. This message is unicast at the data link layer but broadcast at the network layer. It is the final message of the DHCP DORA process.

45.3. The differences when using dhcpd for DHCPv4 and DHCPv6

The dhcpd service supports providing both DHCPv4 and DHCPv6 on one server. However, you need a separate instance of dhcpd with separate configuration files to provide DHCP for each protocol.

DHCPv4
  • Configuration file: /etc/dhcp/dhcpd.conf
  • Systemd service name: dhcpd
DHCPv6
  • Configuration file: /etc/dhcp/dhcpd6.conf
  • Systemd service name: dhcpd6

45.4. The lease database of the dhcpd service

A DHCP lease is the time period for which the dhcpd service allocates a network address to a client. The dhcpd service stores the DHCP leases in the following databases:

  • For DHCPv4: /var/lib/dhcpd/dhcpd.leases
  • For DHCPv6: /var/lib/dhcpd/dhcpd6.leases
Warning

Manually updating the database files can corrupt the databases.

The lease databases contain information about the allocated leases, such as the IP address assigned to a media access control (MAC) address or the time stamp when the lease expires. Note that all time stamps in the lease databases are in Coordinated Universal Time (UTC).

The dhcpd service recreates the databases periodically:

  1. The service renames the existing files:

    • /var/lib/dhcpd/dhcpd.leases to /var/lib/dhcpd/dhcpd.leases~
    • /var/lib/dhcpd/dhcpd6.leases to /var/lib/dhcpd/dhcpd6.leases~
  2. The service writes all known leases to the newly created /var/lib/dhcpd/dhcpd.leases and /var/lib/dhcpd/dhcpd6.leases files.

Additional resources

45.5. Comparison of DHCPv6 to radvd

In an IPv6 network, only router advertisement messages provide information on an IPv6 default gateway. As a consequence, if you want to use DHCPv6 in subnets that require a default gateway setting, you must additionally configure a router advertisement service, such as Router Advertisement Daemon (radvd).

The radvd service uses flags in router advertisement packets to announce the availability of a DHCPv6 server.

This section compares DHCPv6 and radvd, and provides information about configuring radvd.

 DHCPv6radvd

Provides information on the default gateway

no

yes

Guarantees random addresses to protect privacy

yes

no

Sends further network configuration options

yes

no

Maps media access control (MAC) addresses to IPv6 addresses

yes

no

45.6. Configuring the radvd service for IPv6 routers

The router advertisement daemon (radvd) sends router advertisement messages that are required for IPv6 stateless autoconfiguration. This enables users to automatically configure their addresses, settings, routes, and to choose a default router based on these advertisements.

The procedure in this section explains how to configure radvd.

Note

You can only set /64 prefixes in the radvd service. To use other prefixes, use DHCPv6.

Prerequisites

  • You are logged in as the root user.

Procedure

  1. Install the radvd package:

    # yum install radvd
  2. Edit the /etc/radvd.conf file, and add the following configuration:

    interface enp1s0
    {
      AdvSendAdvert on;
      AdvManagedFlag on;
      AdvOtherConfigFlag on;
    
      prefix 2001:db8:0:1::/64 {
      };
    };

    These settings configures radvd to send router advertisement messages on the enp1s0 device for the 2001:db8:0:1::/64 subnet. The AdvManagedFlag on setting defines that the client should receive the IP address from a DHCP server, and the AdvOtherConfigFlag parameter set to on defines that clients should receive non-address information from the DHCP server as well.

  3. Optionally, configure that radvd automatically starts when the system boots:

    # systemctl enable radvd
  4. Start the radvd service:

    # systemctl start radvd
  5. Optionally, display the content of router advertisement packages and the configured values radvd sends:

    # radvdump

Additional resources

45.7. Setting network interfaces for the DHCP servers

By default, the dhcpd service processes requests only on network interfaces that have an IP address in the subnet defined in the configuration file of the service.

For example, in the following scenario, dhcpd listens only on the enp0s1 network interface:

  • You have only a subnet definition for the 192.0.2.0/24 network in the /etc/dhcp/dhcpd.conf file.
  • The enp0s1 network interface is connected to the 192.0.2.0/24 subnet.
  • The enp7s0 interface is connected to a different subnet.

Only follow the procedure in this section if the DHCP server contains multiple network interfaces connected to the same network but the service should listen only on specific interfaces.

Depending on whether you want to provide DHCP for IPv4, IPv6, or both protocols, see the procedure for:

Prerequisites

  • You are logged in as the root user.
  • The dhcp-server package is installed.

Procedure

  • For IPv4 networks:

    1. Copy the /usr/lib/systemd/system/dhcpd.service file to the /etc/systemd/system/ directory:

      # cp /usr/lib/systemd/system/dhcpd.service /etc/systemd/system/

      Do not edit the /usr/lib/systemd/system/dhcpd.service file. Future updates of the dhcp-server package can override the changes.

    2. Edit the /etc/systemd/system/dhcpd.service file, and append the names of the interface, that dhcpd should listen on to the command in the ExecStart parameter:

      ExecStart=/usr/sbin/dhcpd -f -cf /etc/dhcp/dhcpd.conf -user dhcpd -group dhcpd --no-pid $DHCPDARGS enp0s1 enp7s0

      This example configures that dhcpd listens only on the enp0s1 and enp7s0 interfaces.

    3. Reload the systemd manager configuration:

      # systemctl daemon-reload
    4. Restart the dhcpd service:

      # systemctl restart dhcpd.service
  • For IPv6 networks:

    1. Copy the /usr/lib/systemd/system/dhcpd6.service file to the /etc/systemd/system/ directory:

      # cp /usr/lib/systemd/system/dhcpd6.service /etc/systemd/system/

      Do not edit the /usr/lib/systemd/system/dhcpd6.service file. Future updates of the dhcp-server package can override the changes.

    2. Edit the /etc/systemd/system/dhcpd6.service file, and append the names of the interface, that dhcpd should listen on to the command in the ExecStart parameter:

      ExecStart=/usr/sbin/dhcpd -f -6 -cf /etc/dhcp/dhcpd6.conf -user dhcpd -group dhcpd --no-pid $DHCPDARGS enp0s1 enp7s0

      This example configures that dhcpd listens only on the enp0s1 and enp7s0 interfaces.

    3. Reload the systemd manager configuration:

      # systemctl daemon-reload
    4. Restart the dhcpd6 service:

      # systemctl restart dhcpd6.service

45.8. Setting up the DHCP service for subnets directly connected to the DHCP server

Use the following procedure if the DHCP server is directly connected to the subnet for which the server should answer DHCP requests. This is the case if a network interface of the server has an IP address of this subnet assigned.

Depending on whether you want to provide DHCP for IPv4, IPv6, or both protocols, see the procedure for:

Prerequisites

  • You are logged in as the root user.
  • The dhcp-server package is installed.

Procedure

  • For IPv4 networks:

    1. Edit the /etc/dhcp/dhcpd.conf file:

      1. Optionally, add global parameters that dhcpd uses as default if no other directives contain these settings:

        option domain-name "example.com";
        default-lease-time 86400;

        This example sets the default domain name for the connection to example.com, and the default lease time to 86400 seconds (1 day).

      2. Add the authoritative statement on a new line:

        authoritative;
        Important

        Without the authoritative statement, the dhcpd service does not answer DHCPREQUEST messages with DHCPNAK if a client asks for an address that is outside of the pool.

      3. For each IPv4 subnet directly connected to an interface of the server, add a subnet declaration:

        subnet 192.0.2.0 netmask 255.255.255.0 {
          range 192.0.2.20 192.0.2.100;
          option domain-name-servers 192.0.2.1;
          option routers 192.0.2.1;
          option broadcast-address 192.0.2.255;
          max-lease-time 172800;
        }

        This example adds a subnet declaration for the 192.0.2.0/24 network. With this configuration, the DHCP server assigns the following settings to a client that sends a DHCP request from this subnet:

        • A free IPv4 address from the range defined in the range parameter
        • IP of the DNS server for this subnet: 192.0.2.1
        • Default gateway for this subnet: 192.0.2.1
        • Broadcast address for this subnet: 192.0.2.255
        • The maximum lease time, after which clients in this subnet release the IP and send a new request to the server: 172800 seconds (2 days)
    2. Optionally, configure that dhcpd starts automatically when the system boots:

      # systemctl enable dhcpd
    3. Start the dhcpd service:

      # systemctl start dhcpd
  • For IPv6 networks:

    1. Edit the /etc/dhcp/dhcpd6.conf file:

      1. Optionally, add global parameters that dhcpd uses as default if no other directives contain these settings:

        option dhcp6.domain-search "example.com";
        default-lease-time 86400;

        This example sets the default domain name for the connection to example.com, and the default lease time to 86400 seconds (1 day).

      2. Add the authoritative statement on a new line:

        authoritative;
        Important

        Without the authoritative statement, the dhcpd service does not answer DHCPREQUEST messages with DHCPNAK if a client asks for an address that is outside of the pool.

      3. For each IPv6 subnet directly connected to an interface of the server, add a subnet declaration:

        subnet6 2001:db8:0:1::/64 {
          range6 2001:db8:0:1::20 2001:db8:0:1::100;
          option dhcp6.name-servers 2001:db8:0:1::1;
          max-lease-time 172800;
        }

        This example adds a subnet declaration for the 2001:db8:0:1::/64 network. With this configuration, the DHCP server assigns the following settings to a client that sends a DHCP request from this subnet:

        • A free IPv6 address from the range defined in the range6 parameter.
        • The IP of the DNS server for this subnet is 2001:db8:0:1::1.
        • The maximum lease time, after which clients in this subnet release the IP and send a new request to the server is 172800 seconds (2 days).

          Note that IPv6 requires uses router advertisement messages to identify the default gateway.

    2. Optionally, configure that dhcpd6 starts automatically when the system boots:

      # systemctl enable dhcpd6
    3. Start the dhcpd6 service:

      # systemctl start dhcpd6

Additional resources

  • dhcp-options(5) man page
  • The The authoritative statement section in the dhcpd.conf(5) man page
  • /usr/share/doc/dhcp-server/dhcpd.conf.example
  • /usr/share/doc/dhcp-server/dhcpd6.conf.example

45.9. Setting up the DHCP service for subnets that are not directly connected to the DHCP server

Use the following procedure if the DHCP server is not directly connected to the subnet for which the server should answer DHCP requests. This is the case if a DHCP relay agent forwards requests to the DHCP server, because none of the DHCP server’s interfaces is directly connected to the subnet the server should serve.

Depending on whether you want to provide DHCP for IPv4, IPv6, or both protocols, see the procedure for:

Prerequisites

  • You are logged in as the root user.
  • The dhcp-server package is installed.

Procedure

  • For IPv4 networks:

    1. Edit the /etc/dhcp/dhcpd.conf file:

      1. Optionally, add global parameters that dhcpd uses as default if no other directives contain these settings:

        option domain-name "example.com";
        default-lease-time 86400;

        This example sets the default domain name for the connection to example.com, and the default lease time to 86400 seconds (1 day).

      2. Add the authoritative statement on a new line:

        authoritative;
        Important

        Without the authoritative statement, the dhcpd service does not answer DHCPREQUEST messages with DHCPNAK if a client asks for an address that is outside of the pool.

      3. Add a shared-network declaration, such as the following, for IPv4 subnets that are not directly connected to an interface of the server:

        shared-network example {
          option domain-name-servers 192.0.2.1;
          ...
        
          subnet 192.0.2.0 netmask 255.255.255.0 {
            range 192.0.2.20 192.0.2.100;
            option routers 192.0.2.1;
          }
        
          subnet 198.51.100.0 netmask 255.255.255.0 {
            range 198.51.100.20 198.51.100.100;
            option routers 198.51.100.1;
          }
          ...
        }

        This example adds a shared network declaration, that contains a subnet declaration for both the 192.0.2.0/24 and 198.51.100.0/24 networks. With this configuration, the DHCP server assigns the following settings to a client that sends a DHCP request from one of these subnets:

        • The IP of the DNS server for clients from both subnets is: 192.0.2.1.
        • A free IPv4 address from the range defined in the range parameter, depending on from which subnet the client sent the request.
        • The default gateway is either 192.0.2.1 or 198.51.100.1 depending on from which subnet the client sent the request.
      4. Add a subnet declaration for the subnet the server is directly connected to and that is used to reach the remote subnets specified in shared-network above:

        subnet 203.0.113.0 netmask 255.255.255.0 {
        }
        Note

        If the server does not provide DHCP service to this subnet, the subnet declaration must be empty as shown in the example. Without a declaration for the directly connected subnet, dhcpd does not start.

    2. Optionally, configure that dhcpd starts automatically when the system boots:

      # systemctl enable dhcpd
    3. Start the dhcpd service:

      # systemctl start dhcpd
  • For IPv6 networks:

    1. Edit the /etc/dhcp/dhcpd6.conf file:

      1. Optionally, add global parameters that dhcpd uses as default if no other directives contain these settings:

        option dhcp6.domain-search "example.com";
        default-lease-time 86400;

        This example sets the default domain name for the connection to example.com, and the default lease time to 86400 seconds (1 day).

      2. Add the authoritative statement on a new line:

        authoritative;
        Important

        Without the authoritative statement, the dhcpd service does not answer DHCPREQUEST messages with DHCPNAK if a client asks for an address that is outside of the pool.

      3. Add a shared-network declaration, such as the following, for IPv6 subnets that are not directly connected to an interface of the server:

        shared-network example {
          option domain-name-servers 2001:db8:0:1::1:1
          ...
        
          subnet6 2001:db8:0:1::1:0/120 {
            range6 2001:db8:0:1::1:20 2001:db8:0:1::1:100
          }
        
          subnet6 2001:db8:0:1::2:0/120 {
            range6 2001:db8:0:1::2:20 2001:db8:0:1::2:100
          }
          ...
        }

        This example adds a shared network declaration that contains a subnet6 declaration for both the 2001:db8:0:1::1:0/120 and 2001:db8:0:1::2:0/120 networks. With this configuration, the DHCP server assigns the following settings to a client that sends a DHCP request from one of these subnets:

        • The IP of the DNS server for clients from both subnets is 2001:db8:0:1::1:1.
        • A free IPv6 address from the range defined in the range6 parameter, depending on from which subnet the client sent the request.

          Note that IPv6 requires uses router advertisement messages to identify the default gateway.

      4. Add a subnet6 declaration for the subnet the server is directly connected to and that is used to reach the remote subnets specified in shared-network above:

        subnet6 2001:db8:0:1::50:0/120 {
        }
        Note

        If the server does not provide DHCP service to this subnet, the subnet6 declaration must be empty as shown in the example. Without a declaration for the directly connected subnet, dhcpd does not start.

    2. Optionally, configure that dhcpd6 starts automatically when the system boots:

      # systemctl enable dhcpd6
    3. Start the dhcpd6 service:

      # systemctl start dhcpd6

Additional resources

  • dhcp-options(5) man page
  • The The authoritative statement section in the dhcpd.conf(5) man page
  • /usr/share/doc/dhcp-server/dhcpd.conf.example
  • /usr/share/doc/dhcp-server/dhcpd6.conf.example
  • Setting up a DHCP relay agent

45.10. Assigning a static address to a host using DHCP

Using a host declaration, you can configure the DHCP server to assign a fixed IP address to a media access control (MAC) address of a host. For example, use this method to always assign the same IP address to a server or network device.

Important

If you configure a fixed IP address for a MAC address, the IP address must be outside of the address pool you specified in the fixed-address and fixed-address6 parameters.

Depending on whether you want to configure fixed addresses for IPv4, IPv6, or both protocols, see the procedure for:

Prerequisites

  • The dhcpd service is configured and running.
  • You are logged in as the root user.

Procedure

  • For IPv4 networks:

    1. Edit the /etc/dhcp/dhcpd.conf file:

      1. Add a host declaration:

        host server.example.com {
        	hardware ethernet 52:54:00:72:2f:6e;
        	fixed-address 192.0.2.130;
        }

        This example configures the DHCP server to always assigns the 192.0.2.130 IP address to the host with the 52:54:00:72:2f:6e MAC address.

        The dhcpd service identifies systems by the MAC address specified in the fixed-address parameter, and not by the name in the host declaration. As a consequence, you can set this name to any string that does not match other host declarations. To configure the same system for multiple networks, use a different name, otherwise, dhcpd fails to start.

      2. Optionally, add further settings to the host declaration that are specific for this host.
    2. Restart the dhcpd service:

      # systemctl start dhcpd
  • For IPv6 networks:

    1. Edit the /etc/dhcp/dhcpd6.conf file:

      1. Add a host declaration:

        host server.example.com {
        	hardware ethernet 52:54:00:72:2f:6e;
        	fixed-address6 2001:db8:0:1::200;
        }

        This example configures the DHCP server to always assign the 2001:db8:0:1::20 IP address to the host with the 52:54:00:72:2f:6e MAC address.

        The dhcpd service identifies systems by the MAC address specified in the fixed-address6 parameter, and not by the name in the host declaration. As a consequence, you can set this name to any string, as long as it is unique to other host declarations. To configure the same system for multiple networks, use a different name because, otherwise, dhcpd fails to start.

      2. Optionally, add further settings to the host declaration that are specific for this host.
    2. Restart the dhcpd6 service:

      # systemctl start dhcpd6

Additional resources

  • dhcp-options(5) man page
  • /usr/share/doc/dhcp-server/dhcpd.conf.example
  • /usr/share/doc/dhcp-server/dhcpd6.conf.example

45.11. Using a group declaration to apply parameters to multiple hosts, subnets, and shared networks at the same time

Using a group declaration, you can apply the same parameters to multiple hosts, subnets, and shared networks.

Note that the procedure in this section describes using a group declaration for hosts, but the steps are the same for subnets and shared networks.

Depending on whether you want to configure a group for IPv4, IPv6, or both protocols, see the procedure for:

Prerequisites

  • The dhcpd service is configured and running.
  • You are logged in as the root user.

Procedure

  • For IPv4 networks:

    1. Edit the /etc/dhcp/dhcpd.conf file:

      1. Add a group declaration:

        group {
          option domain-name-servers 192.0.2.1;
        
          host server1.example.com {
            hardware ethernet 52:54:00:72:2f:6e;
            fixed-address 192.0.2.130;
          }
        
          host server2.example.com {
            hardware ethernet 52:54:00:1b:f3:cf;
            fixed-address 192.0.2.140;
          }
        }

        This group definition groups two host entries. The dhcpd service applies the value set in the option domain-name-servers parameter to both hosts in the group.

      2. Optionally, add further settings to the group declaration that are specific for these hosts.
    2. Restart the dhcpd service:

      # systemctl start dhcpd
  • For IPv6 networks:

    1. Edit the /etc/dhcp/dhcpd6.conf file:

      1. Add a group declaration:

        group {
          option dhcp6.domain-search "example.com";
        
          host server1.example.com {
            hardware ethernet 52:54:00:72:2f:6e;
            fixed-address 2001:db8:0:1::200;
          }
        
          host server2.example.com {
            hardware ethernet 52:54:00:1b:f3:cf;
            fixed-address 2001:db8:0:1::ba3;
          }
        }

        This group definition groups two host entries. The dhcpd service applies the value set in the option dhcp6.domain-search parameter to both hosts in the group.

      2. Optionally, add further settings to the group declaration that are specific for these hosts.
    2. Restart the dhcpd6 service:

      # systemctl start dhcpd6

Additional resources

  • dhcp-options(5) man page
  • /usr/share/doc/dhcp-server/dhcpd.conf.example
  • /usr/share/doc/dhcp-server/dhcpd6.conf.example

45.12. Restoring a corrupt lease database

If the DHCP server logs an error that is related to the lease database, such as Corrupt lease file - possible data loss!,you can restore the lease database from the copy the dhcpd service created. Note that this copy might not reflect the latest status of the database.

Warning

If you remove the lease database instead of replacing it with a backup, you lose all information about the currently assigned leases. As a consequence, the DHCP server could assign leases to clients that have been previously assigned to other hosts and are not expired yet. This leads to IP conflicts.

Depending on whether you want to restore the DHCPv4, DHCPv6, or both databases, see the procedure for:

Prerequisites

  • You are logged in as the root user.
  • The lease database is corrupt.

Procedure

  • Restoring the DHCPv4 lease database:

    1. Stop the dhcpd service:

      # systemctl stop dhcpd
    2. Rename the corrupt lease database:

      # mv /var/lib/dhcpd/dhcpd.leases /var/lib/dhcpd/dhcpd.leases.corrupt
    3. Restore the copy of the lease database that the dhcp service created when it refreshed the lease database:

      # cp -p /var/lib/dhcpd/dhcpd.leases~ /var/lib/dhcpd/dhcpd.leases
      Important

      If you have a more recent backup of the lease database, restore this backup instead.

    4. Start the dhcpd service:

      # systemctl start dhcpd
  • Restoring the DHCPv6 lease database:

    1. Stop the dhcpd6 service:

      # systemctl stop dhcpd6
    2. Rename the corrupt lease database:

      # mv /var/lib/dhcpd/dhcpd6.leases /var/lib/dhcpd/dhcpd6.leases.corrupt
    3. Restore the copy of the lease database that the dhcp service created when it refreshed the lease database:

      # cp -p /var/lib/dhcpd/dhcpd6.leases~ /var/lib/dhcpd/dhcpd6.leases
      Important

      If you have a more recent backup of the lease database, restore this backup instead.

    4. Start the dhcpd6 service:

      # systemctl start dhcpd6

45.13. Setting up a DHCP relay agent

The DHCP Relay Agent (dhcrelay) enables the relay of DHCP and BOOTP requests from a subnet with no DHCP server on it to one or more DHCP servers on other subnets. When a DHCP client requests information, the DHCP Relay Agent forwards the request to the list of DHCP servers specified. When a DHCP server returns a reply, the DHCP Relay Agent forwards this request to the client.

Depending on whether you want to set up a DHCP relay for IPv4, IPv6, or both protocols, see the procedure for:

Prerequisites

  • You are logged in as the root user.

Procedure

  • For IPv4 networks:

    1. Install the dhcp-relay package:

      # yum install dhcp-relay
    2. Copy the /lib/systemd/system/dhcrelay.service file to the /etc/systemd/system/ directory:

      # cp /lib/systemd/system/dhcrelay.service /etc/systemd/system/

      Do not edit the /usr/lib/systemd/system/dhcrelay.service file. Future updates of the dhcp-relay package can override the changes.

    3. Edit the /etc/systemd/system/dhcrelay.service file, and append the -i interface parameter, together with a list of IP addresses of DHCPv4 servers that are responsible for the subnet:

      ExecStart=/usr/sbin/dhcrelay -d --no-pid -i enp1s0 192.0.2.1

      With these additional parameters, dhcrelay listens for DHCPv4 requests on the enp1s0 interface and forwards them to the DHCP server with the IP 192.0.2.1.

    4. Reload the systemd manager configuration:

      # systemctl daemon-reload
    5. Optionally, configure that the dhcrelay service starts when the system boots:

      # systemctl enable dhcrelay.service
    6. Start the dhcrelay service:

      # systemctl start dhcrelay.service
  • For IPv6 networks:

    1. Install the dhcp-relay package:

      # yum install dhcp-relay
    2. Copy the /lib/systemd/system/dhcrelay.service file to the /etc/systemd/system/ directory and name the file dhcrelay6.service:

      # cp /lib/systemd/system/dhcrelay.service /etc/systemd/system/dhcrelay6.service

      Do not edit the /usr/lib/systemd/system/dhcrelay.service file. Future updates of the dhcp-relay package can override the changes.

    3. Edit the /etc/systemd/system/dhcrelay6.service file, and append the -l receiving_interface and -u outgoing_interface parameters:

      ExecStart=/usr/sbin/dhcrelay -d --no-pid -l enp1s0 -u enp7s0

      With these additional parameters, dhcrelay listens for DHCPv6 requests on the enp1s0 interface and forwards them to the network connected to the enp7s0 interface.

    4. Reload the systemd manager configuration:

      # systemctl daemon-reload
    5. Optionally, configure that the dhcrelay6 service starts when the system boots:

      # systemctl enable dhcrelay6.service
    6. Start the dhcrelay6 service:

      # systemctl start dhcrelay6.service

Additional resources

  • dhcrelay(8) man page

Chapter 46. Configuring and managing a BIND DNS server

DNS (Domain Name System) is a distributed database system that associates hostnames with their respective IP addresses. BIND (Berkeley Internet Name Domain) consists of a set of DNS-related programs. It contains a name server called named. The /etc/named.conf is the main configuration file in the BIND configuration. This section focuses on installing, configuring, and managing BIND on the DNS server.

46.1. Installing BIND

The installation of the bind-utils package ensures the BIND utilities are available on the system.

Procedure

  1. Install BIND:

    # yum install bind bind-utils
  2. Enable and start the named service:

    # systemctl enable --now named

Verification steps

  • Verify the status of the named service:

    # systemctl status named

46.2. Configuring BIND as a caching name server

The following procedure demonstrates configuring BIND as a caching name server.

Prerequisites

  • The BIND package is installed.

Procedure

  1. Ensure to take backup of the original configuration file.

    # cp /etc/named.conf /etc/named.conf.orig
  2. Edit the named.conf file with the following changes:

    • In the options section, uncomment the listen-on, listen-on-v6, and directory parameters:

      acl clients {192.0.2.0/24;};
      
      options {
              listen-on port 53 { any; };
      
              listen-on-v6 port 53 { any; };
      
              directory       /var/named;
    • Set the allow-query parameter to your network address. Only the hosts on your local network can query the DNS server.

          allow-query     { localhost; clients; };
          allow-recursion { localhost; clients; };
          recursion yes;
          allow-update { none; };
          allow-transfer { localhost; };
      };
      logging {
              channel default_debug {
                      file data/named.run;
                      severity dynamic;
              };
      };
    • Use the package shipped file as:

      include /etc/named.rfc1912.zones;
    • Create an extra include for any custom zone configuration.

      include /etc/named/example.zones;
  3. Create the /etc/named/example.zones file and add the following zone configuration.

    //forward zone
    zone _example.com_ IN {
            type master;
            file _example.com.zone_;
    
    };
    
    //backward zone
    zone "2.0.192.in-addr.arpa" IN {
            type master;
            file _example.com.rzone_;
    
    };
    • type: It defines the zone’s role of the server.
    • master: It is an authoritative server and maintains the master copy of the zone data.
    • file: It specifies the zone’s database file.
  4. Go to DNS data directory /var/named/.

    # cd /var/named/
    # ls
    
    data    dynamic  named.ca  named.empty    named.localhost    named.loopback  slaves
  5. Create the DNS record file and add the DNS record data.

    # cp -p named.localhost example.com.zone
  6. Edit the example.com.zone with your forward zone parameters.

    $TTL    86400
    @               IN SOA  example.com. root (
    42              ; serial
    3H              ; refresh
    15M             ; retry
    1W              ; expiry
    1D )            ; minimum
                    IN NS           ns
    ;use IP address of named machine for ns
    ns       IN A          192.0.2.1
    station0        IN A            192.168.x.xxx
    station1        IN A            192.168.x.xxx
    station2        IN A            192.168.x.xxx
    station3        IN A            192.168.x.xxx
  7. Create the example.com.rzone file.

    # cp -p named.localhost example.com.rzone
  8. Edit the example.com.rzone file with your reverse zone parameters.

    $TTL    86400
        @       IN      SOA     example.com. root.example.com.  (
        1997022700 ; serial
        28800      ; refresh
        14400      ; retry
        3600000    ; expire
        86400 )    ; minimum
                IN      NS      ns.example.com.
        101     IN      PTR     station1.example.com.
        102     IN      PTR     station2.example.com.
        103     IN      PTR     station3.example.com.
        104     IN      PTR     station4.example.com.

    Verification steps

    • Verify the zone file

      # named-checkzone example.com example.com.zone
      
      zone example.com/IN: loaded serial xxxxxxx
      OK
    • Verify the configuration.

      # named-checkconf /etc/named.conf

      If the configuration is correct, the command does not return any output.

Chapter 47. Getting started with DPDK

The data plane development kit (DPDK) provides libraries and network drivers to accelerate package processing in user space.

Administrators use DPDK, for example, in virtual machines to use Single Root I/O Virtualization (SR-IOV) to reduce latencies and increase I/O throughput.

Note

Red Hat does not support experimental DPDK APIs.

47.1. Installing the dpdk package

This section describes how to install the dpdk package.

Prerequisites

  • Red Hat Enterprise Linux is installed.
  • A valid subscription is assigned to the host.

Procedure

  • Use the yum utility to install the dpdk package:

    # yum install dpdk

47.2. Additional resources

Chapter 48. Understanding the eBPF networking features in RHEL

The extended Berkeley Packet Filter (eBPF) is an in-kernel virtual machine that allows code execution in the kernel space. This code runs in a restricted sandbox environment with access only to a limited set of functions.

In networking, you can use eBPF to complement or replace kernel packet processing. Depending on the hook you use, eBPF programs have, for example:

  • Read and write access to packet data and metadata
  • Can look up sockets and routes
  • Can set socket options
  • Can redirect packets

48.1. Overview of networking eBPF features in RHEL

You can attach extended Berkeley Packet Filter (eBPF) networking programs to the following hooks in RHEL:

  • eXpress Data Path (XDP): Provides early access to received packets before the kernel networking stack processes them.
  • tc eBPF classifier with direct-action flag: Provides powerful packet processing on ingress and egress.
  • Control Groups version 2 (cgroup v2): Enables filtering and overriding socket-based operations performed by programs in a control group.
  • Socket filtering: Enables filtering of packets received from sockets. This feature was also available in the classic Berkeley Packet Filter (cBPF), but has been extended to support eBPF programs.
  • Stream parser: Enables splitting up streams to individual messages, filtering, and redirecting them to sockets.
  • SO_REUSEPORT socket selection: Provides a programmable selection of a receiving socket from a reuseport socket group.
  • Flow dissector: Enables overriding the way the kernel parses packet headers in certain situations.
  • TCP congestion control callbacks: Enables implementing a custom TCP congestion control algorithm.
  • Routes with encapsulation: Enables creating custom tunnel encapsulation.

Note that Red Hat does not support all of the eBPF functionality that is available in RHEL and described here. For further details and the support status of the individual hooks, see the RHEL 9 Release Notes and the following overview.

XDP

You can attach programs of the BPF_PROG_TYPE_XDP type to a network interface. The kernel then executes the program on received packets before the kernel network stack starts processing them. This allows fast packet forwarding in certain situations, such as fast packet dropping to prevent distributed denial of service (DDoS) attacks and fast packet redirects for load balancing scenarios.

You can also use XDP for different forms of packet monitoring and sampling. The kernel allows XDP programs to modify packets and to pass them for further processing to the kernel network stack.

The following XDP modes are available:

  • Native (driver) XDP: The kernel executes the program from the earliest possible point during packet reception. At this moment, the kernel did not parse the packet and, therefore, no metadata provided by the kernel is available. This mode requires that the network interface driver supports XDP but not all drivers support this native mode.
  • Generic XDP: The kernel network stack executes the XDP program early in the processing. At that time, kernel data structures have been allocated, and the packet has been pre-processed. If a packet should be dropped or redirected, it requires a significant overhead compared to the native mode. However, the generic mode does not require network interface driver support and works with all network interfaces.
  • Offloaded XDP: The kernel executes the XDP program on the network interface instead of on the host CPU. Note that this requires specific hardware, and only certain eBPF features are available in this mode.

On RHEL, load all XDP programs using the libxdp library. This library enables system-controlled usage of XDP.

Note

Currently, there are some system configuration limitations for XDP programs. For example, you must disable certain hardware offload features on the receiving interface. Additionally, not all features are available with all drivers that support the native mode.

In RHEL 9.0, Red Hat supports the XDP feature only if all of the following conditions apply:

  • You load the XDP program on an AMD or Intel 64-bit architecture.
  • You use the libxdp library to load the program into the kernel.
  • The XDP program does not use the XDP hardware offloading.

Additionally, Red Hat provides the following usage of XDP features as unsupported Technology Preview:

  • Loading XDP programs on architectures other than AMD and Intel 64-bit. Note that the libxdp library is not available for architectures other than AMD and Intel 64-bit.
  • The XDP hardware offloading.

AF_XDP

Using an XDP program that filters and redirects packets to a given AF_XDP socket, you can use one or more sockets from the AF_XDP protocol family to fast copy packets from the kernel to the user space.

Traffic Control

The Traffic Control (tc) subsystem offers the following types of eBPF programs:

  • BPF_PROG_TYPE_SCHED_CLS
  • BPF_PROG_TYPE_SCHED_ACT

These types enable you to write custom tc classifiers and tc actions in eBPF. Together with the parts of the tc ecosystem, this provides the ability for powerful packet processing and is the core part of several container networking orchestration solutions.

In most cases, only the classifier is used, as with the direct-action flag, the eBPF classifier can execute actions directly from the same eBPF program. The clsact Queueing Discipline (qdisc) has been designed to enable this on the ingress side.

Note that using a flow dissector eBPF program can influence operation of some other qdiscs and tc classifiers, such as flower.

Socket filter

Several utilities use or have used the classic Berkeley Packet Filter (cBPF) for filtering packets received on a socket. For example, the tcpdump utility enables the user to specify expressions, which tcpdump then translates into cBPF code.

As an alternative to cBPF, the kernel allows eBPF programs of the BPF_PROG_TYPE_SOCKET_FILTER type for the same purpose.

Control Groups

In RHEL, you can use multiple types of eBPF programs that you can attach to a cgroup. The kernel executes these programs when a program in the given cgroup performs an operation. Note that you can use only cgroups version 2.

The following networking-related cgroup eBPF programs are available in RHEL:

  • BPF_PROG_TYPE_SOCK_OPS: The kernel calls this program on various TCP events. The program can adjust the behavior of the kernel TCP stack, including custom TCP header options, and so on.
  • BPF_PROG_TYPE_CGROUP_SOCK_ADDR: The kernel calls this program during connect, bind, sendto, recvmsg, getpeername, and getsockname operations. This program allows changing IP addresses and ports. This is useful when you implement socket-based network address translation (NAT) in eBPF.
  • BPF_PROG_TYPE_CGROUP_SOCKOPT: The kernel calls this program during setsockopt and getsockopt operations and allows changing the options.
  • BPF_PROG_TYPE_CGROUP_SOCK: The kernel calls this program during socket creation, socket releasing, and binding to addresses. You can use these programs to allow or deny the operation, or only to inspect socket creation for statistics.
  • BPF_PROG_TYPE_CGROUP_SKB: This program filters individual packets on ingress and egress, and can accept or reject packets.
  • BPF_PROG_TYPE_CGROUP_SYSCTL: This program allows filtering of access to system controls (sysctl).

Stream Parser

A stream parser operates on a group of sockets that are added to a special eBPF map. The eBPF program then processes packets that the kernel receives or sends on those sockets.

The following stream parser eBPF programs are available in RHEL:

  • BPF_PROG_TYPE_SK_SKB: An eBPF program parses packets received from the socket into individual messages, and instructs the kernel to drop those messages or send them to another socket in the group.
  • BPF_PROG_TYPE_SK_MSG: This program filters egress messages. An eBPF program parses the packets into individual messages and either approves or rejects them.

SO_REUSEPORT socket selection

Using this socket option, you can bind multiple sockets to the same IP address and port. Without eBPF, the kernel selects the receiving socket based on a connection hash. With the BPF_PROG_TYPE_SK_REUSEPORT program, the selection of the receiving socket is fully programmable.

Flow dissector

When the kernel needs to process packet headers without going through the full protocol decode, they are dissected. For example, this happens in the tc subsystem, in multipath routing, in bonding, or when calculating a packet hash. In this situation the kernel parses the packet headers and fills internal structures with the information from the packet headers. You can replace this internal parsing using the BPF_PROG_TYPE_FLOW_DISSECTOR program. Note that you can only dissect TCP and UDP over IPv4 and IPv6 in eBPF in RHEL.

TCP Congestion Control

You can write a custom TCP congestion control algorithm using a group of BPF_PROG_TYPE_STRUCT_OPS programs that implement struct tcp_congestion_oops callbacks. An algorithm that is implemented this way is available to the system alongside the built-in kernel algorithms.

Routes with encapsulation

You can attach one of the following eBPF program types to routes in the routing table as a tunnel encapsulation attribute:

  • BPF_PROG_TYPE_LWT_IN
  • BPF_PROG_TYPE_LWT_OUT
  • BPF_PROG_TYPE_LWT_XMIT

The functionality of such an eBPF program is limited to specific tunnel configurations and does not allow creating a generic encapsulation or decapsulation solution.

Socket lookup

To bypass limitations of the bind system call, use an eBPF program of the BPF_PROG_TYPE_SK_LOOKUP type. Such programs can select a listening socket for new incoming TCP connections or an unconnected socket for UDP packets.

48.2. Overview of XDP features by network cards

The following is an overview of XDP-enabled network cards and the XDP features you can use with them:

Network cardDriverBasicRedirectTargetHW offloadZero-copy

Amazon Elastic Network Adapter

ena

yes

yes

yes

no

no

Broadcom NetXtreme-C/E 10/25/40/50 gigabit Ethernet

bnxt_en

yes

yes

yes [a] [b]

no

no

Cavium Thunder Virtual function

nicvf

yes

no

no

no

no

Intel® Ethernet Controller XL710 Family

i40e

yes

yes

yes [a] [b]

no

yes

Intel® Ethernet Connection E800 Series

ice

yes

yes

yes [a] [b]

no

yes

Intel® PCI Express Gigabit adapters

igb

yes

yes

yes [a]

no

no

Intel® Ethernet Controller I225 Family

igc

yes

yes

yes

no

yes

Intel® 10GbE PCI Express adapters

ixgbe

yes

yes

yes [a] [b]

no

yes

Intel® 10GbE PCI Express Virtual Function Ethernet

ixgbevf

yes

no

no

no

no

Mellanox Technologies 1/10/40Gbit Ethernet

mlx4_en

yes

no

no

no

no

Mellanox 5th generation network adapters (ConnectX series)

mlx5_core

yes

yes

yes [b]

no

yes

Netronome® NFP4000/NFP6000 NIC

nfp

yes

no

no

yes

no

QLogic QED 25/40/100Gb Ethernet NIC

qede

yes

yes

yes

no

no

Solarflare SFC9000/SFC9100/EF100-family

sfc

yes

yes

yes [b]

no

no

STMicroelectronics Multi-Gigabit Ethernet

stmmac

yes

yes

yes

no

yes

Microsoft Hyper-V virtual network

hv_netvsc

yes

no

no

no

no

Universal TUN/TAP device

tun

yes

yes

yes

no

no

Virtual ethernet pair device