Support for multiple network interfaces

Introduction

The NSP and its associated components communicate with different entities that typically exist in different network spaces. Isolating different types of traffic to different networks provides better security and helps manage traffic volume on different networks.

NSP supports configuring different network interfaces to handle the following types of traffic in a multi-homed system.

Component support and limitations

A NSP cluster can be configured with network interfaces for client traffic, for internal network management traffic, and for managed network traffic. In a multi-node NSP cluster, each node must have the same number of interfaces. Each node of the NSP cluster must have mediation network connectivity to all managed NE devices as MDM pods may be rescheduled on different nodes in the NSP cluster.

A deployer node must have connectivity to all NSP cluster nodes on the internal network. The deployer node must also have access to the client network.

A NSP cluster must communicate with a VSR-NRC using the BOF interface.

The NFM-P supports integrated deployment with NSP cluster using network interfaces for client, internal and managed network traffic.

An integrated deployment of multi-interface NSP cluster with an older release NFM-P is supported but a workaround procedure is required on the NFM-P system. The workaround will enable the separation of client and internal network traffic between NFM-P and NSP cluster. See the NSP Installation and Upgrade Guide for details on the integration procedure for older release NFM-P.

The following figure shows a multi network interface deployment of NSP cluster, deployer host and NFM-P.

Figure 7-1: Multi-interface NSP deployment
Multi-interface NSP deployment

The NSP cluster can be deployed with one interface for all client, network management and NE traffic. The NSP cluster can be deployed with one interface for client and internal network traffic, and a second interface for NE traffic. (A NSP deployment of client and NE traffic on one network interface, and internal traffic on a second interface is not supported.) All servers in an NSP deployment must support the same network configuration for client and internal networks. For example, an NSP cluster deployed with network interfaces for client and internal networks cannot be deployed with a NFMP server that is configured for one interface supporting client and internal communications.

When installing NSP components on stations with multiple network interfaces, each interface must reside on a separate subnet, with the exception of interfaces that are to be used in IP Bonding.

There is no requirement on the NSP cluster to use the first network interface (eg. eth0, bge0) to communicate with client applications.

Additional network interfaces can be configured on the NSP cluster, at the customer's discretion, for other operations such as archiving database backups or activity logs.

When an NSP cluster is deployed with WS-NOC , the separation of client and internal network traffic is not supported. NSP and WS-NOC must use a single network for client and internal communications.

When using custom TLS certificates in a multi-network configuration, the NSP server certificate requires the IP address or hostname or FQDN of the client network interface (or virtual IP) and the IP address or hostname or FQDN of the internal network interface (or virtual IP) in the certificate SAN field.

Multi-interface support in IPv4 and IPv6 networks

The NSP cluster can use IPv4 or IPv6 addressing on the client, internal and mediation network interfaces. In addition to the limitations and restrictions documented in section 4.2.1, the following conditions apply:

Multi-interface NSP deployment and traffic management policies

Customers can use traffic management applications to protect NSP components but should be applied with care to ensure that NSP applications are not negatively impacted. NSP communications are defined in Section 6.5 of this guide.

The following table summarizes the traffic management policies for an NSP cluster deployment by each network or network interface.

Table 7-1: NSP cluster communications by network interface

Network description

Permitted communications

Client network

Client communications as defined in Table 6-1, NSP Kubernetes virtual machine communications

Kafka communications on ports 9092, 9093, 9094, 9192, 9193, 9194

Internal network

All communications with NFMP and with redundant datacenter

All communications between cluster nodes and deployer node

Kafka communications on ports 9292, 9293, 9294

Mediation network

Mediation communications as defined in Table 6-1, NSP Kubernetes virtual machine communications

The NSP cluster can communicate with some external components on any network interface, including

Each node in an NSP cluster must allow the same traffic on each network interface.