Multiple network interfaces
1. Multiple network interfaces
In conventional networking, devices can use multiple network interfaces to communicate with multiple networks. Next, let's discuss using multiple network interfaces in a Google Cloud VPC network. Sasha is a network engineer at Symbol Corporation. Symbol is rolling out a new web-based customer portal. This portal will give access to sensitive account data and the capability to initiate transactions. The environment also has a management network that connects to the on-premises environment using a VPN. For compliance and security purposes, Sasha is looking to filter control plane traffic from data plane traffic. She is thinking of using a security virtual appliance to route traffic between VPC networks to an on-premises environment and to the Internet. This means she needs a mechanism to interconnect multiple networks to a single virtual appliance. Let's look into how we can solve this use case. VPC networks are isolated private networking domains by default. As we mentioned earlier, VM instances within a VPC network can communicate among themselves by using internal IP addresses as long as firewall rules allow it. However, no internal IP address communication is allowed between networks unless you set up mechanisms such as VPC peering or VPN. Every VM instance within a VPC network starts with a built-in default network interface. When you add more interfaces, you must choose a VPC network and a subnet within it for each new interface. Importantly, each additional interface has to connect to a different VPC network than the others. This multi-interface setup lets you establish configurations where a single instance directly connects to multiple VPC networks. Use multiple network interfaces when you need a single instance to act as a network appliance for tasks like load balancing, intrusion detection, prevention, IDS, IPS, and web application firewalls, WAF. In the diagram, VM1 communicates with VM2 through an internal IP address. VM1 communicates with VM3 through an external IP address. VM appliance communicates with VM1 and VM3 through NIC. Multiple network interfaces let you create configurations in which an instance connects directly to several VPC networks. Each of the interfaces must have an internal IP address and each interface can also have an external IP address. For example, in this diagram, you have two VM instances. Each instance has network interfaces to a subnet within VPC1, VPC2, VPC3, and VPC4. For some situations, you might require multiple interfaces. For example, to configure an instance as a network appliance for load balancing. Multiple network interfaces are also useful when applications running in an instance require traffic separation such as separation of data plane traffic from management plane traffic. Also, you cannot add or remove NIC to an instance once the instance is created so make sure to add the required NIC when you create the instance. Going back to the use case, the simplest way Sasha can connect multiple networks to a VM appliance is by using multiple network interfaces. This diagram shows multiple VPC networks connecting through a virtual appliance using multiple network interfaces. Each interface connects to one of the VPC networks. The diagram also shows Internet and on-premises connections over separate network interfaces including an Internet connection through an untrusted interface. By configuring multiple interfaces, you can apply separate firewall rules and access controls to each interface separately and enforce security functions in communications from the public to a private domain. When creating VM instances with multiple network interfaces, note these caveats. You can only configure a network interface when you create an instance. Each network interface configured in a single instance must be attached to a different VPC network. Each interface must belong to a subnet whose IP range does not overlap with the subnets of any other interfaces. The additional VPC networks that the multiple interfaces will attach to must exist before you create the instance. You cannot delete a network interface without deleting the instance. When an internal DNS, domain name system, query is made with the instance host name, it resolves to the primary interface nic0 of the instance. If the nic0 interface of the instance belongs to a different VPC network than the instance that issues the internal DNS query, the query will fail. You will explore this in the upcoming lab. The maximum number of network interfaces per instance is eight, but this depends on the instances machine type as shown in this table. Instances with less than are equal to two VCPU can have up to two virtual NICs. Examples include the f1-micro, g1-small, n1- standard-1, and any other custom VMs with one or two VCPUs. Instances with more than two VCPU can have one NIC per VCPU with a maximum of eight virtual NICs.2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.