Managing network interfaces for bare metal servers on VPC

Overview of bare metal server network interfaces

For x86 bare metal servers, you can create two types of network interfaces, PCI interface and VLAN interface.

• A PCI interface is a physical network interface. The VLAN interface is a virtual interface that is associated with a PCI interface. The maximum number of PCI interfaces per bare metal server is eight.
• The VLAN interface automatically tags traffic that is routed through it with the VLAN ID. Inbound traffic that is tagged with a VLAN ID is directed to the appropriate VLAN interface. The VLAN interface has its own security groups and doesn't inherit security groups from the PCI interface. The combined PCI/VLAN interface limit is 128 network interfaces per bare metal server. For more information, see Retrieve a bare metal server profile.

• When you create a bare metal server, a primary PCI interface is created for you. Optionally, you can add one or more secondary PCI or VLAN interfaces. You can also add, update, or delete the network interfaces.

• You can associate one or more floating IPs with a network interface. The multiple floating IPs feature enables the VMware® NSX-T Data Center to assign floating IPs. For more information about associating floating IP, see Associate floating IPs with a network interface.

For more information about associating floating IP, see Associate floating IPs with a network interface.

If you want to control the flow of network traffic in your VPC, you can configure routes. VPC routes specify the next hop for packets, based on their destination addresses. For more information, see Creating a route.

Network interface configurations

You can specify the following configurations for PCI and VLAN interfaces. For VLAN interfaces on x86 architecture-based bare metal servers, you need to specify the VLAN ID.

Creating a network interface

You can create one or more network interfaces when you create a bare metal server. You can also add new interfaces to an existing bare metal server.

For x86 architecture-based bare metal servers, a VLAN interface must be associated with a PCI interface. When you use IBM Cloud® UI to create VLAN interfaces, you must specify the Associated PCI interface field. If you use the CLI or API, you need to use the allowed_vlans property of the PCI interface to specify the VLAN IDs that can be associated with it. Then, when you create VLAN interfaces, the ID of the VLAN interface must be added to the allowed_vlans field of a PCI interface. Otherwise, the VLAN interface can't be created.

Creating a virtual network interface

You can create a virtual network interface without attaching it to a target. The virtual network interface can exist even when its target is removed. For more information, see Working with virtual network interfaces.

Virtual network interfaces can be attached to new bare metal server instances, and cannot be added to existing bare metal server instances with child network interfaces.

1. In the IBM Cloud console, go to Navigation Menu icon > Infrastructure > Compute > Bare metal servers.
2. Click Create to begin creating a bare metal server capable of using a virtual network interface.
3. In the Networking section, select whether to create one of the following:
   • Network attachment with a virtual network interface: a network interface with additional features, such as secondary IP addresses and a lifecycle separate from the bare metal server you are creating.
   • Instance network interface: a child network interface.

Associating floating IPs with a network interface

You can associate one or more floating IPs with one network interface.

To associate multiple floating IPs to a network interface, make sure that both Allow IP spoofing and Enable infrastructure NAT are disabled on the network interface.

Use the following steps to associate a floating IP with the network interface:

1. Under the Network interfaces section of the Bare metal server details page, identify the interface that you want to associate the floating IP with.

2. Click the edit icon of the target interface.

3. On the Edit network interface page, locate the Floating IP address field and select the floating IPs that you want to associate with the network interface.

   Keep in mind that you can associate a floating IP to the secondary network interface only when you configure a default gateway to the secondary network interface within the operating system.

4. Click Save when you finish adding floating IPs.

You can disassociate the associated floating IP from the network interface.

Updating a network interface

After you create a network interface, you can change the Enable infrastructure NAT and Allow IP spoofing setting. You can also change the floating IPs that are attached to it. For PCI interface, updating its associated VLAN IDs is available.

Use the following steps to update the network interface:

1. Under the Network interfaces section of the Bare metal server details page, identify the interface that you want to update.

2. Click the edit icon of the target interface.

3. Update the interface.

4. Click Save.

Deleting a network interface

You can delete a network interface by clicking the delete icon of a network interface on the Bare metal server details page.

Keep the following information in mind when you delete a network interface:

• Network interface deletion can't be reversed.
• The floating IPs that are associated with the network interface are implicitly disassociated.
• You can delete a network interface only when the bare metal server is Stopped.
• You can't delete the primary network interface.

Creating a virtual IP (VIP)

A VIP is used for moving between interfaces to achieve high availability. Typically, two interfaces belong to two servers. Each interface has a primary IP that negotiates with VRRP to determine which server owns the VIP.

From a RIAS perspective, you create a VIP the same way that you create a primary IP.

1. Use the following command to create a VIP.

   ibmcloud is bm-nicc <BM_ID> --subnet <SUBNET_ID> --interface-type vlan --vlan <VLAN_ID> --allow-interface-to-float true
   

2. Set allow-interfaces-to-floatto true.

Creating a custom route

Custom routes communication without NAT rules between VMWare VMS within an NSX-T cluster and virtual server outside the NSX-T cluster, but within the same VPC. To create a custom route, use the following steps.

1. Use the following command to create the custom route.

   ibmcloud is vpc-route-create my-custom-route <VPC_ID> --zone us-south-3 --destination <DEST_CIDR> --next-hop-ip <NH_IP>
   

2. Set allow-ip-spoofing to true for the VNIC of NH_IP by using this command. Typically, a VIP is used as NH_IP for high availability.

   ibmcloud is bm-nicu <BM_ID> <VNIC_ID> --allow-ip-spoofing true
   

3. Associate the custom route with specific subnets.

You can also use a custom route so segment servers can communicate to infrastructure servers or VPNs.