2

Within Citrix XenServer...I want an internal network, not dependent on a physical NIC, that only the HyperVisor and virtual machines can see. I believe I want to implement a "Single-Server Private Network."

How do the VMs communicated with the Hyper-Visor? If I want to manage the Hyper-Visor from one of the VMs, how do I access it?

I know the other option is having a network associated with a physical NIC, but I don't want the LAN to be able to access that Network.

2
  • I'm failing to see how you could manage the hypervisor from a VM without accessing the hypervisor from the physical network. That's a bit of a catch-22 unless you're at the console of the hypervisor, but again, you're accessing the VM from the console of the hyper-visor, not the other way around.
    – joeqwerty
    Dec 3, 2014 at 16:32
  • Short Answer: One VM is acting as a firewall with a physical NIC assigned to it. I can access the resources internally via VPN off that interface. This is working well, with the exception of not being able to see the hypervisor internally. Dec 3, 2014 at 16:41

3 Answers 3

4

not sure about xenserver commands to achieving this

If you want private connection between virtual machines running on the same host you can create isolated bridge network and connect necessary vNIC of virtual machines to it.[from "xl list" you can get domain id]

if using linux-bridge

brctl addbr isolated

if you give same range of private ip to "isolated" then you can reach hypervisor from virtual machines using that IP.

if using ovs

ovs-vsctl add-br isolated

to list vNIC details,with this combined with xl list you can get correct vNIC

 brctl show

To add vNIC to bridge

brctl addif isolated vNIC 

OVS

ovs-vsctl add-port isolated vNIC

Assign private IP inside your virtual machine and now try to connect to hypervisor using the ip assigned on "isolated"

1
  • When trying this in XenCenter's console, I recieved the reponse "add bridge failed: Package not installed" Dec 3, 2014 at 19:19
1

First, citrix recommand for the management network on the xenserver to create a nic bond.

So you are dependant on a NIC. Why, because when you have multiple xenserver they need to talk to each other via the network.

The best way to isolate is with VLAN or dedicated switch.

If you want only one VM to talk to the hypervisor, you add a second nic to that VM that got access to the same network.

1
  • For the DV I dont tell its not possible, just not professional, if the control vm refuse to start you cant manage the host without a physical access. I see the OP use, like for small IoT project, I dont contradict that.
    – yagmoth555
    Oct 24, 2017 at 19:58
-1

One solution my some proposed to me off-line is using one of the spare NICs on the server, assigning the MGMT interface to that and creating what is called a loop back plug.

To create a loopback plug, cross pin 1 (TX+) and pin 3 (RX+) together, and cross pin 2 (TX-) and pin 6 (RX-) together. You need the following equipment to create the loopback:

A 6-inch long CAT5 cable An RJ-45 connector A crimping tool

enter image description here

This way you can use the physical network to bridge your connections, but it is isolated and only available to the HyperVisor and its VMs.

2
  • How it's not the same as isolating your mgmt nic and one nic for a VM in the same mgmt network ? May I remind you that the MGMT network will transfer the memory to another host in a motion, you feel the cable will be at the same spec after such modification ??
    – yagmoth555
    Dec 3, 2014 at 18:48
  • You're right it is dependant on the NIC. But it allows isolation of the network without being physically connected to the NIC. Where did you see the requirement that it needed to be moveable? Don't impose your requirements on to my problems. Dec 3, 2014 at 19:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .