2

I have looked for a solution to this problem but everything that I have found never seems quite match this scenario.

I have a small colocation space and I only get 5 IPv4 addresses. I also get an IPv6 /64 block. I only have one LAN drop, external IP addresses only. The colo provider doesn't provide private network addresses.

The gear I have is a 4 node superserver... each node has IPMI NIC and 2 regular NICs. I also have space for a 1U "switch" of some description that I am seeking advice on what to get. My understanding is that the IPMI ports only support IPv4.

I need to be able to access these 4 IPv4 IPMI ports with only the "switch" operating.

I also need at least 1 IPv4 address per node for web servers etc so I am out of IPv4 space.

What I would like to do is find a 1U switch/router to route the IPv6 addresses to the IPv4 devices.

I have looked at some of the Layer 2 and Layer 3 switches and they have static routing, but I don't think it would route across protocols like this. Am I going to have to break down and put in a full router?

What are some of the approaches to achieve this functionality?

5
  • 1
    Ethernet does not know anything about IP.
    – user9517
    Nov 14, 2014 at 8:11
  • I am not entirely understanding your need. It sounds like you have only a single server, but you need 8 management interfaces. And moreover you have your own switch, but why would you have that, if you only have a single server? If you can clarify your setup a bit, I may be able to come up with a solution. Also a /64 only sounds like a lot if you are used to the IP shortage of IPv4. A provider really should give you both a /64 for the link and a shorter prefix (somewhere in the range from /60 to /48) routed through one IP under the link prefix.
    – kasperd
    Nov 14, 2014 at 8:43
  • I improved my question with more of the back story @kasperd. Nov 14, 2014 at 13:27
  • What connectivity do you have to the data center network? Do your servers have separate links to a switch operated by the hosting provider? Or do you only have a single link to a router operated by the hosting provider that you are expected to connect your own switch to?
    – kasperd
    Nov 14, 2014 at 14:08
  • @kasperd, added more to the question. A single link from the hosting provider with just the external ip block and the gateway. This single link will come to my "switch/router". Nov 14, 2014 at 20:03

3 Answers 3

1

If your IPMI ports have no externally accessible IP addresses, and you need to access them while all four nodes are offline, then there is no way a switch alone could do the job.

On the other hand, replacing the switch with a router may well be overkill for the job.

What you need is one node that can be accessed through an external IP address. Your options are:

  • Use one of the compute nodes (this relies on never having all four go offline simultaneously).
  • Use the computer present inside any managed switch (the capabilities do vary among switches, I don't know whether you can find a switch supporting the protocol you need to communicate with the IMPI ports, and you might not want to put have your switch configuration interface on a externally accessible IP address).
  • Use a router on a stick. Basically find a cheap computer that receives power through the Ethernet connection and doesn't need its only rackmount.

The configuration I would recommend would be roughly the same regardless of whether you are using a compute node or a router on a stick approach. In both cases my suggestion involves using a managed switch (such that you can configure VLANs).

Create two VLANs, an external VLAN and a management VLAN.

The switch port connecting to the data center router will be configured to only be on the external VLAN (untagged).

The switch port connecting to the IMPI ports will be configured to only be on the management VLAN (untagged).

The switch ports connecting to compute nodes and router on a stick will be configured to be on both the external VLAN (untagged) and on the management VLAN (tagged).

The switch management interface itself is configured to be only on the management VLAN.

2

I wouldn't expect a router to be the solution you are looking for. One of the following, is more likely to work for you and should be easier to secure. Place your IPMI ports in a private IP block, and add addresses in that block to your server. (Co-ordinate the addresses with your provider.)

I would look at a proxy. For redundancy I would run it on more than one server. This works well if your IMPI ports provide a web (HTTP/HTTPS) interface.

If the interface protocol is SSH, you can connect to any of the servers using ssh and have it forward the connection.

For a telnet protocol, just log onto one of the servers and telnet from there.

1

Wanted to thank both @BillThor and @kasperd for their excellent answers.

Incorporating points from both of your answers, I am doing a deep dive on the Microtik RouterOS and looking at either the 24 port "smart swtich" http://routerboard.com/CRS125-24G-1S-RM or the "13 port switch" http://routerboard.com/RB1100AHx2 would be a great fit in this application.

They look like a great value and are very flexible.

1
  • The best solution would be to rack up a firewall device and put your IPMI interfaces on a "management" rfc1918 network. You could also have all your public addresses on the firewall and firewall access to the devices. This might be a good question for networking.stackexchange.com
    – Criggie
    Jan 2, 2018 at 19:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .