Virtual Network Types

Zergaw CloudStack provides a flexible networking model that allows users to deploy virtual machines (Instances) in various network topologies. Depending on the use case whether it requires strict isolation, shared resources, or complex multi-tier architectures users can choose between creating a Guest Network or VPC Network. With Zergaw CloudStack Guest Networks you can choose between creating an Isolated or L2 network.

Guest Networks

1. Isolated Networks

An Isolated network is a virtual network dedicated to a single account. It provides the highest level of segregation from other tenants on the cloud.

Key Characteristics

In an Isolated network, the infrastructure (VLAN/VXLAN) is dedicated to the account. A Virtual Router (VR) is automatically deployed to provide network services.

• Exclusive Access: Can be accessed only by Instances of a single account.
• Dynamic Resource Allocation: Resources such as VLANs are allocated and garbage-collected dynamically by Zergaw CloudStack.
• Single Network Offering: There is one network offering for the entire network.
• Scalability: The network offering can be upgraded or downgraded, but changes apply to the entire network.

Network Services

The Virtual Router in an Isolated network typically provides the following services:

• DHCP & DNS: Automatically assigns private IP addresses and resolves hostnames.
• Source NAT: allows guest instances to access the internet via a single public IP.
• Static NAT: Maps a public IP directly to a guest instance (1:1 NAT).
• Port Forwarding: Maps specific public ports to private ports on instances.
• Load Balancing: Distributes traffic across multiple instances.
• Firewall: Controls ingress traffic.

2. L2 (Layer 2) Networks

L2 networks provide raw network isolation without any higher-level network services (Layer 3 routing, DNS, or DHCP). This type is effectively a "virtual wire."

Key Characteristics

This network type assumes the end-user or the guest operating system handles all IP address management (IPAM).

• No Virtual Router: There is no Zergaw-managed router or gateway.
• User-Managed IPAM: The user must statically assign IP addresses or run their own DHCP server within the network.
• Creation: L2 networks can be created by end-users. However, network offerings that allow the network creator to specify a specific VLAN ID can only be created by root admins.
• Config Drive: Userdata and metadata can be passed to the instance using a config drive.

Use Case

L2 Networks are specially useful and widely adopted when using VNF or virtual network appliances. The provide the basic switching functionality while your VNF appliance do all the network functions

3. Shared Networks

A Shared Network allows Instances from different accounts to share the same network segment (for example, a specific VLAN or subnet).

Key Characteristics

Unlike Isolated networks, Shared networks do not usually utilize a Virtual Router for routing or NAT. Instead, they often mimic a traditional flat network where instances sit directly on the network with public or routable IPs.

• Shared Infrastructure: Multiple accounts share the same L2 broadcast domain.
• Isolation Method: Isolation is achieved via Security Groups (distributed firewalls applied at the hypervisor level) rather than VLANs.
• No Source NAT: Instances typically receive an IP address that is directly routable.
• Efficiency: Ideal for environments where heavy routing overhead (Virtual Routers) is unnecessary or where instances need to be on the same subnet as physical devices.

VPC Network (Virtual Private Cloud)

A Zergaw CloudStack Virtual Private Cloud (VPC) is a private, isolated part of the cloud. It allows you to define a virtual network topology that resembles a traditional physical network in a datacenter.

Overview

A VPC acts as a container for multiple "Network Tiers." While an Isolated Network is a single segment, a VPC allows you to have multiple segments (subnets) that route to each other efficiently.

You can launch Instances in the virtual Network that can have private addresses in the range of your choice (CIDR), for example: 10.0.0.0/16.

Structuring a VPC

You define Network Tiers within your VPC Network range to group similar kinds of Instances.

• VPC CIDR: 10.0.0.0/16
  • Tier 1 (Web): 10.0.1.0/24
  • Tier 2 (App): 10.0.2.0/24
  • Tier 3 (DB): 10.0.3.0/24

Major Components of a VPC

• VPC: The container for multiple isolated Networks that communicate via a virtual router.
• Network Tiers: Each Tier acts as an isolated Network with its own VLAN and CIDR. Tiers are segmented by VLANs. The NIC of each Tier acts as its gateway.
• Virtual Router (VPC Router): Automatically created when you create a VPC. It connects the Network Tiers and directs traffic among the public gateway, VPN gateways, and NAT Instances. It provides DNS and DHCP services.
• Public Gateway: Routes traffic to and from the Internet.

  Note: Static routes are not supported for the public gateway as it is not exposed to the end-user.

• Private Gateway: Routes traffic to and from a private Network (e.g., a physical MPLS connection).
• VPN Gateway: The VPC side of a VPN connection.
• Site-to-Site VPN Connection: A hardware-based IPsec VPN connection between your VPC and your datacenter or home network.
• Customer Gateway: The customer side of a VPN Connection.
• NAT Instance: An Instance that provides Port Address Translation for Instances to access the Internet via the public gateway.
• Network ACL (Access Control List): A stateless firewall that controls traffic ingress and egress at the subnet (Tier) level. Rules are numbered and evaluated in order.

Network ACL Lists

In Zergaw CloudStack terminology, a Network ACL is a group of Network ACL rules. Network ACL rules are processed by their order, starting with the lowest numbered rule. Each rule defines at least an affected protocol, traffic type, action and affected destination / source Network. The following table shows a exemplary content of a “default_deny” ACL.

Each Network ACL is associated with a VPC and can be assigned to multiple VPC Network Tiers. Every Network Tier needs to be associated with a Network ACL. Only one ACL can be associated with a Network Tier at a time. If no custom Network ACL is available at the time of Network Tier creation, a default Network ACL has to be used instead.

Currently two default ACL are available. The “default_allow” ACL allows in- and egress traffic while the “default_deny” blocks all in- and egress traffic. Default Network ACL cannot be removed or modified. Newly created ACLs, while showing empty, deny all incoming traffic to the associated tier and allow all outgoing traffic. To change the defaults add a deny all egress destination and / or “allow all ingress source” rule to the ACL. Afterwards traffic can be white- or blacklisted.

Network Architecture Options

In a VPC, you can configure four basic architectures:

1. VPC with a public gateway only.
2. VPC with public and private gateways.
3. VPC with public and private gateways and site-to-site VPN access.

Connectivity Options

You can connect your VPC to:

• The Internet: Via the Public Gateway.
• Corporate Datacenter: Via Site-to-Site VPN through the VPN Gateway.
• Hybrid: Both the Internet and corporate datacenter simultaneously.

VPC Network Considerations & Limitations

Before designing your VPC, consider the following rules:

• The default number of Network Tiers an Account can create within a VPC is 3.

• Each Network Tier should have an unique CIDR in the VPC. Ensure that the Network Tier’s CIDR should be within the VPC CIDR range.

• A Public IP address within a VPC can only be used for only one purpose at a time. If the Public IP address is utilized for source NAT, it cannot be used for StaticNAT, port forwarding or load balancing.

• If an Public IP address is assigned to a Network Tier, That Public IP can’t be used by more than one Network Tier at a time in the VPC. For example, if you have Network Tiers A and B, and a Public IP1, you can create a port forwarding rule by using the IP either for A or B, but not for both.

• The load balancing service can be supported by only one Network Tier inside the VPC.

• All Network Tiers inside the VPC should belong to the same Account.

• ACL Rules in Zergaw Cloudstack are stateful

• Network ACLs in Zergaw Cloudstack only applies to VPC networks

• Source / Destination CIDRs are always external Networks

• ACL rules can also been seen on the virtual router of the VPC. Ingress rules are listed in the table iptables table “filter” while egress rules are placed in the “mangle” table

• ACL rules for ingress and egress are not correlating. For example a
  egress “deny all” won’t affect traffic in response to an allowed ingress
  connection

• Quotas:

  • Default VPCs per Account: 20
  • Default Network Tiers per VPC: 3

• CIDR Management:

  • Each Network Tier must have a unique CIDR.
  • The Tier CIDR must be a subset of the VPC CIDR.

• Isolation: A Network Tier belongs to only one VPC. All Tiers inside the VPC must belong to the same Account.

• Source NAT: When a VPC is created, a SourceNAT IP is allocated. It is released only when the VPC is removed.

• IP Usage: A public IP can be used for only one purpose (e.g., if used for SourceNAT, it cannot be used for StaticNAT).

• Load Balancing: The LB service is supported, but typically restricted to specific tiers.

• Exclusive IP Assignment: If an IP is assigned to a specific Network Tier (e.g., for Port Forwarding), it cannot be reused by another Tier in the same VPC.

Comparison Summary