Product SiteDocumentation Site

9.4. Network Offerings

Note

For the most up-to-date list of supported network services, see the CloudStack UI or call listNetworkServices.
A network offering is a named set of network services, such as:
When creating a new VM, the user chooses one of the available network offerings, and that determines which network services the VM can use.
The CloudStack administrator can create any number of custom network offerings, in addition to the default network offerings provided by CloudStack. By creating multiple custom network offerings, you can set up your cloud to offer different classes of service on a single multi-tenant physical network. For example, while the underlying physical wiring may be the same for two tenants, tenant A may only need simple firewall protection for their website, while tenant B may be running a web server farm and require a scalable firewall solution, load balancing solution, and alternate networks for accessing the database backend.

Note

If you create load balancing rules while using a network service offering that includes an external load balancer device such as NetScaler, and later change the network service offering to one that uses the CloudStack virtual router, you must create a firewall rule on the virtual router for each of your existing load balancing rules so that they continue to function.
When creating a new virtual network, the CloudStack administrator chooses which network offering to enable for that network. Each virtual network is associated with one network offering. A virtual network can be upgraded or downgraded by changing its associated network offering. If you do this, be sure to reprogram the physical network to match.
CloudStack also has internal network offerings for use by CloudStack system VMs. These network offerings are not visible to users but can be modified by administrators.

9.4.1. Creating a New Network Offering

To create a network offering:
  1. Log in with admin privileges to the CloudStack UI.
  2. In the left navigation bar, click Service Offerings.
  3. In Select Offering, choose Network Offering.
  4. Click Add Network Offering.
  5. In the dialog, make the following choices:
    • Name. Any desired name for the network offering.
    • Description. A short description of the offering that can be displayed to users.
    • Network Rate. Allowed data transfer rate in MB per second.
    • Guest Type. Choose whether the guest network is isolated or shared.
      For a description of this term, see Section 9.2, “About Virtual Networks”.
    • Persistent. Indicate whether the guest network is persistent or not. The network that you can provision without having to deploy a VM on it is termed persistent network. For more information, see Section 15.28, “Persistent Networks”.
    • Specify VLAN. (Isolated guest networks only) Indicate whether a VLAN could be specified when this offering is used. If you select this option and later use this network offering while creating a VPC tier or an isolated network, you will be able to specify a VLAN ID for the network you create.
    • VPC. This option indicate whether the guest network is Virtual Private Cloud-enabled. A Virtual Private Cloud (VPC) is a private, isolated part of CloudStack. A VPC can have its own virtual network topology that resembles a traditional physical network. For more information on VPCs, see Section 15.27.1, “About Virtual Private Clouds”.
    • Supported Services. Select one or more of the possible network services. For some services, you must also choose the service provider; for example, if you select Load Balancer, you can choose the CloudStack virtual router or any other load balancers that have been configured in the cloud. Depending on which services you choose, additional fields may appear in the rest of the dialog box.
      Based on the guest network type selected, you can see the following supported services:
      Supported Services
      Description
      Isolated
      Shared
      DHCP
      For more information, see Section 15.24, “DNS and DHCP”.
      Supported
      Supported
      DNS
      For more information, see Section 15.24, “DNS and DHCP”.
      Supported
      Supported
      Load Balancer
      If you select Load Balancer, you can choose the CloudStack virtual router or any other load balancers that have been configured in the cloud.
      Supported
      Supported
      Firewall
      For more information, see the Administration Guide.
      Supported
      Supported
      Source NAT
      If you select Source NAT, you can choose the CloudStack virtual router or any other Source NAT providers that have been configured in the cloud.
      Supported
      Supported
      Static NAT
      If you select Static NAT, you can choose the CloudStack virtual router or any other Static NAT providers that have been configured in the cloud.
      Supported
      Supported
      Port Forwarding
      If you select Port Forwarding, you can choose the CloudStack virtual router or any other Port Forwarding providers that have been configured in the cloud.
      Supported
      Not Supported
      VPN
      For more information, see Section 15.25, “Remote Access VPN”.
      Supported
      Not Supported
      User Data
      For more information, see Section 20.3, “User Data and Meta Data”.
      Not Supported
      Supported
      Network ACL
      For more information, see Section 15.27.4, “Configuring Network Access Control List”.
      Supported
      Not Supported
      Security Groups
      For more information, see Section 15.15.2, “Adding a Security Group”.
      Not Supported
      Supported
    • System Offering. If the service provider for any of the services selected in Supported Services is a virtual router, the System Offering field appears. Choose the system service offering that you want virtual routers to use in this network. For example, if you selected Load Balancer in Supported Services and selected a virtual router to provide load balancing, the System Offering field appears so you can choose between the CloudStack default system service offering and any custom system service offerings that have been defined by the CloudStack root administrator.
      For more information, see Section 8.2, “System Service Offerings”.
    • LB Isolation: Specify what type of load balancer isolation you want for the network: Shared or Dedicated.
      Dedicated: If you select dedicated LB isolation, a dedicated load balancer device is assigned for the network from the pool of dedicated load balancer devices provisioned in the zone. If no sufficient dedicated load balancer devices are available in the zone, network creation fails. Dedicated device is a good choice for the high-traffic networks that make full use of the device's resources.
      Shared: If you select shared LB isolation, a shared load balancer device is assigned for the network from the pool of shared load balancer devices provisioned in the zone. While provisioning CloudStack picks the shared load balancer device that is used by the least number of accounts. Once the device reaches its maximum capacity, the device will not be allocated to a new account.
    • Mode: You can select either Inline mode or Side by Side mode:
      Inline mode: Supported only for Juniper SRX firewall and BigF5 load balancer devices. In inline mode, a firewall device is placed in front of a load balancing device. The firewall acts as the gateway for all the incoming traffic, then redirect the load balancing traffic to the load balancer behind it. The load balancer in this case will not have the direct access to the public network.
      Side by Side: In side by side mode, a firewall device is deployed in parallel with the load balancer device. So the traffic to the load balancer public IP is not routed through the firewall, and therefore, is exposed to the public network.
    • Associate Public IP: Select this option if you want to assign a public IP address to the VMs deployed in the guest network. This option is available only if
      • Guest network is shared.
      • StaticNAT is enabled.
      • Elastic IP is enabled.
      For information on Elastic IP, see Section 15.11, “About Elastic IP”.
    • Redundant router capability: Available only when Virtual Router is selected as the Source NAT provider. Select this option if you want to use two virtual routers in the network for uninterrupted connection: one operating as the master virtual router and the other as the backup. The master virtual router receives requests from and sends responses to the user’s VM. The backup virtual router is activated only when the master is down. After the failover, the backup becomes the master virtual router. CloudStack deploys the routers on different hosts to ensure reliability if one host is down.
    • Conserve mode: Indicate whether to use conserve mode. In this mode, network resources are allocated only when the first virtual machine starts in the network. When conservative mode is off, the public IP can only be used for a single service. For example, a public IP used for a port forwarding rule cannot be used for defining other services, such as StaticNAT or load balancing. When the conserve mode is on, you can define more than one service on the same public IP.

      Note

      If StaticNAT is enabled, irrespective of the status of the conserve mode, no port forwarding or load balancing rule can be created for the IP. However, you can add the firewall rules by using the createFirewallRule command.
    • Tags: Network tag to specify which physical network to use.
    • Default egress policy: Configure the default policy for firewall egress rules. Options are Allow and Deny. Default is Allow if no egress policy is specified, which indicates that all the egress traffic is accepted when a guest network is created from this offering.
      To block the egress traffic for a guest network, select Deny. In this case, when you configure an egress rules for an isolated guest network, rules are added to allow the specified traffic.
  6. Click Add.