Backplane Network Segmentation

What it is

By default all Controller VM (CVM) traffic shares one interface (CVM eth0): management (Prism, SSH, Rsyslog, SNMP, PE↔PC) and CVM↔CVM cluster-service traffic (Stargate, Cassandra, Zookeeper, Curator) all go out the same NIC and VLAN. Network Segmentation moves specific traffic types onto their own dedicated vNIC and VLAN, physically and logically separated from the management network.

Traffic types you can segment

• Management (default, eth0) — Prism, SSH, Rsyslog, SNMP, PE↔PC. Anything that needs the default gateway.
• Backplane (eth2) — CVM↔CVM, Host↔Host and Host↔CVM cluster-service traffic. Always an isolated, non-routable VLAN/subnet, kept separate from every other network in use.
• Service — an AOS feature you choose to move onto its own network, e.g. Volumes (iSCSI data services) or DR/replication (Cerebro). Unlike Backplane, this network is usually routable — DR traffic has to reach a remote cluster.
• RDMA — Stargate-only, uses physical NIC passthrough instead of a vNIC. Separate topic from the three above.

Prerequisites

• At least one spare physical NIC per node beyond what the management virtual switch (vs0/br0) already uses — backplane traffic needs its own uplinks, not a VLAN trunked over the management NICs.
• A second virtual switch (e.g. vs1/br1) built from those spare NICs, present on every node in the cluster.
• CVM and AHV host management interfaces (eth0) must stay on the same subnet/VLAN as each other — segmentation only ever pulls extra traffic off eth0, it never changes the management network itself.
• All hosts reachable and able to enter maintenance mode one at a time — segmentation is applied per host with a rolling CVM restart.

Enabling it (Prism Element)

Settings (gear icon) → Network Configuration → Internal Interfaces → "Backplane LAN" → Configure.

• VLAN ID — a VLAN not used anywhere else on the network.
• Subnet + gateway — Backplane itself never routes anywhere, but the wizard still wants a subnet/mask.
• Virtual switch to bind it to (vs1 from the prerequisites above).
• IP address pool for the interface — see the IP Pools page in this chapter. Prism assigns one address per CVM (and per host, on current AOS) out of this range automatically.

Put hosts into maintenance mode one at a time before configuring, exit again once each CVM has restarted onto the new interface:

acli host.enter_maintenance_mode <host_ip>
# ... configure/verify backplane on this host ...
acli host.exit_maintenance_mode <host_ip>

Multiple clusters / Prism Central

For Service (DR) segmentation spanning a replication pair, Prism Central's Network Segmentation workflow can push the same VLAN/subnet config to several clusters at once — useful to keep both sides of the pair consistent.