# Backplane Network Segmentation

#### What it is

By default all Controller VM (CVM) traffic shares one interface (CVM eth0): management (Prism, SSH, Rsyslog, SNMP, PE↔PC) and CVM↔CVM cluster-service traffic (Stargate, Cassandra, Zookeeper, Curator) all go out the same NIC and VLAN. **Network Segmentation** moves specific traffic types onto their own dedicated vNIC and VLAN, physically and logically separated from the management network.

#### Traffic types you can segment

- **Management** (default, eth0) — Prism, SSH, Rsyslog, SNMP, PE↔PC. Anything that needs the default gateway.
- **Backplane** (eth2) — CVM↔CVM, Host↔Host and Host↔CVM cluster-service traffic. Always an isolated, **non-routable** VLAN/subnet, kept separate from every other network in use.
- **Service** — an AOS feature you choose to move onto its own network, e.g. **Volumes** (iSCSI data services) or **DR/replication** (Cerebro). Unlike Backplane, this network is usually routable — DR traffic has to reach a remote cluster.
- **RDMA** — Stargate-only, uses physical NIC passthrough instead of a vNIC. Separate topic from the three above.

#### Prerequisites

- At least one spare physical NIC per node beyond what the management virtual switch (`vs0`/`br0`) already uses — backplane traffic needs its own uplinks, not a VLAN trunked over the management NICs.
- A second virtual switch (e.g. `vs1`/`br1`) built from those spare NICs, present on every node in the cluster.
- CVM and AHV host management interfaces (eth0) must stay on the same subnet/VLAN as each other — segmentation only ever pulls extra traffic off eth0, it never changes the management network itself.
- All hosts reachable and able to enter maintenance mode one at a time — segmentation is applied per host with a rolling CVM restart.

#### Enabling it (Prism Element)

Settings (gear icon) → Network Configuration → Internal Interfaces → "Backplane LAN" → Configure.

- VLAN ID — a VLAN not used anywhere else on the network.
- Subnet + gateway — Backplane itself never routes anywhere, but the wizard still wants a subnet/mask.
- Virtual switch to bind it to (`vs1` from the prerequisites above).
- IP address pool for the interface — see the *IP Pools* page in this chapter. Prism assigns one address per CVM (and per host, on current AOS) out of this range automatically.

Put hosts into maintenance mode one at a time before configuring, exit again once each CVM has restarted onto the new interface:

```bash
acli host.enter_maintenance_mode <host_ip>
# ... configure/verify backplane on this host ...
acli host.exit_maintenance_mode <host_ip>
```

#### Multiple clusters / Prism Central

For Service (DR) segmentation spanning a replication pair, Prism Central's Network Segmentation workflow can push the same VLAN/subnet config to several clusters at once — useful to keep both sides of the pair consistent.