How should I set up multiple NICs for Hyper-V?

Question

I have a PowerEdge server that has 1 management NIC and 4 other NICs. I have the management NIC set up so that I can access iDRAC and it works great. Now I'd like to set up Windows 2008 R2 Hyper-V. Our network has two kinds of IP addresses. One is the 10.10.x.x kind that you can't get to from outside the network. The other is a public kind, like 128.210.x.x.

I thought I should set up one NIC with a 10.10.x.x IP address and the other with as 128.210.x.x IP address so that the Hyper-V parent partition can use the 10.10.x.x one and be relatively safe from outside attack. Then the child partitions/guest OS's running on top of Hyper-V could use the public NIC, so that people could get at them from anywhere (some of these are web servers).

When I try to set them up this way, Windows complains about having multiple default gateways. If I give both NICs public IPs then things work -- that is, both parent and child partitions can get out to the internet. Could someone who knows vastly more about networking than me explain what I should be doing here? The basic idea is to have one VM running a file server, accessible on a 10.10.x.x IP or via WINS like \FILESERVER and then to have a bunch of other VMs that are separate webservers. Thanks.

Solution

Your problem stems from a misunderstanding about default gateways. There is only one total, not one per NIC. Setting additional default gateways is for redundancy only.

You only have one default gateway, but you still need to set route for the other interfaces for non-default situations. If you don't do this, all traffic leaving your server will attempt to go out of the interface that has the default gateway on it, since that is the only gateway. It's pretty obvious why this won't work well for you.

So, in conclusion, if you define your default gateway for the 10.x.x.x interface, you need to add static routes for the 128.210.x.x interfaces which define the next hop for traffic leaving those NICs.

Comments

[MDMarra]

I believe that he does have 1 NIC for management and the others for guests. Unless I am misunderstanding.

[Kara Marfia]

If iDRAC works the way I believe it does, its NIC is not accessible to the OS at all (but only to its controller card), so I'd probably use one for the host, and the other 3 for guest use.

[MDMarra]

@Kara - Right, He then goes on to say that the 10.x.x.x interface is for the parent partition, which is the equivalent of the management interface, correct? I don't use Hyper-V, but that was my understanding.

[Kara Marfia]

@MarkM I understand 'parent' to refer to the host OS. en.wikipedia.org/wiki/Dell_DRAC implies that the NIC it uses is unavailable to anything else. the 10.x.x.x is just the internal-only address space, likely NAT'ed to the external 128.210.x.x addresses, but I thought I'd save questions about firewalls until after we nailed down the first issue. /grin

[MDMarra]

@Kara - I guess we'll wait for the OP to update. I read it as, he has the DRAC working, he has a NIC on an internal 10.x.x.x address and some other NICs on 128.210.x.x. IT just sounded like he was trying to put a default gateway on each NIC, which would obviously cause issues in a multi-homed situation.

[user21715]

Yes, the DRAC is completely separate. It has its own 10.10.x.x address and is happy that way. There are 4 other NICs.

[user21715]

So I would set up the first NIC with a 10.10.x.y IP and a default gateway of 10.10.x.254, and then the next NIC as 128.210.x.y and just leave the default gateway blank in the settings dialog? And then set up a route (using something like technet.microsoft.com/en-us/library/dd469825.aspx ) to route 128.210.x.y to...what? The router at 128.210.x.254?

[user21715]

So maybe I should enumerate an example. Suppose we have the following: DRAC: 10.10.11.53/255.255.255.0, gateway 10.10.11.254. Then NIC1 (Windows Server 2008 R2): 10.10.11.54/255.255.255.0, gateway 10.10.11.254. Finally, Hyper-V VMs: Webserver1 128.210.x.77 Webserver2 128.210.x.81 Fileserver 10.10.11.14 So those VMs should use NIC2.

[MDMarra]

@smorfnip - ya, pretty much. You can leave the DRAC out of these examples, it's superflous since it is disjoint from the host OS.