Disconnecting a virtual machine temporarily from network

[srai20]

Is there a way to disconnect virtual machines from network temporarily like in vCenter server?

I am looking for something equilavent to following checkbox that's available in vSphere.

Network device status

☑ Connected

☑ Connect at power on

[davydotcom]

Hello,  there is currently not an equivalent checkbox in VME. 

[srai20]

Thank you for the reply.

Is there any other alternative to it in HVM?

I just want to disconnect my virtual machine temporarily from network for some maintenance purpose.

[Arnout_Verbeken]

Hello,

you can bring a VM nic up and down with virsh as follows.  I do not know if this is officially supported, but it works

|12:26:58|root@vmehost-1:[~]> virsh domiflist W2K19
 Interface   Type     Source   Model    MAC
-----------------------------------------------------------
 vnet11      bridge   cmpt     virtio   52:54:00:68:9b:29


|12:27:28|root@vmehost-1:[~]> virsh domif-getlink W2K19 vnet11
vnet11 up

|12:27:36|root@vmehost-1:[~]> ping W2K19
PING W2K19.bel1.global.tslabs.hpecorp.net (10.224.227.11) 56(84) bytes of data.
64 bytes from WIN-55ALLAFGBU7.bel1.global.tslabs.hpecorp.net (10.224.227.11): icmp_seq=1 ttl=127 time=0.681 ms
64 bytes from WIN-55ALLAFGBU7.bel1.global.tslabs.hpecorp.net (10.224.227.11): icmp_seq=2 ttl=127 time=0.308 ms
64 bytes from WIN-55ALLAFGBU7.bel1.global.tslabs.hpecorp.net (10.224.227.11): icmp_seq=3 ttl=127 time=0.377 ms
^C
--- W2K19.bel1.global.tslabs.hpecorp.net ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2065ms
rtt min/avg/max/mdev = 0.308/0.455/0.681/0.162 ms

|12:27:48|root@vmehost-1:[~]> virsh domif-setlink W2K19 vnet11 down
Device updated successfully

|12:28:08|root@vmehost-1:[~]> ping W2K19
PING W2K19.bel1.global.tslabs.hpecorp.net (10.224.227.11) 56(84) bytes of data.
^C
--- W2K19.bel1.global.tslabs.hpecorp.net ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3051ms

|12:28:15|root@vmehost-1:[~]> virsh domif-setlink W2K19 vnet11 up
Device updated successfully

|12:28:19|root@vmehost-1:[~]> ping W2K19
PING W2K19.bel1.global.tslabs.hpecorp.net (10.224.227.11) 56(84) bytes of data.
64 bytes from WIN-55ALLAFGBU7.bel1.global.tslabs.hpecorp.net (10.224.227.11): icmp_seq=1 ttl=127 time=0.346 ms
64 bytes from WIN-55ALLAFGBU7.bel1.global.tslabs.hpecorp.net (10.224.227.11): icmp_seq=2 ttl=127 time=0.664 ms
^C
--- W2K19.bel1.global.tslabs.hpecorp.net ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1007ms
rtt min/avg/max/mdev = 0.346/0.505/0.664/0.159 ms
|12:28:23|root@vmehost-1:[~]>

. 

[srai20]

Hello, thank for the reply and command line examples.

I tried with the commands you provided but it ended up with errors while trying to bring down the interface.

Did I miss something? or where did I go wrong here?

root@hpe-vme-01:~# virsh domiflist sctl-dev00-on-hvm
 Interface   Type     Source       Model    MAC
---------------------------------------------------------------
 vnet2       bridge   Management   virtio   52:54:00:2b:f6:0c

root@hpe-vme-01:~# virsh domif-getlink sctl-dev00-on-hvm vnet2
vnet2 up
root@hpe-vme-01:~# virsh domif-setlink sctl-dev00-on-hvm vnet2 down
error: Failed to update interface link state
error: Unable to add bridge mgmt port vnet2: Operation not supported

[Arnout_Verbeken]

That's strange.  I just retried it on my VME 8.0.8 and in my case, this still works.

What version do you have running?

|09:35:08|root@vmehost-1:[~]> virsh domiflist Ubuntu24-Test1
 Interface   Type     Source   Model    MAC
-----------------------------------------------------------
 vnet1       bridge   mgmt     virtio   52:54:00:79:36:df

|09:36:01|root@vmehost-1:[~]> virsh domif-getlink Ubuntu24-Test1 vnet1
vnet1 up
|09:36:06|root@vmehost-1:[~]> virsh domif-setlink Ubuntu24-Test1 vnet1 down
Device updated successfully

|09:45:06|root@vmehost-1:[~]> virsh domif-setlink Ubuntu24-Test1 vnet1 up
Device updated successfully

[srai20]

Mine is VME  v. 8.0.6

Does it have anything to do?

[Arnout_Verbeken]

Possibly, but not sure...  I never tested this on 8.0.6.

Can you upgrade to 8.0.8?  Do you have an NFR license or just a trial license?

[srai20]

We just have trial license now. We are preparing to place an order for proper license and techincal support in a months time.

We are doing thorough test to see how its like before we finally decide to have HVM to replace our vSphere infrastructure.

I will check and see if we can upgrade to v8.0.8 and come back with the result here.

[davydotcom]

In general, it is not advisable to use virsh commands unless explicitly needed for recovery. This is not supported by VME as it could affect state configurations. It is there as a maintenance option or for basic operations but can cause problems if not used correctly. In this instance, in order to support this, we likely have to talk to ovs-vsctl directly but it is not currently supported. It definitely should go on the ideas board as it is a good idea that we will take into consideration. Thank you!

[Arnout_Verbeken]

Hallo,

This has already been discussed in Slack and is already on the idea board.  Number HCPC0201-I-152
You can ping me in Slack.

[srai20]

Thank you all!

I don't know what is idea board and also I don't have access to slack.

Please provide me with any updates or if any solution pops up regarding this matter.

Temporarily disconnecting VMs from network is something we do often for testing or server maintenance purpose in our current vSphere environment.

We are looking for alike alternative in VME as well.

[CalvinZito]

@srai20 The Idea board is internal to HPE and is a way we are tracking suggested enhancements to VM Essentials. For HPE Partners that are a part of HPE TechPro, we have a Slack workspace to help and hear inputs from channel partners. We are also paying attention to what we hear here on the HPE Community site and there is a process that suggestions are added to our Idea board, prioritize, and our product management and engineering team decides if they can add those to the roadmap. 

[srai20]

I was wondring if there are any updates on this in Idea board or Slack Workspace.

If it is not advisable using virsh command to bring NIC up/down, is there any other command or way to do it?

I have some cases where I need to temporarily disconnect a VME VM from the network while keeping console access, and after a while reconnect.

[shiba9967]

In the Open vSwitch used by HVM, the NICs utilized by the VMs are tap/tun devices on the host OS and are likely managed by the host OS kernel.
In my environment, I was unable to change the link state using "virsh domif-setlink."
Similarly, I could not perform this operation with ovs-vsctl either.
Given that these are tap/tun devices, I consider this behavior to be normal.

The available options are as follows:

1. Disconnecting the tap/tun device on the host OS using "ip link set xxx down"
2. Using OVS flow control (ovs-ofctl)

If you were able to change the link state with virsh, I would like to know about your environment, such as the network devices and OVS configuration!