Configuring and managing networking

1. Optional: /usr/lib/udev/rules.d/60-net.rules

   This file exists only if you install the initscripts-rename-device package. The /usr/lib/udev/rules.d/60-net.rules file defines that the deprecated /usr/lib/udev/rename_device helper utility searches for the HWADDR parameter in /etc/sysconfig/network-scripts/ifcfg-* files. If the value set in the variable matches the MAC address of an interface, the helper utility renames the interface to the name set in the DEVICE parameter of the ifcfg file.

   If the system uses only NetworkManager connection profiles in keyfile format, udev skips this step.

2. Only on Dell systems: /usr/lib/udev/rules.d/71-biosdevname.rules

   This file exists only if the biosdevname package is installed, and the rules file defines that the biosdevname utility renames the interface according to its naming policy, if it was not renamed in the previous step.

   Note

   Install and use biosdevname only on Dell systems.

3. /usr/lib/udev/rules.d/75-net-description.rules

   This file defines how udev examines the network interface and sets the properties in udev-internal variables. These variables are then processed in the next step by the /usr/lib/udev/rules.d/80-net-setup-link.rules file. Some of the properties can be undefined.

4. /usr/lib/udev/rules.d/80-net-setup-link.rules

   This file calls the net_setup_link builtin of the udev service, and udev renames the interface based on the order of the policies in the NamePolicy parameter in the /usr/lib/systemd/network/99-default.link file. For further details, see Network interface naming policies.

   If none of the policies applies, udev does not rename the interface.

Procedure

1. List the network interfaces:

   # ip link show
   2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
       link/ether 00:00:5e:00:53:1a brd ff:ff:ff:ff:ff:ff
   ...

   Record the MAC addresses of the interfaces.

2. Optional: Display the ID_NET_NAMING_SCHEME property of a network interface to identify the naming scheme that RHEL currently uses:

   # udevadm info --query=property --property=ID_NET_NAMING_SCHEME /sys/class/net/eno1'
   ID_NET_NAMING_SCHEME=rhel-9.0

   Note that the property is not available on the lo loopback device.

3. Append the net.naming-scheme=<scheme> option to the command line of all installed kernels, for example:

   # grubby --update-kernel=ALL --args=net.naming-scheme=rhel-9.4

4. Reboot the system.

   # reboot

5. Based on the MAC addresses you recorded, identify the new names of network interfaces that have changed due to the different naming scheme:

   # ip link show
   2: eno1np0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
       link/ether 00:00:5e:00:53:1a brd ff:ff:ff:ff:ff:ff
   ...

   After switching the scheme, udev names in this example the device with MAC address 00:00:5e:00:53:1a eno1np0, whereas it was named eno1 before.

6. Identify which NetworkManager connection profile uses an interface with the previous name:

   # nmcli -f device,name connection show
   DEVICE  NAME
   eno1  example_profile
   ...

7. Set the connection.interface-name property in the connection profile to the new interface name:

   # nmcli connection modify example_profile connection.interface-name "eno1np0"

8. Reactivate the connection profile:

   # nmcli connection up example_profile

Procedure

1. Boot the Red Hat Enterprise Linux installation media.

2. In the boot manager, follow these steps:

   1. Select the Install Red Hat Enterprise Linux <version> entry.
   2. Press Tab to edit the entry.
   3. Append net.ifnames.prefix=<prefix> to the kernel options.
   4. Press Enter to start the installation program.
3. Install Red Hat Enterprise Linux.

Procedure

1. Identify the network interface that you want to rename:

   # ip link show
   ...
   enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
       link/ether 00:00:5e:00:53:1a brd ff:ff:ff:ff:ff:ff
   ...

   Record the MAC address of the interface.

2. Display the device type ID of the interface:

   # cat /sys/class/net/enp1s0/type
   1

3. Create the /etc/udev/rules.d/70-persistent-net.rules file, and add a rule for each interface that you want to rename:

   SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="<MAC_address>",ATTR{type}=="<device_type_id>",NAME="<new_interface_name>"

   Important

   Use only 70-persistent-net.rules as a file name if you require consistent device names during the boot process. The dracut utility adds a file with this name to the initrd image if you regenerate the RAM disk image.

   For example, use the following rule to rename the interface with MAC address 00:00:5e:00:53:1a to provider0:

   SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="00:00:5e:00:53:1a",ATTR{type}=="1",NAME="provider0"

4. Optional: Regenerate the initrd RAM disk image:

   # dracut -f

   You require this step only if you need networking capabilities in the RAM disk. For example, this is the case if the root file system is stored on a network device, such as iSCSI.

5. Identify which NetworkManager connection profile uses the interface that you want to rename:

   # nmcli -f device,name connection show
   DEVICE  NAME
   enp1s0  example_profile
   ...

6. Unset the connection.interface-name property in the connection profile:

   # nmcli connection modify example_profile connection.interface-name ""

7. Temporarily, configure the connection profile to match both the new and the previous interface name:

   # nmcli connection modify example_profile match.interface-name "provider0 enp1s0"

8. Reboot the system:

   # reboot

9. Verify that the device with the MAC address that you specified in the link file has been renamed to provider0:

   # ip link show
   provider0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
       link/ether 00:00:5e:00:53:1a brd ff:ff:ff:ff:ff:ff
   ...

10. Configure the connection profile to match only the new interface name:

    # nmcli connection modify example_profile match.interface-name "provider0"

    You have now removed the old interface name from the connection profile.

11. Reactivate the connection profile:

    # nmcli connection up example_profile

Procedure

1. Identify the network interface that you want to rename:

   # ip link show
   ...
   enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
       link/ether 00:00:5e:00:53:1a brd ff:ff:ff:ff:ff:ff
   ...

   Record the MAC address of the interface.

2. If it does not already exist, create the /etc/systemd/network/ directory:

   # mkdir -p /etc/systemd/network/

3. For each interface that you want to rename, create a 70-*.link file in the /etc/systemd/network/ directory with the following content:

   [Match]
   MACAddress=<MAC_address>
   
   [Link]
   Name=<new_interface_name>

   Important

   Use a file name with a 70- prefix to keep the file names consistent with the udev rules-based solution.

   For example, create the /etc/systemd/network/70-provider0.link file with the following content to rename the interface with MAC address 00:00:5e:00:53:1a to provider0:

   [Match]
   MACAddress=00:00:5e:00:53:1a
   
   [Link]
   Name=provider0

4. Optional: Regenerate the initrd RAM disk image:

   # dracut -f

   You require this step only if you need networking capabilities in the RAM disk. For example, this is the case if the root file system is stored on a network device, such as iSCSI.

5. Identify which NetworkManager connection profile uses the interface that you want to rename:

   # nmcli -f device,name connection show
   DEVICE  NAME
   enp1s0  example_profile
   ...

6. Unset the connection.interface-name property in the connection profile:

   # nmcli connection modify example_profile connection.interface-name ""

7. Temporarily, configure the connection profile to match both the new and the previous interface name:

   # nmcli connection modify example_profile match.interface-name "provider0 enp1s0"

8. Reboot the system:

   # reboot

9. Verify that the device with the MAC address that you specified in the link file has been renamed to provider0:

   # ip link show
   provider0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
       link/ether 00:00:5e:00:53:1a brd ff:ff:ff:ff:ff:ff
   ...

10. Configure the connection profile to match only the new interface name:

    # nmcli connection modify example_profile match.interface-name "provider0"

    You have now removed the old interface name from the connection profile.

11. Reactivate the connection profile.

    # nmcli connection up example_profile

Procedure

1. Display the network interface names and their MAC addresses:

   # ip link show
   ...
   enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
       link/ether 00:00:5e:00:53:1a brd ff:ff:ff:ff:ff:ff
   ...

   Record the MAC address of the interface to which you want to assign an alternative name.

2. If it does not already exist, create the /etc/systemd/network/ directory:

   # mkdir -p /etc/systemd/network/

3. For each interface that must have an alternative name, create a *.link file in the /etc/systemd/network/ directory with the following content:

   [Match]
   MACAddress=<MAC_address>
   
   [Link]
   AlternativeName=<alternative_interface_name_1>
   AlternativeName=<alternative_interface_name_2>
   AlternativeName=<alternative_interface_name_n>

   For example, create the /etc/systemd/network/70-altname.link file with the following content to assign provider as an alternative name to the interface with MAC address 00:00:5e:00:53:1a:

   [Match]
   MACAddress=00:00:5e:00:53:1a
   
   [Link]
   AlternativeName=provider

4. Regenerate the initrd RAM disk image:

   # dracut -f

5. Reboot the system:

   # reboot

Procedure

1. List the NetworkManager connection profiles:

   # nmcli connection show
   NAME                UUID                                  TYPE      DEVICE
   Wired connection 1  a5eb6490-cc20-3668-81f8-0314a27f3f75  ethernet  enp1s0

   By default, NetworkManager creates a profile for each NIC in the host. If you plan to connect this NIC only to a specific network, adapt the automatically-created profile. If you plan to connect this NIC to networks with different settings, create individual profiles for each network.

2. If you want to create an additional connection profile, enter:

   # nmcli connection add con-name <connection-name> ifname <device-name> type ethernet

   Skip this step to modify an existing profile.

3. Optional: Rename the connection profile:

   # nmcli connection modify "Wired connection 1" connection.id "Internal-LAN"

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

4. Display the current settings of the connection profile:

   # nmcli connection show Internal-LAN
   ...
   connection.interface-name:     enp1s0
   connection.autoconnect:        yes
   ipv4.method:                   auto
   ipv6.method:                   auto
   ...

5. Configure the IPv4 settings:

   • To use DHCP, enter:

     # nmcli connection modify Internal-LAN ipv4.method auto

     Skip this step if ipv4.method is already set to auto (default).

   • To set a static IPv4 address, network mask, default gateway, DNS servers, and search domain, enter:

     # nmcli connection modify Internal-LAN ipv4.method manual ipv4.addresses 192.0.2.1/24 ipv4.gateway 192.0.2.254 ipv4.dns 192.0.2.200 ipv4.dns-search example.com

6. Configure the IPv6 settings:

   • To use stateless address autoconfiguration (SLAAC), enter:

     # nmcli connection modify Internal-LAN ipv6.method auto

     Skip this step if ipv6.method is already set to auto (default).

   • To set a static IPv6 address, network mask, default gateway, DNS servers, and search domain, enter:

     # nmcli connection modify Internal-LAN ipv6.method manual ipv6.addresses 2001:db8:1::fffe/64 ipv6.gateway 2001:db8:1::fffe ipv6.dns 2001:db8:1::ffbb ipv6.dns-search example.com

7. To customize other settings in the profile, use the following command:

   # nmcli connection modify <connection-name> <setting> <value>

   Enclose values with spaces or semicolons in quotes.

8. Activate the profile:

   # nmcli connection up Internal-LAN

Verification

1. Display the IP settings of the NIC:

   # ip address show enp1s0
   2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 52:54:00:17:b8:b6 brd ff:ff:ff:ff:ff:ff
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::fffe/64 scope global noprefixroute
          valid_lft forever preferred_lft forever

2. Display the IPv4 default gateway:

   # ip route show default
   default via 192.0.2.254 dev enp1s0 proto static metric 102

3. Display the IPv6 default gateway:

   # ip -6 route show default
   default via 2001:db8:1::ffee dev enp1s0 proto static metric 102 pref medium

4. Display the DNS settings:

   # cat /etc/resolv.conf
   search example.com
   nameserver 192.0.2.200
   nameserver 2001:db8:1::ffbb

   If multiple connection profiles are active at the same time, the order of nameserver entries depend on the DNS priority values in these profile and the connection types.

5. Use the ping utility to verify that this host can send packets to other hosts:

   # ping <host-name-or-IP-address>

Procedure

1. List the NetworkManager connection profiles:

   # nmcli connection show
   NAME                UUID                                  TYPE      DEVICE
   Wired connection 1  a5eb6490-cc20-3668-81f8-0314a27f3f75  ethernet  enp1s0

   By default, NetworkManager creates a profile for each NIC in the host. If you plan to connect this NIC only to a specific network, adapt the automatically-created profile. If you plan to connect this NIC to networks with different settings, create individual profiles for each network.

2. Start nmcli in interactive mode:

   • To create an additional connection profile, enter:

     # nmcli connection edit type ethernet con-name "<connection-name>"

   • To modify an existing connection profile, enter:

     # nmcli connection edit con-name "<connection-name>"

3. Optional: Rename the connection profile:

   nmcli> set connection.id Internal-LAN

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

   Do not use quotes to set an ID that contains spaces to avoid that nmcli makes the quotes part of the name. For example, to set Example Connection as ID, enter set connection.id Example Connection.

4. Display the current settings of the connection profile:

   nmcli> print
   ...
   connection.interface-name:     enp1s0
   connection.autoconnect:        yes
   ipv4.method:                   auto
   ipv6.method:                   auto
   ...

5. If you create a new connection profile, set the network interface:

   nmcli> set connection.interface-name enp1s0

6. Configure the IPv4 settings:

   • To use DHCP, enter:

     nmcli> set ipv4.method auto

     Skip this step if ipv4.method is already set to auto (default).

   • To set a static IPv4 address, network mask, default gateway, DNS servers, and search domain, enter:

     nmcli> ipv4.addresses 192.0.2.1/24
     Do you also want to set 'ipv4.method' to 'manual'? [yes]: yes
     nmcli> ipv4.gateway 192.0.2.254
     nmcli> ipv4.dns 192.0.2.200
     nmcli> ipv4.dns-search example.com

7. Configure the IPv6 settings:

   • To use stateless address autoconfiguration (SLAAC), enter:

     nmcli> set ipv6.method auto

     Skip this step if ipv6.method is already set to auto (default).

   • To set a static IPv6 address, network mask, default gateway, DNS servers, and search domain, enter:

     nmcli> ipv6.addresses 2001:db8:1::fffe/64
     Do you also want to set 'ipv6.method' to 'manual'? [yes]: yes
     nmcli> ipv6.gateway 2001:db8:1::fffe
     nmcli> ipv6.dns 2001:db8:1::ffbb
     nmcli> ipv6.dns-search example.com

8. Save and activate the connection:

   nmcli> save persistent

9. Leave the interactive mode:

   nmcli> quit

Verification

1. Display the IP settings of the NIC:

   # ip address show enp1s0
   2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 52:54:00:17:b8:b6 brd ff:ff:ff:ff:ff:ff
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::fffe/64 scope global noprefixroute
          valid_lft forever preferred_lft forever

2. Display the IPv4 default gateway:

   # ip route show default
   default via 192.0.2.254 dev enp1s0 proto static metric 102

3. Display the IPv6 default gateway:

   # ip -6 route show default
   default via 2001:db8:1::ffee dev enp1s0 proto static metric 102 pref medium

4. Display the DNS settings:

   # cat /etc/resolv.conf
   search example.com
   nameserver 192.0.2.200
   nameserver 2001:db8:1::ffbb

   If multiple connection profiles are active at the same time, the order of nameserver entries depend on the DNS priority values in these profile and the connection types.

5. Use the ping utility to verify that this host can send packets to other hosts:

   # ping <host-name-or-IP-address>

Procedure

1. If you do not know the network device name you want to use in the connection, display the available devices:

   # nmcli device status
   DEVICE     TYPE      STATE                   CONNECTION
   enp1s0     ethernet  unavailable             --
   ...

2. Start nmtui:

   # nmtui

3. Select Edit a connection, and press Enter.

4. Choose whether to add a new connection profile or to modify an existing one:

   • To create a new profile:

     1. Press Add.
     2. Select Ethernet from the list of network types, and press Enter.
   • To modify an existing profile, select the profile from the list, and press Enter.

5. Optional: Update the name of the connection profile.

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

6. If you create a new connection profile, enter the network device name into the Device field.

7. Depending on your environment, configure the IP address settings in the IPv4 configuration and IPv6 configuration areas accordingly. For this, press the button next to these areas, and select:

   • Disabled, if this connection does not require an IP address.
   • Automatic, if a DHCP server dynamically assigns an IP address to this NIC.

   • Manual, if the network requires static IP address settings. In this case, you must fill further fields:

     1. Press Show next to the protocol you want to configure to display additional fields.

     2. Press Add next to Addresses, and enter the IP address and the subnet mask in Classless Inter-Domain Routing (CIDR) format.

        If you do not specify a subnet mask, NetworkManager sets a /32 subnet mask for IPv4 addresses and /64 for IPv6 addresses.

     3. Enter the address of the default gateway.
     4. Press Add next to DNS servers, and enter the DNS server address.
     5. Press Add next to Search domains, and enter the DNS search domain.

   Figure 2.1. Example of an Ethernet connection with static IP address settings

   
8. Press OK to create and automatically activate the new connection.
9. Press Back to return to the main menu.
10. Select Quit, and press Enter to close the nmtui application.

Verification

1. Display the IP settings of the NIC:

   # ip address show enp1s0
   2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 52:54:00:17:b8:b6 brd ff:ff:ff:ff:ff:ff
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::fffe/64 scope global noprefixroute
          valid_lft forever preferred_lft forever

2. Display the IPv4 default gateway:

   # ip route show default
   default via 192.0.2.254 dev enp1s0 proto static metric 102

3. Display the IPv6 default gateway:

   # ip -6 route show default
   default via 2001:db8:1::ffee dev enp1s0 proto static metric 102 pref medium

4. Display the DNS settings:

   # cat /etc/resolv.conf
   search example.com
   nameserver 192.0.2.200
   nameserver 2001:db8:1::ffbb

   If multiple connection profiles are active at the same time, the order of nameserver entries depend on the DNS priority values in these profile and the connection types.

5. Use the ping utility to verify that this host can send packets to other hosts:

   # ping <host-name-or-IP-address>

Procedure

1. Press the Super key, enter Settings, and press Enter.
2. Select Network in the navigation on the left.

3. Choose whether to add a new connection profile or to modify an existing one:

   • To create a new profile, click the + button next to the Ethernet entry.
   • To modify an existing profile, click the gear icon next to the profile entry.

4. Optional: On the Identity tab, update the name of the connection profile.

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

5. Depending on your environment, configure the IP address settings on the IPv4 and IPv6 tabs accordingly:

   • To use DHCP or IPv6 stateless address autoconfiguration (SLAAC), select Automatic (DHCP) as method (default).

   • To set a static IP address, network mask, default gateway, DNS servers, and search domain, select Manual as method, and fill the fields on the tabs:

     

6. Depending on whether you add or modify a connection profile, click the Add or Apply button to save the connection.

   The GNOME control-center automatically activates the connection.

Verification

1. Display the IP settings of the NIC:

   # ip address show enp1s0
   2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 52:54:00:17:b8:b6 brd ff:ff:ff:ff:ff:ff
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::fffe/64 scope global noprefixroute
          valid_lft forever preferred_lft forever

2. Display the IPv4 default gateway:

   # ip route show default
   default via 192.0.2.254 dev enp1s0 proto static metric 102

3. Display the IPv6 default gateway:

   # ip -6 route show default
   default via 2001:db8:1::ffee dev enp1s0 proto static metric 102 pref medium

4. Display the DNS settings:

   # cat /etc/resolv.conf
   search example.com
   nameserver 192.0.2.200
   nameserver 2001:db8:1::ffbb

   If multiple connection profiles are active at the same time, the order of nameserver entries depend on the DNS priority values in these profile and the connection types.

5. Use the ping utility to verify that this host can send packets to other hosts:

   # ping <host-name-or-IP-address>

Procedure

1. Open a terminal, and enter:

   $ nm-connection-editor

2. Choose whether to add a new connection profile or to modify an existing one:

   • To create a new profile:

     1. Click the + button
     2. Select Ethernet as connection type, and click Create.
   • To modify an existing profile, double-click the profile entry.

3. Optional: Update the name of the profile in the Connection Name field.

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

4. If you create a new profile, select the device on the Ethernet tab:

   

5. Depending on your environment, configure the IP address settings on the IPv4 Settings and IPv6 Settings tabs accordingly:

   • To use DHCP or IPv6 stateless address autoconfiguration (SLAAC), select Automatic (DHCP) as method (default).

   • To set a static IP address, network mask, default gateway, DNS servers, and search domain, select Manual as method, and fill the fields on the tabs:

     
6. Click Save.
7. Close nm-connection-editor.

Verification

1. Display the IP settings of the NIC:

   # ip address show enp1s0
   2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 52:54:00:17:b8:b6 brd ff:ff:ff:ff:ff:ff
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::fffe/64 scope global noprefixroute
          valid_lft forever preferred_lft forever

2. Display the IPv4 default gateway:

   # ip route show default
   default via 192.0.2.254 dev enp1s0 proto static metric 102

3. Display the IPv6 default gateway:

   # ip -6 route show default
   default via 2001:db8:1::ffee dev enp1s0 proto static metric 102 pref medium

4. Display the DNS settings:

   # cat /etc/resolv.conf
   search example.com
   nameserver 192.0.2.200
   nameserver 2001:db8:1::ffbb

   If multiple connection profiles are active at the same time, the order of nameserver entries depend on the DNS priority values in these profile and the connection types.

5. Use the ping utility to verify that this host can send packets to other hosts:

   # ping <host-name-or-IP-address>

Procedure

1. Create a YAML file, for example ~/create-ethernet-profile.yml, with the following content:

   ---
   interfaces:
   - name: enp1s0
     type: ethernet
     state: up
     ipv4:
       enabled: true
       address:
       - ip: 192.0.2.1
         prefix-length: 24
       dhcp: false
     ipv6:
       enabled: true
       address:
       - ip: 2001:db8:1::1
         prefix-length: 64
       autoconf: false
       dhcp: false
   routes:
     config:
     - destination: 0.0.0.0/0
       next-hop-address: 192.0.2.254
       next-hop-interface: enp1s0
     - destination: ::/0
       next-hop-address: 2001:db8:1::fffe
       next-hop-interface: enp1s0
   dns-resolver:
     config:
       search:
       - example.com
       server:
       - 192.0.2.200
       - 2001:db8:1::ffbb

   These settings define an Ethernet connection profile for the enp1s0 device with the following settings:

   • A static IPv4 address - 192.0.2.1 with the /24 subnet mask
   • A static IPv6 address - 2001:db8:1::1 with the /64 subnet mask
   • An IPv4 default gateway - 192.0.2.254
   • An IPv6 default gateway - 2001:db8:1::fffe
   • An IPv4 DNS server - 192.0.2.200
   • An IPv6 DNS server - 2001:db8:1::ffbb
   • A DNS search domain - example.com

2. Optional: You can define the identifier: mac-address and mac-address: <mac_address> properties in the interfaces property to identify the network interface card by its MAC address instead of its name, for example:

   ---
   interfaces:
   - name: <profile_name>
     type: ethernet
     identifier: mac-address
     mac-address: <mac_address>
     ...

3. Apply the settings to the system:

   # nmstatectl apply ~/create-ethernet-profile.yml

Verification

1. Display the current state in YAML format:

   # nmstatectl show enp1s0

2. Display the IP settings of the NIC:

   # ip address show enp1s0
   2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 52:54:00:17:b8:b6 brd ff:ff:ff:ff:ff:ff
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::fffe/64 scope global noprefixroute
          valid_lft forever preferred_lft forever

3. Display the IPv4 default gateway:

   # ip route show default
   default via 192.0.2.254 dev enp1s0 proto static metric 102

4. Display the IPv6 default gateway:

   # ip -6 route show default
   default via 2001:db8:1::ffee dev enp1s0 proto static metric 102 pref medium

5. Display the DNS settings:

   # cat /etc/resolv.conf
   search example.com
   nameserver 192.0.2.200
   nameserver 2001:db8:1::ffbb

   If multiple connection profiles are active at the same time, the order of nameserver entries depend on the DNS priority values in these profile and the connection types.

6. Use the ping utility to verify that this host can send packets to other hosts:

   # ping <host-name-or-IP-address>

Procedure

1. Edit the ~/inventory file, and append the host-specific settings to the host entries:

   managed-node-01.example.com interface=enp1s0 ip_v4=192.0.2.1/24 ip_v6=2001:db8:1::1/64 gateway_v4=192.0.2.254 gateway_v6=2001:db8:1::fffe
   
   managed-node-02.example.com interface=enp1s0 ip_v4=192.0.2.2/24 ip_v6=2001:db8:1::2/64 gateway_v4=192.0.2.254 gateway_v6=2001:db8:1::fffe

2. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure the network
     hosts: managed-node-01.example.com,managed-node-02.example.com
     tasks:
       - name: Ethernet connection profile with static IP address settings
         ansible.builtin.include_role:
           name: rhel-system-roles.network
         vars:
           network_connections:
             - name: "{{ interface }}"
               interface_name: "{{ interface }}"
               type: ethernet
               autoconnect: yes
               ip:
                 address:
                   - "{{ ip_v4 }}"
                   - "{{ ip_v6 }}"
                 gateway4: "{{ gateway_v4 }}"
                 gateway6: "{{ gateway_v6 }}"
                 dns:
                   - 192.0.2.200
                   - 2001:db8:1::ffbb
                 dns_search:
                   - example.com
               state: up

   This playbook reads certain values dynamically for each host from the inventory file and uses static values in the playbook for settings which are the same for all hosts.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.network/README.md file on the control node.

3. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

4. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure the network
     hosts: managed-node-01.example.com
     tasks:
       - name: Ethernet connection profile with static IP address settings
         ansible.builtin.include_role:
           name: rhel-system-roles.network
         vars:
           network_connections:
             - name: example
               match:
                 path:
                   - pci-0000:00:0[1-3].0
                   - &!pci-0000:00:02.0
               type: ethernet
               autoconnect: yes
               ip:
                 address:
                   - 192.0.2.1/24
                   - 2001:db8:1::1/64
                 gateway4: 192.0.2.254
                 gateway6: 2001:db8:1::fffe
                 dns:
                   - 192.0.2.200
                   - 2001:db8:1::ffbb
                 dns_search:
                   - example.com
               state: up

   The settings specified in the example playbook include the following:

   match

   Defines that a condition must be met in order to apply the settings. You can only use this variable with the path option.

   path

   Defines the persistent path of a device. You can set it as a fixed path or an expression. Its value can contain modifiers and wildcards. The example applies the settings to devices that match PCI ID 0000:00:0[1-3].0, but not 0000:00:02.0.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.network/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a YAML file, for example ~/create-ethernet-profile.yml, with the following content:

   ---
   interfaces:
   - name: enp1s0
     type: ethernet
     state: up
     ipv4:
       enabled: true
       auto-dns: true
       auto-gateway: true
       auto-routes: true
       dhcp: true
     ipv6:
       enabled: true
       auto-dns: true
       auto-gateway: true
       auto-routes: true
       autoconf: true
       dhcp: true

   These settings define an Ethernet connection profile for the enp1s0 device. The connection retrieves IPv4 addresses, IPv6 addresses, default gateway, routes, DNS servers, and search domains from a DHCP server and IPv6 stateless address autoconfiguration (SLAAC).

2. Optional: You can define the identifier: mac-address and mac-address: <mac_address> properties in the interfaces property to identify the network interface card by its MAC address instead of its name, for example:

   ---
   interfaces:
   - name: <profile_name>
     type: ethernet
     identifier: mac-address
     mac-address: <mac_address>
     ...

3. Apply the settings to the system:

   # nmstatectl apply ~/create-ethernet-profile.yml

Verification

1. Display the current state in YAML format:

   # nmstatectl show enp1s0

2. Display the IP settings of the NIC:

   # ip address show enp1s0
   2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 52:54:00:17:b8:b6 brd ff:ff:ff:ff:ff:ff
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::fffe/64 scope global noprefixroute
          valid_lft forever preferred_lft forever

3. Display the IPv4 default gateway:

   # ip route show default
   default via 192.0.2.254 dev enp1s0 proto static metric 102

4. Display the IPv6 default gateway:

   # ip -6 route show default
   default via 2001:db8:1::ffee dev enp1s0 proto static metric 102 pref medium

5. Display the DNS settings:

   # cat /etc/resolv.conf
   search example.com
   nameserver 192.0.2.200
   nameserver 2001:db8:1::ffbb

   If multiple connection profiles are active at the same time, the order of nameserver entries depend on the DNS priority values in these profile and the connection types.

6. Use the ping utility to verify that this host can send packets to other hosts:

   # ping <host-name-or-IP-address>

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure the network
     hosts: managed-node-01.example.com
     tasks:
       - name: Ethernet connection profile with dynamic IP address settings
         ansible.builtin.include_role:
           name: rhel-system-roles.network
         vars:
           network_connections:
             - name: enp1s0
               interface_name: enp1s0
               type: ethernet
               autoconnect: yes
               ip:
                 dhcp4: yes
                 auto6: yes
               state: up

   The settings specified in the example playbook include the following:

   dhcp4: yes

   Enables automatic IPv4 address assignment from DHCP, PPP, or similar services.

   auto6: yes

   Enables IPv6 auto-configuration. By default, NetworkManager uses Router Advertisements. If the router announces the managed flag, NetworkManager requests an IPv6 address and prefix from a DHCPv6 server.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.network/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure the network
     hosts: managed-node-01.example.com
     tasks:
       - name: Ethernet connection profile with dynamic IP address settings
         ansible.builtin.include_role:
           name: rhel-system-roles.network
         vars:
           network_connections:
             - name: example
               match:
                 path:
                   - pci-0000:00:0[1-3].0
                   - &!pci-0000:00:02.0
               type: ethernet
               autoconnect: yes
               ip:
                 dhcp4: yes
                 auto6: yes
               state: up

   The settings specified in the example playbook include the following:

   match: path

   Defines that a condition must be met in order to apply the settings. You can only use this variable with the path option.

   path: <path_and_expressions>

   Defines the persistent path of a device. You can set it as a fixed path or an expression. Its value can contain modifiers and wildcards. The example applies the settings to devices that match PCI ID 0000:00:0[1-3].0, but not 0000:00:02.0.

   dhcp4: yes

   Enables automatic IPv4 address assignment from DHCP, PPP, or similar services.

   auto6: yes

   Enables IPv6 auto-configuration. By default, NetworkManager uses Router Advertisements. If the router announces the managed flag, NetworkManager requests an IPv6 address and prefix from a DHCPv6 server.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.network/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Add a connection profile that applies to all interface names starting with enp:

   # nmcli connection add con-name "Wired connection 1" connection.multi-connect multiple match.interface-name enp* type ethernet

Verification

1. Display all settings of the single connection profile:

   # nmcli connection show "Wired connection 1"
   connection.id:                      Wired connection 1
   ...
   connection.multi-connect:           3 (multiple)
   match.interface-name:               enp*
   ...

   3 indicates the number of interfaces active on the connection profile at the same time, and not the number of network interfaces in the connection profile. The connection profile uses all devices that match the pattern in the match.interface-name parameter and, therefore, the connection profiles have the same Universally Unique Identifier (UUID).

2. Display the status of the connections:

   # nmcli connection show
   NAME                UUID                                  TYPE      DEVICE
   ...
   Wired connection 1  6f22402e-c0cc-49cf-b702-eaf0cd5ea7d1  ethernet  enp7s0
   Wired connection 1  6f22402e-c0cc-49cf-b702-eaf0cd5ea7d1  ethernet  enp8s0
   Wired connection 1  6f22402e-c0cc-49cf-b702-eaf0cd5ea7d1  ethernet  enp9s0

Procedure

1. Identify the device path. For example, to display the device paths of all interfaces starting with enp, enter :

   # udevadm info /sys/class/net/enp | grep ID_PATH=*
   ...
   E: ID_PATH=pci-0000:07:00.0
   E: ID_PATH=pci-0000:08:00.0

2. Add a connection profile that applies to all PCI IDs matching the 0000:00:0[7-8].0 expression:

   # nmcli connection add type ethernet connection.multi-connect multiple match.path "pci-0000:07:00.0 pci-0000:08:00.0" con-name "Wired connection 1"

Verification

1. Display the status of the connection:

   # nmcli connection show
   NAME                 UUID                                  TYPE      DEVICE
   Wired connection 1   9cee0958-512f-4203-9d3d-b57af1d88466  ethernet  enp7s0
   Wired connection 1   9cee0958-512f-4203-9d3d-b57af1d88466  ethernet  enp8s0
   ...

2. To display all settings of the connection profile:

   # nmcli connection show "Wired connection 1"
   connection.id:               Wired connection 1
   ...
   connection.multi-connect:    3 (multiple)
   match.path:                  pci-0000:07:00.0,pci-0000:08:00.0
   ...

   This connection profile uses all devices with a PCI ID which match the pattern in the match.path parameter and, therefore, the connection profiles have the same Universally Unique Identifier (UUID).

Procedure

1. Create a bond interface:

   # nmcli connection add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup"

   This command creates a bond named bond0 that uses the active-backup mode.

   To additionally set a Media Independent Interface (MII) monitoring interval, add the miimon=interval option to the bond.options property, for example:

   # nmcli connection add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup,miimon=1000"

2. Display the network interfaces, and note names of interfaces you plan to add to the bond:

   # nmcli device status
   DEVICE   TYPE      STATE         CONNECTION
   enp7s0   ethernet  disconnected  --
   enp8s0   ethernet  disconnected  --
   bridge0  bridge    connected     bridge0
   bridge1  bridge    connected     bridge1
   ...

   In this example:

   • enp7s0 and enp8s0 are not configured. To use these devices as ports, add connection profiles in the next step.
   • bridge0 and bridge1 have existing connection profiles. To use these devices as ports, modify their profiles in the next step.

3. Assign interfaces to the bond:

   1. If the interfaces you want to assign to the bond are not configured, create new connection profiles for them:

      # nmcli connection add type ethernet port-type bond con-name bond0-port1 ifname enp7s0 controller bond0
      # nmcli connection add type ethernet port-type bond con-name bond0-port2 ifname enp8s0 controller bond0

      These commands create profiles for enp7s0 and enp8s0, and add them to the bond0 connection.

   2. To assign an existing connection profile to the bond:

      1. Set the controller parameter of these connections to bond0:

         # nmcli connection modify bridge0 controller bond0
         # nmcli connection modify bridge1 controller bond0

         These commands assign the existing connection profiles named bridge0 and bridge1 to the bond0 connection.

      2. Reactivate the connections:

         # nmcli connection up bridge0
         # nmcli connection up bridge1

4. Configure the IPv4 settings:

   • To use this bond device as a port of other devices, enter:

     # nmcli connection modify bond0 ipv4.method disabled

   • To use DHCP, no action is required.

   • To set a static IPv4 address, network mask, default gateway, and DNS server to the bond0 connection, enter:

     # nmcli connection modify bond0 ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '192.0.2.253' ipv4.dns-search 'example.com' ipv4.method manual

5. Configure the IPv6 settings:

   • To use this bond device as a port of other devices, enter:

     # nmcli connection modify bond0 ipv6.method disabled

   • To use stateless address autoconfiguration (SLAAC), no action is required.

   • To set a static IPv6 address, network mask, default gateway, and DNS server to the bond0 connection, enter:

     # nmcli connection modify bond0 ipv6.addresses '2001:db8:1::1/64' ipv6.gateway '2001:db8:1::fffe' ipv6.dns '2001:db8:1::fffd' ipv6.dns-search 'example.com' ipv6.method manual

6. Optional: If you want to set any parameters on the bond ports, use the following command:

   # nmcli connection modify bond0-port1 bond-port.<parameter> <value>

7. Activate the connection:

   # nmcli connection up bond0

8. Verify that the ports are connected, and the CONNECTION column displays the port’s connection name:

   # nmcli device
   DEVICE   TYPE      STATE      CONNECTION
   ...
   enp7s0   ethernet  connected  bond0-port1
   enp8s0   ethernet  connected  bond0-port2

   When you activate any port of the connection, NetworkManager also activates the bond, but not the other ports of it. You can configure that Red Hat Enterprise Linux enables all ports automatically when the bond is enabled:

   1. Enable the connection.autoconnect-ports parameter of the bond’s connection:

      # nmcli connection modify bond0 connection.autoconnect-ports 1

   2. Reactivate the bridge:

      # nmcli connection up bond0

Verification

1. Temporarily remove the network cable from one of the network devices and check if the other device in the bond handling the traffic.

   Note that there is no method to properly test link failure events using software utilities. Tools that deactivate connections, such as nmcli, show only the bonding driver’s ability to handle port configuration changes and not actual link failure events.

2. Display the status of the bond:

   # cat /proc/net/bonding/bond0

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Select the Networking tab in the navigation on the left side of the screen.
3. Click Add bond in the Interfaces section.
4. Enter the name of the bond device you want to create.
5. Select the interfaces that should be members of the bond.

6. Select the mode of the bond.

   If you select Active backup, the web console shows the additional field Primary in which you can select the preferred active device.

7. Set the link monitoring mode. For example, when you use the Adaptive load balancing mode, set it to ARP.

8. Optional: Adjust the monitoring interval, link up delay, and link down delay settings. Typically, you only change the defaults for troubleshooting purposes.

   
9. Click Apply.

10. By default, the bond uses a dynamic IP address. If you want to set a static IP address:

    1. Click the name of the bond in the Interfaces section.
    2. Click Edit next to the protocol you want to configure.
    3. Select Manual next to Addresses, and enter the IP address, prefix, and default gateway.
    4. In the DNS section, click the + button, and enter the IP address of the DNS server. Repeat this step to set multiple DNS servers.
    5. In the DNS search domains section, click the + button, and enter the search domain.

    6. If the interface requires static routes, configure them in the Routes section.

       
    7. Click Apply

Verification

1. Select the Networking tab in the navigation on the left side of the screen, and check if there is incoming and outgoing traffic on the interface:

   

2. Temporarily remove the network cable from one of the network devices and check if the other device in the bond handling the traffic.

   Note that there is no method to properly test link failure events using software utilities. Tools that deactivate connections, such as the web console, show only the bonding driver’s ability to handle member configuration changes and not actual link failure events.

3. Display the status of the bond:

   # cat /proc/net/bonding/bond0

Procedure

1. If you do not know the network device names on which you want configure a network bond, display the available devices:

   # nmcli device status
   DEVICE     TYPE      STATE                   CONNECTION
   enp7s0     ethernet  unavailable             --
   enp8s0     ethernet  unavailable             --
   ...

2. Start nmtui:

   # nmtui

3. Select Edit a connection, and press Enter.
4. Press Add.
5. Select Bond from the list of network types, and press Enter.

6. Optional: Enter a name for the NetworkManager profile to be created.

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

7. Enter the bond device name to be created into the Device field.

8. Add ports to the bond to be created:

   1. Press Add next to the Slaves list.
   2. Select the type of the interface you want to add as port to the bond, for example, Ethernet.
   3. Optional: Enter a name for the NetworkManager profile to be created for this bond port.
   4. Enter the port’s device name into the Device field.

   5. Press OK to return to the window with the bond settings.

      Figure 3.1. Adding an Ethernet device as port to a bond

      
   6. Repeat these steps to add more ports to the bond.
9. Set the bond mode. Depending on the value you set, nmtui displays additional fields for settings that are related to the selected mode.

10. Depending on your environment, configure the IP address settings in the IPv4 configuration and IPv6 configuration areas accordingly. For this, press the button next to these areas, and select:

    • Disabled, if the bond does not require an IP address.
    • Automatic, if a DHCP server or stateless address autoconfiguration (SLAAC) dynamically assigns an IP address to the bond.

    • Manual, if the network requires static IP address settings. In this case, you must fill further fields:

      1. Press Show next to the protocol you want to configure to display additional fields.

      2. Press Add next to Addresses, and enter the IP address and the subnet mask in Classless Inter-Domain Routing (CIDR) format.

         If you do not specify a subnet mask, NetworkManager sets a /32 subnet mask for IPv4 addresses and /64 for IPv6 addresses.

      3. Enter the address of the default gateway.
      4. Press Add next to DNS servers, and enter the DNS server address.
      5. Press Add next to Search domains, and enter the DNS search domain.

    Figure 3.2. Example of a bond connection with static IP address settings

    
11. Press OK to create and automatically activate the new connection.
12. Press Back to return to the main menu.
13. Select Quit, and press Enter to close the nmtui application.

Verification

1. Temporarily remove the network cable from one of the network devices and check if the other device in the bond handling the traffic.

   Note that there is no method to properly test link failure events using software utilities. Tools that deactivate connections, such as nmcli, show only the bonding driver’s ability to handle port configuration changes and not actual link failure events.

2. Display the status of the bond:

   # cat /proc/net/bonding/bond0

Procedure

1. Open a terminal, and enter nm-connection-editor:

   $ nm-connection-editor

2. Click the + button to add a new connection.
3. Select the Bond connection type, and click Create.

4. On the Bond tab:

   1. Optional: Set the name of the bond interface in the Interface name field.

   2. Click the Add button to add a network interface as a port to the bond.

      1. Select the connection type of the interface. For example, select Ethernet for a wired connection.
      2. Optional: Set a connection name for the port.
      3. If you create a connection profile for an Ethernet device, open the Ethernet tab, and select in the Device field the network interface you want to add as a port to the bond. If you selected a different device type, configure it accordingly. Note that you can only use Ethernet interfaces in a bond that are not configured.
      4. Click Save.

   3. Repeat the previous step for each interface you want to add to the bond:

      

   4. Optional: Set other options, such as the Media Independent Interface (MII) monitoring interval.

5. Configure the IP address settings on both the IPv4 Settings and IPv6 Settings tabs:

   • To use this bridge device as a port of other devices, set the Method field to Disabled.
   • To use DHCP, leave the Method field at its default, Automatic (DHCP).

   • To use static IP settings, set the Method field to Manual and fill the fields accordingly:

     

6. Click Save.
7. Close nm-connection-editor.

Verification

1. Temporarily remove the network cable from one of the network devices and check if the other device in the bond handling the traffic.

   Note that there is no method to properly test link failure events using software utilities. Tools that deactivate connections, such as nmcli, show only the bonding driver’s ability to handle port configuration changes and not actual link failure events.

2. Display the status of the bond:

   # cat /proc/net/bonding/bond0

Procedure

1. Create a YAML file, for example ~/create-bond.yml, with the following content:

   ---
   interfaces:
   - name: bond0
     type: bond
     state: up
     ipv4:
       enabled: true
       address:
       - ip: 192.0.2.1
         prefix-length: 24
       dhcp: false
     ipv6:
       enabled: true
       address:
       - ip: 2001:db8:1::1
         prefix-length: 64
       autoconf: false
       dhcp: false
     link-aggregation:
       mode: active-backup
       port:
       - enp1s0
       - enp7s0
   - name: enp1s0
     type: ethernet
     state: up
   - name: enp7s0
     type: ethernet
     state: up
   
   routes:
     config:
     - destination: 0.0.0.0/0
       next-hop-address: 192.0.2.254
       next-hop-interface: bond0
     - destination: ::/0
       next-hop-address: 2001:db8:1::fffe
       next-hop-interface: bond0
   
   dns-resolver:
     config:
       search:
       - example.com
       server:
       - 192.0.2.200
       - 2001:db8:1::ffbb

   These settings define a network bond with the following settings:

   • Network interfaces in the bond: enp1s0 and enp7s0
   • Mode: active-backup
   • Static IPv4 address: 192.0.2.1 with a /24 subnet mask
   • Static IPv6 address: 2001:db8:1::1 with a /64 subnet mask
   • IPv4 default gateway: 192.0.2.254
   • IPv6 default gateway: 2001:db8:1::fffe
   • IPv4 DNS server: 192.0.2.200
   • IPv6 DNS server: 2001:db8:1::ffbb
   • DNS search domain: example.com

2. Apply the settings to the system:

   # nmstatectl apply ~/create-bond.yml

Verification

1. Display the status of the devices and connections:

   # nmcli device status
   DEVICE      TYPE      STATE      CONNECTION
   bond0       bond      connected  bond0

2. Display all settings of the connection profile:

   # nmcli connection show bond0
   connection.id:              bond0
   connection.uuid:            79cbc3bd-302e-4b1f-ad89-f12533b818ee
   connection.stable-id:       --
   connection.type:            bond
   connection.interface-name:  bond0
   ...

3. Display the connection settings in YAML format:

   # nmstatectl show bond0

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure the network
     hosts: managed-node-01.example.com
     tasks:
       - name: Bond connection profile with two Ethernet ports
         ansible.builtin.include_role:
           name: rhel-system-roles.network
         vars:
           network_connections:
             # Bond profile
             - name: bond0
               type: bond
               interface_name: bond0
               ip:
                 dhcp4: yes
                 auto6: yes
               bond:
                 mode: active-backup
               state: up
   
             # Port profile for the 1st Ethernet device
             - name: bond0-port1
               interface_name: enp7s0
               type: ethernet
               controller: bond0
               state: up
   
             # Port profile for the 2nd Ethernet device
             - name: bond0-port2
               interface_name: enp8s0
               type: ethernet
               controller: bond0
               state: up

   The settings specified in the example playbook include the following:

   type: <profile_type>

   Sets the type of the profile to create. The example playbook creates three connection profiles: One for the bond and two for the Ethernet devices.

   dhcp4: yes

   Enables automatic IPv4 address assignment from DHCP, PPP, or similar services.

   auto6: yes

   Enables IPv6 auto-configuration. By default, NetworkManager uses Router Advertisements. If the router announces the managed flag, NetworkManager requests an IPv6 address and prefix from a DHCPv6 server.

   mode: <bond_mode>

   Sets the bonding mode. Possible values are:

   • balance-rr (default)
   • active-backup
   • balance-xor
   • broadcast
   • 802.3ad
   • balance-tlb
   • balance-alb.

   Depending on the mode you set, you need to set additional variables in the playbook.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.network/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a bond interface in active-backup mode:

   # nmcli connection add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup"

   This command names both the interface and connection profile bond0.

2. Configure the IPv4 settings of the bond:

   • If a DHCP server in your network assigns IPv4 addresses to hosts, no action is required.

   • If your local network requires static IPv4 addresses, set the address, network mask, default gateway, DNS server, and DNS search domain to the bond0 connection:

     # nmcli connection modify bond0 ipv4.addresses '192.0.2.1/24'
     # nmcli connection modify bond0 ipv4.gateway '192.0.2.254'
     # nmcli connection modify bond0 ipv4.dns '192.0.2.253'
     # nmcli connection modify bond0 ipv4.dns-search 'example.com'
     # nmcli connection modify bond0 ipv4.method manual

3. Configure the IPv6 settings of the bond:

   • If your router or a DHCP server in your network assigns IPv6 addresses to hosts, no action is required.

   • If your local network requires static IPv6 addresses, set the address, network mask, default gateway, DNS server, and DNS search domain to the bond0 connection:

     # nmcli connection modify bond0 ipv6.addresses '2001:db8:1::1/64'
     # nmcli connection modify bond0 ipv6.gateway '2001:db8:1::fffe'
     # nmcli connection modify bond0 ipv6.dns '2001:db8:1::fffd'
     # nmcli connection modify bond0 ipv6.dns-search 'example.com'
     # nmcli connection modify bond0 ipv6.method manual

4. Display the connection profiles:

   # nmcli connection show
   NAME             UUID                                  TYPE      DEVICE
   Docking_station  256dd073-fecc-339d-91ae-9834a00407f9  ethernet  enp11s0u1
   Wi-Fi            1f1531c7-8737-4c60-91af-2d21164417e8  wifi      wlp1s0
   ...

   You require the names of the connection profiles and the Ethernet device name in the next steps.

5. Assign the connection profile of the Ethernet connection to the bond:

   # nmcli connection modify Docking_station controller bond0

6. Assign the connection profile of the Wi-Fi connection to the bond:

   # nmcli connection modify Wi-Fi controller bond0

7. If your Wi-Fi network uses MAC filtering to allow only MAC addresses on a allow list to access the network, configure that NetworkManager dynamically assigns the MAC address of the active port to the bond:

   # nmcli connection modify bond0 +bond.options fail_over_mac=1

   With this setting, you must set only the MAC address of the Wi-Fi device to the allow list instead of the MAC address of both the Ethernet and Wi-Fi device.

8. Set the device associated with the Ethernet connection as primary device of the bond:

   # nmcli con modify bond0 +bond.options "primary=enp11s0u1"

   With this setting, the bond always uses the Ethernet connection if it is available.

9. Configure that NetworkManager automatically activates ports when the bond0 device is activated:

   # nmcli connection modify bond0 connection.autoconnect-ports 1

10. Activate the bond0 connection:

    # nmcli connection up bond0

Procedure

1. Optional: Display the IP configuration of the team-team0 NetworkManager connection:

   # nmcli connection show team-team0 | egrep "^ip"
   ...
   ipv4.method:                            manual
   ipv4.dns:                               192.0.2.253
   ipv4.dns-search:                        example.com
   ipv4.addresses:                         192.0.2.1/24
   ipv4.gateway:                           192.0.2.254
   ...
   ipv6.method:                            manual
   ipv6.dns:                               2001:db8:1::fffd
   ipv6.dns-search:                        example.com
   ipv6.addresses:                         2001:db8:1::1/64
   ipv6.gateway:                           2001:db8:1::fffe
   ...

2. Export the configuration of the team0 device to a JSON file:

   # teamdctl team0 config dump actual > /tmp/team0.json

3. Remove the NIC team. For example, if you configured the team in NetworkManager, remove the team-team0 connection profile and the profiles of associated ports:

   # nmcli connection delete team-team0
   # nmcli connection delete team-team0-port1
   # nmcli connection delete team-team0-port2

4. Run the team2bond utility in dry-run mode to display nmcli commands that set up a network bond with similar settings as the team device:

   # team2bond --config=/tmp/team0.json --rename=bond0
   nmcli con add type bond ifname bond0 bond.options "mode=active-backup,num_grat_arp=1,num_unsol_na=1,resend_igmp=1,miimon=100,miimon=100"
   nmcli con add type ethernet ifname enp7s0 controller bond0
   nmcli con add type ethernet ifname enp8s0 controller bond0

   The first command contains two miimon options because the team configuration file contained two link_watch entries. Note that this does not affect the creation of the bond.

   If you bound services to the device name of the team and want to avoid updating or breaking these services, omit the --rename=bond0 option. In this case, team2bond uses the same interface name for the bond as for the team.

5. Verify that the options for the bond the team2bond utility suggested are correct.

6. Create the bond. You can execute the suggested nmcli commands or re-run the team2bond command with the --exec-cmd option:

   # team2bond --config=/tmp/team0.json --rename=bond0 --exec-cmd
   Connection 'bond-bond0' (0241a531-0c72-4202-80df-73eadfc126b5) successfully added.
   Connection 'bond-port-enp7s0' (38489729-b624-4606-a784-1ccf01e2f6d6) successfully added.
   Connection 'bond-port-enp8s0' (de97ec06-7daa-4298-9a71-9d4c7909daa1) successfully added.

   You require the name of the bond connection profile (bond-bond0) in the next steps.

7. Set the IPv4 settings that were previously configured on team-team0 to the bond-bond0 connection:

   # nmcli connection modify bond-bond0 ipv4.addresses '192.0.2.1/24'
   # nmcli connection modify bond-bond0 ipv4.gateway '192.0.2.254'
   # nmcli connection modify bond-bond0 ipv4.dns '192.0.2.253'
   # nmcli connection modify bond-bond0 ipv4.dns-search 'example.com'
   # nmcli connection modify bond-bond0 ipv4.method manual

8. Set the IPv6 settings that were previously configured on team-team0 to the bond-bond0 connection:

   # nmcli connection modify bond-bond0 ipv6.addresses '2001:db8:1::1/64'
   # nmcli connection modify bond-bond0 ipv6.gateway '2001:db8:1::fffe'
   # nmcli connection modify bond-bond0 ipv6.dns '2001:db8:1::fffd'
   # nmcli connection modify bond-bond0 ipv6.dns-search 'example.com'
   # nmcli connection modify bond-bond0 ipv6.method manual

9. Activate the connection:

   # nmcli connection up bond-bond0

Verification

1. Display the IP configuration of the bond-bond0 NetworkManager connection:

   # nmcli connection show bond-bond0 | egrep "^ip"
   ...
   ipv4.method:                            manual
   ipv4.dns:                               192.0.2.253
   ipv4.dns-search:                        example.com
   ipv4.addresses:                         192.0.2.1/24
   ipv4.gateway:                           192.0.2.254
   ...
   ipv6.method:                            manual
   ipv6.dns:                               2001:db8:1::fffd
   ipv6.dns-search:                        example.com
   ipv6.addresses:                         2001:db8:1::1/64
   ipv6.gateway:                           2001:db8:1::fffe
   ...

2. Display the status of the bond:

   # cat /proc/net/bonding/bond0
   Ethernet Channel Bonding Driver: v5.13.0-0.rc7.51.el9.x86_64
   
   Bonding Mode: fault-tolerance (active-backup)
   Primary Slave: None
   Currently Active Slave: enp7s0
   MII Status: up
   MII Polling Interval (ms): 100
   Up Delay (ms): 0
   Down Delay (ms): 0
   Peer Notification Delay (ms): 0
   
   Slave Interface: enp7s0
   MII Status: up
   Speed: Unknown
   Duplex: Unknown
   Link Failure Count: 0
   Permanent HW addr: 52:54:00:bf:b1:a9
   Slave queue ID: 0
   
   Slave Interface: enp8s0
   MII Status: up
   Speed: Unknown
   Duplex: Unknown
   Link Failure Count: 0
   Permanent HW addr: 52:54:00:04:36:0f
   Slave queue ID: 0

   In this example, both ports are up.

3. To verify that bonding failover works:

   1. Temporarily remove the network cable from the host. Note that there is no method to properly test link failure events using the command line.

   2. Display the status of the bond:

      # cat /proc/net/bonding/bond0

Procedure

1. Create a team interface:

   # nmcli connection add type team con-name team0 ifname team0 team.runner activebackup

   This command creates a NIC team named team0 that uses the activebackup runner.

2. Optional: Set a link watcher. For example, to set the ethtool link watcher in the team0 connection profile:

   # nmcli connection modify team0 team.link-watchers "name=ethtool"

   Link watchers support different parameters. To set parameters for a link watcher, specify them space-separated in the name property. Note that the name property must be surrounded by quotation marks. For example, to use the ethtool link watcher and set its delay-up parameter to 2500 milliseconds (2.5 seconds):

   # nmcli connection modify team0 team.link-watchers "name=ethtool delay-up=2500"

   To set multiple link watchers and each of them with specific parameters, the link watchers must be separated by a comma. The following example sets the ethtool link watcher with the delay-up parameter and the arp_ping link watcher with the source-host and target-host parameter:

   # nmcli connection modify team0 team.link-watchers "name=ethtool delay-up=2, name=arp_ping source-host=192.0.2.1 target-host=192.0.2.2"

3. Display the network interfaces, and note the names of the interfaces you want to add to the team:

   # nmcli device status
   DEVICE  TYPE      STATE         CONNECTION
   enp7s0  ethernet  disconnected  --
   enp8s0  ethernet  disconnected  --
   bond0   bond      connected  bond0
   bond1   bond      connected  bond1
   ...

   In this example:

   • enp7s0 and enp8s0 are not configured. To use these devices as ports, add connection profiles in the next step. Note that you can only use Ethernet interfaces in a team that are not assigned to any connection.
   • bond0 and bond1 have existing connection profiles. To use these devices as ports, modify their profiles in the next step.

4. Assign the port interfaces to the team:

   1. If the interfaces you want to assign to the team are not configured, create new connection profiles for them:

      # nmcli connection add type ethernet port-type team con-name team0-port1 ifname enp7s0 controller team0
      # nmcli connection add type ethernet port--type team con-name team0-port2 ifname enp8s0 controller team0

      These commands create profiles for enp7s0 and enp8s0, and add them to the team0 connection.

   2. To assign an existing connection profile to the team:

      1. Set the controller parameter of these connections to team0:

         # nmcli connection modify bond0 controller team0
         # nmcli connection modify bond1 controller team0

         These commands assign the existing connection profiles named bond0 and bond1 to the team0 connection.

      2. Reactivate the connections:

         # nmcli connection up bond0
         # nmcli connection up bond1

5. Configure the IPv4 settings:

   • To use this team device as a port of other devices, enter:

     # nmcli connection modify team0 ipv4.method disabled

   • To use DHCP, no action is required.

   • To set a static IPv4 address, network mask, default gateway, and DNS server to the team0 connection, enter:

     # nmcli connection modify team0 ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '192.0.2.253' ipv4.dns-search 'example.com' ipv4.method manual

6. Configure the IPv6 settings:

   • To use this team device as a port of other devices, enter:

     # nmcli connection modify team0 ipv6.method disabled

   • To use stateless address autoconfiguration (SLAAC), no action is required.

   • To set a static IPv6 address, network mask, default gateway, and DNS server to the team0 connection, enter:

     # nmcli connection modify team0 ipv6.addresses '2001:db8:1::1/64' ipv6.gateway '2001:db8:1::fffe' ipv6.dns '2001:db8:1::fffd' ipv6.dns-search 'example.com' ipv6.method manual

7. Activate the connection:

   # nmcli connection up team0

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Select the Networking tab in the navigation on the left side of the screen.
3. Click Add team in the Interfaces section.
4. Enter the name of the team device you want to create.
5. Select the interfaces that should be ports of the team.

6. Select the runner of the team.

   If you select Load balancing or 802.3ad LACP, the web console shows the additional field Balancer.

7. Set the link watcher:

   • If you select Ethtool, additionally, set a link up and link down delay.
   • If you set ARP ping or NSNA ping, additionally, set a ping interval and ping target.
   
8. Click Apply.

9. By default, the team uses a dynamic IP address. If you want to set a static IP address:

   1. Click the name of the team in the Interfaces section.
   2. Click Edit next to the protocol you want to configure.
   3. Select Manual next to Addresses, and enter the IP address, prefix, and default gateway.
   4. In the DNS section, click the + button, and enter the IP address of the DNS server. Repeat this step to set multiple DNS servers.
   5. In the DNS search domains section, click the + button, and enter the search domain.

   6. If the interface requires static routes, configure them in the Routes section.

      
   7. Click Apply

Verification

1. Select the Networking tab in the navigation on the left side of the screen, and check if there is incoming and outgoing traffic on the interface.

   

2. Display the status of the team:

   # teamdctl team0 state
   setup:
     runner: activebackup
   ports:
     enp7s0
       link watches:
         link summary: up
         instance[link_watch_0]:
           name: ethtool
           link: up
           down count: 0
     enp8s0
       link watches:
         link summary: up
         instance[link_watch_0]:
           name: ethtool
           link: up
           down count: 0
   runner:
     active port: enp7s0

   In this example, both ports are up.

Procedure

1. Open a terminal, and enter nm-connection-editor:

   $ nm-connection-editor

2. Click the + button to add a new connection.
3. Select the Team connection type, and click Create.

4. On the Team tab:

   1. Optional: Set the name of the team interface in the Interface name field.

   2. Click the Add button to add a new connection profile for a network interface and adding the profile as a port to the team.

      1. Select the connection type of the interface. For example, select Ethernet for a wired connection.
      2. Optional: Set a connection name for the port.
      3. If you create a connection profile for an Ethernet device, open the Ethernet tab, and select in the Device field the network interface you want to add as a port to the team. If you selected a different device type, configure it accordingly. Note that you can only use Ethernet interfaces in a team that are not assigned to any connection.
      4. Click Save.

   3. Repeat the previous step for each interface you want to add to the team.

      

   4. Click the Advanced button to set advanced options to the team connection.

      1. On the Runner tab, select the runner.
      2. On the Link Watcher tab, set the link watcher and its optional settings.
      3. Click OK.

5. Configure the IP address settings on both the IPv4 Settings and IPv6 Settings tabs:

   • To use this bridge device as a port of other devices, set the Method field to Disabled.
   • To use DHCP, leave the Method field at its default, Automatic (DHCP).

   • To use static IP settings, set the Method field to Manual and fill the fields accordingly:

     

6. Click Save.
7. Close nm-connection-editor.

Procedure

1. Display the network interfaces:

   # nmcli device status
   DEVICE   TYPE      STATE         CONNECTION
   enp1s0   ethernet  disconnected  enp1s0
   bridge0  bridge    connected     bridge0
   bond0    bond      connected     bond0
   ...

2. Create the VLAN interface. For example, to create a VLAN interface named vlan10 that uses enp1s0 as its parent interface and that tags packets with VLAN ID 10, enter:

   # nmcli connection add type vlan con-name vlan10 ifname vlan10 vlan.parent enp1s0 vlan.id 10

   Note that the VLAN must be within the range from 0 to 4094.

3. By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. Optionally, set a different MTU value:

   # nmcli connection modify vlan10 ethernet.mtu 2000

4. Configure the IPv4 settings:

   • To use this VLAN device as a port of other devices, enter:

     # nmcli connection modify vlan10 ipv4.method disabled

   • To use DHCP, no action is required.

   • To set a static IPv4 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

     # nmcli connection modify vlan10 ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '192.0.2.253' ipv4.method manual

5. Configure the IPv6 settings:

   • To use this VLAN device as a port of other devices, enter:

     # nmcli connection modify vlan10 ipv6.method disabled

   • To use stateless address autoconfiguration (SLAAC), no action is required.

   • To set a static IPv6 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

     # nmcli connection modify vlan10 ipv6.addresses '2001:db8:1::1/32' ipv6.gateway '2001:db8:1::fffe' ipv6.dns '2001:db8:1::fffd' ipv6.method manual

6. Activate the connection:

   # nmcli connection up vlan10

Procedure

1. Display the physical network devices:

   # nmcli device status
   DEVICE   TYPE      STATE         CONNECTION
   enp1s0  ethernet  connected      enp1s0
   ...

2. Create the base VLAN interface. For example, to create a base VLAN interface named vlan10 that uses enp1s0 as its parent interface and that tags packets with VLAN ID 10, enter:

   # nmcli connection add type vlan con-name vlan10 dev enp1s0 vlan.id 10

   Note that the VLAN must be within the range from 0 to 4094.

3. By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. Optionally, set a different MTU value:

   # nmcli connection modify vlan10 ethernet.mtu 2000

4. Create the nested VLAN interface on top of the base VLAN interface:

   # nmcli connection add type vlan con-name vlan10.20 dev enp1s0.10 id 20 vlan.protocol 802.1ad

   This command creates a new VLAN connection with a name of vlan10.20 and a VLAN ID of 20 on the parent VLAN connection vlan10. The dev option specifies the parent network device. In this case it is enp1s0.10. The vlan.protocol option specifies the VLAN encapsulation protocol. In this case it is 802.1ad (Q-in-Q).

5. Configure the IPv4 settings of the nested VLAN interface:

   • To use DHCP, no action is required.

   • To set a static IPv4 address, network mask, default gateway, and DNS server to the vlan10.20 connection, enter:

     # nmcli connection modify vlan10.20 ipv4.method manual ipv4.addresses 192.0.2.1/24 ipv4.gateway 192.0.2.254 ipv4.dns 192.0.2.200

6. Configure the IPv6 settings of the nested VLAN interface:

   • To use stateless address autoconfiguration (SLAAC), no action is required.

   • To set a static IPv4 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

     # nmcli connection modify vlan10 ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '192.0.2.253' ipv4.method manual

7. Activate the profile:

   # nmcli connection up vlan10.20

Verification

1. Verify the configuration of the nested VLAN interface:

   # ip -d addr show enp1s0.10.20
   10: enp1s0.10.20@enp1s0.10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
       link/ether 52:54:00:d2:74:3e brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 0 maxmtu 65535
       vlan protocol 802.1ad id 20 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 tso_max_size 65536 tso_max_segs 65535 gro_max_size 65536
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0.10.20
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::1/32 scope global noprefixroute
          valid_lft forever preferred_lft forever
       inet6 fe80::ce3b:84c5:9ef8:d0e6/64 scope link noprefixroute
          valid_lft forever preferred_lft forever

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Select the Networking tab in the navigation on the left side of the screen.
3. Click Add VLAN in the Interfaces section.
4. Select the parent device.
5. Enter the VLAN ID.

6. Enter the name of the VLAN device or keep the automatically-generated name.

   
7. Click Apply.

8. By default, the VLAN device uses a dynamic IP address. If you want to set a static IP address:

   1. Click the name of the VLAN device in the Interfaces section.
   2. Click Edit next to the protocol you want to configure.
   3. Select Manual next to Addresses, and enter the IP address, prefix, and default gateway.
   4. In the DNS section, click the + button, and enter the IP address of the DNS server. Repeat this step to set multiple DNS servers.
   5. In the DNS search domains section, click the + button, and enter the search domain.

   6. If the interface requires static routes, configure them in the Routes section.

      
   7. Click Apply

Procedure

1. If you do not know the network device name on which you want configure VLAN tagging, display the available devices:

   # nmcli device status
   DEVICE     TYPE      STATE                   CONNECTION
   enp1s0     ethernet  unavailable             --
   ...

2. Start nmtui:

   # nmtui

3. Select Edit a connection, and press Enter.
4. Press Add.
5. Select VLAN from the list of network types, and press Enter.

6. Optional: Enter a name for the NetworkManager profile to be created.

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

7. Enter the VLAN device name to be created into the Device field.
8. Enter the name of the device on which you want to configure VLAN tagging into the Parent field.
9. Enter the VLAN ID. The ID must be within the range from 0 to 4094.

10. Depending on your environment, configure the IP address settings in the IPv4 configuration and IPv6 configuration areas accordingly. For this, press the button next to these areas, and select:

    • Disabled, if this VLAN device does not require an IP address or you want to use it as a port of other devices.
    • Automatic, if a DHCP server or stateless address autoconfiguration (SLAAC) dynamically assigns an IP address to the VLAN device.

    • Manual, if the network requires static IP address settings. In this case, you must fill further fields:

      1. Press Show next to the protocol you want to configure to display additional fields.

      2. Press Add next to Addresses, and enter the IP address and the subnet mask in Classless Inter-Domain Routing (CIDR) format.

         If you do not specify a subnet mask, NetworkManager sets a /32 subnet mask for IPv4 addresses and /64 for IPv6 addresses.

      3. Enter the address of the default gateway.
      4. Press Add next to DNS servers, and enter the DNS server address.
      5. Press Add next to Search domains, and enter the DNS search domain.

    Figure 5.1. Example of a VLAN connection with static IP address settings

    
11. Press OK to create and automatically activate the new connection.
12. Press Back to return to the main menu.
13. Select Quit, and press Enter to close the nmtui application.

Procedure

1. Open a terminal, and enter nm-connection-editor:

   $ nm-connection-editor

2. Click the + button to add a new connection.
3. Select the VLAN connection type, and click Create.

4. On the VLAN tab:

   1. Select the parent interface.
   2. Select the VLAN id. Note that the VLAN must be within the range from 0 to 4094.
   3. By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. Optionally, set a different MTU value.

   4. Optional: Set the name of the VLAN interface and further VLAN-specific options.

      

5. Configure the IP address settings on both the IPv4 Settings and IPv6 Settings tabs:

   • To use this bridge device as a port of other devices, set the Method field to Disabled.
   • To use DHCP, leave the Method field at its default, Automatic (DHCP).

   • To use static IP settings, set the Method field to Manual and fill the fields accordingly:

     

6. Click Save.
7. Close nm-connection-editor.

Verification

1. Verify the settings:

   # ip -d addr show vlan10
   4: vlan10@enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
       link/ether 52:54:00:d5:e0:fb brd ff:ff:ff:ff:ff:ff promiscuity 0
       vlan protocol 802.1Q id 10 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute vlan10
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::1/32 scope global noprefixroute
          valid_lft forever preferred_lft forever
       inet6 fe80::8dd7:9030:6f8e:89e6/64 scope link noprefixroute
          valid_lft forever preferred_lft forever

Procedure

1. Create a YAML file, for example ~/create-vlan.yml, with the following content:

   ---
   interfaces:
   - name: vlan10
     type: vlan
     state: up
     ipv4:
       enabled: true
       address:
       - ip: 192.0.2.1
         prefix-length: 24
       dhcp: false
     ipv6:
       enabled: true
       address:
       - ip: 2001:db8:1::1
         prefix-length: 64
       autoconf: false
       dhcp: false
     vlan:
       base-iface: enp1s0
       id: 10
   - name: enp1s0
     type: ethernet
     state: up
   
   routes:
     config:
     - destination: 0.0.0.0/0
       next-hop-address: 192.0.2.254
       next-hop-interface: vlan10
     - destination: ::/0
       next-hop-address: 2001:db8:1::fffe
       next-hop-interface: vlan10
   
   dns-resolver:
     config:
       search:
       - example.com
       server:
       - 192.0.2.200
       - 2001:db8:1::ffbb

   These settings define a VLAN with ID 10 that uses the enp1s0 device. As the child device, the VLAN connection has the following settings:

   • A static IPv4 address - 192.0.2.1 with the /24 subnet mask
   • A static IPv6 address - 2001:db8:1::1 with the /64 subnet mask
   • An IPv4 default gateway - 192.0.2.254
   • An IPv6 default gateway - 2001:db8:1::fffe
   • An IPv4 DNS server - 192.0.2.200
   • An IPv6 DNS server - 2001:db8:1::ffbb
   • A DNS search domain - example.com

2. Apply the settings to the system:

   # nmstatectl apply ~/create-vlan.yml

Verification

1. Display the status of the devices and connections:

   # nmcli device status
   DEVICE      TYPE      STATE      CONNECTION
   vlan10      vlan      connected  vlan10

2. Display all settings of the connection profile:

   # nmcli connection show vlan10
   connection.id:              vlan10
   connection.uuid:            1722970f-788e-4f81-bd7d-a86bf21c9df5
   connection.stable-id:       --
   connection.type:            vlan
   connection.interface-name:  vlan10
   ...

3. Display the connection settings in YAML format:

   # nmstatectl show vlan0

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure the network
     hosts: managed-node-01.example.com
     tasks:
       - name: VLAN connection profile with Ethernet port
         ansible.builtin.include_role:
           name: rhel-system-roles.network
         vars:
           network_connections:
             # Ethernet profile
             - name: enp1s0
               type: ethernet
               interface_name: enp1s0
               autoconnect: yes
               state: up
               ip:
                 dhcp4: no
                 auto6: no
   
             # VLAN profile
             - name: enp1s0.10
               type: vlan
               vlan:
                 id: 10
               ip:
                 dhcp4: yes
                 auto6: yes
               parent: enp1s0
               state: up

   e settings specified in the example playbook include the following:

   type: <profile_type>

   Sets the type of the profile to create. The example playbook creates two connection profiles: One for the parent Ethernet device and one for the VLAN device.

   dhcp4: <value>

   If set to yes, automatic IPv4 address assignment from DHCP, PPP, or similar services is enabled. Disable the IP address configuration on the parent device.

   auto6: <value>

   If set to yes, IPv6 auto-configuration is enabled. In this case, by default, NetworkManager uses Router Advertisements and, if the router announces the managed flag, NetworkManager requests an IPv6 address and prefix from a DHCPv6 server. Disable the IP address configuration on the parent device.

   parent: <parent_device>

   Sets the parent device of the VLAN connection profile. In the example, the parent is the Ethernet interface.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.network/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a bridge interface:

   # nmcli connection add type bridge con-name bridge0 ifname bridge0

   This command creates a bridge named bridge0, enter:

2. Display the network interfaces, and note the names of the interfaces you want to add to the bridge:

   # nmcli device status
   DEVICE  TYPE      STATE         CONNECTION
   enp7s0  ethernet  disconnected  --
   enp8s0  ethernet  disconnected  --
   bond0   bond      connected     bond0
   bond1   bond      connected     bond1
   ...

   In this example:

   • enp7s0 and enp8s0 are not configured. To use these devices as ports, add connection profiles in the next step.
   • bond0 and bond1 have existing connection profiles. To use these devices as ports, modify their profiles in the next step.

3. Assign the interfaces to the bridge.

   1. If the interfaces you want to assign to the bridge are not configured, create new connection profiles for them:

      # nmcli connection add type ethernet port-type bridge con-name bridge0-port1 ifname enp7s0 controller bridge0
      # nmcli connection add type ethernet port-type bridge con-name bridge0-port2 ifname enp8s0 controller bridge0

      These commands create profiles for enp7s0 and enp8s0, and add them to the bridge0 connection.

   2. If you want to assign an existing connection profile to the bridge:

      1. Set the controller parameter of these connections to bridge0:

         # nmcli connection modify bond0 controller bridge0
         # nmcli connection modify bond1 controller bridge0

         These commands assign the existing connection profiles named bond0 and bond1 to the bridge0 connection.

      2. Reactivate the connections:

         # nmcli connection up bond0
         # nmcli connection up bond1

4. Configure the IPv4 settings:

   • To use this bridge device as a port of other devices, enter:

     # nmcli connection modify bridge0 ipv4.method disabled

   • To use DHCP, no action is required.

   • To set a static IPv4 address, network mask, default gateway, and DNS server to the bridge0 connection, enter:

     # nmcli connection modify bridge0 ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '192.0.2.253' ipv4.dns-search 'example.com' ipv4.method manual

5. Configure the IPv6 settings:

   • To use this bridge device as a port of other devices, enter:

     # nmcli connection modify bridge0 ipv6.method disabled

   • To use stateless address autoconfiguration (SLAAC), no action is required.

   • To set a static IPv6 address, network mask, default gateway, and DNS server to the bridge0 connection, enter:

     # nmcli connection modify bridge0 ipv6.addresses '2001:db8:1::1/64' ipv6.gateway '2001:db8:1::fffe' ipv6.dns '2001:db8:1::fffd' ipv6.dns-search 'example.com' ipv6.method manual

6. Optional: Configure further properties of the bridge. For example, to set the Spanning Tree Protocol (STP) priority of bridge0 to 16384, enter:

   # nmcli connection modify bridge0 bridge.priority '16384'

   By default, STP is enabled.

7. Activate the connection:

   # nmcli connection up bridge0

8. Verify that the ports are connected, and the CONNECTION column displays the port’s connection name:

   # nmcli device
   DEVICE   TYPE      STATE      CONNECTION
   ...
   enp7s0   ethernet  connected  bridge0-port1
   enp8s0   ethernet  connected  bridge0-port2

   When you activate any port of the connection, NetworkManager also activates the bridge, but not the other ports of it. You can configure that Red Hat Enterprise Linux enables all ports automatically when the bridge is enabled:

   1. Enable the connection.autoconnect-ports parameter of the bridge connection:

      # nmcli connection modify bridge0 connection.autoconnect-ports 1

   2. Reactivate the bridge:

      # nmcli connection up bridge0

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Select the Networking tab in the navigation on the left side of the screen.
3. Click Add bridge in the Interfaces section.
4. Enter the name of the bridge device you want to create.
5. Select the interfaces that should be ports of the bridge.

6. Optional: Enable the Spanning tree protocol (STP) feature to avoid bridge loops and broadcast radiation.

   
7. Click Apply.

8. By default, the bridge uses a dynamic IP address. If you want to set a static IP address:

   1. Click the name of the bridge in the Interfaces section.
   2. Click Edit next to the protocol you want to configure.
   3. Select Manual next to Addresses, and enter the IP address, prefix, and default gateway.
   4. In the DNS section, click the + button, and enter the IP address of the DNS server. Repeat this step to set multiple DNS servers.
   5. In the DNS search domains section, click the + button, and enter the search domain.

   6. If the interface requires static routes, configure them in the Routes section.

      
   7. Click Apply

Verification

1. Select the Networking tab in the navigation on the left side of the screen, and check if there is incoming and outgoing traffic on the interface:

   

Procedure

1. If you do not know the network device names on which you want configure a network bridge, display the available devices:

   # nmcli device status
   DEVICE     TYPE      STATE                   CONNECTION
   enp7s0     ethernet  unavailable             --
   enp8s0     ethernet  unavailable             --
   ...

2. Start nmtui:

   # nmtui

3. Select Edit a connection, and press Enter.
4. Press Add.
5. Select Bridge from the list of network types, and press Enter.

6. Optional: Enter a name for the NetworkManager profile to be created.

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

7. Enter the bridge device name to be created into the Device field.

8. Add ports to the bridge to be created:

   1. Press Add next to the Slaves list.
   2. Select the type of the interface you want to add as port to the bridge, for example, Ethernet.
   3. Optional: Enter a name for the NetworkManager profile to be created for this bridge port.
   4. Enter the port’s device name into the Device field.

   5. Press OK to return to the window with the bridge settings.

      Figure 6.1. Adding an Ethernet device as port to a bridge

      
   6. Repeat these steps to add more ports to the bridge.

9. Depending on your environment, configure the IP address settings in the IPv4 configuration and IPv6 configuration areas accordingly. For this, press the button next to these areas, and select:

   • Disabled, if the bridge does not require an IP address.
   • Automatic, if a DHCP server or stateless address autoconfiguration (SLAAC) dynamically assigns an IP address to the bridge.

   • Manual, if the network requires static IP address settings. In this case, you must fill further fields:

     1. Press Show next to the protocol you want to configure to display additional fields.

     2. Press Add next to Addresses, and enter the IP address and the subnet mask in Classless Inter-Domain Routing (CIDR) format.

        If you do not specify a subnet mask, NetworkManager sets a /32 subnet mask for IPv4 addresses and /64 for IPv6 addresses.

     3. Enter the address of the default gateway.
     4. Press Add next to DNS servers, and enter the DNS server address.
     5. Press Add next to Search domains, and enter the DNS search domain.

   Figure 6.2. Example of a bridge connection without IP address settings

   
10. Press OK to create and automatically activate the new connection.
11. Press Back to return to the main menu.
12. Select Quit, and press Enter to close the nmtui application.

Verification

1. Use the ip utility to display the link status of Ethernet devices that are ports of a specific bridge:

   # ip link show master bridge0
   3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000
       link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff
   4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000
       link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ff

2. Use the bridge utility to display the status of Ethernet devices that are ports of any bridge device:

   # bridge link show
   3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100
   4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100
   ...

   To display the status for a specific Ethernet device, use the bridge link show dev <ethernet_device_name> command.

Procedure

1. Open a terminal, and enter nm-connection-editor:

   $ nm-connection-editor

2. Click the + button to add a new connection.
3. Select the Bridge connection type, and click Create.

4. On the Bridge tab:

   1. Optional: Set the name of the bridge interface in the Interface name field.

   2. Click the Add button to create a new connection profile for a network interface and adding the profile as a port to the bridge.

      1. Select the connection type of the interface. For example, select Ethernet for a wired connection.
      2. Optional: Set a connection name for the port device.
      3. If you create a connection profile for an Ethernet device, open the Ethernet tab, and select in the Device field the network interface you want to add as a port to the bridge. If you selected a different device type, configure it accordingly.
      4. Click Save.

   3. Repeat the previous step for each interface you want to add to the bridge.

      

5. Optional: Configure further bridge settings, such as Spanning Tree Protocol (STP) options.

6. Configure the IP address settings on both the IPv4 Settings and IPv6 Settings tabs:

   • To use this bridge device as a port of other devices, set the Method field to Disabled.
   • To use DHCP, leave the Method field at its default, Automatic (DHCP).

   • To use static IP settings, set the Method field to Manual and fill the fields accordingly:

     

7. Click Save.
8. Close nm-connection-editor.

Procedure

1. Create a YAML file, for example ~/create-bridge.yml, with the following content:

   ---
   interfaces:
   - name: bridge0
     type: linux-bridge
     state: up
     ipv4:
       enabled: true
       address:
       - ip: 192.0.2.1
         prefix-length: 24
       dhcp: false
     ipv6:
       enabled: true
       address:
       - ip: 2001:db8:1::1
         prefix-length: 64
       autoconf: false
       dhcp: false
     bridge:
       options:
         stp:
           enabled: true
       port:
         - name: enp1s0
         - name: enp7s0
   - name: enp1s0
     type: ethernet
     state: up
   - name: enp7s0
     type: ethernet
     state: up
   
   routes:
     config:
     - destination: 0.0.0.0/0
       next-hop-address: 192.0.2.254
       next-hop-interface: bridge0
     - destination: ::/0
       next-hop-address: 2001:db8:1::fffe
       next-hop-interface: bridge0
   dns-resolver:
     config:
       search:
       - example.com
       server:
       - 192.0.2.200
       - 2001:db8:1::ffbb

   These settings define a network bridge with the following settings:

   • Network interfaces in the bridge: enp1s0 and enp7s0
   • Spanning Tree Protocol (STP): Enabled
   • Static IPv4 address: 192.0.2.1 with the /24 subnet mask
   • Static IPv6 address: 2001:db8:1::1 with the /64 subnet mask
   • IPv4 default gateway: 192.0.2.254
   • IPv6 default gateway: 2001:db8:1::fffe
   • IPv4 DNS server: 192.0.2.200
   • IPv6 DNS server: 2001:db8:1::ffbb
   • DNS search domain: example.com

2. Apply the settings to the system:

   # nmstatectl apply ~/create-bridge.yml

Verification

1. Display the status of the devices and connections:

   # nmcli device status
   DEVICE      TYPE      STATE      CONNECTION
   bridge0     bridge    connected  bridge0

2. Display all settings of the connection profile:

   # nmcli connection show bridge0
   connection.id:              bridge0_
   connection.uuid:            e2cc9206-75a2-4622-89cf-1252926060a9
   connection.stable-id:       --
   connection.type:            bridge
   connection.interface-name:  bridge0
   ...

3. Display the connection settings in YAML format:

   # nmstatectl show bridge0

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure the network
     hosts: managed-node-01.example.com
     tasks:
       - name: Bridge connection profile with two Ethernet ports
         ansible.builtin.include_role:
           name: rhel-system-roles.network
         vars:
           network_connections:
             # Bridge profile
             - name: bridge0
               type: bridge
               interface_name: bridge0
               ip:
                 dhcp4: yes
                 auto6: yes
               state: up
   
             # Port profile for the 1st Ethernet device
             - name: bridge0-port1
               interface_name: enp7s0
               type: ethernet
               controller: bridge0
               port_type: bridge
               state: up
   
             # Port profile for the 2nd Ethernet device
             - name: bridge0-port2
               interface_name: enp8s0
               type: ethernet
               controller: bridge0
               port_type: bridge
               state: up

   The settings specified in the example playbook include the following:

   type: <profile_type>

   Sets the type of the profile to create. The example playbook creates three connection profiles: One for the bridge and two for the Ethernet devices.

   dhcp4: yes

   Enables automatic IPv4 address assignment from DHCP, PPP, or similar services.

   auto6: yes

   Enables IPv6 auto-configuration. By default, NetworkManager uses Router Advertisements. If the router announces the managed flag, NetworkManager requests an IPv6 address and prefix from a DHCPv6 server.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.network/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Display the link status of Ethernet devices that are ports of a specific bridge:

   # ansible managed-node-01.example.com -m command -a 'ip link show master bridge0'
   managed-node-01.example.com | CHANGED | rc=0 >>
   3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000
       link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff
   4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge0 state UP mode DEFAULT group default qlen 1000
       link/ether 52:54:00:9e:f1:ce brd ff:ff:ff:ff:ff:ff

2. Display the status of Ethernet devices that are ports of any bridge device:

   # ansible managed-node-01.example.com -m command -a 'bridge link show'
   managed-node-01.example.com | CHANGED | rc=0 >>
   3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100
   4: enp8s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state listening priority 32 cost 100

Procedure

1. Install the libreswan packages:

   # dnf install libreswan

2. If you are re-installing Libreswan, remove its old database files and create a new database:

   # systemctl stop ipsec
   # rm /var/lib/ipsec/nss/*db
   # ipsec initnss

3. Start the ipsec service, and enable the service to be started automatically on boot:

   # systemctl enable ipsec --now

4. Configure the firewall to allow 500 and 4500/UDP ports for the IKE, ESP, and AH protocols by adding the ipsec service:

   # firewall-cmd --add-service="ipsec"
   # firewall-cmd --runtime-to-permanent

Procedure

1. Generate a raw RSA key pair on each host:

   # ipsec newhostkey

2. The previous step returned the generated key’s ckaid. Use that ckaid with the following command on left, for example:

   # ipsec showhostkey --left --ckaid 2d3ea57b61c9419dfd6cf43a1eb6cb306c0e857d

   The output of the previous command generated the leftrsasigkey= line required for the configuration. Do the same on the second host (right):

   # ipsec showhostkey --right --ckaid a9e1f6ce9ecd3608c24e8f701318383f41798f03

3. In the /etc/ipsec.d/ directory, create a new my_host-to-host.conf file. Write the RSA host keys from the output of the ipsec showhostkey commands in the previous step to the new file. For example:

   conn mytunnel
       leftid=@west
       left=192.1.2.23
       leftrsasigkey=0sAQOrlo+hOafUZDlCQmXFrje/oZm [...] W2n417C/4urYHQkCvuIQ==
       rightid=@east
       right=192.1.2.45
       rightrsasigkey=0sAQO3fwC6nSSGgt64DWiYZzuHbc4 [...] D/v8t5YTQ==
       authby=rsasig

4. After importing keys, restart the ipsec service:

   # systemctl restart ipsec

5. Load the connection:

   # ipsec auto --add mytunnel

6. Establish the tunnel:

   # ipsec auto --up mytunnel

7. To automatically start the tunnel when the ipsec service is started, add the following line to the connection definition:

   auto=start

Procedure

1. Copy the file with the configuration of your host-to-host VPN to a new file, for example:

   # cp /etc/ipsec.d/my_host-to-host.conf /etc/ipsec.d/my_site-to-site.conf

2. Add the subnet configuration to the file created in the previous step, for example:

   conn mysubnet
        also=mytunnel
        leftsubnet=192.0.1.0/24
        rightsubnet=192.0.2.0/24
        auto=start
   
   conn mysubnet6
        also=mytunnel
        leftsubnet=2001:db8:0:1::/64
        rightsubnet=2001:db8:0:2::/64
        auto=start
   
   # the following part of the configuration file is the same for both host-to-host and site-to-site connections:
   
   conn mytunnel
       leftid=@west
       left=192.1.2.23
       leftrsasigkey=0sAQOrlo+hOafUZDlCQmXFrje/oZm [...] W2n417C/4urYHQkCvuIQ==
       rightid=@east
       right=192.1.2.45
       rightrsasigkey=0sAQO3fwC6nSSGgt64DWiYZzuHbc4 [...] D/v8t5YTQ==
       authby=rsasig

Procedure

1. On each node, import PKCS #12 files. This step requires the password used to generate the PKCS #12 files:

   # ipsec import nodeXXX.p12

2. Create the following three connection definitions for the IPsec required (private), IPsec optional (private-or-clear), and No IPsec (clear) profiles:

   # cat /etc/ipsec.d/mesh.conf
   conn clear
   	auto=ondemand 1
   	type=passthrough
   	authby=never
   	left=%defaultroute
   	right=%group
   
   conn private
   	auto=ondemand
   	type=transport
   	authby=rsasig
   	failureshunt=drop
   	negotiationshunt=drop
   	ikev2=insist
   	left=%defaultroute
   	leftcert=nodeXXXX
   	leftid=%fromcert 2
   	rightid=%fromcert
   	right=%opportunisticgroup
   
   conn private-or-clear
   	auto=ondemand
   	type=transport
   	authby=rsasig
   	failureshunt=passthrough
   	negotiationshunt=passthrough
   	# left
   	left=%defaultroute
   	leftcert=nodeXXXX 3
   	leftid=%fromcert
   	leftrsasigkey=%cert
   	# right
   	rightrsasigkey=%cert
   	rightid=%fromcert
   	right=%opportunisticgroup

Verification

1. Open an IPsec tunnel by using the ping command:

   # ping <nodeYYY>

2. Display the NSS database with the imported certification:

   # certutil -L -d sql:/etc/ipsec.d
   
   Certificate Nickname    Trust Attributes
                           SSL,S/MIME,JAR/XPI
   
   west                    u,u,u
   ca                      CT,,

3. See which tunnels are open on the node:

   # ipsec trafficstatus
   006 #2: "private#10.15.0.0/16"[1] ...<nodeYYY>, type=ESP, add_time=1691399301, inBytes=512, outBytes=512, maxBytes=2^63B, id='C=US, ST=NC, O=Example Organization, CN=east'

Procedure

1. Install the libreswan packages:

   # dnf install libreswan

2. If you are re-installing Libreswan, remove its old NSS database:

   # systemctl stop ipsec
   
   # rm /var/lib/ipsec/nss/*db

3. Start the ipsec service, and enable the service to be started automatically on boot:

   # systemctl enable ipsec --now

4. Configure the firewall to allow 500 and 4500 UDP ports for the IKE, ESP, and AH protocols by adding the ipsec service:

   # firewall-cmd --add-service="ipsec"
   # firewall-cmd --runtime-to-permanent

5. Switch the system to FIPS mode:

   # fips-mode-setup --enable

6. Restart your system to allow the kernel to switch to FIPS mode:

   # reboot

Verification

1. Confirm Libreswan is running in FIPS mode:

   # ipsec whack --fipsstatus
   000 FIPS mode enabled

2. Alternatively, check entries for the ipsec unit in the systemd journal:

   $ journalctl -u ipsec
   ...
   Jan 22 11:26:50 localhost.localdomain pluto[3076]: FIPS Mode: YES

3. To see the available algorithms in FIPS mode:

   # ipsec pluto --selftest 2>&1 | head -6
   Initializing NSS using read-write database "sql:/var/lib/ipsec/nss"
   FIPS Mode: YES
   NSS crypto library initialized
   FIPS mode enabled for pluto daemon
   NSS library is running in FIPS mode
   FIPS HMAC integrity support [disabled]

4. To query disabled algorithms in FIPS mode:

   # ipsec pluto --selftest 2>&1 | grep disabled
   Encryption algorithm CAMELLIA_CTR disabled; not FIPS compliant
   Encryption algorithm CAMELLIA_CBC disabled; not FIPS compliant
   Encryption algorithm NULL disabled; not FIPS compliant
   Encryption algorithm CHACHA20_POLY1305 disabled; not FIPS compliant
   Hash algorithm MD5 disabled; not FIPS compliant
   PRF algorithm HMAC_MD5 disabled; not FIPS compliant
   PRF algorithm AES_XCBC disabled; not FIPS compliant
   Integrity algorithm HMAC_MD5_96 disabled; not FIPS compliant
   Integrity algorithm HMAC_SHA2_256_TRUNCBUG disabled; not FIPS compliant
   Integrity algorithm AES_XCBC_96 disabled; not FIPS compliant
   DH algorithm MODP1536 disabled; not FIPS compliant
   DH algorithm DH31 disabled; not FIPS compliant

5. To list all allowed algorithms and ciphers in FIPS mode:

   # ipsec pluto --selftest 2>&1 | grep ESP | grep FIPS | sed "s/^.*FIPS//"
   aes_ccm, aes_ccm_c
   aes_ccm_b
   aes_ccm_a
   NSS(CBC)  3des
   NSS(GCM)  aes_gcm, aes_gcm_c
   NSS(GCM)  aes_gcm_b
   NSS(GCM)  aes_gcm_a
   NSS(CTR)  aesctr
   NSS(CBC)  aes
   aes_gmac
   NSS       sha, sha1, sha1_96, hmac_sha1
   NSS       sha512, sha2_512, sha2_512_256, hmac_sha2_512
   NSS       sha384, sha2_384, sha2_384_192, hmac_sha2_384
   NSS       sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256
   aes_cmac
   null
   NSS(MODP) null, dh0
   NSS(MODP) dh14
   NSS(MODP) dh15
   NSS(MODP) dh16
   NSS(MODP) dh17
   NSS(MODP) dh18
   NSS(ECP)  ecp_256, ecp256
   NSS(ECP)  ecp_384, ecp384
   NSS(ECP)  ecp_521, ecp521

Procedure

1. Enable password protection for the NSS database for Libreswan:

   # certutil -N -d sql:/var/lib/ipsec/nss
   Enter Password or Pin for "NSS Certificate DB":
   Enter a password which will be used to encrypt your keys.
   The password should be at least 8 characters long,
   and should contain at least one non-alphabetic character.
   
   Enter new password:

2. Create the /etc/ipsec.d/nsspassword file that containins the password you have set in the previous step, for example:

   # cat /etc/ipsec.d/nsspassword
   NSS Certificate DB:_<password>_

   The nsspassword file use the following syntax:

   <token_1>:<password1>
   <token_2>:<password2>

   The default NSS software token is NSS Certificate DB. If your system is running in FIPS mode, the name of the token is NSS FIPS 140-2 Certificate DB.

3. Depending on your scenario, either start or restart the ipsec service after you finish the nsspassword file:

   # systemctl restart ipsec

Verification

1. Check that the ipsec service is running after you have added a non-empty password to its NSS database:

   # systemctl status ipsec
   ● ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec
      Loaded: loaded (/usr/lib/systemd/system/ipsec.service; enabled; vendor preset: disable>
      Active: active (running)...

Procedure

1. Add the following option to the /etc/ipsec.conf file in the config setup section:

   listen-tcp=yes

2. To use TCP encapsulation as a fallback option when the first attempt over UDP fails, add the following two options to the client’s connection definition:

   enable-tcp=fallback
   tcp-remoteport=4500

   Alternatively, if you know that UDP is permanently blocked, use the following options in the client’s connection configuration:

   enable-tcp=yes
   tcp-remoteport=4500

Procedure

1. Edit the Libreswan configuration file in the /etc/ipsec.d/ directory of the connection that should use automatic detection of ESP hardware offload support.
2. Ensure the nic-offload parameter is not set in the connection’s settings.

3. If you removed nic-offload, restart the ipsec service:

   # systemctl restart ipsec

Verification

1. Display the tx_ipsec and rx_ipsec counters of the Ethernet device the IPsec connection uses:

   # ethtool -S enp1s0 | egrep "_ipsec"
        tx_ipsec: 10
        rx_ipsec: 10

2. Send traffic through the IPsec tunnel. For example, ping a remote IP address:

   # ping -c 5 remote_ip_address

3. Display the tx_ipsec and rx_ipsec counters of the Ethernet device again:

   # ethtool -S enp1s0 | egrep "_ipsec"
        tx_ipsec: 15
        rx_ipsec: 15

   If the counter values have increased, ESP hardware offload works.

Procedure

1. Enable ESP hardware offload support on the network bond:

   # nmcli connection modify bond0 ethtool.feature-esp-hw-offload on

   This command enables ESP hardware offload support on the bond0 connection.

2. Reactivate the bond0 connection:

   # nmcli connection up bond0

3. Edit the Libreswan configuration file in the /etc/ipsec.d/ directory of the connection that should use ESP hardware offload, and append the nic-offload=yes statement to the connection entry:

   conn example
       ...
       nic-offload=yes

4. Restart the ipsec service:

   # systemctl restart ipsec

1. Display the active port of the bond:

   # grep "Currently Active Slave" /proc/net/bonding/bond0
   Currently Active Slave: enp1s0

2. Display the tx_ipsec and rx_ipsec counters of the active port:

   # ethtool -S enp1s0 | egrep "_ipsec"
        tx_ipsec: 10
        rx_ipsec: 10

3. Send traffic through the IPsec tunnel. For example, ping a remote IP address:

   # ping -c 5 remote_ip_address

4. Display the tx_ipsec and rx_ipsec counters of the active port again:

   # ethtool -S enp1s0 | egrep "_ipsec"
        tx_ipsec: 15
        rx_ipsec: 15

   If the counter values have increased, ESP hardware offload works.

1. Reload the vpn.example.com connection:

   # ipsec auto --add vpn.example.com
   002 added connection description "vpn.example.com"

2. Next, initiate the VPN connection:

   # ipsec auto --up vpn.example.com

Procedure

1. Press the Super key, type Settings, and press Enter to open the control-center application.
2. Select the Network entry on the left.
3. Click the + icon.
4. Select VPN.

5. Select the Identity menu entry to see the basic configuration options:

   General

   Gateway — The name or IP address of the remote VPN gateway.

   Authentication

   Type

   • IKEv2 (Certificate)- client is authenticated by certificate. It is more secure (default).

   • IKEv1 (XAUTH) - client is authenticated by user name and password, or a pre-shared key (PSK).

     The following configuration settings are available under the Advanced section:

     Figure 7.1. Advanced options of a VPN connection

     
     Warning

     When configuring an IPsec-based VPN connection using the gnome-control-center application, the Advanced dialog displays the configuration, but it does not allow any changes. As a consequence, users cannot change any advanced IPsec options. Use the nm-connection-editor or nmcli tools instead to perform configuration of the advanced properties.

     Identification

   • Domain — If required, enter the Domain Name.

     Security

   • Phase1 Algorithms — corresponds to the ike Libreswan parameter — enter the algorithms to be used to authenticate and set up an encrypted channel.

   • Phase2 Algorithms — corresponds to the esp Libreswan parameter — enter the algorithms to be used for the IPsec negotiations.

     Check the Disable PFS field to turn off Perfect Forward Secrecy (PFS) to ensure compatibility with old servers that do not support PFS.

   • Phase1 Lifetime — corresponds to the ikelifetime Libreswan parameter — how long the key used to encrypt the traffic will be valid.

   • Phase2 Lifetime — corresponds to the salifetime Libreswan parameter — how long a particular instance of a connection should last before expiring.

     Note that the encryption key should be changed from time to time for security reasons.

   • Remote network — corresponds to the rightsubnet Libreswan parameter — the destination private remote network that should be reached through the VPN.

     Check the narrowing field to enable narrowing. Note that it is only effective in IKEv2 negotiation.

   • Enable fragmentation — corresponds to the fragmentation Libreswan parameter — whether or not to allow IKE fragmentation. Valid values are yes (default) or no.
   • Enable Mobike — corresponds to the mobike Libreswan parameter — whether to allow Mobility and Multihoming Protocol (MOBIKE, RFC 4555) to enable a connection to migrate its endpoint without needing to restart the connection from scratch. This is used on mobile devices that switch between wired, wireless, or mobile data connections. The values are no (default) or yes.

6. Select the IPv4 menu entry:

   IPv4 Method

   • Automatic (DHCP) — Choose this option if the network you are connecting to uses a DHCP server to assign dynamic IP addresses.
   • Link-Local Only — Choose this option if the network you are connecting to does not have a DHCP server and you do not want to assign IP addresses manually. Random addresses will be assigned as per RFC 3927 with prefix 169.254/16.
   • Manual — Choose this option if you want to assign IP addresses manually.

   • Disable — IPv4 is disabled for this connection.

     DNS

     In the DNS section, when Automatic is ON, switch it to OFF to enter the IP address of a DNS server you want to use separating the IPs by comma.

     Routes

     Note that in the Routes section, when Automatic is ON, routes from DHCP are used, but you can also add additional static routes. When OFF, only static routes are used.

   • Address — Enter the IP address of a remote network or host.
   • Netmask — The netmask or prefix length of the IP address entered above.
   • Gateway — The IP address of the gateway leading to the remote network or host entered above.

   • Metric — A network cost, a preference value to give to this route. Lower values will be preferred over higher values.

     Use this connection only for resources on its network

     Select this check box to prevent the connection from becoming the default route. Selecting this option means that only traffic specifically destined for routes learned automatically over the connection or entered here manually is routed over the connection.

7. To configure IPv6 settings in a VPN connection, select the IPv6 menu entry:

   IPv6 Method

   • Automatic — Choose this option to use IPv6 Stateless Address AutoConfiguration (SLAAC) to create an automatic, stateless configuration based on the hardware address and Router Advertisements (RA).
   • Automatic, DHCP only — Choose this option to not use RA, but request information from DHCPv6 directly to create a stateful configuration.
   • Link-Local Only — Choose this option if the network you are connecting to does not have a DHCP server and you do not want to assign IP addresses manually. Random addresses will be assigned as per RFC 4862 with prefix FE80::0.
   • Manual — Choose this option if you want to assign IP addresses manually.

   • Disable — IPv6 is disabled for this connection.

     Note that DNS, Routes, Use this connection only for resources on its network are common to IPv4 settings.

8. Once you have finished editing the VPN connection, click the Add button to customize the configuration or the Apply button to save it for the existing one.
9. Switch the profile to ON to active the VPN connection.