Network interfaces
The physical and/or virtual network interfaces of the Anapaya appliance are configured in the
interfaces section of the appliance configuration. Note that these network interfaces are
different from the SCION interfaces - a SCION interface is a purely logical interface that always
binds to a physical or virtual network interface, usually a WAN interface. In addition to WAN
interfaces, an appliance can have multiple LAN interfaces.
The Configuration reference section provides the full configuration reference. The sections following after provide examples for configuration of different types of network interfaces.
Configuration reference
Anapaya appliance configuration (interfaces only)
interfaces object
Top-level configuration and state for interfaces.
bonds object[]
Top-level configuration and state for the bond interfaces.
Whether to accept the route advertisements for the corresponding interface. (This is currently supported only for the interfaces that are using the Linux driver.)
falseThe addresses configured on this interface. Each address must be a valid IP prefix in CIDR notation.
gateway object
The gateway for the network interface.
The gateway address for the IPv4 networking stack. Note that there must only be one IPv4 gateway configured across all the interfaces.
The gateway address for the IPv6 networking stack. Note that there must only be one IPv6 gateway configured across all the interfaces.
The list of interfaces that are part of this bond.
Possible values: >= 1
The MAC address to use on this interface.
It is of the form XX:XX:XX:XX:XX:XX.
The MTU (Maximum Transmission Unit) to be used on this interface.
15001472The name of the network interface.
neighbors object[]
The static neighbors configured on this network interface.
The IP address.
An optional human-readable string to comment on this neighbor.
The MAC address corresponding to the address.
It is of the form XX:XX:XX:XX:XX:XX.
The sequence id determines the order of the neighbor entries.
3routes object[]
The routes which are configured on this network interface.
An optional human-readable string to comment on this route.
The source IP address for traffic going through the route.
The metric for the route. The lower its value, the higher its priority.
10The sequence id determines the order of the route entries.
3The destination prefix in CIDR notation of this route.
The next hop address which should be used for the prefix.
The number of descriptors in the receive queue. (This option is currently supported only for VPP interfaces.)
10242048The number of descriptors in the transmit queue. (This is currently supported only for VPP interfaces.)
10242048vrrp object[]
The VRRP (Virtual Router Redundancy Protocol) configurations for this interface.
The list of virtual IP addresses. It must contain at least one IP address. Each sequence entry is in CIDR notation.
Possible values: >= 1
If set to true, the preempt mode is disabled. This means that the router will not preempt the master even if it has a higher priority than the current master. If set to false, the router will preempt the master if it has a higher priority than the current master.
falseOptional list of IP addresses of the VRRP peers. If the list is empty, the router will send VRRP packets to the multicast address. If the list is not empty, the router will send VRRP packets to the unicast addresses specified in the list.
Possible values: >= 1
The priority value to be used by this VRRP router. Higher means higher priority and it ranges between 1 and 255 (decimal).
117The virtual router identifier, which ranges between 1 and 255 (decimal).
3ethernets object[]
Top-level configuration and state for ethernet interfaces.
Whether to accept the route advertisements for the corresponding interface. (This is currently supported only for the interfaces that are using the Linux driver.)
falseThe addresses configured on this interface. Each address must be a valid IP prefix in CIDR notation.
The driver which should be used for the interface.
Possible values: [LINUX, VPP, VPP_DPDK, VPP_VMXNET3, VPP_MEMIF, VPP_RDMA]
gateway object
The gateway for the network interface.
The gateway address for the IPv4 networking stack. Note that there must only be one IPv4 gateway configured across all the interfaces.
The gateway address for the IPv6 networking stack. Note that there must only be one IPv6 gateway configured across all the interfaces.
The MAC address to use on this interface.
It is of the form XX:XX:XX:XX:XX:XX.
The MTU (Maximum Transmission Unit) to be used on this interface.
15001472The name of the network interface.
neighbors object[]
The static neighbors configured on this network interface.
The IP address.
An optional human-readable string to comment on this neighbor.
The MAC address corresponding to the address.
It is of the form XX:XX:XX:XX:XX:XX.
The sequence id determines the order of the neighbor entries.
3routes object[]
The routes which are configured on this network interface.
An optional human-readable string to comment on this route.
The source IP address for traffic going through the route.
The metric for the route. The lower its value, the higher its priority.
10The sequence id determines the order of the route entries.
3The destination prefix in CIDR notation of this route.
The next hop address which should be used for the prefix.
The number of descriptors in the receive queue. (This option is currently supported only for VPP interfaces.)
10242048The number of descriptors in the transmit queue. (This is currently supported only for VPP interfaces.)
10242048vpp object
The VPP driver specific configuration.
The number of receive queues. Automatically configured if the value is 0.
0Whether vlan-strip-offload on should be added to the interface
configuration of the VPP dataplane.
falsevrrp object[]
The VRRP (Virtual Router Redundancy Protocol) configurations for this interface.
The list of virtual IP addresses. It must contain at least one IP address. Each sequence entry is in CIDR notation.
Possible values: >= 1
If set to true, the preempt mode is disabled. This means that the router will not preempt the master even if it has a higher priority than the current master. If set to false, the router will preempt the master if it has a higher priority than the current master.
falseOptional list of IP addresses of the VRRP peers. If the list is empty, the router will send VRRP packets to the multicast address. If the list is not empty, the router will send VRRP packets to the unicast addresses specified in the list.
Possible values: >= 1
The priority value to be used by this VRRP router. Higher means higher priority and it ranges between 1 and 255 (decimal).
117The virtual router identifier, which ranges between 1 and 255 (decimal).
3gres object[]
Generic routing encapsulation (GRE) interfaces.
Whether to accept the route advertisements for the corresponding interface. (This is currently supported only for the interfaces that are using the Linux driver.)
falseThe addresses configured on this interface. Each address must be a valid IP prefix in CIDR notation.
The destination IP address for the GRE tunnel.
gateway object
The gateway for the network interface.
The gateway address for the IPv4 networking stack. Note that there must only be one IPv4 gateway configured across all the interfaces.
The gateway address for the IPv6 networking stack. Note that there must only be one IPv6 gateway configured across all the interfaces.
The MAC address to use on this interface.
It is of the form XX:XX:XX:XX:XX:XX.
The MTU (Maximum Transmission Unit) to be used on this interface.
15001472The name of the network interface.
neighbors object[]
The static neighbors configured on this network interface.
The IP address.
An optional human-readable string to comment on this neighbor.
The MAC address corresponding to the address.
It is of the form XX:XX:XX:XX:XX:XX.
The sequence id determines the order of the neighbor entries.
3routes object[]
The routes which are configured on this network interface.
An optional human-readable string to comment on this route.
The source IP address for traffic going through the route.
The metric for the route. The lower its value, the higher its priority.
10The sequence id determines the order of the route entries.
3The destination prefix in CIDR notation of this route.
The next hop address which should be used for the prefix.
The number of descriptors in the receive queue. (This option is currently supported only for VPP interfaces.)
10242048The source IP address for the GRE tunnel.
The number of descriptors in the transmit queue. (This is currently supported only for VPP interfaces.)
10242048vrrp object[]
The VRRP (Virtual Router Redundancy Protocol) configurations for this interface.
The list of virtual IP addresses. It must contain at least one IP address. Each sequence entry is in CIDR notation.
Possible values: >= 1
If set to true, the preempt mode is disabled. This means that the router will not preempt the master even if it has a higher priority than the current master. If set to false, the router will preempt the master if it has a higher priority than the current master.
falseOptional list of IP addresses of the VRRP peers. If the list is empty, the router will send VRRP packets to the multicast address. If the list is not empty, the router will send VRRP packets to the unicast addresses specified in the list.
Possible values: >= 1
The priority value to be used by this VRRP router. Higher means higher priority and it ranges between 1 and 255 (decimal).
117The virtual router identifier, which ranges between 1 and 255 (decimal).
3loopbacks object[]
Top-level configuration and state for loopback interfaces.
The list of addresses configured on the loopback interface.
The name of the loopback interface, which must have a 'loop' prefix.
shuttles object[]
Top-level configuration and state for Shuttle interfaces.
Disable the Shuttle interface. By default, it is false. If disabled, the Shuttle interface is not created and existing Shuttle interface will be removed. Disabling an existing interface preserves the corresponding certificate and private key, which can be used after re-enabling the interface.
falseLocal endpoint of the Shuttle tunnel. In two alternative forms ISD-AS,IP, or IP,
where ISD-AS is an ISD-AS number, IP is an IPv4/IPv6 address
1-ff00:0:1,127.0.0.1The MTU (Maximum Transmission Unit) to be used on this interface. The user does not need to change this default value. The value is chosen to work in extrem circumstances.
1000The name of the network interface.
servers object[]
The list of Shuttle servers.
Remote endpoint of the Shuttle tunnel. In the form host:port,
where host is a SCION host address, in ISD-AS,IP format, where ISD-AS is the
ISD-AS number and IP is the IPv4 address, and port is a port number
[1-ff00:0:1,127.0.0.1]:443virtual_functions object[]
Top-level configuration and state for VF interfaces.
Whether to accept the route advertisements for the corresponding interface. (This is currently supported only for the interfaces that are using the Linux driver.)
falseThe addresses configured on this interface. Each address must be a valid IP prefix in CIDR notation.
gateway object
The gateway for the network interface.
The gateway address for the IPv4 networking stack. Note that there must only be one IPv4 gateway configured across all the interfaces.
The gateway address for the IPv6 networking stack. Note that there must only be one IPv6 gateway configured across all the interfaces.
The name of the network interface that is used as the parent on which the virtual function will be created.
The MAC address to use on this interface.
It is of the form XX:XX:XX:XX:XX:XX.
The MTU (Maximum Transmission Unit) to be used on this interface.
15001472The name of the network interface.
neighbors object[]
The static neighbors configured on this network interface.
The IP address.
An optional human-readable string to comment on this neighbor.
The MAC address corresponding to the address.
It is of the form XX:XX:XX:XX:XX:XX.
The sequence id determines the order of the neighbor entries.
3The number of receive queues. Automatically configured if the value is 0.
0routes object[]
The routes which are configured on this network interface.
An optional human-readable string to comment on this route.
The source IP address for traffic going through the route.
The metric for the route. The lower its value, the higher its priority.
10The sequence id determines the order of the route entries.
3The destination prefix in CIDR notation of this route.
The next hop address which should be used for the prefix.
The number of descriptors in the receive queue. (This option is currently supported only for VPP interfaces.)
10242048The number of descriptors in the transmit queue. (This is currently supported only for VPP interfaces.)
10242048vrrp object[]
The VRRP (Virtual Router Redundancy Protocol) configurations for this interface.
The list of virtual IP addresses. It must contain at least one IP address. Each sequence entry is in CIDR notation.
Possible values: >= 1
If set to true, the preempt mode is disabled. This means that the router will not preempt the master even if it has a higher priority than the current master. If set to false, the router will preempt the master if it has a higher priority than the current master.
falseOptional list of IP addresses of the VRRP peers. If the list is empty, the router will send VRRP packets to the multicast address. If the list is not empty, the router will send VRRP packets to the unicast addresses specified in the list.
Possible values: >= 1
The priority value to be used by this VRRP router. Higher means higher priority and it ranges between 1 and 255 (decimal).
117The virtual router identifier, which ranges between 1 and 255 (decimal).
3vlans object[]
Top-level configuration and state for VLAN interfaces.
Whether to accept the route advertisements for the corresponding interface. (This is currently supported only for the interfaces that are using the Linux driver.)
falseThe addresses configured on this interface. Each address must be a valid IP prefix in CIDR notation.
gateway object
The gateway for the network interface.
The gateway address for the IPv4 networking stack. Note that there must only be one IPv4 gateway configured across all the interfaces.
The gateway address for the IPv6 networking stack. Note that there must only be one IPv6 gateway configured across all the interfaces.
The VLAN ID of the VLAN interface. It ranges between 0 and 4095.
Possible values: <= 4095
The name of the physical interface used for this VLAN.
The MAC address to use on this interface.
It is of the form XX:XX:XX:XX:XX:XX.
The MTU (Maximum Transmission Unit) to be used on this interface.
15001472The name of the network interface.
neighbors object[]
The static neighbors configured on this network interface.
The IP address.
An optional human-readable string to comment on this neighbor.
The MAC address corresponding to the address.
It is of the form XX:XX:XX:XX:XX:XX.
The sequence id determines the order of the neighbor entries.
3routes object[]
The routes which are configured on this network interface.
An optional human-readable string to comment on this route.
The source IP address for traffic going through the route.
The metric for the route. The lower its value, the higher its priority.
10The sequence id determines the order of the route entries.
3The destination prefix in CIDR notation of this route.
The next hop address which should be used for the prefix.
The number of descriptors in the receive queue. (This option is currently supported only for VPP interfaces.)
10242048The number of descriptors in the transmit queue. (This is currently supported only for VPP interfaces.)
10242048vrrp object[]
The VRRP (Virtual Router Redundancy Protocol) configurations for this interface.
The list of virtual IP addresses. It must contain at least one IP address. Each sequence entry is in CIDR notation.
Possible values: >= 1
If set to true, the preempt mode is disabled. This means that the router will not preempt the master even if it has a higher priority than the current master. If set to false, the router will preempt the master if it has a higher priority than the current master.
falseOptional list of IP addresses of the VRRP peers. If the list is empty, the router will send VRRP packets to the multicast address. If the list is not empty, the router will send VRRP packets to the unicast addresses specified in the list.
Possible values: >= 1
The priority value to be used by this VRRP router. Higher means higher priority and it ranges between 1 and 255 (decimal).
117The virtual router identifier, which ranges between 1 and 255 (decimal).
3wireguards object[]
Top-level configuration and state for Wireguard interfaces.
The addresses configured on this interface. Each address must be a valid IP prefix in CIDR notation.
gateway object
The gateway for the network interface.
The gateway address for the IPv4 networking stack. Note that there must only be one IPv4 gateway configured across all the interfaces.
The gateway address for the IPv6 networking stack. Note that there must only be one IPv6 gateway configured across all the interfaces.
The MTU (Maximum Transmission Unit) to be used on this interface.
1420The name of the network interface.
peers object[]
The list of Wireguard peers.
A list of IPv4/IPv6 addresses with a CIDR mask. The list indicates the addresses from which the peer is allowed to connect. Catch all are expressed as 0.0.0.0/0 (IPv4) and ::/0 (IPv6)
Remote endpoint of the Wireguard tunnel. In the form host:port
where host can be an IPv4/IPv6 address or a hostname,
and port is a port number.
The base64 encoded public key of the Wireguard peer.
This enables the point-to-point mode on the interface, meaning that it is a direct link between two machines with nobody else listening on it.
The port to listen on.
routes object[]
The routes for the network interface.
An optional human-readable string to comment on this route.
The source IP address for traffic going through the route.
The metric for the route. The lower its value, the higher its priority.
10The sequence id determines the order of the route entries.
3The destination prefix in CIDR notation of this route.
The next hop address which should be used for the prefix.
Ethernet interfaces configuration
An Ethernet interface is a physical network interface. Availability depends on the platform the appliance runs on. Please consult the platform documentation to find out what physical interfaces are available. Alternatively, the List physical interfaces API endpoint can be used to retrieve the available physical interfaces.
If you are using virtio interfaces, please consult the Virtio network interfaces user guide.
If no driver is configured, the default driver is VPP_DPDK.
This examples shows a configuration for an appliance with three physical interfaces:
- Interface
lanconfigures the LAN access with the address Loading.... We also configure the IPv4 gateway on this interface via Loading.... This means that a default route0.0.0.0/0via Loading... is installed. The interface driver is Loading... for performance, and we will use this interface to deliver traffic towards the AS internal network. - Interface
wanconfigures the WAN access with the link-local address Loading.... The interface driver is Loading... for performance, and we will use this interface to deliver traffic towards the neighboring AS. - Interface
mgmtconfigures the management access with the address Loading.... Because we use this interface for management, we do not bind it in VPP and use the Loading... driver. We will use this interface for management traffic, e.g., to interact with the management API.
Virtual functions configuration
A Virtual Function (VF) is a virtual network interface that can be configured on top of a physical
interface supporting SR-IOV
Please consult the platform documentation to find out if and which interfaces support the creation
of VFs. A VF is always bound to a physical interface that is configured in the
interfaces.ethernets section (specified by the link property). This interface must use the
LINUX driver.
This example shows a configuration for an appliance with a physical interface that supports SR-IOV. The Loading... VF on top of this interface.
VLAN interfaces configuration
A VLAN interface is a logical interface that is bound to an underlying network interface. A VLAN
interface can be configured on top of ethernets, virtual_functions and bonds. The underlying
network interface is specified by the link property. The name of the VLAN interface must be of the
form <link>.<id>, e.g., Loading... where Loading... is the name of the
physical interface, and Loading... is the VLAN ID.
This example shows a configuration for an appliance with a VLAN interface on the ethernet interface
Loading... with the VLAN ID Loading....
Bond interfaces configuration
A bond interface groups multiple network interfaces together to a single logical network interface.
Bonding can offer performance improvements and increased redundancy. A bond can only consist of
ethernet interfaces. Additionally, all ethernet interfaces that are part of a bond must use the
VPP driver.
This example shows a configuration of an appliance that bonds two interfaces together. The bond is created over two virtual functions.
Loopback interfaces configuration
A loopback interface is a logical network interface using which a host can communicate to itself. A
default loopback interface with IP prefixes 127.0.0.0/8 and ::1/128 is automatically created for
each appliance host and must not be configured.
Two exemplary use cases are:
-
In a single-appliance setup where SCION services need not to be reachable from the internal network, you can configure a loopback and use it for the SCION control service and router addresses. Even if the SCION services are not reachable from the outside, you can still configure the appliance to provide IP-in-SCION tunneling between your internal network to the remote SCION ASes.
-
You want the SCION services of an appliance to be reachable via multiple interfaces for redundancy on the network interface level. In that case, you can configure a loopback and bind the SCION services to that address. This can be paired with BGP such that the chosen loopback address is announced to the internal network. If no dynamic routing protocol is used, you will need to install the routes appropriately in the internal network.
Generic Routing Encapsulation (GRE) interfaces configuration
To create GRE tunnels, configure GRE interfaces in the interfaces configuration, where the source
of the GRE tunnel must be an address already configured on another interface.
At this point, we only support L3 point-to-point tunnels. If you require L2 tunnels, please contact the Anapaya Support.
WireGuard interfaces configuration
A WireGuard interface is a virtual network interface using the
WireGuard protocol to establish a secure tunnel to other WireGuard
peers. When configuring a WireGuard interface, the appliance automatically generates a private key
and a public key. The public key is then exposed in the configuration as the public_key property
of WireGuard interface entry, which you can request via the Get latest
configuration.
Shuttle interfaces configuration
A shuttle interface is a virtual network interface providing secure IP tunneling over SCION. A major use case for shuttle is the management of Anapaya appliances over SCION network, for which the management API should listen on the shuttle interface. For more information on shuttle, please consult Configure shuttle user guide.