If you want to segregate the communication traffic across multiple channels, you can configure a Cryptographic Security Platform Vault node to use multiple virtual NICs (Network Interface Cards). For example, you may want one NIC to handle the communication between the Cryptographic Security Platform Vault webGUI and the Cryptographic Security Platform Vault nodes on TCP/443 while a second NIC handles the cluster traffic and the internal node management traffic on TCP/8443. Multi-NIC configuration is only supported with the Cryptographic Security Platform Vault for Databases and the Cryptographic Security Platform Vault for VM Encryption for policy agent communication.
With multiple NICs, one NIC must be designated as the "management interface", and this interface must be able to communicate on port TCP/8443. Cryptographic Security Platform Vault uses the internal node management interface to:
Determine the administrative MAC address for the node.
- Initializes the communication traffic between the nodes in the cluster.
- Handle any authentication requests that come into the cluster.
All management interface communication must take place on the management interface. You cannot split management communication across multiple interfaces.
Considerations
When you are configuring multiple NICs on a node, keep the following things in mind:
- Cryptographic Security Platform Vault supports a maximum of four virtual NICs. One NIC must be the management interface, as described above. In addition to the management interface, you can specify up to three additional NICs that can be used for inbound and outbound traffic. This includes inbound client and Cryptographic Security Platform Vault webGUI traffic as well as outbound syslog, NFS, and email traffic.
- All NICs must be of the same interface adapter type. For example, if the first NIC specified uses the adapter type VMXNET, all other NICs must be of type VMXNET.
- All NICs use global values for their DNS settings, NTP settings, default gateway, and DNS server list. Any change made to those settings on one NIC affects all NICs.
When you deploy a new Cryptographic Security Platform Vault node through an OVA template or an ISO image, you must specify basic network information such as an IP address, domain, gateway, and DNS server list. When you do so, Cryptographic Security Platform Vault automatically designates that IP address as the management interface on port
TCP/8443. We strongly recommend that you do not change this interface if the node is already part of a cluster or if any VMs have already been registered with the node.If you want to select the management interface during deployment, you must install Cryptographic Security Platform Vault from the ISO image on an existing VM that already has all of the required NICs configured. In this case, Cryptographic Security Platform Vault will prompt you to select the management interface during the installation.
Adding additional NICs to the VM after deployment requires you to shut down the Cryptographic Security Platform Vault node while you add the NICs. You cannot add NICs to a running system.
If the node is part of a cluster, the cluster will become degraded if the node is unreachable for too long. If the node is a standalone node, any VMs registered with the node will be unable to retrieve their keys while the network services are offline, and any VM heartbeats will fail.
- Cryptographic Security Platform Vault automatically restarts the network services on the node every time you change the configuration for a NIC. The node will be unavailable for a brief period until this process has finished.