Centos 7 Fog Setup with 2 network cards, Public / Private

[Wayne Workman]

@george1421 said in Centos 7 Fog Setup with 2 network cards, Public / Private:

When you image your target computers on your isolated imaging LAN, do they need to connect to resources on your business LAN during imaging like active directory. If so you will need to take a few steps to turn your fog server into a router too.

I really dislike it when people want to “isolate” fog, like it’s some liability or threat or some boogie man on the network that you can’t control.

[george1421]

@Wayne-Workman While I can’t speak for the OP, there are valid reasons for using an isolated imaging LAN vs the business LAN. The one thing that comes to mind is having conflicting dhcp settings that can’t be overcome. In some environments dhcp is managed by a third party or there are conflicts between voip (which uses dhcp/pxe to provision the phones) and pxe based imaging. There also many be bandwidth constrains where some people may have to limit high bandwidth traffic to a single dedicated switch.

The benefit of FOG is that it supports both the traditional distributed imaging environment as well as the dedicated imaging environment. You just make the decision at install time which functions you want FOG to do and it creates the proper configuration.

[Wayne Workman]

@george1421 when dhcp is managed by a third party, dnsmasq is an option that will work usually. When there is voip on the network, you would create dhcp matching for the phones you have so they get the correct option 066 and 067, and also create matching for legacy and uefi. I helped a guy in Australia set this up once using isc-dhcp, it worked fine. For bandwidth problems, there are storage nodes, the location plugin, and multi-master setups if need be. If there are 10Mbps switches in use, those are extremely obsolete, are beyond end-of-life, out of warranty, and need replacing. 100Mbps while very old can do imaging at an acceptable rate, 3 of our 24 buildings are 100Mbps and they do ok.

[Tom Elliott]

While it may not make sense to all, the idea of “isolated networks” is that they are independent of the main network infrastructure the rest of the business is using. Isolated networks actually make multicast, I think, a lot more reliable without potentially causing issues with the main network due to the oblivious network packets pushed around.

There’s any number of reasons a business, or user, would prefer to have fog on it’s own network though. The aim of FOG is to support whatever the environment is around them. Some of the reasons may include security, but I’ll side more on the area of just keeping large bandwidth usage off of the main “users” network is more likely.

To work off of @george1421’s question regarding:

Now something you haven’t mentioned is this: When you image your target computers on your isolated imaging LAN, do they need to connect to resources on your business LAN during imaging like active directory. If so you will need to take a few steps to turn your fog server into a router too.

I don’t know that imaging, itself, would require AD access unless you’re specifically using AD to connect to a file share that a download script is going to be connecting, to place files on. (This is fairly uncommon from what I’ve seen.)

Maybe I’m asking too many questions? The area of concern here is the isolated network though. As @george1421 asked, if you do need AD joining after imaging has finished, are these systems going to be connected to both networks? Maybe you could do better using a setup of VLAN’s so as to limit traffic to a specific VLAN, while enabling cross-VLAN communication? This way you don’t need to keep disconnecting the systems being imaged to get profile stuff after imaging is completed: (For example FOG Client, while allowing the freshly imaged systems to still pickup their Windows Updates or activation schema’s).

I personally prefer the VLAN approach as the vlan can be segmented while still allowing communication to the whole network. This is just my own personal preference as I’m not a fan (myself) of doing that much more work.

The way I’m understanding the current workflow for most Isolated networks is:

1. System needs to be taken off “primary” network and placed on “imaging” network.
2. System needs to be rebooted (however you may decide to do this).
3. System images through and may need to be shutdown after imaging to ensure PC is in still waiting in “clean” state.
4. System needs to be taken off “imaging” network and placed on “primary” network.
5. System needs to be booted to make sure the system gets it’s information depending on your layout.

I think this is just a lot of extra steps when you could more simply just keep traffic restricted to a particular vlan. Heck you can even setup so that you don’t have to worry about a specific VLAN doing the imaging and never even have to take down a whole network. I know this may seem a bit involved, but when we switched to VLANs in my past position, there was as significant improvement in the overall network availability during imaging.

There are some caveats that I think need to be added. If I could redo the structure, I’d have placed a FOG Storage Node on each separate VLAN and installed the location plugin. I’d then point the systems within the VLAN scope to the location defined for each related VLAN Storage node. This would totally perform exactly as needed while, again, keeping the imaging restricted to the relevant VLAN scope for such things as Multicast, Unicast, Uploads, etc…

These are just my thoughts and you can do as you please. If you don’t mind doing the extra work of disconnecting from main and putting on isolated switch, then everything should be fairly straight forward from now on.

[ally_uk]

The main reason was to have the imaging side isolated because of the DHCP server running on the main network I wanted to avoid any potential conflicts.

The first Ethernet card connected to main network;

192.168.1.102/24
( This network has gateway and DNS setup the router handles DHCP I have manually set it as a static I,P this card is for server to get to outside world)

The second card is isolated for imaging connected to a separate switch.

192.168.2.12
255.255.255.0
No Gateway

---

Firstly are these networking details ok?

Go easy on me lads as this is all new to me during the initial fog setup it asks for a default network card to use? am I right in saying it would be the first Ethernet card?

Secondly it is asking me whether to use DHCP and which device to use this part is giving me a headache I assume I set it to the second network card?

Again thank you

[george1421]

@ally_uk Your network settings look correct based on what we know so far.

As for your default network card, you want to select the one for your imaging network. You want the imaging servers (dhcp especially) to bind to the imaging LAN interface and not to your business LAN (which would be a bad thing).

[ally_uk]

Please tell me if any of this information is wrong. I have put a # next to items I am unsure of

#Server I.P Address: 192.168.1.102
Server S/M 255.255.255.0
#Interface enp3s9 ( Second network card has different i.p from server i.p addy)
Installation type: normal server
Image storage location /images
Using Fog DHCP: yes
#DHCP Router address:

Again many thanks for holding my hand I will document everything once it is working lol

[george1421]

@ally_uk As far as FOG goes, ignore that you have a business LAN nic installed in this computer. It (fog) only needs to know about interfaces it must use. So for server IP it would be the nic address on the imaging LAN.

As for dhcp router address, that should be blank because there is no path data out of your isolated imaging LAN.

[ally_uk]

Thank you my man

[ally_uk]

I am getting a warning after the mysql update that says there is no dns / dhcp address is this ok to proceed?

[george1421]

@ally_uk Is this the first time you’ve got this far with the installer?

I can’t say for sure, I don’t remember the exact steps the installer uses on a fresh install. As long as you told the installer you wanted to have fog manage the dhcp server we can get you to where you need. The key is getting the isc-dhcp installed.

[george1421]

@ally_uk Knowing what we know now, you may want to review Wayne’s post https://forums.fogproject.org/topic/8861/centos-7-fog-setup-with-2-network-cards-public-private/3 because it pretty much covered what we are talking about now.

[ally_uk]

I will fire up the machine and report progress tommorow.

Regarding DHCP I assumed FOG would automatically setup a range and automatically configure the DHCP side of things.

The installation guide I have been following on the wiki had no mention of how to configure DHCP.

Ahwell least I am learning loads

I need a Centos7 DHCP tutorial now lol

Thank you guys

[Wayne Workman]

@ally_uk said in Centos 7 Fog Setup with 2 network cards, Public / Private:

I need a Centos7 DHCP tutorial now lol

The configuration file on all linux distributions is setup exactly the same. The only variation is the commands to install, start, and enable.

I didn’t include DHCP instructions in the CentOS 7 wiki article because no one-size fits all, and I figured people either have a pre-existing DHCP server they want to use, or they want FOG to do it all and in which case they just answer “yes” to DHCP during the fog installer and the installer does take care of it.

You can’t do that though because you have two NICs.

You need a custom configuration, and you cannot let FOG manage it - because it’ll mess it up, because it’s written under the assumption of one Network Interface being used, and every time you run the installer with FOG managing DHCP, it’ll write-over the custom configuration unless you just totally disable FOG touching DHCP.

There’s no way around this, not at all. You must manually edit or create a DHCP configuration - and it’s not all that tough, and all the instructions are already written in my first post in this thread.

[ally_uk]

@Wayne-Workman

Many Thanks for the guidance I really do appreciate it because of yourself and others on this fantastic forum I have learned alot.

I haven’t had a chance today to play with the FOG stuff. However hopefully I can look at the DHCP configuration side of things tommorow.

I will report back my progress and any problems.

Many Thanks