https://archive-ce-3-20.netlify.app/assets/js/6d6aae45.3461c7a3.js

1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["4746"],{22588(e,n,t){t.r(n),t.d(n,{metadata:()=>i,default:()=>h,frontMatter:()=>r,contentTitle:()=>a,toc:()=>l,assets:()=>c});var i=JSON.parse('{"id":"reference/faq","title":"Frequently asked questions","description":"Common questions that users ask about Calico Enterprise.","source":"@site/calico-enterprise_versioned_docs/version-3.20-2/reference/faq.mdx","sourceDirName":"reference","slug":"/reference/faq","permalink":"/calico-enterprise/3.20/reference/faq","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico-enterprise_versioned_docs/version-3.20-2/reference/faq.mdx","tags":[],"version":"3.20-2","frontMatter":{"description":"Common questions that users ask about Calico Enterprise."},"sidebar":"calicoEnterpriseSidebar","previous":{"title":"Component versions","permalink":"/calico-enterprise/3.20/reference/component-versions"},"next":{"title":"Platform support policy","permalink":"/calico-enterprise/3.20/reference/support-policy"}}'),o=t(70689),s=t(3413);let r={description:"Common questions that users ask about Calico Enterprise."},a="Frequently asked questions",c={},l=[{value:"Why use Calico Enterprise?",id:"why-use-calico-enterprise",level:2},{value:"Does Calico Enterprise work with IPv6?",id:"does-calico-enterprise-work-with-ipv6",level:2},{value:"Why does my container have a route to 169.254.1.1?",id:"why-does-my-container-have-a-route-to-16925411",level:2},{value:"Why isn&#39;t Calico Enterprise working with a containerized kubelet?",id:"why-isnt-calico-enterprise-working-with-a-containerized-kubelet",level:2},{value:"How do I view Calico Enterprise CNI logs?",id:"how-do-i-view-calico-enterprise-cni-logs",level:2},{value:"How do I configure the pod IP range?",id:"how-do-i-configure-the-pod-ip-range",level:2},{value:"How do I assign a specific IP address to a pod?",id:"how-do-i-assign-a-specific-ip-address-to-a-pod",level:2},{value:"Why can&#39;t I see the 169.254.1.1 address mentioned above on my host?",id:"why-cant-i-see-the-16925411-address-mentioned-above-on-my-host",level:2},{value:"Why do all cali* interfaces have the MAC address ee:ee:ee:ee:ee:ee?",id:"why-do-all-cali-interfaces-have-the-mac-address-eeeeeeeeeeee",level:2},{value:"Can I prevent my Kubernetes pods from initiating outgoing connections?",id:"can-i-prevent-my-kubernetes-pods-from-initiating-outgoing-connections",level:2},{value:"I&#39;ve heard Calico Enterprise uses proxy ARP, doesn&#39;t proxy ARP cause a lot of problems?",id:"ive-heard-calico-enterprise-uses-proxy-arp-doesnt-proxy-arp-cause-a-lot-of-problems",level:2},{value:"Is Calico Enterprise compliant with PCI/DSS requirements?",id:"is-calico-enterprise-compliant-with-pcidss-requirements",level:2},{value:"How do I enable IP-in-IP and NAT outgoing on an IP pool?",id:"how-do-i-enable-ip-in-ip-and-nat-outgoing-on-an-ip-pool",level:2},{value:"How does Calico Enterprise maintain saved state?",id:"how-does-calico-enterprise-maintain-saved-state",level:2},{value:"I heard Calico Enterprise is suggesting layer 2: I thought you were layer 3! What&#39;s happening?",id:"i-heard-calico-enterprise-is-suggesting-layer-2-i-thought-you-were-layer-3-whats-happening",level:2},{value:"How do I control policy/connectivity without virtual/physical firewalls?",id:"how-do-i-control-policyconnectivity-without-virtualphysical-firewalls",level:2},{value:"Why isn&#39;t the <code>-p</code> flag on <code>docker run</code> working as expected?",id:"why-isnt-the--p-flag-on-docker-run-working-as-expected",level:2},{value:"Can Calico Enterprise containers use any IP address within a pool, even subnet network/broadcast addresses?",id:"can-calico-enterprise-containers-use-any-ip-address-within-a-pool-even-subnet-networkbroadcast-addresses",level:2},{value:"How do I get network traffic into and out of my Calico Enterprise cluster?",id:"how-do-i-get-network-traffic-into-and-out-of-my-calico-enterprise-cluster",level:2},{value:"How can I enable NAT for outgoing traffic from containers with private IP addresses?",id:"how-can-i-enable-nat-for-outgoing-traffic-from-containers-with-private-ip-addresses",level:3},{value:"How can I enable NAT for incoming traffic to containers with private IP addresses?",id:"how-can-i-enable-nat-for-incoming-traffic-to-containers-with-private-ip-addresses",level:3},{value:"Can I run Calico Enterprise in a public cloud environment?",id:"can-i-run-calico-enterprise-in-a-public-cloud-environment",level:3},{value:"On AWS with IP-in-IP, why do I see no connectivity between workloads or only see connectivity if I ping in both directions?",id:"on-aws-with-ip-in-ip-why-do-i-see-no-connectivity-between-workloads-or-only-see-connectivity-if-i-ping-in-both-directions",level:3},{value:"Can Calico do IP multicast?",id:"can-calico-do-ip-multicast",level:2}];function d(e){let n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,s.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.header,{children:(0,o.jsx)(n.h1,{id:"frequently-asked-questions",children:"Frequently asked questions"})}),"\n",(0,o.jsx)(n.h2,{id:"why-use-calico-enterprise",children:"Why use Calico Enterprise?"}),"\n",(0,o.jsx)(n.p,{children:"The problem Calico Enterprise tries to solve is the networking of workloads (VMs,\ncontainers, etc) in a high scale environment. Existing L2-based methods\nfor solving this problem have problems at high scale. Compared to these,\nwe think Calico Enterprise is more scalable, simpler, and more flexible. We think\nyou should look into it if you have more than a handful of nodes on a\nsingle site."}),"\n",(0,o.jsx)(n.p,{children:"Calico Enterprise also provides a rich network security model that\nallows operators and developers to declare intent-based network security\npolicy that is automatically rendered into distributed firewall rules\nacross a cluster of containers, VMs, and/or servers."}),"\n",(0,o.jsxs)(n.p,{children:["For a more detailed discussion of this topic, see our blog post at\n",(0,o.jsx)(n.a,{href:"https://www.projectcalico.org/why-calico/",children:"Why Calico?"}),"."]}),"\n",(0,o.jsx)(n.h2,{id:"does-calico-enterprise-work-with-ipv6",children:"Does Calico Enterprise work with IPv6?"}),"\n",(0,o.jsx)(n.p,{children:"Yes! Calico Enterprise's core components support IPv6 out of the box. However,\nnot all orchestrators that we integrate with support IPv6 yet."}),"\n",(0,o.jsx)(n.h2,{id:"why-does-my-container-have-a-route-to-16925411",children:"Why does my container have a route to 169.254.1.1?"}),"\n",(0,o.jsx)(n.p,{children:"In a Calico Enterprise network, each host acts as a gateway router for the\nworkloads that it hosts. In container deployments, Calico Enterprise uses\n169.254.1.1 as the address for the Calico Enterprise router. By using a\nlink-local address, Calico Enterprise saves precious IP addresses and avoids\nburdening the user with configuring a suitable address."}),"\n",(0,o.jsx)(n.p,{children:"While the routing table may look a little odd to someone who is used to\nconfiguring LAN networking, using explicit routes rather than\nsubnet-local gateways is fairly common in WAN networking."}),"\n",(0,o.jsx)(n.h2,{id:"why-isnt-calico-enterprise-working-with-a-containerized-kubelet",children:"Why isn't Calico Enterprise working with a containerized kubelet?"}),"\n",(0,o.jsx)(n.p,{children:"Calico Enterprise hosted install places the necessary CNI binaries and config on each\nKubernetes node in a directory on the host as specified in the manifest. By\ndefault it places binaries in /opt/cni/bin and config /etc/cni/net.d."}),"\n",(0,o.jsx)(n.p,{children:"When running the kubelet as a container using hyperkube,\nyou need to make sure that the containerized kubelet can see the CNI network\nplugins and config that have been installed by mounting them into the kubelet container."}),"\n",(0,o.jsx)(n.p,{children:"For example add the following arguments to the kubelet-wrapper service:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"--volume /etc/cni/net.d:/etc/cni/net.d \\\n--volume /opt/cni/bin:/opt/cni/bin \\\n"})}),"\n",(0,o.jsxs)(n.p,{children:["Without the above volume mounts, the kubelet will not call the Calico Enterprise CNI binaries, and so\nCalico Enterprise ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/resources/workloadendpoint",children:"workload endpoints"})," will\nnot be created, and Calico Enterprise policy will not be enforced."]}),"\n",(0,o.jsx)(n.h2,{id:"how-do-i-view-calico-enterprise-cni-logs",children:"How do I view Calico Enterprise CNI logs?"}),"\n",(0,o.jsxs)(n.p,{children:["The Calico Enterprise CNI plugin emits logs to stderr, which are then logged out by the kubelet. Where these logs end up\ndepend on how your kubelet is configured. For deployments using ",(0,o.jsx)(n.code,{children:"systemd"}),", you can do this via ",(0,o.jsx)(n.code,{children:"journalctl"}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["The log level can be configured via the CNI network configuration file, by changing the value of the\nkey ",(0,o.jsx)(n.code,{children:"log_level"}),". See ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/component-resources/configuration",children:"Configuring the Calico Enterprise CNI plugins"})," for more information."]}),"\n",(0,o.jsxs)(n.p,{children:["CNI plugin logs can also be found in ",(0,o.jsx)(n.code,{children:"/var/log/calico/cni"}),"."]}),"\n",(0,o.jsx)(n.h2,{id:"how-do-i-configure-the-pod-ip-range",children:"How do I configure the pod IP range?"}),"\n",(0,o.jsxs)(n.p,{children:["When using Calico Enterprise IPAM, IP addresses are assigned from ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/resources/ippool",children:"IP Pools"}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["By default, all enabled IP pools are used. However, you can specify which IP pools to use for IP address management in the ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/component-resources/configuration#ipam",children:"CNI network config"}),",\nor on a per-pod basis using ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/component-resources/configuration#using-kubernetes-annotations",children:"Kubernetes annotations"}),"."]}),"\n",(0,o.jsx)(n.h2,{id:"how-do-i-assign-a-specific-ip-address-to-a-pod",children:"How do I assign a specific IP address to a pod?"}),"\n",(0,o.jsx)(n.p,{children:"For most use cases it's not necessary to assign specific IP addresses to a Kubernetes pod and it's recommended to use Kubernetes services instead.\nHowever, if you do need to assign a particular address to a pod, Calico Enterprise provides two ways of doing this:"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["You can request an IP that is available in Calico Enterprise IPAM using the ",(0,o.jsx)(n.code,{children:"cni.projectcalico.org/ipAddrs"})," annotation."]}),"\n",(0,o.jsxs)(n.li,{children:["You can request an IP using the ",(0,o.jsx)(n.code,{children:"cni.projectcalico.org/ipAddrsNoIpam"})," annotation. Note that this annotation bypasses the configured IPAM plugin, and thus in most cases it is recommended to use the above annotation."]}),"\n"]}),"\n",(0,o.jsxs)(n.p,{children:["See the ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/component-resources/configuration#requesting-a-specific-ip-address",children:"Requesting a specific IP address"})," section in the CNI plugin reference documentation for more details."]}),"\n",(0,o.jsx)(n.h2,{id:"why-cant-i-see-the-16925411-address-mentioned-above-on-my-host",children:"Why can't I see the 169.254.1.1 address mentioned above on my host?"}),"\n",(0,o.jsxs)(n.p,{children:["Calico Enterprise tries hard to avoid interfer

1ing with any other configuration\non the host. Rather than adding the gateway address to the host side\nof each workload interface, Calico Enterprise sets the ",(0,o.jsx)(n.code,{children:"proxy_arp"})," flag on the\ninterface. This makes the host behave like a gateway, responding to\nARPs for 169.254.1.1 without having to actually allocate the IP address\nto the interface."]}),"\n",(0,o.jsx)(n.h2,{id:"why-do-all-cali-interfaces-have-the-mac-address-eeeeeeeeeeee",children:"Why do all cali* interfaces have the MAC address ee:ee:ee:ee:ee:ee?"}),"\n",(0,o.jsx)(n.p,{children:"In some setups the kernel is unable to generate a persistent MAC address and so\nCalico Enterprise assigns a MAC address itself. Since Calico Enterprise uses\npoint-to-point routed interfaces, traffic does not reach the data link layer\nso the MAC Address is never used and can therefore be the same for all the\ncali* interfaces."}),"\n",(0,o.jsx)(n.h2,{id:"can-i-prevent-my-kubernetes-pods-from-initiating-outgoing-connections",children:"Can I prevent my Kubernetes pods from initiating outgoing connections?"}),"\n",(0,o.jsxs)(n.p,{children:["Yes! The Kubernetes ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/services-networking/network-policies/",children:(0,o.jsx)(n.code,{children:"NetworkPolicy"})}),"\nAPI added support for egress policies in v1.8. You can also use ",(0,o.jsx)(n.code,{children:"calicoctl"}),"\nto configure egress policy to prevent Kubernetes pods from initiating outgoing\nconnections based on the full set of supported Calico Enterprise policy primitives\nincluding labels, Kubernetes namespaces, CIDRs, and ports."]}),"\n",(0,o.jsx)(n.h2,{id:"ive-heard-calico-enterprise-uses-proxy-arp-doesnt-proxy-arp-cause-a-lot-of-problems",children:"I've heard Calico Enterprise uses proxy ARP, doesn't proxy ARP cause a lot of problems?"}),"\n",(0,o.jsx)(n.p,{children:"It can, but not in the way that Calico Enterprise uses it."}),"\n",(0,o.jsx)(n.p,{children:"In container deployments, Calico Enterprise only uses proxy ARP for resolving the\n169.254.1.1 address. The routing table inside the container ensures\nthat all traffic goes via the 169.254.1.1 gateway so that is the only\nIP that will be ARPed by the container."}),"\n",(0,o.jsx)(n.h2,{id:"is-calico-enterprise-compliant-with-pcidss-requirements",children:"Is Calico Enterprise compliant with PCI/DSS requirements?"}),"\n",(0,o.jsxs)(n.p,{children:["PCI certification applies to the whole end-to-end system, of which\nCalico Enterprise would be a part. We understand that most current solutions use\nVLANs, but after studying the PCI requirements documents, we believe\nthat Calico Enterprise does meet those requirements and that nothing in the\ndocuments ",(0,o.jsx)(n.em,{children:"mandates"})," the use of VLANs."]}),"\n",(0,o.jsx)(n.h2,{id:"how-do-i-enable-ip-in-ip-and-nat-outgoing-on-an-ip-pool",children:"How do I enable IP-in-IP and NAT outgoing on an IP pool?"}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsx)(n.p,{children:"Retrieve current IP pool config."}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:"calicoctl get ipPool --export -o yaml > pool.yaml\n"})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsx)(n.p,{children:"Modify IP pool config."}),"\n",(0,o.jsxs)(n.p,{children:["Modify the pool's spec to enable IP-in-IP and NAT outgoing. (See\n",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/resources/ippool",children:"IP pools"}),"\nfor other settings that can be edited.)"]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-shell",children:"- apiVersion: projectcalico.org/v3\n  kind: IPPool\n  metadata:\n   name: ippool-1\n  spec:\n    cidr: 192.168.0.0/16\n    ipipMode: Always\n    natOutgoing: true\n"})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsx)(n.p,{children:"Load the modified file."}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:"kubectl replace -f pool.yaml\n"})}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(n.h2,{id:"how-does-calico-enterprise-maintain-saved-state",children:"How does Calico Enterprise maintain saved state?"}),"\n",(0,o.jsx)(n.p,{children:"State is saved in a few places in a Calico Enterprise deployment, depending on\nwhether it's global or local state."}),"\n",(0,o.jsx)(n.p,{children:"Local state is state that belongs on a single compute host, associated\nwith a 

1single running Felix instance (things like kernel routes, tap\ndevices etc.). Local state is entirely stored by the Linux kernel on the\nhost, with Felix storing it only as a temporary mirror. This makes Felix\neffectively stateless, with the kernel acting as a backing data store on\none side and Kubernetes (kdd) as a data source on the other."}),"\n",(0,o.jsx)(n.p,{children:"If Felix is restarted, it learns current local state by interrogating\nthe kernel at start up. It then reads from the etcd datastore all the local state\nwhich it should have, and updates the kernel to match. This approach has\nstrong resiliency benefits, in that if Felix restarts you don't suddenly\nlose access to your VMs or containers. As long as the Linux kernel is\nrunning, you've still got full functionality."}),"\n",(0,o.jsx)(n.p,{children:"The bulk of global state is mastered in whatever component hosts the\nplugin."}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["In certain cases, ",(0,o.jsx)(n.code,{children:"etcd"})," itself contains the master copy of\nthe data. This is because some Docker deployments have an ",(0,o.jsx)(n.code,{children:"etcd"}),"\ncluster that has the required resiliency characteristics, used to\nstore all system configuration and so ",(0,o.jsx)(n.code,{children:"etcd"})," is configured so as to\nbe a suitable store for critical data."]}),"\n",(0,o.jsx)(n.li,{children:"In other orchestration systems, it may be stored in distributed\ndatabases, either owned directly by the plugin or by the\norchestrator itself."}),"\n"]}),"\n",(0,o.jsx)(n.p,{children:"The only other state storage in a Calico Enterprise network is in the BGP sessions,\nwhich approximate a distributed database of routes. This BGP state is\nsimply a replicated copy of the per-host routes configured by Felix\nbased on the global state provided by the orchestrator."}),"\n",(0,o.jsx)(n.p,{children:"This makes the Calico Enterprise design very simple, because we store very little\nstate. All of our components can be shut down and restarted without risk,\nbecause they resynchronize state as necessary. This makes modeling\ntheir behavior extremely simple, reducing the complexity of bugs."}),"\n",(0,o.jsx)(n.h2,{id:"i-heard-calico-enterprise-is-suggesting-layer-2-i-thought-you-were-layer-3-whats-happening",children:"I heard Calico Enterprise is suggesting layer 2: I thought you were layer 3! What's happening?"}),"\n",(0,o.jsxs)(n.p,{children:["It's important to distinguish what Calico Enterprise provides to the workloads\nhosted in a data center (a purely layer 3 network) with what the Calico Enterprise\nproject ",(0,o.jsx)(n.em,{children:"recommends"})," operators use to build their underlying network\nfabric."]}),"\n",(0,o.jsxs)(n.p,{children:["Calico Enterprise's core principle is that ",(0,o.jsx)(n.em,{children:"applications"})," and ",(0,o.jsx)(n.em,{children:"workloads"}),"\noverwhelmingly need only IP connectivity to communicate. For this reason\nwe build an IP-forwarded network to connect the tenant applications and\nworkloads to each other and the broader world."]}),"\n",(0,o.jsxs)(n.p,{children:["However, the underlying physical fabric obviously needs to be set up\ntoo. Here, Calico Enterprise has discussed how both a layer 2 (see\n",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/architecture/design/l2-interconnect-fabric",children:"here"}),")\nor a layer 3 (see\n",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/architecture/design/l3-interconnect-fabric",children:"here"}),")\nfabric\ncould be integrated with Calico Enterprise. This is one of the great strengths of\nthe Calico Enterprise model: it allows the infrastructure to be decoupled from what\nwe show to the tenant applications and workloads."]}),"\n",(0,o.jsx)(n.p,{children:'We have some thoughts on different interconnect approaches (as noted\nabove), but just because we say that there are layer 2 and layer 3 ways\nof building the fabric, and that those decisions may have an impact on\nroute scale, does not mean that Calico Enterprise is "going back to Ethernet" or\nthat we\'re recommending layer 2 for tenant applications. In all cases we\nforward on IP packets, no matter what architecture is used to build the\nfabric.'}),"\n",(0,o.jsx)(n.h2,{id:"how-do-i-control-policyconnectivity-without-virtualphysical-firewalls",children:"How do I control policy/connectivity without virtual/physical firewalls?"}),"\n",(0,o.jsx)(n.p,{children:"Calico Enterprise provides an extremely rich security policy model, applying policy at the first and last hop\nof the routed traffic within the Calico Enterprise network (the source and\ndestination compute hosts)."}),"\n",(0,o.jsx)(n.p,{children:"This model is substantially more robust to failure than a centralized\nfirewall-based model. In particular, the Calico Enterprise approach has no\nsingle point of failure: if the device enforcing the firewall has failed\nthen so has one of the workloads involved in the traffic (because the\nfirewall is enforced by the compute host)."}),"\n",(0,o.jsx)(n.p,{children:"This model is also extremely amenable to scaling out. Because we have a\ncentral repository of policy configuration, but apply it at the edges of\nthe network (the hosts) where it is needed, we automatically ensure that\nthe rules match the topology of the data center. This allows easy\nscaling out, and g

1ives us all the advantages of a single firewall (one\nplace to manage the rules), but none of the disadvantages (single points\nof failure, state sharing, hairpinning of traffic, etc.)."}),"\n",(0,o.jsxs)(n.p,{children:["Lastly, we decouple the reachability of nodes and the policy applied to\nthem. We use BGP to distribute the topology of the network, telling\nevery node how to get to every endpoint in case two endpoints need to\ncommunicate. We use policy to decide ",(0,o.jsx)(n.em,{children:"if"})," those two nodes should\ncommunicate, and if so, how. If policy changes and two endpoints should\nnow communicate, where before they shouldn\u2019t have, all we have to do is\nupdate policy: the reachability information does not change. If later\nthey should be denied the ability to communicate, the policy is updated\nagain, and again the reachability doesn\u2019t have to change."]}),"\n",(0,o.jsxs)(n.h2,{id:"why-isnt-the--p-flag-on-docker-run-working-as-expected",children:["Why isn't the ",(0,o.jsx)(n.code,{children:"-p"})," flag on ",(0,o.jsx)(n.code,{children:"docker run"})," working as expected?"]}),"\n",(0,o.jsxs)(n.p,{children:["The ",(0,o.jsx)(n.code,{children:"-p"})," flag tells Docker to set up port mapping to connect a port on the\nDocker host to a port on your container via the ",(0,o.jsx)(n.code,{children:"docker0"})," bridge."]}),"\n",(0,o.jsxs)(n.p,{children:["If a host's containers are connected to the ",(0,o.jsx)(n.code,{children:"docker0"})," bridge interface, Calico Enterprise\nwould be unable to enforce security rules between workloads on the same host;\nall containers on the bridge would be able to communicate with one other."]}),"\n",(0,o.jsx)(n.h2,{id:"can-calico-enterprise-containers-use-any-ip-address-within-a-pool-even-subnet-networkbroadcast-addresses",children:"Can Calico Enterprise containers use any IP address within a pool, even subnet network/broadcast addresses?"}),"\n",(0,o.jsx)(n.p,{children:"Yes! Calico Enterprise is fully routed, so all IP address within a Calico Enterprise pool are usable as\nprivate IP addresses to assign to a workload. This means addresses commonly\nreserved in a L2 subnet, such as IPv4 addresses ending in .0 or .255, are perfectly\nokay to use."}),"\n",(0,o.jsx)(n.h2,{id:"how-do-i-get-network-traffic-into-and-out-of-my-calico-enterprise-cluster",children:"How do I get network traffic into and out of my Calico Enterprise cluster?"}),"\n",(0,o.jsx)(n.p,{children:"The recommended way to get traffic to/from your Calico Enterprise network is by peering to\nyour existing data center L3 routers using BGP and by assigning globally\nroutable IPs (public IPs) to containers that need to be accessed from the internet.\nThis allows incoming traffic to be routed directly to your containers without the\nneed for NAT. This flat L3 approach delivers exceptional network scalability\nand performance."}),"\n",(0,o.jsx)(n.p,{children:"A common scenario is for your container hosts to be on their own\nisolated layer 2 network, like a rack in your server room or an entire data\ncenter. Access to that network is via a router, which also is the default\nrouter for all the container hosts."}),"\n",(0,o.jsxs)(n.p,{children:["If this describes your infrastructure,\n[Configure outgoing NAT](../networking/configuring/workloads-outside-cluster.mdx explains in more detail\nwhat to do. Otherwise, if you have a layer 3 (IP) fabric, then there are\ndetailed datacenter networking recommendations given\nin ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/architecture/design/l3-interconnect-fabric",children:"Calico Enterprise over IP fabrics"}),".\nWe'd also encourage you to ",(0,o.jsx)(n.a,{href:"https://www.projectcalico.org/contact",children:"get in touch"}),"\nto discuss your environment."]}),"\n",(0,o.jsx)(n.h3,{id:"how-can-i-enable-nat-for-outgoing-traffic-from-containers-with-private-ip-addresses",children:"How can I enable NAT for outgoing traffic from containers with private IP addresses?"}),"\n",(0,o.jsx)(n.p,{children:"If you want to allow containers with private IP addresses to be able to access the\ninternet then you can use your data center's existing outbound NAT capabilities\n(typically provided by the data center's border routers)."}),"\n",(0,o.jsx)(n.p,{children:"Alternatively you can use Calico Enterprise's built in outbound NAT capability by enabling it on any\nCalico Enterprise IP pool. In this case Calico Enterprise will perform outbound NAT locally on the compute\nnode on which each container is hosted."}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:"cat <<EOF | kubectl apply -f -\napiVersion: projectcalico.org/v3\nkind: IPPool\nmetadata:\n  name: ippool-1\nspec:\n  cidr: <CIDR>\n  natOutgoing: true\nEOF\n"})}),"\n",(0,o.jsxs)(n.p,{children:["Where ",(0,o.jsx)(n.code,{children:"<CIDR>"})," is the CIDR of your IP pool, for example ",(0,o.jsx)(n.code,{children:"192.168.0.0/16"}),"."]}),"\n",(0,o.jsx)(n.p,{children:"Remember: the security profile for the container will need to allow traffic to the\ninternet as well. Refer to the appropriate guide for your orchestration\nsystem for details on how to configure policy."}),"\n",(0,o.jsx)(n.h3,{id:"how-can-i-enable-nat-for-incoming-traffic-to-containers-with-private-ip-addresses",children:"How can I enable NAT for incoming traffic to containers with private IP addresses?"}),"\n",(0,o.jsx)(n.p,{children:"As discussed, the recommended way to get traffic to containers that\nneed to be accessed from the internet is to give them public IP addresses and\nto configure Calico Enterprise to peer with the data center's existing L3 routers."}),"\n",(0,o.jsx)(n.p,{children:"In cases where this is not possible then you can configure incoming NAT\n(also known as DNAT) on your data centers existing border routers. Alternatively\nyou can configure incoming NAT with port mapping on the host on which the container\nis running on."}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["Create a new chain called ",(0,o.jsx)(n.code,{children:"expose-ports"})," to hold the NAT rules."]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:"iptables -t nat -N expose-ports\n"})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["Jump to that chain from the ",(0,o.jsx)(n.code,{children:"OUTPUT"})," and ",(0,o.jsx)(n.code,{children:"PREROUTING"})," chains."]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:"iptables -t nat -A OUTPUT -j expose-ports\niptables -t nat -A PREROUTING -j expose-ports\n"})}),"\n",(0,o.jsx)(n.admonition,{type:"tip",children:(0,o.jsxs)(n.p,{children:["The ",(0,o.jsx)(n.code,{children:"OUTPUT"}

1)," chain is hit by traffic originating on the host itself;\nthe ",(0,o.jsx)(n.code,{children:"PREROUTING"})," chain is hit by traffic coming from elsewhere."]})}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["For each port you want to expose, add a rule to the\nexpose-ports chain, replacing ",(0,o.jsx)(n.code,{children:"<PUBLIC_IP>"})," with the host IP that you\nwant to use to expose the port and ",(0,o.jsx)(n.code,{children:"<PUBLIC_PORT>"})," with the host port."]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:"iptables -t nat -A expose-ports -p tcp --destination <PUBLIC_IP> \\\n--dport <PUBLIC_PORT> -j DNAT  --to <CALICO_IP>:<SERVICE_PORT>\n"})}),"\n"]}),"\n"]}),"\n",(0,o.jsxs)(n.p,{children:["For example, you have a container to which you've assigned the ",(0,o.jsx)(n.code,{children:"CALICO_IP"}),"\nof 192.168.7.4, and you have NGINX running on port 8080 inside the container.\nIf you want to expose this service on port 80 and your host has IP 192.0.2.1,\nthen you could run the following commands:"]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:"iptables -t nat -N expose-ports\niptables -t nat -A OUTPUT -j expose-ports\niptables -t nat -A PREROUTING -j expose-ports\n\niptables -t nat -A expose-ports -p tcp --destination 192.0.2.1 --dport 80 -j DNAT --to 192.168.7.4:8080\n"})}),"\n",(0,o.jsx)(n.p,{children:"The commands will need to be run each time the host is restarted."}),"\n",(0,o.jsx)(n.p,{children:"Remember: the security profile for the container will need to allow traffic to the exposed port as well.\nRefer to the appropriate guide for your orchestration system for details on how to configure policy."}),"\n",(0,o.jsx)(n.h3,{id:"can-i-run-calico-enterprise-in-a-public-cloud-environment",children:"Can I run Calico Enterprise in a public cloud environment?"}),"\n",(0,o.jsx)(n.p,{children:"Yes. If you are running in a public cloud that doesn't allow either L3 peering or L2 connectivity between Calico Enterprise hosts then you can enable IP-in-IP in your Calico Enterprise IP pool:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:"cat <<EOF | kubectl apply -f -\napiVersion: projectcalico.org/v3\nkind: IPPool\nmetadata:\n  name: ippool-1\nspec:\n  cidr: <CIDR>\n  ipipMode: Always\n  natOutgoing: true\nEOF\n"})}),"\n",(0,o.jsx)(n.p,{children:"Calico Enterprise will then route traffic between Calico Enterprise hosts using IP-in-IP."}),"\n",(0,o.jsxs)(n.p,{children:["For best performance in AWS, you can disable ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/resources/felixconfig#spec",children:"Source/Destination Check"})," instead of using IP-in-IP or VXLAN; but only if all your instances are in the same subnet of your VPC. The setting must be ",(0,o.jsx)(n.code,{children:"Disable"})," for the EC2 instance(s) to process traffic not matching the host interface IP address. This is also applicable if your cluster is spread across multiple subnets. If your cluster traffic crosses subnets, set ",(0,o.jsx)(n.code,{children:"ipipMode"})," (or ",(0,o.jsx)(n.code,{children:"vxlanMode"}),") to ",(0,o.jsx)(n.code,{children:"CrossSubnet"})," to reduce the encapsulation overhead. Check ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/networking/configuring/vxlan-ipip",children:"configuring overlay networking"})," for the details."]}),"\n",(0,o.jsxs)(n.p,{children:["You can disable Source/Destination Check using ",(0,o.jsx)(n.a,{href:"/calico-enterprise/3.20/reference/resources/felixconfig",children:"Felix configuration"}),", the AWS CLI, or the EC2 console. For example, using the AWS CLI:"]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-bash",children:'aws ec2 modify-instance-attribute --instance-id <INSTANCE_ID> --source-dest-check "{\\"Value\\": false}"\n\ncat <<EOF | kubectl apply -f -\napiVersion: projectcalico.org/v3\nkind: IPPool\nmetadata:\n  name: ippool-2\nspec:\n  cidr: <CIDR>\n  natOutgoing: true\nEOF\n'})}),"\n",(0,o.jsx)(n.h3,{id:"on-aws-with-ip-in-ip-why-do-i-see-no-connectivity-between-workloads-or-only-see-connectivity-if-i-ping-in-both-directions",children:"On AWS with IP-in-IP, why do I see no connectivity between workloads or only see connectivity if I ping in both directions?"}

1),"\n",(0,o.jsx)(n.p,{children:"By default, AWS security groups block incoming IP-in-IP traffic."}),"\n",(0,o.jsx)(n.p,{children:"However, if an instance has recently sent some IP-in-IP traffic out when it receives some incoming IP-in-IP traffic,\nthen AWS sees that as a response to an outgoing connection and it allows the incoming traffic. This leads to some very\nconfusing behavior where traffic can be blocked and then suddenly start working!"}),"\n",(0,o.jsx)(n.p,{children:"To resolve the issue, add a rule to your security groups that allows inbound and outbound IP-in-IP traffic (IP protocol\nnumber 4) between your hosts."}),"\n",(0,o.jsx)(n.h2,{id:"can-calico-do-ip-multicast",children:"Can Calico do IP multicast?"}),"\n",(0,o.jsx)(n.p,{children:"Calico is a routed L3 network where each pod gets a /32. There's no broadcast domain for pods.\nThat means that multicast doesn't just work as a side effect of broadcast. To get multicast to\nwork, the host needs to act as a multicast gateway of some kind. Calico's architecture was designed\nto extend to cover that case but it's not part of the product as yet."})]})}function h(e={}){let{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},3413(e,n,t){t.d(n,{R:()=>r,x:()=>a});var i=t(16645);let o={},s=i.createContext(o);function r(e){let n=i.useContext(s);return i.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),i.createElement(s.Provider,{value:n},e.children)}}}]);