Network Overview

1.1. Network Types

Physical Networks

  • Zone-level network configuration

  • Defines traffic types (Guest, Management, Storage, Public)

  • Sets isolation method (VLAN or VXLAN)

  • Template for infrastructure networking

Guest Networks

  • VM-level network configuration

  • Three types: Isolated, Shared, and L2

  • VMs connect to guest networks

  • Provides network services to VMs

Isolation Method Selection (VLAN vs VXLAN)

Use this quick guide when creating or updating physical networks:

Method

Choose when

Watch-outs

VLAN

You need simple L2 segmentation and your switch fabric is already VLAN-based.

Limited ID space (1-4094), requires switch trunk/allowed-VLAN alignment.

VXLAN

You need large-scale tenant segmentation or stretched overlay design across L3 underlay.

Requires overlay-capable network design and MTU headroom: VXLAN adds 50 bytes of encapsulation overhead.

Important

The underlay MTU is the master value; the overlay MTU is derived from it (overlay MTU = underlay MTU - 50). Never set an overlay MTU separately. Size the underlay at least 50 bytes above the guest MTU you want - for a 9000-byte guest MTU the underlay must be at least 9050.

The underlay MTU is declared once at the installer/bootstrap layer. On K-Nets -> SDN Fabric the fabric plan’s Underlay MTU field echoes it and is locked read-only once the live cluster value is known.

1.1.1. Why Configure Traffic Types

Traffic types exist so each class of traffic can be controlled independently for reliability, security, and scale.

Traffic Type

Why it exists

When you need to add/change it

Management

Carries host and system-VM control-plane communication.

Add or expand when onboarding more hosts/system VMs or when management IP capacity is low.

Storage

Carries host-to-storage I/O paths and helps isolate storage load from other traffic.

Add or expand when storage traffic grows, latency is high, or storage IP capacity is low.

Public

Provides internet-facing IP space for NAT, port forwarding, VPN, and external exposure.

Add when workloads need public ingress/egress; skip for internal-only deployments.

Guest

Defines the VM-attached networks where workload traffic actually flows.

Change when you need new tenant/network segments, custom VLAN/VXLAN mapping, or shared-subnet design.

1.1.2. Guest Network Type Descriptions (Plain Language)

  • Isolated: private VM network with built-in network services (DHCP/NAT/firewall).

  • Shared: flat VM network on a shared subnet. Use when VMs must be directly reachable on an existing network design.

  • L2: pure Layer-2 segment with no built-in gateway, DHCP, or NAT - Karios attaches VMs to the segment and your own (external) services handle addressing. An L2 segment is backed by either a VXLAN VNI on the EVPN fabric or a native 802.1Q VLAN on an existing VLAN physical network. You choose which when you create it, using the VLAN / VXLAN control on the create form.

Note

Only the VXLAN-backed L2 family needs a configured EVPN fabric. The VLAN-backed L2 family rides the operator’s existing 802.1Q VLAN physical network, so it is the one guest-network path that still works when no fabric is configured.

1.2. Network Hierarchy

Zone
└── Physical Network
├── Guest Traffic Type → Guest Networks (VMs)
├── Management Traffic Type (Hosts, System VMs)
├── Storage Traffic Type (Storage communication)
└── Public Traffic Type (External access)

1.3. Network Modules (UI)

Networking has its own module, K-Nets, on the left icon rail. The same pages are also reachable from the Network category inside Control Center. This guide leads with the K-Nets path and names the Control Center path as the alternate.

Modules documented in this guide:

  • Physical Network: K-Nets -> Physical Network (also Control Center -> Network -> Physical Network)

  • Guest Network: K-Nets -> Guest Network

  • VM Networking: K-Nets -> VM Networking

  • SDN Fabric: K-Nets -> SDN Fabric

  • Fabric Topology: K-Nets -> Fabric Topology

  • Network Topology: K-Nets -> Network Topology

  • IPAM: K-Nets -> IPAM

  • Network Config: K-Nets -> Network Config (cluster MTU, zone DNS/NTP)

  • VPCs: K-Nets -> VPCs

Also present in the sidebar, not covered by this guide:

  • Dashboard: K-Nets -> Dashboard (the module landing page; exists only under K-Nets)

  • DNS Analytics: K-Nets -> DNS Analytics

Note

The K-Nets module is hidden from non-root tenant accounts. Those accounts reach the same pages through Control Center -> Network, which does not include the Dashboard entry.

Note

This guide includes full new-user paths for the modules it documents, including VPCs. The SDN Fabric section in particular covers the full lifecycle - first-time setup (Add fabric switch, with the underlay preflight as a hard gate), the health dashboard and BGP/OSPF/EVPN/RIB node tabs, and the troubleshooting flow.

→ Next: Physical Networks