Go to main content

Creating and Using Oracle® Solaris Zones

Exit Print View

Updated: August 2019

How to Create a Private Network of Multiple Zones

This procedure summarizes the steps to set up a private network of zones.

  1. Become a zone administrator.

    For more information, see Using Rights Profiles to Install and Manage Zones.

  2. Create the etherstub and VNICs on the global zone.

    Use the appropriate dladm subcommands. See the dladm(8) man page or How to Configure VNICs and Etherstubs in Managing Network Virtualization and Network Resources in Oracle Solaris 11.4.

  3. Configure and install the zones of the private network.

    To complete this step quickly by using a source zone, see How to Install and Deploy Zones by Cloning.

  4. Configure the zones' physical property.

    To configure interactively, see How to Configure Zone Properties and Resources.

  5. Boot the zones.
    global$ zoneadm -z zonename boot
  6. Configure the zones' VNICs with IP addresses.

    For this step, you would typically log in to each zone.

    global$ zlogin -C zonename

    Then you use appropriate ipadm subcommands to configure the VNICs. For reference, see the ipadm(8) man page or How to Configure an IPv4 Interface in Configuring and Managing Network Components in Oracle Solaris 11.4.

Example 14  Setting Up a Private Network

This example goes through the process of setting zone0, zone1, and zone2 as a private network. The scenario consists of the following:

  • The global zone's IP address is

  • The private network of the zones is

  • The zones (zone0, zone1, and zone2) will be configured with VNICs (vnic0, vnic1, and vnic2, respectively).

This example assumes that the zones have already been created and installed.

For demonstration purposes, instead of using zonecfg interactively, zone configuration will be performed on the global zone as described in Performing Zone Configuration From the Global Zone. Likewise, IP configuration will be performed from the global zone instead of from within each zone, as described in Using the zlogin Command.

Prepare the etherstub and VNICs on the host.
global$ dladm create-etherstub stub0
global$ dladm create-vnic -l stub0 vnic0
global$ dladm create-vnic -l stub0 vnic1
global$ dladm create-vnic -l stub0 vnic2

Set the zones' physical property.
global$ zonecfg -z zone0 "add net;set physical=vnic0; end"
global$ zonecfg -z zone1 "add net;set physical=vnic1; end"
global$ zonecfg -z zone2 "add net;set physical=vnic2; end"

Boot the zones.
global$ zoneadm -z zone0 boot
global$ zoneadm -z zone1 boot
global$ zoneadm -z zone2 boot

Configure the VNICs with IP addresses.
global$ zlogin zone0 ipadm create-ip vnic0
global$ zlogin zone0 ipadm create-addr -a vnic0

global$ zlogin zone1 ipadm create-ip vnic1
global$ zlogin zone1 ipadm create-addr -a vnic0

global$ zlogin zone2 ipadm create-ip vnic2
global$ zlogin zone2 ipadm create-addr -a vnic0

Display all the information.
global$ dladm
LINK         CLASS      MTU    STATE    OVER
stub0        etherstub  9000   unknown  --
vnic0        vnic       9000   up       stub0
vnic1        vnic       9000   up       stub0
vnic2        vnic       9000   up       stub0
zone0/vnic0  vnic       9000   up       stub0
zone1/vnic1  vnic       9000   up       stub0
zone2/vnic2  vnic       9000   up       stub0

global$ zlogin zone0 ipadm
vnic0        ip       ok          --     --
  vnic0/v4   static   ok          --

global$ zlogin zone1 ipadm
vnic1        ip       ok          --     --
  vnic1/v4   static   ok          --

global$ zlogin zone2 ipadm
vnic2        ip       ok          --     --
  vnic2/v4   static   ok          --

To enable communications between the private network ( and the external network (, configure one of the zones with another port that will provide the connectivity. Enable IP forwarding on that port. For this part of the example, interactive configuration is used.

global$ zonecfg -z zone2
zonecfg:zone2> add net
zonecfg:zone2:net> set physical=net1
zonecfg:zone2:net> end
zonecfg:zone2> exit
global$ zoneadm -z zone2 apply
Checking: Adding net physical=net1
Applying the changes

global$ zlogin zone2
[Connected to zone 'zone2' pts/3]
username@zone2:-$ ipadm create-ip net1
username@zone2:-$ ipadm create-addr -a net1
username@zone2:-$ ipadm
net1         ip       ok          --     --
  net1/v4    static   ok          --

vnic2        ip       ok          --     --
  vnic2/v4   static   ok          --
username@zone2:-$ ipadm set-prop forwarding=on ipv4
username@zone2:-$ exit

[Connection to zone 'zone2' pts/3 closed]
global$ zoneadm -z zone2 reboot

Test the connections by pinging a zone from a system in the network, or conversely, pinging the network from inside a zone.