Assigning Dedicated IP and Physical Network Interfaces to Solaris Zones

When architecting secure multitenant enterprise deployments on Sun SPARC hardware, isolating network traffic across isolated non-global zones is essential. Standard installations share physical interface addresses across the global host. However, strict network isolation requires reassigning distinct physical ethernet interfaces (bge0, igb0) or modifying IP addresses dynamically without interrupting adjacent services.

In this operational manual, I outline how to interactively inspect running zone network parameters, delete legacy shared bindings, and reconfigure physical datalinks using zonecfg.

Step 1: Querying Currently Assigned Interfaces

Before executing network modifications on an active zone (such as SUNBOX15), review the active interface definition block to ensure zero address overlap.

zonecfg -z SUNBOX15 info

zonepath: /export/SUNBOX15
autoboot: true
pool: 
net:
        address: 10.10.10.149/24
        physical: bge0

---

Step 2: Modifying Active Zone Interface Assignments

To transition an interface from legacy Broadcom ethernet hardware (bge0) to high-throughput Intel Gigabit hardware (igb0) or update static routing blocks, launch interactive configuration edit mode.

zonecfg -z SUNBOX15

Removing Legacy Bound Subnets

Select the matching active interface definition and remove it from the zone configuration profile:

zonecfg:SUNBOX15> remove net address=10.10.10.149/24

Establishing New Datalink Parameters

Define fresh subnet addressing, link physical hardware pointers, and assign explicit default gateway routing:

zonecfg:SUNBOX15> add net
zonecfg:SUNBOX15:net> set address=10.10.10.187/24
zonecfg:SUNBOX15:net> set physical=igb0
zonecfg:SUNBOX15:net> set defrouter=10.10.10.200
zonecfg:SUNBOX15:net> end

Verify internal syntax consistency and commit changes to persistent non-global internal XML records:

zonecfg:SUNBOX15> verify
zonecfg:SUNBOX15> commit
zonecfg:SUNBOX15> exit

---

Step 3: Enforcing Profile Dynamic Instantiation

To enforce the newly assigned physical datalinks and routing policies, reboot the target container instance via zoneadm.

# Verify global zone network links before rebooting
ifconfig -a | grep igb0

# Enforce dynamic container reboot
zoneadm -z SUNBOX15 reboot

Execute a post-boot validation pass to confirm that IP interfaces have initialized successfully on the underlying physical hardware layer:

zoneadm list -cv

References

• Configuring Shared and Exclusive Network IP in Zones
• Managing SPARC Ethernet Data Links