> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Multi-Path Routing and Failover with Local Virtual Networks

> Configure a Local virtual network with adapter labels, static routes, and probing for multi-path routing, automatic failover, and port-forwarding limits.

## Introduction

This use case demonstrates how to configure a Local virtual network on a node with multiple network interfaces to implement multi-path routing, automatic failover, and inbound port-forwarding restrictions. The same techniques apply to any node that requires redundant connectivity or selective application access policies.

For a description of static routes, connected routes, and probing, see [Virtual Networks Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks.md).

### Prerequisites

* EVE-OS (Edge Virtualization Engine) 13.3.0 or later on the target node.
* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* A node with at least four physical Ethernet ports onboarded to Edge Infrastructure Services.
* An edge application created in your enterprise.

## Example Scenario

In this scenario, the node has four Ethernet ports: eth0, eth1, eth2, and eth3. Each port is connected to a different subnet. The requirements are:

* Internet connectivity with automatic failover across multiple ports.
* Connectivity to the local network of each port.
* SSH access into the application instance through eth0, eth1, and eth3, but not eth2.
* Connectivity to a remote HTTP server, with failover.

![Diagram showing the example scenario: a four-port node with adapter labels assigned to eth0, eth1, eth2, and eth3, connected to internet and local subnets.](https://mintcdn.com/zededa/nH470gZ2VKSQBZu8/new-ui/infrastructure-services/virtual-networks/images/multipath_example_scenario.png?fit=max\&auto=format\&n=nH470gZ2VKSQBZu8\&q=85\&s=29e0d4c8786bd0ef42ed6f72a10c5f7f)

## Add Adapter Labels to the Node

Adapter labels group ports so that a single virtual network route can use multiple ports with automatic failover.

1. Navigate to the node's configuration in Edge Infrastructure Services.
2. In the **Adapters** tab, assign the following labels to the node ports:

   * `eth0`: `internet`, `portfwd`
   * `eth1`: `internet`, `httpsrv`, `portfwd`
   * `eth2`: `all`
   * `eth3`: `httpsrv`, `portfwd`

## Create a Local Virtual Network

Create a Local virtual network on the node and assign all ports to it using the **Adapter Labels > All** predefined port group. The virtual network routes you configure in the next step will control which ports carry which traffic.

1. In the sidebar, click **Infrastructure > Workloads > Virtual Networks**.
2. Select the contextual **+** create action and create a **Local** virtual network on the node.
3. In the **Node Port** field, select **Adapter Labels > All** to make all node ports available to the virtual network.
4. Proceed to the **Routes** section.

### Configure static routes

Add the following two static routes in the **Routes** section:

**Route 1: Internet connectivity**

* **Prefix**: `0.0.0.0/0`.
* **Gateway**: leave blank (EVE-OS automatically uses the default gateway of the selected output port).
* **Output Port**: `internet` (the adapter label you assigned to eth0 and eth1).

**Route 2: HTTP server connectivity**

* **Prefix**: `10.88.88.0/24` (the subnet of the HTTP server).
* **Gateway**: leave blank.
* **Output Port**: `httpsrv` (the adapter label you assigned to eth1 and eth3).

Selecting an adapter label as the output port creates a multi-path route. EVE-OS probes all ports with that label and automatically switches to a working port when the current port loses connectivity.

### Configure probing

When you select an adapter label as the output port for a route, a probing configuration section appears directly below that route row. Configure probing for each adapter-label route separately.

For the Internet route (output port: `internet`):

1. Toggle **Prefer Low Adapter Cost** on.
2. Toggle **Gateway Ping** on.

For the HTTP server route (output port: `httpsrv`):

1. Toggle **Prefer Low Adapter Cost** on.
2. Toggle **Custom User Probe** on.
3. Set **Probing Method** to **TCP**.
4. Set **Custom Probing Address** to `10.88.88.70` (the HTTP server IP address).
5. Set **TCP Port** to `80`.

Click **Create** to save the virtual network.

## Configure Port Forwarding on the Application

Restrict SSH access to the application instance so that it is reachable through eth0, eth1, and eth3, but not eth2.

1. Navigate to your edge application in the marketplace.
2. Edit the application definition.
3. In the **Environment** section, add an inbound rule with the following settings: **Node Port** `2222`, **Application Port** `22`, **Protocol** TCP, and **Allowed Sources** set to the adapter label `portfwd` (which covers eth0, eth1, and eth3).

This rule forwards TCP port 2222 on the allowed ports to port 22 inside the application instance, while blocking SSH access through eth2.

## Result

After applying these configurations:

* EVE-OS selects the best available port with the `internet` label for outbound internet traffic, and fails over automatically if that port loses connectivity.
* EVE-OS selects the best available port with the `httpsrv` label for traffic to the HTTP server, with TCP handshake probing confirming server reachability.
* The application instance accepts SSH connections through eth0, eth1, and eth3 only.

![Diagram showing the result: traffic flows for internet, HTTP server, and SSH routes across the labeled ports on the node.](https://mintcdn.com/zededa/nH470gZ2VKSQBZu8/new-ui/infrastructure-services/virtual-networks/images/multipath_result.png?fit=max\&auto=format\&n=nH470gZ2VKSQBZu8\&q=85\&s=bfd9412114f0fcd72ad934b98fbce576)

## Next Steps

> [card] [Virtual Networks Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks.md)
>
> Reference documentation on static routes, adapter labels, and probing.

> [card] [Create a Virtual Network](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/create-a-virtual-network.md)
>
> The full creation wizard walkthrough.

> [card] [Manage a Virtual Network](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/manage-a-virtual-network.md)
>
> Update routes and configuration after creation.