// Module included in the following assemblies:
//
// * networking/ovn_kubernetes_network_provider/configuring-egress-ips-ovn.adoc

:_mod-docs-content-type: CONCEPT
[id="nw-egress-ips-multi-nic-considerations_{context}"]
= Considerations for using an egress IP address on additional network interfaces

[role="_abstract"]
In {product-title}, egress IP addresses provide administrators a way to control network traffic. You can use egress IP addresses with a `br-ex` Open vSwitch (OVS) bridge interface. You can also use any physical interface that has IP connectivity enabled.

You can inspect your network interface type by running the following command:

[source,terminal]
----
$ ip -details link show
----

The primary network interface is assigned a node IP address which also contains a subnet mask. You can retrieve this node IP address information from the Kubnernetes node object. Inspect the `k8s.ovn.org/node-primary-ifaddr` annotation for each node in your cluster. In an IPv4 cluster, this annotation is similar to the following example: `"k8s.ovn.org/node-primary-ifaddr: {"ipv4":"192.168.111.23/24"}"`.

If the egress IP address is not within the subnet of the primary network interface subnet, use another Linux network interface. This interface must not be of the primary network interface type. With this approach, an administrator can provide a greater level of control over networking aspects such as routing, addressing, segmentation, and security policies. With this feature, you can route workload traffic over specific network interfaces for purposes such as traffic segmentation or meeting specialized requirements.

If the egress IP address is not within the subnet of the primary network interface, then the selection of another network interface for egress traffic might occur if they are present on a node.

You can determine which other network interfaces might support egress IP address addresses by inspecting the `k8s.ovn.org/host-cidrs` Kubernetes node annotation. This annotation contains the addresses and subnet mask found for the primary network interface. The annotation also contains additional network interface addresses and subnet mask information. These addresses and subnet masks are assigned to network interfaces that use the longest prefix match routing mechanism to determine which network interface supports the egress IP address. For more information, see "Longest prefix match routing" in the _Additional resources_ section.

[NOTE]
====
By using OVN-Kubernetes, you can control how outbound traffic leaves the cluster. You can configure traffic from specific namespaces or pods to exit through a chosen network interface and use a designated egress IP address. This configuration routes application traffic over specific network paths, providing better network isolation and traffic management.
====

As an administrator who wants an egress IP address and traffic to route over a particular interface that is not the primary network interface, you must meet the following conditions:

* {product-title} is installed on a bare-metal cluster. This feature is disabled within a cloud or a hypervisor environment.

* Your {product-title} pods are not configured as _host-networked_.

* You understand that if a network interface is removed or if the IP address and subnet mask which allows the egress IP address to be hosted on the interface is removed, reconfiguration of the egress IP address occurs. Consequently, the egress IP address might get assigned to another node and interface.

* You configured a NIC with routes by ensuring a gateway exists in the main routing table. As a postinstallation task, Red Hat does not support configuring a NIC on a cluster that uses OVN-Kubernetes.

* Routes associated with an egress interface get copied from the main routing table to the routing table that was created to support the Egress IP object. 

* You can use an Egress IP address on a secondary network interface card (NIC). However, you must use the Node Tuning Operator to enable IP forwarding on the secondary NIC.
+
[IMPORTANT]
====
Red{nbsp}Hat does not support EgressIP multi-NIC configurations when the target network interface is bound to a VRF instance.
====
