IB Three-Plane Separation: PKey Partitions, SL/VL and IPoIB

"Separate the three network planes" is one line in the plan and a whole different story on the ground: how to plan PKeys, map SL/VL, attach IPoIB, and switch OpenSM primary/backup — every layer has its verification commands and its traps. This article is the implementation record from delivering a 384-GPU L40S IB cluster.

1. Three Planes: Cutting Fault Domains, Not Just Pulling More Cables

Plane	Devices	Carries	Failure Impact
IB compute (parameter plane)	4×200G HDR × 48 nodes → Leaf/Spine	NCCL, collectives	Training performance
IB storage plane	1×200G HDR × 48 nodes → 2×QM8790	IPoIB + RDMA storage traffic	Data throughput
Ethernet mgmt/business	2×25G Bond × 48 nodes	SSH, monitoring, file sharing	Ops reachability

Judgment: physical plane isolation means "a saturated storage network does not drag down training" and "management jitter does not trigger IB retransmissions." Trading physical isolation for fault domains is the most cost-effective reliability investment a mid-size cluster can make.

2. PKey: The "VLAN" Inside the Subnet

The PKey (Partition Key) splits one subnet into logical partitions; traffic isolation is enforced by PKeys, not by switch configuration. The plan's layout:

PKey	Purpose	Members
0x100	Compute partition	48 compute ports + Leaf/Spine
0x200	Storage partition	48 storage ports + storage switches

• PKeys are membership-based: a port must join a partition to communicate there; wrong partition = no connectivity (and the symptom looks exactly like a cable/driver problem);
• Default partition 0x7fff: every port is a full member by default, so cross-partition traffic is allowed by default — the real security hole. Tighten the default partition before going live;
• Configuration is pushed from OpenSM/switches; node-side verification uses mlnx_qos/ibconfig.

Verification:

# Which partitions does this port belong to (expect 0x7fff + business partitions)
ibdev2netdev
cat /sys/class/infiniband/*/ports/*/pkeys
# Classic cross-partition symptom: sm_poll/ibstat all healthy but ping fails → check PKey

3. SL/VL: Congestion Isolation, Not a QOS Showcase

• SL (Service Level): end-to-end service class carried in the packet;
• VL (Virtual Lane): virtual channels on the physical link, each with independent buffering and scheduling.

This plan maps compute and storage traffic to different SLs; switches assign VLs per SL. The point: storage bursts cannot starve compute buffers — the second layer of isolation, on top of IB's "lossless by design," obtained by explicit planning.

Engineering judgment: most mid-size clusters do not need eight SLs. Two to three (compute high-priority / storage / default mgmt) are enough. Configuring eight SLs as a QOS exhibition has negative returns — every SL needs buffer tuning and verification.

4. IPoIB: The Right Way to Put IP on the Storage Plane

To run TCP/IP applications (NFS/iSCSI) over the storage plane, the IB port must "speak IP" — that is IPoIB:

• connected mode + MTU 65520: IPoIB defaults to datagram mode at MTU 2044, a significant performance gap. Storage must switch to connected mode and enlarge the MTU;
• Traps: mismatched MTU between ends → fragmentation/loss; leftover rdma_rxe software stacks → silently using soft RDMA while thinking it is hardware.

# Switch to connected mode (openEuler)
echo connected > /sys/class/net/ib0/ipoib_mode
ip link set ib0 mtu 65520
# Verify with a large ping: -s 65000 at MTU 65520, zero loss to the storage gateway
ping -s 65000 -M do <storage-gateway>

5. OpenSM Primary/Backup: Don't Split the Subnet

An IB subnet must have exactly one primary SM. The plan:

• Primary SM runs on a node reachable via the management network with reliable power (a standalone management host in this plan);
• The backup SM heartbeats the primary and takes over automatically; the whole subnet's LID/PKey/SL tables are recomputed — failover is not seamless, traffic briefly interrupts;
• Forbidden: multiple hosts running opensm, each believing it is primary. The SM election mechanism (Master/Slave) provides a safety net, but misconfiguration causes flapping.

Verification:

ibstat | grep -A2 "State"        # Port state: Active
smpquery sminfo                   # Who is the current primary SM
opensm -C /etc/opensm.conf -F     # Backup SM resident; watch logs for takeover

6. Delivery Checklist

1. PKey: deploy 0x100/0x200, verify port membership, tighten default partition 0x7fff;
2. SL/VL: three-tier mapping (compute/storage/mgmt), confirm buffer allocation on switches;
3. IPoIB: all storage ports connected mode + MTU 65520, large-ping zero loss;
4. OpenSM: primary + backup, smpquery confirms current primary, run one failover drill;
5. End-to-end acceptance: NCCL on the compute plane, large-file IO on the storage plane, SSH on the mgmt plane — stress all three simultaneously and confirm no interference.

---

Based on field measurements from a 384-GPU L40S IB cluster delivery; exact versions and commands follow on-site validation.