Question about OVS VNETs and arp_cache_poisoning option

Community Support
1

Hi all

This is a very specific use case, for some VNETs (not used by the users just by the sys admins) we have some floating IPs that are not managed by OpenNebula or included in our VNET. The problem is that by default OpenNebula OVS VNETs have the mac-spoofing and IP hijacking rules enabled by default:

http://docs.opennebula.org/5.0/deployment/open_cloud_networking_setup/openvswitch.html#openflow-rules

And that’s great! but we want to disable this for some specific VMs. I saw that is possible to disable it globally just changing /var/lib/one/remotes/vnm/OpenNebulaNetwork.conf and set:

:arp_cache_poisoning: false

But we only want to disable these rules for an specific VM or VNET, it’s possible to do that? I mean it is possible to set ARP_CACHE_POISONING or another similar option within VM NIC or VNET template sections?

Thanks in advance!
Alvaro

2

Álvaro Simón opennebula@discoursemail.com writes:

Hello,

This is a very specific use case, for some VNETs (not used by the users just by the sys admins) we have some floating IPs that are not managed by OpenNebula or included in our VNET. The problem is that by default OpenNebula OVS VNETs have the mac-spoofing and IP hijacking rules enabled by default:

Open vSwitch Networks — OpenNebula 5.0.2 documentation

And that’s great! but we want to disable this for some specific VMs. I saw that is possible to disable it globally just changing /var/lib/one/remotes/vnm/OpenNebulaNetwork.conf and set:

:arp_cache_poisoning: false

But we only want to disable these rules for an specific VM or VNET, it’s possible to do that? I mean it is possible to set ARP_CACHE_POISONING or another similar option within VM NIC or VNET template sections?

I think this join the issue we opened Feature #3387: Make OpenNebulaNetwork.conf settings overridable per network - OpenNebula - OpenNebula Development pages.

Regards.

Daniel Dehennin
Récupérer ma clef GPG: gpg --recv-keys 0xCC1E9E5B7A6FE2DF
Fingerprint: 3E69 014E 5C23 50E8 9ED6 2AAD CC1E 9E5B 7A6F E2DF

3

Hi Daniel

Yes, exactly that :slight_smile:

Thanks!
Alvaro