All,
Had a strange incident the other day that seems like it shouldn't be
possible inside of neutron...
We are currently running Queens on Ubuntu 16.04 w/ the linuxbridge ml2
plugin with vxlan overlays. We have a single, large provider network
that we have set to 'shared' and 'external', so people who need to do
things that don't work well with NAT can connect their instances
directly to the provider network. Our 'allocation range' as defined in
our provider subnet is dedicated to tenants, so there should be no
conflicts.
The other day, one of our users connected a neutron router to the
provider network (not via the 'external network' option, but rather via
the normal 'add interface' option) and neglected to specify an IP
address. The neutron router decided that it was now the gateway for the
entire provider network and began arp'ing as such (I'm sure you can
imagine the results).
To me, this seems like it should be disallowed inside of neutron (you
shouldn't be able to specify an IP address for a router interface that
isn't explicitly part of your allocation range on said subnet). Does
neutron just expect issues like this to be handled by the physical
provider infrastructure (spoofing prevention, etc.)?
Thanks,
---
v/r
Chris Apsey
bitskr...@bitskrieg.net
https://www.bitskrieg.net
_______________________________________________
OpenStack-operators mailing list
OpenStack-operators@lists.openstack.org
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators
