Hello everyone, We are evaluating CloudStack 4.23 with KVM (Ubuntu) as a replacement for our VMware platform, and I would appreciate input from people running a similar network design.
Our current setup: - around 1000 VMs, each with a public IPv4 and IPv6 address - a stretched L2 network across two data centres (Amsterdam and London), with VMs running in both - a VRRP gateway with a floating IP between the two sites The design we are considering: - an Advanced zone with security groups enabled and shared networks - VXLAN isolation using the BGP+EVPN script from PR #9778 (modifyvxlan-evpn.sh) instead of multicast - FRR on every KVM host, with route reflectors in both sites My questions: 1. Does modifyvxlan-evpn.sh work together with security groups on shared networks, or has it only been used with isolated networks and VPCs? 2. Is anyone running this across multiple clusters or sites? The PR mentions testing in a single cluster only. 3. How well do security group rules work for IPv6 on shared networks in recent releases? 4. Can routed networks with BGP peering coexist with security groups in the same zone in 4.23, or is it still one model per zone? First-hand experience, including problems you ran into, would be very welcome. On a side note: I would also like to join the community Slack, but self-signup is limited to a few email domains. Could someone send me an invite? regards -- Massimiliano Adamo GÉANT
