Op 13-10-2026 om 10:33 schreef Massimiliano Adamo:
Hello everyone,
We are evaluating CloudStack 4.23 with KVM (Ubuntu) as a replacement for
our VMware platform, and I would appreciate input from people running a
similar network design.
Our current setup:
- around 1000 VMs, each with a public IPv4 and IPv6 address
- a stretched L2 network across two data centres (Amsterdam and London),
with VMs running in both
- a VRRP gateway with a floating IP between the two sites
Forget VRRP, with VXLAN you should use Anycast IPv4 and IPv6 gateways.
Stretching between two sites, you are stretching your ASN over both
sites and have private interconnects between them to exchange the BGP
EVPN routes?
The design we are considering:
- an Advanced zone with security groups enabled and shared networks
- VXLAN isolation using the BGP+EVPN script from PR #9778
(modifyvxlan-evpn.sh) instead of multicast
- FRR on every KVM host, with route reflectors in both sites
Works!
My questions:
1. Does modifyvxlan-evpn.sh work together with security groups on shared
networks, or has it only been used with isolated networks and VPCs?
Works with shared networks!
2. Is anyone running this across multiple clusters or sites? The PR
mentions testing in a single cluster only.
Yes, we use it in a large zone between two datacenters in Amsterdam. We
run dark fiber (DWDM) between them where we have the BGP sessions. Same
could work between Amsterdam and London.
3. How well do security group rules work for IPv6 on shared networks in
recent releases?
Yes and this has been working for over 5 years now.
4. Can routed networks with BGP peering coexist with security groups in
the same zone in 4.23, or is it still one model per zone?
First-hand experience, including problems you ran into, would be very
welcome.
I have a lot of operational experience with this. During the CCC on Nov
18-21 I will give a EVPN and VXLAN workshop with CloudStack. Would be
great if you could join. I can answer all your questions there as well.
Wido
On a side note: I would also like to join the community Slack, but
self-signup is limited to a few email domains. Could someone send me an
invite?
regards
