danm icon indicating copy to clipboard operation
danm copied to clipboard

Disable source learning aka. multicast flooding on Netwatcher created VTEP interfaces

Open Levovar opened this issue 5 years ago • 1 comments

Based on recent feedback from the field we probably made an error assuming multicast is allowed for VNFs on top of all private, and public cloud offerings. Example for such an environment turned out to be AWS.

To be able to survive in those environments, but still be able to interwork with strict port security settings Netwatcher should not create host VTEPs with source-learning enabled. Instead, Netwatchers of all hosts' should update the VTEPs' neighbour table based on the DanmEp API.

Other possible solution would be employing some proven techniques and protocols automating just that, e.g. BGP.

Levovar avatar Oct 04 '19 11:10 Levovar

sthing sthing sthing "unicast dynamic L3" described here: https://vincent.bernat.ch/en/blog/2017-vxlan-linux#unicast-with-static-l2-entries

Levovar avatar Oct 07 '19 13:10 Levovar