danm
danm copied to clipboard
Disable source learning aka. multicast flooding on Netwatcher created VTEP interfaces
Based on recent feedback from the field we probably made an error assuming multicast is allowed for VNFs on top of all private, and public cloud offerings. Example for such an environment turned out to be AWS.
To be able to survive in those environments, but still be able to interwork with strict port security settings Netwatcher should not create host VTEPs with source-learning enabled. Instead, Netwatchers of all hosts' should update the VTEPs' neighbour table based on the DanmEp API.
Other possible solution would be employing some proven techniques and protocols automating just that, e.g. BGP.
sthing sthing sthing "unicast dynamic L3" described here: https://vincent.bernat.ch/en/blog/2017-vxlan-linux#unicast-with-static-l2-entries