search

nuagenetworks / nuage-metroae

Nuage Networks Metro Automation Engine
http://devops.nuagenetworks.net
Apache License 2.0
44 stars 17 forks source link

VSD node ipset objects with 0.0.0.0/1 and 128.0.0.0/1 #410

Closed greenpau closed 4 years ago

greenpau commented 7 years ago

Recently, I deployed Nuage VSD and VSC with Nuage Metro. I had one build_vars.yaml for a single VSD and another one for two VSCs.

While reviewing security policies on VSD, I noticed the following:

$ ipset list
Name: api
Type: hash:net
Revision: 3
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 16848
References: 11
Members:
128.0.0.0/1
0.0.0.0/1

Name: vns
Type: hash:net
Revision: 3
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 16848
References: 8
Members:
0.0.0.0/1
128.0.0.0/1

Name: vsc
Type: hash:net
Revision: 3
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 16848
References: 1
Members:
0.0.0.0/1
128.0.0.0/1

The 0.0.0.0/1 and 128.0.0.0/1 looked a bit odd and I recalled I've seen it somewhere.

A similar reference existed in the build_vars.yaml file for VSCs, but not VSDs.

  "vsc_static_route_list":
    "0.0.0.0/1": !!null "null"
    "128.0.0.0/1": !!null "null"

Is there an option in build_vars.yaml to configure what goes into the ipset list?

ghost commented 7 years ago

@greenpau , we currently don't support configuring the ipset list with Metro. What you see is default behavior. How would you like to see this changed?

greenpau commented 7 years ago

@greenpau , we currently don't support configuring the ipset list with Metro. What you see is default behavior. How would you like to see this changed?

@bacastelli , it depends on what does the below do?

  "vsc_static_route_list":
    "0.0.0.0/1": !!null "null"
    "128.0.0.0/1": !!null "null"

we currently don't support configuring the ipset list with Metro.

I would say something like this:

ipset:
  vsc:
    - ip address of vsc
    - ip address of vsc
    - ip address of vsc  
    - etc.
  vsd:
    - x.x.x.x
    - etc.
  vstat: 
    - x.x.x.x

The above are IP address based set.

Then below, I have NET based sets:

  vrs:
    - 10.0.0.0/8
    - etc.

Currently, you don't have netmon sets.

  netmon:
    - 1.1.1.1
    - 2.2.2.2

The netmon is Prometheuse, SNMP, etc.

ghost commented 4 years ago

Decided not to implement.