You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cloudstack.apache.org by "TheKunalSen (via GitHub)" <gi...@apache.org> on 2026/03/29 20:09:51 UTC
[D] Multi-subnet setup with VPN – System VMs unreachable and agent not connecting [cloudstack]
GitHub user TheKunalSen created a discussion: Multi-subnet setup with VPN – System VMs unreachable and agent not connecting
I am testing a multi-network setup in Apache CloudStack and running into issues when hosts are placed on different subnets.
Current Setup:
Management server and NFS server are deployed in a 192.168.1.0/24 subnet
Initially, I had KVM hosts in the same .1 network → everything worked seamlessly
I then tried to add a new host in a different public subnet (192.168.2.0/24 network)
What I Did:
Since there was no L3 switch or routing between the two subnets, I configured a site-to-site VPN using StrongSwan between the .1 and .2 networks.
VPN connectivity is working
I can reach the .2 host from the management and NFS servers
However, I had to manually add routes on all machines:
```ip route add <subnet> via <vpn_gateway_ip>```
After this, the new host in .2 was successfully added to CloudStack
Problem:
Although the host is added successfully:
System VMs (SSVM/CPVM) are created on the .2 host and appear to be running
But:
Agent state is not Up
System VMs are not reachable
Cannot ping system VMs from management server or host
Cannot ping outside host from system VMs
Even within the .2 network, system VM IPs are not reachable
As a result:
No user VMs are getting deployed
Console access is not working
Observation:
System VMs are getting IPs in the .1 network (same as management server)
However, they are running on a host in .2 network
And those .1 system vms ips are not reachable from anywhere not even from the .1 network
This seems to create a routing / network isolation issue
GitHub link: https://github.com/apache/cloudstack/discussions/12909
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Multi-subnet setup with VPN – System VMs unreachable and agent not connecting [cloudstack]
Posted by "prashanthr2 (via GitHub)" <gi...@apache.org>.
GitHub user prashanthr2 added a comment to the discussion: Multi-subnet setup with VPN – System VMs unreachable and agent not connecting
@TheKunalSen
No, adding .1.1 and .2.1 as internal DNS will not resolve this issue. The problem is not DNS, but how the networks are structured.
In Apache CloudStack, Layer-2 (broadcast domain) consistency is expected per pod. When you place .2 network hosts in a pod under a .1-based zone without proper L2/L3 reachability, guest networking (DHCP, gateway, metadata, password injection) breaks which explains the VM boot/login issues you’re seeing.
If you need to use hosts from multiple networks in the same zone, you must ensure proper network design (e.g., VLAN-backed guest networks or SDN) so that guest traffic is consistently reachable across those hosts.
Otherwise, keep them in separate pods/zones where network boundaries are cleanly maintained.
GitHub link: https://github.com/apache/cloudstack/discussions/12909#discussioncomment-16585523
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Multi-subnet setup with VPN – System VMs unreachable and agent not connecting [cloudstack]
Posted by "TheKunalSen (via GitHub)" <gi...@apache.org>.
GitHub user TheKunalSen added a comment to the discussion: Multi-subnet setup with VPN – System VMs unreachable and agent not connecting
@prashanthr2
We added the .2 network host in a totally seperate zone with the internal dns1 of .2.1 and also the physical network ip address range also we put of .2 network and also the pod tha got created in that zone also has .2 ip ranges and it worked, vms getting created and all evrything worked but if I create a zone on .1 ip address and only put .1.1 as a internal dns1 in the zone and then create a separate pod in that .1 zone which will have ip ranges of .2 network then also in that pod -> cluster the .2 host were getting added and also the vm was getting created on that .2 host too but there was a problem, the vms which are getting created on .2 host was getting stuck at boot screen and even if after a long time the login screen was showing but the password it was providing, it always says incorrect note that if I create vm with that same Ubuntu template on .1 host then it's not issue all smooth,
Different zone for .2 network host totally works but then I can not migrate the vms through out the zones , ig I have to build my own layer upon cloudstack itself to do that but if I add different network hosts in different pods but same zone then I can migrate,
Let me know if I add the .2.1 on internal dns2 of the zone and .1.1 on the internal dns1 of the zone then will it work?
Even if it works then what will I do if I have to add hosts from 4 different networks under one zone and different pods
GitHub link: https://github.com/apache/cloudstack/discussions/12909#discussioncomment-16464851
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Multi-subnet setup with VPN – System VMs unreachable and agent not connecting [cloudstack]
Posted by "TheKunalSen (via GitHub)" <gi...@apache.org>.
GitHub user TheKunalSen added a comment to the discussion: Multi-subnet setup with VPN – System VMs unreachable and agent not connecting
Yes I haven't tried by creating another pod with that .2 network ip ranges
But is this the ideal way to add a remote host into a management server or is there any other way?
GitHub link: https://github.com/apache/cloudstack/discussions/12909#discussioncomment-16395111
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Multi-subnet setup with VPN – System VMs unreachable and agent not connecting [cloudstack]
Posted by "prashanthr2 (via GitHub)" <gi...@apache.org>.
GitHub user prashanthr2 edited a comment on the discussion: Multi-subnet setup with VPN – System VMs unreachable and agent not connecting
@TheKunalSen
This setup is a non-standard implementation, I don't think this will work because CloudStack requires all hosts within a single Pod to share a Layer 2 broadcast domain, whereas a VPN only provides Layer 3 routing. The System VMs are failing because they are assigned .1.x addresses while residing on a .2.x host.
Because there is no Layer 2 continuity they cannot resolve ARP requests or egress the local bridge making them unreachabel even within the .2.0/24 network. To resolve this try creating a separate Pod for the .2.0/24 network with its own Management IP range, cloudStack will then ensure that any System VM deployed in that Pod receives a local .2.x address ( this may resolve your issue)
GitHub link: https://github.com/apache/cloudstack/discussions/12909#discussioncomment-16391990
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Multi-subnet setup with VPN – System VMs unreachable and agent not connecting [cloudstack]
Posted by "prashanthr2 (via GitHub)" <gi...@apache.org>.
GitHub user prashanthr2 added a comment to the discussion: Multi-subnet setup with VPN – System VMs unreachable and agent not connecting
@TheKunalSen Based
This setup is a non-standard implementation, I don't think this will work because CloudStack requires all hosts within a single Pod to share a Layer 2 broadcast domain, whereas a VPN only provides Layer 3 routing. The System VMs are failing because they are assigned .1.x addresses while residing on a .2.x host.
Because there is no Layer 2 continuity they cannot resolve ARP requests or egress the local bridge making them unreachabel even within the .2.0/24 network. To resolve this try creating a separate Pod for the .2.0/24 network with its own Management IP range, cloudStack will then ensure that any System VM deployed in that Pod receives a local .2.x address ( this may resolve your issue)
GitHub link: https://github.com/apache/cloudstack/discussions/12909#discussioncomment-16391990
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Multi-subnet setup with VPN – System VMs unreachable and agent not connecting [cloudstack]
Posted by "prashanthr2 (via GitHub)" <gi...@apache.org>.
GitHub user prashanthr2 added a comment to the discussion: Multi-subnet setup with VPN – System VMs unreachable and agent not connecting
@TheKunalSen There are multiple ways to achieve a remote host connection, but the best approach depends on your specific requirements for high availability and migration. Apart from creating a separate Pod (which is the most straightforward fix for your current routing issues) you could also implement a VXLAN or GRE overlay if you need to maintain a single 'stretched' Layer 2 network for live migration support. However, for most remote site scenarios, using separate Pods or even separate Zones is the standard way to ensure that System VMs receive the correct local networking configuration automatically.
Also, If going "Separate Pod" route make sure to ensure that the NFS Secondary Storage is reachable from the new .2.x as well, as the System VMs in the new Pod will still need to mount it.
GitHub link: https://github.com/apache/cloudstack/discussions/12909#discussioncomment-16463938
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org