You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cloudstack.apache.org by Massimiliano Adamo <ma...@geant.org> on 2026/10/13 08:33:00 UTC
Security groups on shared networks with VXLAN + BGP/EVPN (modifyvxlan-evpn.sh) on KVM
Hello everyone,
We are evaluating CloudStack 4.23 with KVM (Ubuntu) as a replacement for
our VMware platform, and I would appreciate input from people running a
similar network design.
Our current setup:
- around 1000 VMs, each with a public IPv4 and IPv6 address
- a stretched L2 network across two data centres (Amsterdam and London),
with VMs running in both
- a VRRP gateway with a floating IP between the two sites
The design we are considering:
- an Advanced zone with security groups enabled and shared networks
- VXLAN isolation using the BGP+EVPN script from PR #9778
(modifyvxlan-evpn.sh) instead of multicast
- FRR on every KVM host, with route reflectors in both sites
My questions:
1. Does modifyvxlan-evpn.sh work together with security groups on shared
networks, or has it only been used with isolated networks and VPCs?
2. Is anyone running this across multiple clusters or sites? The PR
mentions testing in a single cluster only.
3. How well do security group rules work for IPv6 on shared networks in
recent releases?
4. Can routed networks with BGP peering coexist with security groups in
the same zone in 4.23, or is it still one model per zone?
First-hand experience, including problems you ran into, would be very
welcome.
On a side note: I would also like to join the community Slack, but
self-signup is limited to a few email domains. Could someone send me an
invite?
regards
--
Massimiliano Adamo
GÉANT
Security groups on shared networks with VXLAN + BGP/EVPN (modifyvxlan-evpn.sh) on KVM
Posted by IONOS Support via users <us...@cloudstack.apache.org>.
Dear Sender,
Thank you for contacting us. As we couldn't identify a specific request from your inquiry, please provide additional details so that we may assist you. Our team is here to help and can also be contacted by phone at 1-484-424-7392.
If you’re a customer, you also have access to additional support resources, including:
* Resend your request using the email address associated with your customer account for personalised support.
* Chat with our AI Assistant https://login.ionos.com directly in your IONOS account for instant answers.
* Log in https://my.ionos.com to your IONOS account to view available support options (Help & contact).
* For updating or verifying your contact information, please click here for instructions https://www.ionos.com/help/index.php?id=2574 .
If you have any complaints regarding content on websites hosted by IONOS, please find instructions and contact information here https://registrar.ionos.com/domains_raa/complaints?market=en_US .
Thank you again for reaching out. We're committed to providing you with the best possible support and look forward to helping you further.
Best regards,
IONOS Team
This email was created with the support of artificial intelligence (AI).
Contact: https://contact.ionos.com
Facebook: https://www.facebook.com/my.ionos
X/Twitter: https://twitter.com/IONOS_help_US
E-Mail: support@ionos.com
IONOS Inc.
Re: Security groups on shared networks with VXLAN + BGP/EVPN (modifyvxlan-evpn.sh) on KVM
Posted by Prashanth Reddy <pr...@shapeblue.com>.
Just on the below query
>>4. Can routed networks with BGP peering coexist with security groups in the same zone in 4.23, or is it still one model per zone?
If you create the zone with securitygroupenabled=true, you’re locked into the shared-network model.
If you leave the zone flag off and instead enable the SecurityGroupProvider on the guest physical network , security groups still work on shared networks along with isolated, VPC and routed networks coexist in the same zone.
Thanks
Prashanth
From: Wido den Hollander via users <us...@cloudstack.apache.org>
Date: Tuesday, 13 October 2026 at 10:13
To: users@cloudstack.apache.org <us...@cloudstack.apache.org>; Massimiliano Adamo <ma...@geant.org>
Cc: Daniel Ejike <da...@geant.org>; Wido den Hollander <wi...@widodh.nl>
Subject: Re: Security groups on shared networks with VXLAN + BGP/EVPN (modifyvxlan-evpn.sh) on KVM
Op 13-10-2026 om 10:33 schreef Massimiliano Adamo:
> Hello everyone,
>
> We are evaluating CloudStack 4.23 with KVM (Ubuntu) as a replacement for
> our VMware platform, and I would appreciate input from people running a
> similar network design.
>
> Our current setup:
> - around 1000 VMs, each with a public IPv4 and IPv6 address
> - a stretched L2 network across two data centres (Amsterdam and London),
> with VMs running in both
> - a VRRP gateway with a floating IP between the two sites
Forget VRRP, with VXLAN you should use Anycast IPv4 and IPv6 gateways.
Stretching between two sites, you are stretching your ASN over both
sites and have private interconnects between them to exchange the BGP
EVPN routes?
>
> The design we are considering:
> - an Advanced zone with security groups enabled and shared networks
> - VXLAN isolation using the BGP+EVPN script from PR #9778
> (modifyvxlan-evpn.sh) instead of multicast
> - FRR on every KVM host, with route reflectors in both sites
Works!
>
> My questions:
>
> 1. Does modifyvxlan-evpn.sh work together with security groups on shared
> networks, or has it only been used with isolated networks and VPCs?
Works with shared networks!
> 2. Is anyone running this across multiple clusters or sites? The PR
> mentions testing in a single cluster only.
Yes, we use it in a large zone between two datacenters in Amsterdam. We
run dark fiber (DWDM) between them where we have the BGP sessions. Same
could work between Amsterdam and London.
> 3. How well do security group rules work for IPv6 on shared networks in
> recent releases?
Yes and this has been working for over 5 years now.
> 4. Can routed networks with BGP peering coexist with security groups in
> the same zone in 4.23, or is it still one model per zone?
>
> First-hand experience, including problems you ran into, would be very
> welcome.
>
I have a lot of operational experience with this. During the CCC on Nov
18-21 I will give a EVPN and VXLAN workshop with CloudStack. Would be
great if you could join. I can answer all your questions there as well.
Wido
> On a side note: I would also like to join the community Slack, but
> self-signup is limited to a few email domains. Could someone send me an
> invite?
>
> regards
>
Re: Security groups on shared networks with VXLAN + BGP/EVPN (modifyvxlan-evpn.sh) on KVM
Posted by Wido den Hollander via users <us...@cloudstack.apache.org>.
Op 13-10-2026 om 10:33 schreef Massimiliano Adamo:
> Hello everyone,
>
> We are evaluating CloudStack 4.23 with KVM (Ubuntu) as a replacement for
> our VMware platform, and I would appreciate input from people running a
> similar network design.
>
> Our current setup:
> - around 1000 VMs, each with a public IPv4 and IPv6 address
> - a stretched L2 network across two data centres (Amsterdam and London),
> with VMs running in both
> - a VRRP gateway with a floating IP between the two sites
Forget VRRP, with VXLAN you should use Anycast IPv4 and IPv6 gateways.
Stretching between two sites, you are stretching your ASN over both
sites and have private interconnects between them to exchange the BGP
EVPN routes?
>
> The design we are considering:
> - an Advanced zone with security groups enabled and shared networks
> - VXLAN isolation using the BGP+EVPN script from PR #9778
> (modifyvxlan-evpn.sh) instead of multicast
> - FRR on every KVM host, with route reflectors in both sites
Works!
>
> My questions:
>
> 1. Does modifyvxlan-evpn.sh work together with security groups on shared
> networks, or has it only been used with isolated networks and VPCs?
Works with shared networks!
> 2. Is anyone running this across multiple clusters or sites? The PR
> mentions testing in a single cluster only.
Yes, we use it in a large zone between two datacenters in Amsterdam. We
run dark fiber (DWDM) between them where we have the BGP sessions. Same
could work between Amsterdam and London.
> 3. How well do security group rules work for IPv6 on shared networks in
> recent releases?
Yes and this has been working for over 5 years now.
> 4. Can routed networks with BGP peering coexist with security groups in
> the same zone in 4.23, or is it still one model per zone?
>
> First-hand experience, including problems you ran into, would be very
> welcome.
>
I have a lot of operational experience with this. During the CCC on Nov
18-21 I will give a EVPN and VXLAN workshop with CloudStack. Would be
great if you could join. I can answer all your questions there as well.
Wido
> On a side note: I would also like to join the community Slack, but
> self-signup is limited to a few email domains. Could someone send me an
> invite?
>
> regards
>
Re: Security groups on shared networks with VXLAN + BGP/EVPN (modifyvxlan-evpn.sh) on KVM
Posted by Wei ZHOU <us...@gmail.com>.
Hi Massimiliano,
Could you join the slack channel via link
https://join.slack.com/t/apachecloudstack/shared_invite/zt-4cyzk9aap-HS0QPxhfT657CbXY67nWrg
?
It will be valid for 30 days.
-Wei
On Tue, Oct 13, 2026 at 10:33 AM Massimiliano Adamo <
massimiliano.adamo@geant.org> wrote:
> Hello everyone,
>
> We are evaluating CloudStack 4.23 with KVM (Ubuntu) as a replacement for
> our VMware platform, and I would appreciate input from people running a
> similar network design.
>
> Our current setup:
> - around 1000 VMs, each with a public IPv4 and IPv6 address
> - a stretched L2 network across two data centres (Amsterdam and London),
> with VMs running in both
> - a VRRP gateway with a floating IP between the two sites
>
> The design we are considering:
> - an Advanced zone with security groups enabled and shared networks
> - VXLAN isolation using the BGP+EVPN script from PR #9778
> (modifyvxlan-evpn.sh) instead of multicast
> - FRR on every KVM host, with route reflectors in both sites
>
> My questions:
>
> 1. Does modifyvxlan-evpn.sh work together with security groups on shared
> networks, or has it only been used with isolated networks and VPCs?
> 2. Is anyone running this across multiple clusters or sites? The PR
> mentions testing in a single cluster only.
> 3. How well do security group rules work for IPv6 on shared networks in
> recent releases?
> 4. Can routed networks with BGP peering coexist with security groups in
> the same zone in 4.23, or is it still one model per zone?
>
> First-hand experience, including problems you ran into, would be very
> welcome.
>
> On a side note: I would also like to join the community Slack, but
> self-signup is limited to a few email domains. Could someone send me an
> invite?
>
> regards
>
> --
> Massimiliano Adamo
> GÉANT
>
>