I am not getting traffic between 2 VMs on the same vxlan when the VMs are on the same node. When I migrate either VM to another node in my cluster, these work as configured.
I have SDN enabled, and in there SDN > VNets have a VNet science at the cluster level, tag 801. It has isolate ports set, and vlan aware NOT set.
First VM has interface net0: virtio=MAC1,bridge=science,firewall=1
Second VM has interface net1: virtio=MAC2,bridge=science,firewall=1
I manually set an ARP rule for debugging on first VM, otherwise it would just ARP and get no replies. This is also an issue - just was trying to rule out broadcast issues by working around it first.
On the node, I tcpdump on the fwbr/fwln/tap for the first VM, and see the traffic leaving, with the right MAC (the VM's MAC) for the source and destination set. When I tcpdump on the fwbr/fwln/tap for the second VM, I see no traffic.
For debugging, I put a firewall rule on first VM to log all non-explicitly-allowed connections (and accept).
On second VM, I put accepts with logging at the start of the rule chain also on the VM firewall.
I don't see anything in firewall logs (which makes sense: first VM explicitly allows these connections, second VM is not getting the traffic)
The vnet has no firewall configured at the datacenter level under VNet Firewall.
The datacenter firewall has DROP configured for in, out, forward as the default.
I read the following but none appear to be quite it:
I have SDN enabled, and in there SDN > VNets have a VNet science at the cluster level, tag 801. It has isolate ports set, and vlan aware NOT set.
First VM has interface net0: virtio=MAC1,bridge=science,firewall=1
Second VM has interface net1: virtio=MAC2,bridge=science,firewall=1
I manually set an ARP rule for debugging on first VM, otherwise it would just ARP and get no replies. This is also an issue - just was trying to rule out broadcast issues by working around it first.
On the node, I tcpdump on the fwbr/fwln/tap for the first VM, and see the traffic leaving, with the right MAC (the VM's MAC) for the source and destination set. When I tcpdump on the fwbr/fwln/tap for the second VM, I see no traffic.
For debugging, I put a firewall rule on first VM to log all non-explicitly-allowed connections (and accept).
On second VM, I put accepts with logging at the start of the rule chain also on the VM firewall.
I don't see anything in firewall logs (which makes sense: first VM explicitly allows these connections, second VM is not getting the traffic)
The vnet has no firewall configured at the datacenter level under VNet Firewall.
The datacenter firewall has DROP configured for in, out, forward as the default.
I read the following but none appear to be quite it: