Bug 1474823

1. Proposed title of this feature request

Require a feature similar to private VLAN for instance ports.


2. Who is the customer behind the request?


Account: Telus
Account #: 5649866

TAM customer: yes
SRM customer: no
Strategic: yes


3. What is the nature and description of the request?

We require the ability to restrict the range of an ARP broadcast on provider networks, whether they be VLAN, Flat, or VXLAN based.  

Currently, if two instances are on the same network and one sends an ARP request, it is visible to the other instance.  Port security doesn't (seem to) provide a mechanism to block this.  

Private VLANs are not implemented in neutron/OVS, and wouldn't be a viable solution for non-VLAN based networks anyhow.  They do, however, provide the same functionality we desire.


4. Why does the customer need this? (List the business requirements here)

This is a security request to isolate hosts sharing the same network, forcing upstream policy via a firewall or router.


5. How would the customer like to achieve this? (List the functional requirements here)

Customer is open to interpretation of how best to implement. But customer would like the ability to filter ARP traffic on provider networks, likely in the form of traffic filtering or port grouping.


6. For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented.

Customer or Red Hat can generate ARP traffic on each provider network type (VLAN, VXLAN, GRE, Flat), and tcpdump listen on an instance attached to a filtered/grouped port to see if the broadcast traffic reaches that private grouping.


7. Is there already an existing RFE upstream or in Red Hat Bugzilla?

There is a spec and upstream change for isolated network, but they've both been abandoned in 2013.

https://blueprints.launchpad.net/neutron/+spec/isolated-network
https://review.openstack.org/#/q/topic:bp/isolated-network,n,z


8. Does the customer have any specific timeline dependencies and which release would they like to target (i.e. RHEL5, RHEL6)?

As soon as possible.


9. Is the sales team involved in this request and do they have any additional input?

Not at this time.


10. List any affected packages or components.

OSP10, and/or future versions.


11. Would the customer be able to assist in testing this functionality if implemented?

Yes.