Bug 2125247 - [RFE Request] Support conditional SNATs
Summary: [RFE Request] Support conditional SNATs
Keywords:
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux Fast Datapath
Classification: Red Hat
Component: OVN
Version: FDP 22.L
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: ---
: ---
Assignee: OVN Team
QA Contact: Jianlin Shi
URL:
Whiteboard:
Depends On:
Blocks: 2078222
TreeView+ depends on / blocked
 
Reported: 2022-09-08 12:39 UTC by Surya Seetharaman
Modified: 2023-07-28 17:47 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FD-2280 0 None None None 2022-09-08 12:56:20 UTC

Description Surya Seetharaman 2022-09-08 12:39:42 UTC
Description of problem:

Currently there is no way to express conditional SNATs in OVN if the packets are coming from the same srcIP. Example:

TYPE             GATEWAY_PORT          EXTERNAL_IP        EXTERNAL_PORT    LOGICAL_IP          EXTERNAL_MAC         LOGICAL_PORT
snat                                   172.18.0.4                          10.244.2.5
snat                                   172.18.0.4                          10.244.2.4
snat                                   172.18.0.4                          10.244.2.3
snat                                   172.18.0.9                          10.244.2.3


Can we have a way to say when to use 0.9 versus when to use 0.4 ? Maybe based on pkt_mark-ing? That way say I mark a specific set of packets that match a policy:

101 ip4.src == $a12749576804119081385 && ip4.dst == $a11079093880111560446     allow         pkt_mark="1008"

Later if there are two SNATs that match on same srcIP can we give precedence based on pkt_mark?


Additional info:
An alternative to this is to implement pkt_marking also on switches, so that once I match on switch, I can take a decision based on the mark on routers to route traffic? Currently once I mark using a policy, there aren't many options to then match on this mark and take a decision or express that in OVNK via OVN.


Note You need to log in before you can comment on or make changes to this bug.