apache / apache/cloudstack

CS4.22.0 vROUTER ACLs Feature is non RFC compliant applied to Internal Interface

未关闭
#13,266 10 条评论 0 个 reaction 已指派 1 人 已被 @weizhouapache 认领 在 GitHub 查看
component:networking component:virtual-router type:enhancement
主要语言
Java
星标
3.1k
派生
1.4k
平均合并
6 天 19 小时
30 天内合并 PR
32

描述

### problem

CS 4.22.0
Host Ubuntu 22.4 KVM
vRouter on VPC ACLs

This VPC ACL feature is beyond good, it's awesome. However @weizhouapache with all the love I have for the team. That's not right, ACL should be applied to the edge - and we know that should not be to interpretation, and many think are just Cisco best practices - we should have a feature to select WAN-side, LAN-side or named Edge-side, Internal-Side which seems are more contemporary names.

- RFC 2827
- RFC 3704

Suggestion: if decided to make it RF-ish. To make easy the transition for existing systems, the updated feature will apply to LAN-side (internal-side) by default.

### versions

CS 4.22.0
Host Ubuntu 22.4 KVM
running vRouter with 8CPUs and 8GRAM, oversubscription is 1:1 for all systems.

### The steps to reproduce the bug

1. Create a VPC
2. Add the custom ACL with ingress only
3. the ACL does not filter the traffic, as is applied to the vRouter LAN AKA Internal interface.

### What to do about it?

_No response_

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。