hello again, i'm sorry to spam this list, in fact it seems to be *a vmware esx configuration* , vswitch must be promiscous enable (bold) , by default is not. I do not understand why , in my linux guest, ethX is promiscuous enable.
Regards, Nicolas Prochazka. -- Edit Security Policy for a Virtual Switch Use the vSwitch Properties dialog box to set the Layer 2 security policy for a virtual switch. Layer 2 is the data link layer. The three elements of the Layer 2 Security policy are promiscuous mode, MAC address changes, and forged transmits. In non-promiscuous mode, a guest adapter listens to traffic only on its own MAC address. In promiscuous mode, it can listen to all the packets. By default, guest adapters are set to non-promiscuous mode. You can override the switch-level settings for individual port groups by editing the settings for the port group. For more information on security, see the ESX Configuration Guide or the ESXi Configuration Guide as appropriate for your system. Procedure 1 Log in to the vSphere Client and select the server from the inventory panel. 2 Click the Configuration tab and click Networking. 3 Click Properties for the vSwitch whose Layer 2 Security policy to edit. 4 In the Properties dialog box for the vSwitch, click the Ports tab. 5 Select the vSwitch item and click Edit. 6 Click the Security tab. 7 In the Policy Exceptions pane, select whether to reject or accept the Layer2 Security policy exceptions. Option Description Promiscuous Mode â Reject â Placing a guest adapter in promiscuous mode has no effect on which frames are received by the adapter. â *Accept â Placing a guest adapter in promiscuous mode causes it to detect all frames passed on the vSwitch that are allowed under the VLAN policy for the port group that the adapter is connected to.* MAC Address Changes â Reject â If you set the MAC Address Changes to Reject and the guest operating system changes the MAC address of the adapter to anything other than what is in the .vmx configuration file, all inbound frames are dropped. If the Guest OS changes the MAC address back to match the MAC address in the .vmx configuration file, inbound frames are passed again. â Accept â Changing the MAC address from the Guest OS has the intended effect: frames to the new MAC address are received. Forged Transmits â Reject â Any outbound frame with a source MAC address that is different from the one currently set on the adapter are dropped. â 2011/5/13 nicolas prochazka <[email protected]> > helo, > tcpdump on openvswitch ( i assign it ip address ) : dump some traffic from > external to bridge interface ( arp , broadcast ) as eth1 > ping from openvswitch to external network ( dest host unreachable ) > > ( bridge ip ; 192.150.20.1 , ping to 192.150.1.1 ) > > suppress bridge, assign 192.150.20.1 to eth1 , no problem. > > cat /tmp/ovs > in_port(1),eth(src=ac:de:49:61:3f:b0,dst=ff:ff:ff:ff:ff:ff),eth_type(0x0800),ipv4(src=192.150.36.164,dst=192.150.255.255,proto=17,tos=0),udp(src=138,dst=138), > packets:0, bytes:0, used:never, actions:2,0 > in_port(2),eth(src=00:23:20:86:6a:bc,dst=ff:ff:ff:ff:ff:ff),eth_type(0x0806),arp(sip=192.150.20.1,tip=192.150.1.1,op=1,sha=00:23:20:86:6a:bc,tha=00:00:00:00:00:00), > packets:4, bytes:168, used:0.600s, actions:1,0 > in_port(1),eth(src=ac:de:49:86:4c:bb,dst=ff:ff:ff:ff:ff:ff),eth_type(0x0806),arp(sip=192.150.46.59,tip=192.150.35.64,op=1,sha=ac:de:49:86:4c:bb,tha=00:00:00:00:00:00), > packets:0, bytes:0, used:never, actions:2,0 > in_port(1),eth(src=00:1d:09:fd:51:7a,dst=ff:ff:ff:ff:ff:ff),eth_type(0x0806),arp(sip=192.150.10.5,tip=192.150.45.34,op=1,sha=00:1d:09:fd:51:7a,tha=00:00:00:00:00:00), > packets:2, bytes:120, used:0.700s, actions:2,0 > in_port(1),eth(src=ac:de:49:47:bf:b8,dst=ff:ff:ff:ff:ff:ff),eth_type(0x0806),arp(sip=192.150.49.228,tip=192.150.1.1,op=1,sha=ac:de:49:47:bf:b8,tha=00:00:00:00:00:00), > packets:0, bytes:0, used:never, actions:2,0 > in_port(1),eth(src=00:1d:09:fd:51:7a,dst=ff:ff:ff:ff:ff:ff),eth_type(0x0806),arp(sip=192.150.10.5,tip=192.150.22.216,op=1,sha=00:1d:09:fd:51:7a,tha=00:00:00:00:00:00), > packets:2, bytes:120, used:0.960s, actions:2,0 > in_port(1),eth(src=ac:de:49:1f:c8:13,dst=ff:ff:ff:ff:ff:ff),eth_type(0x0800),ipv4(src=192.150.35.64,dst=192.150.255.255,proto=17,tos=0),udp(src=137,dst=137), > packets:0, bytes:0, used:never, actions:2,0 > > 2011/5/12 Jesse Gross <[email protected]> > >> On Thu, May 12, 2011 at 3:10 AM, nicolas prochazka >> <[email protected]> wrote: >> > Hello , >> > no it does not work. >> > eth1 without openvswitch works with promisc and not promisc >> > tcpdump on eth1 in openvswitch bridge , i can see arp traffic and >> broadcast >> > ( from externe to eth1 ) without response from eth1 >> >> What do you see if you run tcpdump on the bridge interface? What does >> ovs-dpctl dump-flows <br> show when you're trying to send traffic? >> > >
_______________________________________________ dev mailing list [email protected] http://openvswitch.org/mailman/listinfo/dev
