On 10/19/2011 01:56 AM, Peter E. Abresch Jr. - at Pepco wrote:
Maybe, net.ipv4.conf.all.rp_filter was set to 1. I took one of my
SLES11-SP1 guest and set it to 2. It now pings from z/VM. When I set it
back to 1, it still pings. When I set it to 0, it still pings. I went to a
different SLES11 guest. It did not ping, but once I set
net.ipv4.conf.all.rp_filter to 0, it pinged fine. I returned it to 1 and
it still pings. I am confused. Why is it pinging all of a sudden or is it
just the nature of the beast.
I suppose that once you had loosened the reverse path filtering, you got
routing cache entries and then rp_filter no longer checks the FIB
(forwarding information base == routing table(s)) as long as a
corresponding cache entry is still there even if you have set rp_filter
back to 1 for strict checking.
/sbin/ip route list table cache
The routing cache is volatile. You can cross check my assumption by
flushing the routing cache after having set rp_filter back to 1 for
strict filtering and checking whether ping fails to work again.
/sbin/ip route flush table cache
Should I set it to 2 globally?
Probably this depends on your network topology and security
requirements. Do you have any asymmetric routing or multiple interfaces
to the same subnet [1] in the same virtual machine and need such
configuration?
[1] http://www.mail-archive.com/[email protected]/msg57175.html
From: "Michael O'Reilly"<[email protected]>
Are you by any chance hitting:
"Applying SLES 11 SP 1 Causing Communication Issues"
http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=7007649&sliceId=1&docTypeID=DT_TID_1_1
On 10/18/2011 at 06:42 PM, "Peter E. Abresch Jr. - at Pepco"
<[email protected]> wrote:
We are running z/VM Version 5 Release 4.0, service level 1001 (64-bit). We
can ping all of our SLES10 guests through our real hypersockets from z/VM.
however we cannot ping our SLES11 guests from z/VM through our real
hypersockets. All our Linux guests (SLES10 and SLES11) can ping each other
fine through hypersockets. z/OS can ping SLES10 and SLES11 guests through
hypersockets fine. SLES10 and SLES11 Linux guest can ping everything fine
through hypersockets. The only problem is pinging SLES11 guests from z/VM.
Has anyone else experienced this problem or have any suggestions?
Steffen
Linux on System z Development
IBM Deutschland Research & Development GmbH
Vorsitzender des Aufsichtsrats: Martin Jetter
Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen
Registergericht: Amtsgericht Stuttgart, HRB 243294
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For more information on Linux on System z, visit
http://wiki.linuxvm.org/
