On Friday, 04/22/2016 at 04:50 GMT, Offer Baruch <[email protected]> wrote: > If you make sure you have NATIVE NONE and keep track of your grants (just > like PORTBASED) there is no real security concern... > The guest is only allowed the vlans you grant it (just like PORTBASED) and > he cant send any untagged frames. > I would rather manage a USERBASED VSWITCH with trunks over managing ports > with PORTBASED any day... > It is much easier to make vlan mistakes with PORTBASED... USERBASED is much > more intuitive, easy to manage and easy to view...
To that end, there is work under way to simplify the configuration of PORTBASED VSWITCHes. With the proposed configuration simplification, the only difference between the two is the explicit v. implicit port numbering scheme. I think that can be consolidated back into a single VSWITCH. > I agree you should close all the security holes before you do that... but > that seems a better solution then PORTBASED. > > There are pro's and con's for everything but I would recommend USERBASED > for security reasons and management reasons (assuming you know what you are > doing). At the end of the day, it's your choice. The problem was that USERBASED did not address the explicit need to put two access port vNICs on the same VSWITCH in different VLANs. The PORTBASED VSWITCH solved that problem, but introduced others. Let's talk again after we've made some progress on the VSWITCH Reconciliation Project (Do you like the name? I just made it up!) Alan Altmark Senior Managing z/VM and Linux Consultant Lab Services System z Delivery Practice IBM Systems & Technology Group ibm.com/systems/services/labservices office: 607.429.3323 mobile; 607.321.7556 [email protected] IBM Endicott ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For more information on Linux on System z, visit http://wiki.linuxvm.org/
