OK, there is something off here: This is my routing table where I can ping another physical host with an link-local address
route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.158.231.1 0.0.0.0 UG 0 0 0 eth1 10.158.231.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 cloudbr0 172.16.0.0 0.0.0.0 255.255.0.0 U 0 0 0 cloudbr0 172.16.8.0 0.0.0.0 255.255.255.0 U 0 0 0 cloudbr0 If I restart the cloudstack-agent; the routing table has changed to: route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.158.231.1 0.0.0.0 UG 0 0 0 eth1 10.158.231.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 cloud0 172.16.0.0 0.0.0.0 255.255.0.0 U 0 0 0 cloudbr0 172.16.8.0 0.0.0.0 255.255.255.0 U 0 0 0 cloudbr0 and link-local devices cannot be accessed. In both cases, I cannot access the system VMs with ssh.