Just on the below query >>4. Can routed networks with BGP peering coexist with security groups in the >>same zone in 4.23, or is it still one model per zone?
If you create the zone with securitygroupenabled=true, you’re locked into the shared-network model. If you leave the zone flag off and instead enable the SecurityGroupProvider on the guest physical network , security groups still work on shared networks along with isolated, VPC and routed networks coexist in the same zone. Thanks Prashanth From: Wido den Hollander via users <[email protected]> Date: Tuesday, 13 October 2026 at 10:13 To: [email protected] <[email protected]>; Massimiliano Adamo <[email protected]> Cc: Daniel Ejike <[email protected]>; Wido den Hollander <[email protected]> Subject: Re: Security groups on shared networks with VXLAN + BGP/EVPN (modifyvxlan-evpn.sh) on KVM Op 13-10-2026 om 10:33 schreef Massimiliano Adamo: > Hello everyone, > > We are evaluating CloudStack 4.23 with KVM (Ubuntu) as a replacement for > our VMware platform, and I would appreciate input from people running a > similar network design. > > Our current setup: > - around 1000 VMs, each with a public IPv4 and IPv6 address > - a stretched L2 network across two data centres (Amsterdam and London), > with VMs running in both > - a VRRP gateway with a floating IP between the two sites Forget VRRP, with VXLAN you should use Anycast IPv4 and IPv6 gateways. Stretching between two sites, you are stretching your ASN over both sites and have private interconnects between them to exchange the BGP EVPN routes? > > The design we are considering: > - an Advanced zone with security groups enabled and shared networks > - VXLAN isolation using the BGP+EVPN script from PR #9778 > (modifyvxlan-evpn.sh) instead of multicast > - FRR on every KVM host, with route reflectors in both sites Works! > > My questions: > > 1. Does modifyvxlan-evpn.sh work together with security groups on shared > networks, or has it only been used with isolated networks and VPCs? Works with shared networks! > 2. Is anyone running this across multiple clusters or sites? The PR > mentions testing in a single cluster only. Yes, we use it in a large zone between two datacenters in Amsterdam. We run dark fiber (DWDM) between them where we have the BGP sessions. Same could work between Amsterdam and London. > 3. How well do security group rules work for IPv6 on shared networks in > recent releases? Yes and this has been working for over 5 years now. > 4. Can routed networks with BGP peering coexist with security groups in > the same zone in 4.23, or is it still one model per zone? > > First-hand experience, including problems you ran into, would be very > welcome. > I have a lot of operational experience with this. During the CCC on Nov 18-21 I will give a EVPN and VXLAN workshop with CloudStack. Would be great if you could join. I can answer all your questions there as well. Wido > On a side note: I would also like to join the community Slack, but > self-signup is limited to a few email domains. Could someone send me an > invite? > > regards >
