Solved

CumulusVX demo + ACL's on SVI

  • 30 August 2018
  • 5 replies
  • 302 views

Hello,

We've recently purchased a handful of switches and while we await their delivery I was looking into the demo provided here: https://github.com/CumulusNetworks/cldemo-vagrant/

I was curious if there are any known gotcha's regarding ACL's -- more specifically ACL's on / matching an SVI behaving differently in the virtualized environment compared to the hardware.

For context I was simply trying to drop all traffic to a subnet from a specific VLAN / SVI / bridge and I don't seem to be having much luck. Here is a succinct portion of the config:

code:
auto vlan100
iface vlan100
address 10.5.0.2/24
address-virtual 44:38:39:00:01:20 10.5.0.1/24
vlan-id 100
vlan-raw-device bridge



code:
# Custom rules
-A $INNFWD_CHAIN --in-interface vlan100 -d 10.5.0.0/24 -j DROP



The topology is that of the demo (https://raw.githubusercontent.com/CumulusNetworks/cldemo-vagrant/master/documentation/cldemo_topology.png). server01 & server02 can still reach each other within that subnet even with that rule in place. Any idea where I could be going wrong?

It may be worth noting that the SVI is on the spine in this instance instead of the leaf / the VRR IP is active on one spine (I turned off every switch besides spine01, leaf01 to ensure nothing goofy is going on).

Thanks!
icon

Best answer by Pete B 31 August 2018, 21:42

@SleepyWombat So TIL that on a physical switch the ACLs are programmed into the ASIC, so all ACL checks are done on the ASIC. Since VX doesn't have an ASIC, and all ACL checks are done up at the kernel.

If you want to troubleshoot this in a more immediate fashion feel free to join our public Slack instance and ask there. Our consultants monitor it throughout the day and can pitch in and help you.
View original

5 replies

Userlevel 4
Hi @SleepyWombat have you read the Cumulus Linux user guide chapter on ACLs? There's a section on matching SVIs.

I don't believe there should be a difference in how VX treats ACLs as opposed to Cumulus Linux itself. I'll ask around.
Hi @Pete B -- I have which is why I'm confused why my simple ACL rule isn't working. I feel like I may be missing something obvious and wanted to make sure it's an end user issue and not due to a gotcha.

There was a similar thread here however it never got updated from the OP. The different behavior from the ASIC's you mentioned made me uncertain if similar gotcha's exist in the virtualized environment.
Userlevel 4
OK I spoke too soon about differences; turns out there are some differences but we do our best to match them. Let me ask the people behind the demo as they may have some ideas here.
Userlevel 4
@SleepyWombat So TIL that on a physical switch the ACLs are programmed into the ASIC, so all ACL checks are done on the ASIC. Since VX doesn't have an ASIC, and all ACL checks are done up at the kernel.

If you want to troubleshoot this in a more immediate fashion feel free to join our public Slack instance and ask there. Our consultants monitor it throughout the day and can pitch in and help you.
Understood -- thank you for following up on this. I'll see if I can get this to work and if not I'll hop in the Slack / update this thread with any relevant information.

Cheers!

Reply