<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<blockquote
cite="mid:CAMsssPmm8nr25RtPp43=UUoKVum1csM5MSBoohJ_mKGH8TDDVA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
Another approach would be to use a single IP address per
router per compute<br>
node. This avoids the multi-tenant issue mentioned above,
at the cost of<br>
consuming more IP addresses, potentially one default SNAT
IP address for each<br>
VM on the compute server (which is the case when every VM
on the compute node<br>
is from a different tenant and/or using a different
router). At that point<br>
you might as well give each VM a floating IP.<br>
<br>
Hence the approach taken with the initial DVR
implementation is to keep<br>
default SNAT as a centralized service.<br>
</blockquote>
<div><br>
</div>
<div>In contrast to moving service to distributed CN, we
should take care of keeping them as centralized,
especially FIP and FW. I know a lot of customer prefer
using some dedicated servers to act as network nodes,
which have more NICs(as external connection) than compute
nodes, in these cases FIP must be centralized instead of
being distributed. As for FW, if we want stateful ACL then
DVR can do nothing, except that we think security group is
already some kind of FW.</div>
<div><br>
</div>
</div>
</div>
</div>
</blockquote>
+1, I had another email to discuss about FW (FWaaS) and DVR
integration. Traditionally, we run firewall with router so that
firewall can use route and NAT info from router. since DVR is
asymmetric when handling traffic, it is hard to run stateful
firewall on top of DVR just like a traditional firewall does . When
the NAT is in the picture, the situation can be even worse.<br>
Yi <br>
<blockquote
cite="mid:CAMsssPmm8nr25RtPp43=UUoKVum1csM5MSBoohJ_mKGH8TDDVA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div> </div>
<br>
</div>
</div>
</div>
</blockquote>
<br>
</body>
</html>