<div dir="ltr"><div><div>Hi<br><br></div>You can check this feature page to configure network filter per vNIC profile on 4.0<br><a href="https://www.ovirt.org/feature/networkfilter/">https://www.ovirt.org/feature/networkfilter/</a><br><br></div>Thanks<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Sep 25, 2016 at 3:36 PM, Edward Haas <span dir="ltr"><<a href="mailto:ehaas@redhat.com" target="_blank">ehaas@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote"><span class="">On Sun, Sep 25, 2016 at 11:17 AM, Troels Arvin <span dir="ltr"><<a href="mailto:troels@arvin.dk" target="_blank">troels@arvin.dk</a>></span> wrote:<br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">I would like to minimize the risk of virtual servers harming each other.<br>
As part of this, I would like to prevent them from changing their IP<br>
address to something different from what they are expected to have. In<br>
other words, I would like to prevent IP address spoofing in the guests.<br>
And I want to be able to do this without having to assign a different VLAN<br>
to each guest.<br>
<br>
Setup: RHEV 3.6 with RH7-based RHEV-H hypervisor hosts.<br>
<br>
Using virsh -r dumpxml <guest name> on a host, I can see that the guests<br>
have the "vdsm-no-mac-spoofing" network filter active for the virtual<br>
network interface.<br>
<br>
But what if I want the "clean-traffic" filter to be active for the<br>
guests, as well (or instead): Is there a way to accomplish that in the<br>
RHEV-M/oVirt management interface? If so: Where's the option(s) to be<br>
found in the management interface? Can it be done globally, i.e. as a<br>
default when guests are started?<br>
<span><font color="#888888"><br></font></span></blockquote><div><br></div></span><div>In 4.0 you can set this in the vnic profile (per network).<br></div><div><br>With 3.6, you will need to create a hook to do it.<br>See <a href="https://github.com/oVirt/vdsm/tree/master/vdsm_hooks/macspoof" target="_blank">https://github.com/oVirt/vdsm/<wbr>tree/master/vdsm_hooks/<wbr>macspoof</a> to get<br></div><div>an idea how you could do it.<br></div><span class=""><div> </div><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><span><font color="#888888">
--<br>
Regards,<br>
Troels Arvin<br>
<br>
______________________________<wbr>_________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
<a rel="noreferrer" href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/mailman<wbr>/listinfo/users</a><br>
</font></span></blockquote></span></div><br></div></div>
<br>______________________________<wbr>_________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org">Users@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.ovirt.org/<wbr>mailman/listinfo/users</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Michael Burman<br>RedHat Israel, RHEV-M QE Network Team<br><br>Mobile: 054-5355725<br>IRC: mburman</div></div>
</div>