Re: [ovirt-users] ovirtmgmt network security

On Mon, Oct 30, 2017 at 10:50 AM, Alona Kaplan <alkaplan(a)redhat.com&gt; wrote: > Hi Istvan, > > I agree with Luca. You can remove nic1. > 'ovirtmgmt' network is not mandatory on the vm, you can run the vm with > no vnics (vitrual nics) at all. > The 'ovirtmgmt' network is used for communication between the engine and > the host. > Whether the vm using the 'ovirtmgmt' network or not won't affect the > management capabilities. > > You said that the vm nic with 'ovirtmgmt' was automatically added when > you added the vm. > It is strange and shouldn't behave this way. Are you sure that in the add > vm dialog you didn't choose it as the network of nic1? (you could leave > this section in the dialog unfilled, it is not mandatory). > > BTW, if you don't want any VM to use the 'ovirtmgmt' network you can go > to the edit network dialog of 'ovirtmgmt' (in the Network main tab) and > uncheck the 'vm network' checkbox. > > Hope it helps you, > Alona. > > Hi Alona, Yes, removing nic1 was the solution I was looking for. You are right, I probably added nic1 during the creation of the VM. This is my first ovirt install and I'm a little bit overwhelmed by all the details one has to know to create a system that is reliable and efficient. Fortunately, thanks to people like you and Luca, I'll be able to overcome the initial difficulties. Istvan On Mon, Oct 30, 2017 at 11:26 AM, Luca 'remix_tj' Lorenzetto < > lorenzetto.luca(a)gmail.com&gt; wrote: > >> On Mon, Oct 30, 2017 at 8:45 AM, Istvan Buki <buki.istvan(a)gmail.com&gt; >> wrote: >> > Hello, >> > >> > thank you for your patience for trying to let me see the light. >> > >> > Indeed I don't understand what you are explaining. Maybe if I give you >> more >> > concrete details it will help. >> > >> > My internal network is 192.168.196.0 >> > My DMZ network is 192.168.188.0 >> > >> > ovirt-engine is running on a centos server with IP 192.168.186.3 >> > ovirt host is on a centos server with IP 192.168.186.4 >> > >> > On the host I created a VM that I want to be in the DMZ. When I >> created the >> > VM, nic 1 was automatically added and is linked to the ovirtmgmt >> network. >> > In the VM nic1 becomes eth0 and was assigned an IP address with DHCP >> > 192.168.186.167. >> > >> > After that I added a host device to that VM using passthrough. This >> device >> > is called ens7 in the VM and I gave IP 192.186.188.4. >> > That device is directly connected to my physical DMZ switch and from >> there >> > to the firewall. >> > This part is OK. >> > >> > My problem is that through eth0 my VM has access to my internal >> network. >> > Removing the device seems impossible because this is ovirtmgmt network. >> > I can not change or remove the IP of my host because it would not be >> > reachable anymore on my internal network. >> > >> > Maybe the solution is obvious but I can't see it. I'm running in >> circle with >> > this problem and it makes me crazy. >> > >> >> >> >> Hi Istvan, >> >> why are you using device passthrough? >> >> Anyway. If you don't need the VM to access to ovirtmgmt, remove nic1. >> As far as i can understand, you're directly communicating through DMZ. >> >> Luca >> >> >> -- >> "E' assurdo impiegare gli uomini di intelligenza eccellente per fare >> calcoli che potrebbero essere affidati a chiunque se si usassero delle >> macchine" >> Gottfried Wilhelm von Leibnitz, Filosofo e Matematico (1646-1716) >> >> "Internet è la più grande biblioteca del mondo. >> Ma il problema è che i libri sono tutti sparsi sul pavimento" >> John Allen Paulos, Matematico (1945-vivente) >> >> Luca 'remix_tj' Lorenzetto, http://www.remixtj.net , < >> lorenzetto.luca(a)gmail.com&gt; >> _______________________________________________ >> Users mailing list >> Users(a)ovirt.org >> http://lists.ovirt.org/mailman/listinfo/users >> > >