Ipv6

We run multiple teams on the same OpenStack platform, one project per team. Traffic between two projects always hairpins through the gateway nodes, even with DVR enabled. This is expected behavior, not a misconfiguration. Below is the technical summary of why. What DVR distributes East-west between networks on the same router: routed locally on the ingress chassis, tunneled to the destination chassis. Fully distributed. North-south with a floating IP: the chassis hosting the VM performs the 1:1 NAT and answers ARP for the FIP on the external network. Distributed, but requires the provider network to be attached to every compute node and distributed FIP to be enabled. North-south with SNAT: centralized. The router’s external address is shared by all VMs behind it; it can be ARP-owned at only one point of the external segment, and the NAT state must live in a single conntrack table. It is pinned to a gateway chassis by design. DVR distributes only what it can bind 1:1 to a single chassis. Everything based on a shared, stateful address is centralized. ...

Why anycast inside the fabric is harder than it looks An anycast service is advertised from multiple hosts into the data center fabric — the same prefix, the same service IP, originated from several places at once. The promise is appealing: multiple next hops for one service prefix gives you load balancing, fast failover, and horizontal scalability without any state in the network. The catch is that for every leaf to actually use all of those origins, the fabric has to carry and install multiple equal-cost paths for a single prefix end to end. That is not BGP’s default behavior, and the moment you combine it with two things modern fabrics love — an IPv6 unnumbered underlay and IPv4-in-IPv6 next hops (RFC 5549) — one of the most common EVPN disambiguation tricks stops working. This post walks through why, and what the realistic options are. ...

⚠️ Modernization Notice These notes were written in 2018–2019. IPv6 CPE and OS support, DHCPv6 implementations, and ISP best practices have evolved significantly since then. Treat this as a record of real testing and the architectural decisions behind it, and validate against current RFCs, CPE datasheets, and OS release notes before deploying in production. Overview This post brings together two pieces of work I did on IPv6 for PPP broadband. The first is a set of notes and lab tests on running a single dual-stack PPP session per subscriber and assigning IPv6 prefixes to the CPE from a Cisco IOS XE BNG. The second is a design sketch for assigning static IPv6 prefixes per customer from a RADIUS/AAA backend. They belong together: the lab work shows how Cisco ISG/IOS XE actually behaves when prefixes arrive over RADIUS, and the design sketch is the natural next step once you decide that static, per-customer prefixes are what you want. ...