Isolated-network

Overview

When a network is created, a broadcast domain is available to plug ports. It should be interesting to proposed an option on the network creation that enable the isolation between ports in a same broadcast domain (network), similar to a common use of private VLANs with isolated port technologies (RFC 5517). This prevents communication between VMs on the same logical switch.

This functionality could be addressed case where we create a shared network between tenants, for example. This should work also with a provider network.

Possible implementation

1. white list of know MAC address
2. local proxy ARP

• ARP broadcast modifies to unicast MAC address of a local proxy ARP (gateway)
• Multicast bootp traffic modifies to unicast MAC address of the DHCP agent
• drop all other broadcast and multicast traffic
• Drop all other traffic aren't having the MAC address of the local proxy ARP as destination (broadcast, multicast, illegitimate unicast)