...
- priority 1200:- allow all incoming broadcast (dl_dst=ff:ff:ff:ff:ff:ff) and multicast (nw_dst=224.0.0.0/24) traffic from the VIF's that are connected to the VM's
- priority 1100 :-permit broadcast (dl_dst=ff:ff:ff:ff:ff:ff) and multicast (nw_dst=224.0.0.0/24) traffic to be sent out ONLY on the VIF's that are connect to VM's (i.e excluding the tunnel and patch interfaces)
- priority 1000 :- suppress all broadcast/multicast ingress traffic on GRE tunnels
- priority 1: all incoming packets on patch port, just flood
- priority:0 :- do NORMAL processing on the rest of the flows. this rule will ensure (due to NORMAL processing) new mac address seen from a interface is learned
logical router:
Image Added
Fall back approach:
Achieving distributed routing and network ACL, would need distributed configuration. Given the scale of changes that would involve