{"action":"created","issue":{"url":"https://api.github.com/repos/vmware/vic/issues/3081","repository_url":"https://api.github.com/repos/vmware/vic","labels_url":"https://api.github.com/repos/vmware/vic/issues/3081/labels{/name}","comments_url":"https://api.github.com/repos/vmware/vic/issues/3081/comments","events_url":"https://api.github.com/repos/vmware/vic/issues/3081/events","html_url":"https://github.com/vmware/vic/issues/3081","id":188353926,"number":3081,"title":"If management interface of the VCH is not Layer 2 adjacent to vSphere management endpoints VCH will not work.","user":{"login":"mlh78750","id":16670605,"avatar_url":"https://avatars.githubusercontent.com/u/16670605?v=3","gravatar_id":"","url":"https://api.github.com/users/mlh78750","html_url":"https://github.com/mlh78750","followers_url":"https://api.github.com/users/mlh78750/followers","following_url":"https://api.github.com/users/mlh78750/following{/other_user}","gists_url":"https://api.github.com/users/mlh78750/gists{/gist_id}","starred_url":"https://api.github.com/users/mlh78750/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mlh78750/subscriptions","organizations_url":"https://api.github.com/users/mlh78750/orgs","repos_url":"https://api.github.com/users/mlh78750/repos","events_url":"https://api.github.com/users/mlh78750/events{/privacy}","received_events_url":"https://api.github.com/users/mlh78750/received_events","type":"User","site_admin":false},"labels":[{"id":324262087,"url":"https://api.github.com/repos/vmware/vic/labels/area/appliance","name":"area/appliance","color":"fef2c0","default":false},{"id":318104882,"url":"https://api.github.com/repos/vmware/vic/labels/area/security","name":"area/security","color":"fbca04","default":false},{"id":327811025,"url":"https://api.github.com/repos/vmware/vic/labels/component/portlayer/network","name":"component/portlayer/network","color":"d4c5f9","default":false},{"id":327809115,"url":"https://api.github.com/repos/vmware/vic/labels/component/vic-machine","name":"component/vic-machine","color":"d4c5f9","default":false},{"id":310959982,"url":"https://api.github.com/repos/vmware/vic/labels/kind/bug","name":"kind/bug","color":"f7c6c7","default":false},{"id":465799667,"url":"https://api.github.com/repos/vmware/vic/labels/kind/customer-found","name":"kind/customer-found","color":"006b75","default":false},{"id":404465874,"url":"https://api.github.com/repos/vmware/vic/labels/kind/note","name":"kind/note","color":"bfd4f2","default":false},{"id":407736447,"url":"https://api.github.com/repos/vmware/vic/labels/status/needs-regression-test","name":"status/needs-regression-test","color":"b60205","default":false}],"state":"open","locked":false,"assignee":{"login":"hmahmood","id":6599778,"avatar_url":"https://avatars.githubusercontent.com/u/6599778?v=3","gravatar_id":"","url":"https://api.github.com/users/hmahmood","html_url":"https://github.com/hmahmood","followers_url":"https://api.github.com/users/hmahmood/followers","following_url":"https://api.github.com/users/hmahmood/following{/other_user}","gists_url":"https://api.github.com/users/hmahmood/gists{/gist_id}","starred_url":"https://api.github.com/users/hmahmood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hmahmood/subscriptions","organizations_url":"https://api.github.com/users/hmahmood/orgs","repos_url":"https://api.github.com/users/hmahmood/repos","events_url":"https://api.github.com/users/hmahmood/events{/privacy}","received_events_url":"https://api.github.com/users/hmahmood/received_events","type":"User","site_admin":false},"assignees":[{"login":"hmahmood","id":6599778,"avatar_url":"https://avatars.githubusercontent.com/u/6599778?v=3","gravatar_id":"","url":"https://api.github.com/users/hmahmood","html_url":"https://github.com/hmahmood","followers_url":"https://api.github.com/users/hmahmood/followers","following_url":"https://api.github.com/users/hmahmood/following{/other_user}","gists_url":"https://api.github.com/users/hmahmood/gists{/gist_id}","starred_url":"https://api.github.com/users/hmahmood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hmahmood/subscriptions","organizations_url":"https://api.github.com/users/hmahmood/orgs","repos_url":"https://api.github.com/users/hmahmood/repos","events_url":"https://api.github.com/users/hmahmood/events{/privacy}","received_events_url":"https://api.github.com/users/hmahmood/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/vmware/vic/milestones/37","html_url":"https://github.com/vmware/vic/milestones/VIC%20GA%20Release","labels_url":"https://api.github.com/repos/vmware/vic/milestones/37/labels","id":1799354,"number":37,"title":"VIC GA Release","description":"Milestone for tracking all work towards the GA goal","creator":{"login":"mdubya66","id":15821624,"avatar_url":"https://avatars.githubusercontent.com/u/15821624?v=3","gravatar_id":"","url":"https://api.github.com/users/mdubya66","html_url":"https://github.com/mdubya66","followers_url":"https://api.github.com/users/mdubya66/followers","following_url":"https://api.github.com/users/mdubya66/following{/other_user}","gists_url":"https://api.github.com/users/mdubya66/gists{/gist_id}","starred_url":"https://api.github.com/users/mdubya66/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mdubya66/subscriptions","organizations_url":"https://api.github.com/users/mdubya66/orgs","repos_url":"https://api.github.com/users/mdubya66/repos","events_url":"https://api.github.com/users/mdubya66/events{/privacy}","received_events_url":"https://api.github.com/users/mdubya66/received_events","type":"User","site_admin":false},"open_issues":54,"closed_issues":495,"state":"open","created_at":"2016-05-31T17:50:00Z","updated_at":"2016-11-11T00:12:14Z","due_on":"2016-11-23T00:00:00Z","closed_at":null},"comments":10,"created_at":"2016-11-09T21:13:32Z","updated_at":"2016-11-11T14:47:32Z","closed_at":null,"body":"Configuration of the management gateway for the VCH needs to include networks that should use that gateway.\r\n\r\nCurrently we have the options: \r\n\r\n```\r\n--management-network 'network 2'\r\n--management-network-gateway 192.168.2.1/24\r\n--management-network-ip 192.168.2.10/24\r\n\r\n```\r\nfor setting up a VCH. \r\n\r\nThe problem is that the external (soon to be renamed public) interface should have the default route. Therefore, we need to allow the customer to specify the network(s) that need to route over the management network/interface of the VCH and through the gateway provided in --management-network-gateway. The way it works in .7.0 is that randomly one of the interfaces and gateways becomes the default route on the VCH. This means that if the external interface gateway is picked as the default route, then all vSphere management traffic that is not L2 adjacent to the VCH management interface will route out of the external interface and for all reasonable security configurations for customers will not reach the target.\r\n\r\n**Proposal:**\r\n\r\nChange --management-network-gateway 192.168.2.1/24 to --management-network-gateway 192.168.3.0/24,192.168.128.0/22:192.168.2.1/24. What this would do is cause the VCH to know that all of the network addresses in 192.168.3.0-255 and 192.168.128.0-192.168.131.255 can be reached by sending packets to 192.168.2.1. Which would result in vic-init adding the following routes into the VCH.\r\n\r\n```\r\nDestination     Gateway         Genmask\r\n192.168.3.0    192.168.2.1     255.255.255.0\r\n192.168.128.0  192.168.2.1    255.255.252.0\r\n```\r\n\r\nThe default route would remain on the external interface. The specifier would allow 1 to many network spaces separated by commas with a colon and then the gateway with mask.\r\n\r\n**Workaround for 0.7.0:**\r\nUse vic-machine debug to turn on ssh access to the VCH.\r\nLogin to the VCH via ssh and ensure the default route is on the external interface.\r\nAdd routes as needed to the management network.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/vmware/vic/issues/comments/259972297","html_url":"https://github.com/vmware/vic/issues/3081#issuecomment-259972297","issue_url":"https://api.github.com/repos/vmware/vic/issues/3081","id":259972297,"user":{"login":"stuclem","id":16718369,"avatar_url":"https://avatars.githubusercontent.com/u/16718369?v=3","gravatar_id":"","url":"https://api.github.com/users/stuclem","html_url":"https://github.com/stuclem","followers_url":"https://api.github.com/users/stuclem/followers","following_url":"https://api.github.com/users/stuclem/following{/other_user}","gists_url":"https://api.github.com/users/stuclem/gists{/gist_id}","starred_url":"https://api.github.com/users/stuclem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stuclem/subscriptions","organizations_url":"https://api.github.com/users/stuclem/orgs","repos_url":"https://api.github.com/users/stuclem/repos","events_url":"https://api.github.com/users/stuclem/events{/privacy}","received_events_url":"https://api.github.com/users/stuclem/received_events","type":"User","site_admin":false},"created_at":"2016-11-11T14:47:32Z","updated_at":"2016-11-11T14:47:32Z","body":"Just noticed the kind/note flag on this one. Attempted to write this up as follows:\r\n\r\n- <b>Virtual container host does not work if management interface is not Layer 2 adjacent to vSphere management endpoints. [#3081](https://github.com/vmware/vic/issues/3081)</b><br>In vSphere Integrated Containers 0.7.0 one of the interfaces and gateways that you configure on the networks is selected randomly to serve as the default route on the virtual container host. However, the external interface should have the default route. As a consequence, if the external interface gateway is selected as the default route, all vSphere management traffic that is not L2 adjacent to the management interface of the virtual container host is routed out of the external interface. In all reasonable security configurations, this traffic will not reach the target.\r\n\r\n  Workaround: \r\n  1. Use `vic-machine debug` to enable SSH access to the virtual container host.\r\n  2. Login to the VCH via SSH \r\n  3. Ensure the default route is on the external interface.\r\n  3. Add routes to the management network as required.\r\n\r\n@mlh78750 is this anywhere near accurate?"}}
{"actor":{"display_login":"stuclem"}}