Api proposal 2 #16
Api proposal 2 #16
Conversation
|
|
||
| ## Constraints | ||
| * An external addresses can belong to only one VPC. | ||
| * No other restriction is needed IMO, but happy to discuss why. |
There was a problem hiding this comment.
Can you discuss why? Dealing with multiple pifs with the same IP addresses and return routes in the gateway was the whole issue here, especially if there are conflicting policies between the PIFs (e.g., firewall rules, PAT, etc.). Why is this no longer an issue?
There was a problem hiding this comment.
Yes, my example for the firewall rules at the pif level was not good.
The intent --still valid-- was to show that having an entity that users can refer to and acts as anchor, eases things. Now, for firewall rules, you'd probably have some other entity outside the pifs for that, (which could refer to the pifs if needed) indicating what traffic is allowed.
There was a problem hiding this comment.
For, the rest, let's chat about it.
|
Also, can you give some examples of how you would use your approach to implement more complex things like firewall policies? And if we have different policies on different PIFs, how can you uniquely identify the PIF if multiple PIFs are using the same IP addresses. |
See above for the firewall. When you say that multiple PIFs use the same Ip address, can you give an example? |
No description provided.