Address pair rules include:

• When creating a VM instance, do not bind the instance to a virtual port (vPort). Instead, use a port whose IP address is not a member of another port’s allowed address pair.

  Binding a vPort to an instance prevents the instance from spawning and produces an error message similar to the following:

  Sample output

  WARNING nova.virt.libvirt.driver [req-XXXX - - - default default] \
  [instance: XXXXXXXXX] Timeout waiting for [('network-vif-plugged', \
  'XXXXXXXXXX')] for instance with vm_state building and task_state \
  spawning.: eventlet.timeout.Timeout: 300 seconds

• Since RHOSO 18.0.17, Feature Release 5, ML2/OVN supports Virtual Router Redundancy Protocol version 3 (VRRPv3) and allowed address pairs with virtual MAC addresses.

  You must use virtual MAC addresses within this range:

  • IPv4 VRRP: 00:00:5e:00:01:XX (prefix 00:00:5e:00:01)
  • IPv6 VRRP: 00:00:5e:00:02:XX (prefix 00:00:5e:00:02)

    If you use virtual MAC addresses outside this range, ovn-northd discards the LSP port security with a message similar to the following:

    Sample output

    invalid syntax 'fa:16:3e:d6:f4:4c' in port security for LSP \
    2cbcc5e3-0afe-4237-8743-078b30ce3e4b: Invalid VRRPv3 MAC

• Do not use the default security group with an IP address outside the range in an allowed address pair.

  Doing so can allow a single port to bypass security groups for all other ports within the same network.

• Do not use a CIDR format IP address for the bound port allowed_address_pairs. If you use a CIDR format IP address for the bound port, port forwarding is not configured in the network, and inbound traffic fails for the bound port.