Interface identity and anti-spoofing

Authorize guest source addresses and approved virtual service identities.

Interface anti-spoofing restricts guest-originated traffic to the MAC and address identities assigned to that interface. It is enforced independently of firewall allow rules.

Default identityCopy link

The managed interface owns its assigned MAC address and IP allocations. A guest cannot acquire another project's address by configuring it locally. A permissive firewall does not disable source-identity enforcement.

This affects appliances that forward packets, run virtual routers, or advertise an application-controlled virtual IP. Their additional identities need an explicit supported configuration rather than an assumed exception for router images.

Allowed address pairsCopy link

Open Interface → Advanced → Allowed address pairs. Add the specific virtual IP and optional MAC used by an approved service. The prefix must lie within a range permitted for that network, and the caller must have the corresponding network administration permission.

To permit a reviewed virtual IPv4 identity, use this address-pair definition:

{
  "allowed_address_pairs": [
    {
      "address": "10.42.0.50/32",
      "mac_address": "02:00:00:00:42:50"
    }
  ]
}

An IP-only entry uses the interface's managed MAC. Broad prefixes are rejected unless organization policy explicitly permits them. A public reserved address cannot be claimed through this list; use its managed assignment workflow.

Virtual IP failoverCopy link

A virtual-IP service needs more than two allowed pairs. Configure the application's ownership protocol, guest address behavior, and relevant route or neighbor updates. Both interfaces being authorized does not establish which application instance is the writer or active endpoint.

A guest-level failover address remains distinct from Infra's load-balancer or public-address ownership. Do not let two unrelated failover mechanisms manage the same public identity.

Routers and forwarding guestsCopy link

An approved forwarding interface can receive explicit source-check exceptions for routed prefixes. The exception is scoped to that interface and does not create a route or enable guest kernel forwarding. Return routing and firewall policy still apply.

The effective view identifies the controlling exception and its owner. Do not remove identity checks organization-wide to repair a single appliance.

Change and revokeCopy link

A pair edit creates a revision and an asynchronous realization operation. Check applied revisions on the active execution node before relying on a new service identity. A pending withdrawal is not an immediate isolation boundary.

Removing an allocation does not automatically remove an unrelated manually configured guest address. The managed path rejects that identity after withdrawal applies even if the guest continues advertising it. See Interface API, firewall rollouts, and route tables.