Management Interfaces Links on Ceos

[mahmutaydin1]

Hello,

I need a help about management interfaces connectivity. When I do links, they are working well. However, show lldp neighbors gives an output that Ma1 interfaces are connected to all nodes. I want to make them host ports.I think since it is bridge by default, it is seen as connected to each other.
Is there any paretemer to provide it?

`leaf1#show lldp neighbors
Last table change time : 0:03:16 ago
Number of table inserts : 12
Number of table deletes : 0
Number of table drops : 0
Number of table age-outs : 0

Port Neighbor Device ID Neighbor Port ID TTL

---

Et1 leaf2 Ethernet1 120
Et2 spine1 Ethernet2 120
Et3 spine2 Ethernet2 120
Et4 host1 Ethernet1 120
Et6 leaf2 Ethernet6 120
Ma1 host1 Management1 120
Ma1 leaf3 Management1 120
Ma1 spine1 Management1 120
Ma1 leaf4 Management1 120
Ma1 leaf2 Management1 120
Ma1 spine2 Management1 120
Ma1 host2 Management1 120`

[hellt]

Hi
all management ports are part of the same linux bridge, so yes, they see one another connected to the same broadcast domain

[mahmutaydin1]

Is there any way to isolate them?maybe we can assign interfaces to network type host?

[hellt]

I don't think there is an easy way to solve this.
I'd look into iptables maybe on the linux side to block comms between the mgmt ip addresses, while allowing the traffic from the host to each of the nodes

[mahmutaydin1]

I am trying to change driver type in my yaml file. for example, I give name ceos_mgmt2. it is created as bridge. When I try to change its driver type to host, there is below error. I am trying to solve this:)

root@ubuntu:# docker network create ceos_mgmt2 --driver host
Error response from daemon: only one instance of "host" network is allowed
root@ubuntu:#

[steiler]

How about port isolationon the linux bridge.
Something along these lines:
https://serverfault.com/questions/388544/is-it-possible-to-enable-port-isolation-on-linux-bridges