Virtual Network Function integration in OVN#

Sragdhara Datta Chaudhuri (Nutanix), Naveen Yerramneni (Nutanix)

• Why: Inserting third-party firewalls / network functions into the OVN traffic path has been a long-standing gap; this is a concrete, code-in-review design for bump-in-the-wire service insertion — network security chaining at the OVN layer.
• What: ACL-matched traffic is steered through a VNF's port pair (inline mode) or cloned to the VNF (tap mode); stateful symmetry via conntrack labels; VNF groups with datapath-probe health monitoring; member selection or load balancing across healthy members; configurable fail-close vs fail-open when all members are unhealthy; enforced tunneling for cross-host traffic to and from the VNF's node. Supports active/standby now, active/active planned.
• How: New logical-switch pipeline stages, new NB entities for network functions, a new ACL action, a new ovn-controller health-monitor type; conntrack labels redirect response packets and enforce tunnel behavior.
• Where applicable: OVN with either VLAN or overlay subnets, vendor-agnostic VNFs. Status: patch series in code review (July 2025 on ovs-dev). Note: the slide deck is mostly diagrams with no extractable detail, so this write-up is grounded in the abstract only.