Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Configure Allowed Address Pairs

Juniper Networks supports Allowed Address Pairs (AAPs) using Cloud-Native Contrail® Networking™ Release 22.1 or later in a Kubernetes-orchestrated environment.

Allowed address pairs in Contrail Networking enables you to add IP/MAC (CIDR) addresses to the guest interface (VirtualMachineInterface) by using a secondary IP address.

When you create a pod in a cluster, each pod automatically obtains its IP address from the virtual machine (VM) interface. If your pod is not on the same virtual network, you can add an AAP to allow traffic to flow through the port regardless of the subnet. For example, let's say that your pod's IP address is If you define an AAP with subnet, the AAP allows the pods to communicate with the guest interface. The vRouter then forwards the traffic and advertises reachability to the pod.

To configure an allowed address pair, insert the following attribute into your pod YAML file, as shown in the code block that follows:

The AllowedAddressPairs attribute contains a list of allowed address pair definitions, as described in the following table:

Table 1: Allowed Address Pair Definitions
Definition Description
ip Specify the external pod IP address through which you want to allow traffic to pass.
mac (Optional) Specify the MAC address of the external pod.
addressMode (Optional) Specify a high availability (HA) address mode. Choose from active/active or active/standby. Active/standby is the default.

The addressMode default value is an empty string. Active/standby is used for VRRP addresses. Active/active is used for ECMP.

In Kubemanager, the PodControllerthat watches for Pod events reads the interface definitions for each new AAP. The controller then generates an AllowedAddressPair and adds it to the list of interfaces in the VirtualMachineInterface.

Alternative Configuration

Alternatively, you can configure AAP interfaces directly from the VirtualMachineInterface. To apply an AAP to this configuration, run the following command from the kubectl command-line tool:

The preceding command updates the existing VirtualMachineInterface with the AAP configuration, as shown in the following code block: