Unable to Ping Network Gateway From VM With Security Group Enabled

Problem

• Unable to Ping Network Gateway From VM With Security Group Enabled

• This behaviour is observed when the security group attached does not have Ingress rule defined.

Environment

• Private Cloud Director Virtualization - v2025.4 and Higher

• Self-Hosted Private Cloud Director Virtualization – v2025.4 and Higher

• Component - Networking

Cause

• When using a security group**,** inbound rule in the Security Group is not defined to allow the incoming traffic.

Resolution

• To allow the incoming traffic for the Tenant Network Gateway IP, add the rule in the Security Group.

• Steps to add ingress rule in the security group

1. Identify the security group UUID.

2. Run the below command to add the ingress rule to allow all incoming traffic.

Additional Information

• No additional action needs to be performed on the virtual machine or security group.

• Ingress Rule is required for the ping to be successful. Refer this Upstream Documentation.

• To understand Logical Tracing of the ONV Packet Flow, Refer this Upstream Documentation.

• To run ovn-* commands on the hosts onboarded to PCD, execute below steps.

1. Create an environment file ovs-alias.rc as below

2. Export the rc file and start using the ovn commands;

1. Access the OVN North Bond Pod in the Management Cluster using the below command.

2. Run the below command to validate.