The allowed-address-pairs extension can be used to allow additional IPs, subnets, and MAC addresses, other than the fixed IP and MAC address associated with the port, to act as source addresses for traffic leaving a port or virtual interface. This is useful when treating an instance as a routing device or VPN concentrator, or when implementing high-availability between multiple instances using addresses that need to "float" between them, such as an haproxy and/or keepalived implementation.
Existing allowed address pairs can be found in the details of each port by using the openstack port show command. For every network and/or MAC address that should be allowed, the openstack port set command should be used with the --allowed-address argument, as shown here:
openstack port set <port>
--allowed-address ip_address=<IP_ADDR>,mac-address=...
