diff --git a/README.md b/README.md
index 9ef5b941b..71e4aeaf4 100644
--- a/README.md
+++ b/README.md
@@ -942,7 +942,7 @@ module "cluster_pattern" {
 | <a name="input_vpc_placement_groups"></a> [vpc\_placement\_groups](#input\_vpc\_placement\_groups) | List of VPC placement groups to create | <pre>list(<br/>    object({<br/>      access_tags    = optional(list(string), [])<br/>      name           = string<br/>      resource_group = optional(string)<br/>      strategy       = string<br/>    })<br/>  )</pre> | `[]` | no |
 | <a name="input_vpcs"></a> [vpcs](#input\_vpcs) | A map describing VPCs to be created in this repo. | <pre>list(<br/>    object({<br/>      prefix          = string # VPC prefix<br/>      existing_vpc_id = optional(string)<br/>      existing_subnets = optional(<br/>        list(<br/>          object({<br/>            id             = string<br/>            public_gateway = optional(bool, false)<br/>          })<br/>        )<br/>      )<br/>      resource_group              = optional(string) # Name of the group where VPC will be created<br/>      access_tags                 = optional(list(string), [])<br/>      default_network_acl_name    = optional(string)<br/>      default_security_group_name = optional(string)<br/>      clean_default_sg_acl        = optional(bool, false)<br/>      dns_binding_name            = optional(string, null)<br/>      dns_instance_name           = optional(string, null)<br/>      dns_custom_resolver_name    = optional(string, null)<br/>      dns_location                = optional(string, "global")<br/>      dns_plan                    = optional(string, "standard-dns")<br/>      dns_zone_name               = optional(string, null)<br/>      dns_zone_description        = optional(string, null)<br/>      dns_zone_label              = optional(string, null)<br/>      dns_records = optional(list(object({<br/>        name       = string<br/>        type       = string<br/>        ttl        = number<br/>        rdata      = string<br/>        preference = optional(number, null)<br/>        service    = optional(string, null)<br/>        protocol   = optional(string, null)<br/>        priority   = optional(number, null)<br/>        weight     = optional(number, null)<br/>        port       = optional(number, null)<br/>      })), [])<br/>      existing_dns_instance_id          = optional(string, null)<br/>      use_existing_dns_instance         = optional(bool, false)<br/>      enable_hub                        = optional(bool, false)<br/>      skip_spoke_auth_policy            = optional(bool, false)<br/>      hub_account_id                    = optional(string, null)<br/>      enable_hub_vpc_id                 = optional(bool, false)<br/>      hub_vpc_id                        = optional(string, null)<br/>      enable_hub_vpc_crn                = optional(bool, false)<br/>      hub_vpc_crn                       = optional(string, null)<br/>      update_delegated_resolver         = optional(bool, false)<br/>      skip_custom_resolver_hub_creation = optional(bool, false)<br/>      resolver_type                     = optional(string, null)<br/>      manual_servers = optional(list(object({<br/>        address       = string<br/>        zone_affinity = optional(string)<br/>      })), [])<br/>      default_security_group_rules = optional(<br/>        list(<br/>          object({<br/>            name      = string<br/>            direction = string<br/>            remote    = string<br/>            tcp = optional(<br/>              object({<br/>                port_max = optional(number)<br/>                port_min = optional(number)<br/>              })<br/>            )<br/>            udp = optional(<br/>              object({<br/>                port_max = optional(number)<br/>                port_min = optional(number)<br/>              })<br/>            )<br/>            icmp = optional(<br/>              object({<br/>                type = optional(number)<br/>                code = optional(number)<br/>              })<br/>            )<br/>          })<br/>        )<br/>      )<br/>      default_routing_table_name = optional(string)<br/>      flow_logs_bucket_name      = optional(string)<br/>      address_prefixes = optional(<br/>        object({<br/>          zone-1 = optional(list(string))<br/>          zone-2 = optional(list(string))<br/>          zone-3 = optional(list(string))<br/>        })<br/>      )<br/>      network_acls = list(<br/>        object({<br/>          name                         = string<br/>          add_ibm_cloud_internal_rules = optional(bool)<br/>          add_vpc_connectivity_rules   = optional(bool)<br/>          prepend_ibm_rules            = optional(bool)<br/>          rules = list(<br/>            object({<br/>              name        = string<br/>              action      = string<br/>              destination = string<br/>              direction   = string<br/>              source      = string<br/>              tcp = optional(<br/>                object({<br/>                  port_max        = optional(number)<br/>                  port_min        = optional(number)<br/>                  source_port_max = optional(number)<br/>                  source_port_min = optional(number)<br/>                })<br/>              )<br/>              udp = optional(<br/>                object({<br/>                  port_max        = optional(number)<br/>                  port_min        = optional(number)<br/>                  source_port_max = optional(number)<br/>                  source_port_min = optional(number)<br/>                })<br/>              )<br/>              icmp = optional(<br/>                object({<br/>                  type = optional(number)<br/>                  code = optional(number)<br/>                })<br/>              )<br/>            })<br/>          )<br/>        })<br/>      )<br/>      use_public_gateways = object({<br/>        zone-1 = optional(bool)<br/>        zone-2 = optional(bool)<br/>        zone-3 = optional(bool)<br/>      })<br/>      subnets = optional(object({<br/>        zone-1 = list(object({<br/>          name           = string<br/>          cidr           = string<br/>          public_gateway = optional(bool)<br/>          acl_name       = string<br/>          no_addr_prefix = optional(bool, false)<br/>        }))<br/>        zone-2 = list(object({<br/>          name           = string<br/>          cidr           = string<br/>          public_gateway = optional(bool)<br/>          acl_name       = string<br/>          no_addr_prefix = optional(bool, false)<br/>        }))<br/>        zone-3 = list(object({<br/>          name           = string<br/>          cidr           = string<br/>          public_gateway = optional(bool)<br/>          acl_name       = string<br/>          no_addr_prefix = optional(bool, false)<br/>        }))<br/>      }))<br/>    })<br/>  )</pre> | n/a | yes |
 | <a name="input_vpn_gateways"></a> [vpn\_gateways](#input\_vpn\_gateways) | List of VPN Gateways to create. | <pre>list(<br/>    object({<br/>      name           = string<br/>      vpc_name       = string<br/>      subnet_name    = string # Do not include prefix, use same name as in `var.subnets`<br/>      mode           = optional(string)<br/>      resource_group = optional(string)<br/>      access_tags    = optional(list(string), [])<br/>    })<br/>  )</pre> | n/a | yes |
-| <a name="input_vsi"></a> [vsi](#input\_vsi) | A list describing VSI workloads to create | <pre>list(<br/>    object({<br/>      name                            = string<br/>      vpc_name                        = string<br/>      subnet_names                    = list(string)<br/>      ssh_keys                        = list(string)<br/>      image_name                      = string<br/>      machine_type                    = string<br/>      vsi_per_subnet                  = number<br/>      user_data                       = optional(string)<br/>      resource_group                  = optional(string)<br/>      enable_floating_ip              = optional(bool)<br/>      security_groups                 = optional(list(string))<br/>      boot_volume_encryption_key_name = optional(string)<br/>      primary_vni_additional_ip_count = optional(number)<br/>      use_legacy_network_interface    = optional(bool)<br/>      access_tags                     = optional(list(string), [])<br/>      security_group = optional(<br/>        object({<br/>          name = string<br/>          rules = list(<br/>            object({<br/>              name      = string<br/>              direction = string<br/>              source    = string<br/>              tcp = optional(<br/>                object({<br/>                  port_max = number<br/>                  port_min = number<br/>                })<br/>              )<br/>              udp = optional(<br/>                object({<br/>                  port_max = number<br/>                  port_min = number<br/>                })<br/>              )<br/>              icmp = optional(<br/>                object({<br/>                  type = number<br/>                  code = number<br/>                })<br/>              )<br/>            })<br/>          )<br/>        })<br/>      )<br/>      block_storage_volumes = optional(list(<br/>        object({<br/>          name           = string<br/>          profile        = string<br/>          capacity       = optional(number)<br/>          iops           = optional(number)<br/>          encryption_key = optional(string)<br/>        })<br/>      ))<br/>      load_balancers = optional(list(<br/>        object({<br/>          name                       = string<br/>          type                       = string<br/>          listener_port              = optional(number)<br/>          listener_port_max          = optional(number)<br/>          listener_port_min          = optional(number)<br/>          listener_protocol          = string<br/>          connection_limit           = optional(number)<br/>          idle_connection_timeout    = optional(number)<br/>          algorithm                  = string<br/>          protocol                   = string<br/>          health_delay               = number<br/>          health_retries             = number<br/>          health_timeout             = number<br/>          health_type                = string<br/>          pool_member_port           = string<br/>          profile                    = optional(string)<br/>          accept_proxy_protocol      = optional(bool)<br/>          subnet_id_to_provision_nlb = optional(string) # Required for Network Load Balancer. If no value is provided, the first one from the VPC subnet list will be selected.<br/>          dns = optional(<br/>            object({<br/>              instance_crn = string<br/>              zone_id      = string<br/>            })<br/>          )<br/>          security_group = optional(<br/>            object({<br/>              name = string<br/>              rules = list(<br/>                object({<br/>                  name      = string<br/>                  direction = string<br/>                  source    = string<br/>                  tcp = optional(<br/>                    object({<br/>                      port_max = number<br/>                      port_min = number<br/>                    })<br/>                  )<br/>                  udp = optional(<br/>                    object({<br/>                      port_max = number<br/>                      port_min = number<br/>                    })<br/>                  )<br/>                  icmp = optional(<br/>                    object({<br/>                      type = number<br/>                      code = number<br/>                    })<br/>                  )<br/>                })<br/>              )<br/>            })<br/>          )<br/>        })<br/>      ))<br/>    })<br/>  )</pre> | n/a | yes |
+| <a name="input_vsi"></a> [vsi](#input\_vsi) | A list describing VSI workloads to create | <pre>list(<br/>    object({<br/>      name                            = string<br/>      vpc_name                        = string<br/>      subnet_names                    = list(string)<br/>      ssh_keys                        = list(string)<br/>      image_name                      = string<br/>      machine_type                    = string<br/>      vsi_per_subnet                  = number<br/>      user_data                       = optional(string)<br/>      resource_group                  = optional(string)<br/>      enable_floating_ip              = optional(bool)<br/>      allow_ip_spoofing               = optional(bool)<br/>      security_groups                 = optional(list(string))<br/>      boot_volume_encryption_key_name = optional(string)<br/>      primary_vni_additional_ip_count = optional(number)<br/>      use_legacy_network_interface    = optional(bool)<br/>      access_tags                     = optional(list(string), [])<br/>      security_group = optional(<br/>        object({<br/>          name = string<br/>          rules = list(<br/>            object({<br/>              name      = string<br/>              direction = string<br/>              source    = string<br/>              tcp = optional(<br/>                object({<br/>                  port_max = number<br/>                  port_min = number<br/>                })<br/>              )<br/>              udp = optional(<br/>                object({<br/>                  port_max = number<br/>                  port_min = number<br/>                })<br/>              )<br/>              icmp = optional(<br/>                object({<br/>                  type = number<br/>                  code = number<br/>                })<br/>              )<br/>            })<br/>          )<br/>        })<br/>      )<br/>      block_storage_volumes = optional(list(<br/>        object({<br/>          name           = string<br/>          profile        = string<br/>          capacity       = optional(number)<br/>          iops           = optional(number)<br/>          encryption_key = optional(string)<br/>        })<br/>      ))<br/>      load_balancers = optional(list(<br/>        object({<br/>          name                       = string<br/>          type                       = string<br/>          listener_port              = optional(number)<br/>          listener_port_max          = optional(number)<br/>          listener_port_min          = optional(number)<br/>          listener_protocol          = string<br/>          connection_limit           = optional(number)<br/>          idle_connection_timeout    = optional(number)<br/>          algorithm                  = string<br/>          protocol                   = string<br/>          health_delay               = number<br/>          health_retries             = number<br/>          health_timeout             = number<br/>          health_type                = string<br/>          pool_member_port           = string<br/>          profile                    = optional(string)<br/>          accept_proxy_protocol      = optional(bool)<br/>          subnet_id_to_provision_nlb = optional(string) # Required for Network Load Balancer. If no value is provided, the first one from the VPC subnet list will be selected.<br/>          dns = optional(<br/>            object({<br/>              instance_crn = string<br/>              zone_id      = string<br/>            })<br/>          )<br/>          security_group = optional(<br/>            object({<br/>              name = string<br/>              rules = list(<br/>                object({<br/>                  name      = string<br/>                  direction = string<br/>                  source    = string<br/>                  tcp = optional(<br/>                    object({<br/>                      port_max = number<br/>                      port_min = number<br/>                    })<br/>                  )<br/>                  udp = optional(<br/>                    object({<br/>                      port_max = number<br/>                      port_min = number<br/>                    })<br/>                  )<br/>                  icmp = optional(<br/>                    object({<br/>                      type = number<br/>                      code = number<br/>                    })<br/>                  )<br/>                })<br/>              )<br/>            })<br/>          )<br/>        })<br/>      ))<br/>    })<br/>  )</pre> | n/a | yes |
 | <a name="input_wait_till"></a> [wait\_till](#input\_wait\_till) | To avoid long wait times when you run your Terraform code, you can specify the stage when you want Terraform to mark the cluster resource creation as completed. Depending on what stage you choose, the cluster creation might not be fully completed and continues to run in the background. However, your Terraform code can continue to run without waiting for the cluster to be fully created. Supported args are `MasterNodeReady`, `OneWorkerNodeReady`, and `IngressReady` | `string` | `"IngressReady"` | no |
 
 ### Outputs
diff --git a/ibm_catalog.json b/ibm_catalog.json
index a00436b80..14e29a72c 100644
--- a/ibm_catalog.json
+++ b/ibm_catalog.json
@@ -295,6 +295,9 @@
             {
               "key": "use_legacy_network_interface"
             },
+            {
+              "key": "allow_ip_spoofing"
+            },
             {
               "key": "add_edge_vpc",
               "hidden": true
@@ -717,6 +720,9 @@
             },
             {
               "key": "use_legacy_network_interface"
+            },
+            {
+              "key": "allow_ip_spoofing"
             }
           ],
           "iam_permissions": [
diff --git a/patterns/vsi-extension/main.tf b/patterns/vsi-extension/main.tf
index cb15c6a98..b27fbf124 100644
--- a/patterns/vsi-extension/main.tf
+++ b/patterns/vsi-extension/main.tf
@@ -68,4 +68,5 @@ module "vsi" {
   placement_group_id              = var.placement_group_id
   primary_vni_additional_ip_count = var.primary_vni_additional_ip_count
   use_legacy_network_interface    = var.use_legacy_network_interface
+  allow_ip_spoofing               = var.allow_ip_spoofing
 }
diff --git a/patterns/vsi-extension/variables.tf b/patterns/vsi-extension/variables.tf
index 5e5cb486b..0e16c0717 100644
--- a/patterns/vsi-extension/variables.tf
+++ b/patterns/vsi-extension/variables.tf
@@ -209,3 +209,9 @@ variable "use_legacy_network_interface" {
   type        = bool
   default     = false
 }
+
+variable "allow_ip_spoofing" {
+  description = "Allow IP spoofing on the primary network interface"
+  type        = bool
+  default     = false
+}
diff --git a/patterns/vsi/main.tf b/patterns/vsi/main.tf
index 07b8eef34..5d4c0ad03 100644
--- a/patterns/vsi/main.tf
+++ b/patterns/vsi/main.tf
@@ -89,6 +89,7 @@ module "vsi_landing_zone" {
   existing_vpc_cbr_zone_id               = var.existing_vpc_cbr_zone_id
   user_data                              = var.user_data
   use_legacy_network_interface           = var.use_legacy_network_interface
+  allow_ip_spoofing                      = var.allow_ip_spoofing
 }
 
 moved {
diff --git a/patterns/vsi/module/config.tf b/patterns/vsi/module/config.tf
index 92222580f..7d5bfc3d0 100644
--- a/patterns/vsi/module/config.tf
+++ b/patterns/vsi/module/config.tf
@@ -86,6 +86,7 @@ locals {
         boot_volume_encryption_key_name = "${var.prefix}-vsi-volume-key"
         user_data                       = lookup(var.user_data, network, null) != null ? var.user_data[network].user_data : null
         use_legacy_network_interface    = var.use_legacy_network_interface
+        allow_ip_spoofing               = var.allow_ip_spoofing
         security_group = {
           name     = "${var.prefix}-${network}"
           vpc_name = var.vpcs[0]
diff --git a/patterns/vsi/module/variables.tf b/patterns/vsi/module/variables.tf
index 4e360bedd..26e98009c 100644
--- a/patterns/vsi/module/variables.tf
+++ b/patterns/vsi/module/variables.tf
@@ -160,6 +160,12 @@ variable "use_legacy_network_interface" {
   default     = false
 }
 
+variable "allow_ip_spoofing" {
+  description = "Allow IP spoofing on the primary network interface"
+  type        = bool
+  default     = false
+}
+
 ##############################################################################
 
 
diff --git a/patterns/vsi/override.json b/patterns/vsi/override.json
index 546c9c097..bc73a6f88 100644
--- a/patterns/vsi/override.json
+++ b/patterns/vsi/override.json
@@ -423,7 +423,8 @@
                 "vsi-zone-3"
             ],
             "vpc_name": "management",
-            "vsi_per_subnet": 1
+            "vsi_per_subnet": 1,
+            "allow_ip_spoofing": false
         },
         {
             "boot_volume_encryption_key_name": "slz-vsi-volume-key",
diff --git a/patterns/vsi/variables.tf b/patterns/vsi/variables.tf
index c9d18a408..f7e8509ec 100644
--- a/patterns/vsi/variables.tf
+++ b/patterns/vsi/variables.tf
@@ -160,6 +160,12 @@ variable "use_legacy_network_interface" {
   default     = false
 }
 
+variable "allow_ip_spoofing" {
+  description = "Allow IP spoofing on the primary network interface"
+  type        = bool
+  default     = false
+}
+
 ##############################################################################
 
 
diff --git a/variables.tf b/variables.tf
index 3199a94a1..61f6692b9 100644
--- a/variables.tf
+++ b/variables.tf
@@ -317,6 +317,7 @@ variable "vsi" {
       user_data                       = optional(string)
       resource_group                  = optional(string)
       enable_floating_ip              = optional(bool)
+      allow_ip_spoofing               = optional(bool)
       security_groups                 = optional(list(string))
       boot_volume_encryption_key_name = optional(string)
       primary_vni_additional_ip_count = optional(number)
diff --git a/virtual_servers.tf b/virtual_servers.tf
index c38b427e0..0a726e8ec 100644
--- a/virtual_servers.tf
+++ b/virtual_servers.tf
@@ -88,6 +88,7 @@ module "vsi" {
     }
   ]
   enable_floating_ip = each.value.enable_floating_ip == true ? true : false
+  allow_ip_spoofing  = each.value.allow_ip_spoofing
   depends_on         = [module.ssh_keys]
 }