add docs for u2oInterconnection subnet isolate

docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx

@@ -23,3 +23,67 @@ To achieve automatic interconnection between Underlay and Overlay subnets, you c
 6. Click **Update**.
 
 **Note**: Existing compute components in the Underlay subnet need to be recreated for the changes to take effect.
+
+## Isolation Between Underlay Subnets with u2oInterconnection Enabled
+
+When multiple Underlay subnets have `u2oInterconnection: true` enabled, traffic between them no longer goes through the physical gateway but is routed directly via the internal OVN network.
+
+If you need to isolate two Underlay subnets while both have `u2oInterconnection` enabled, you must first configure the kube-ovn-controller parameter, then configure the subnet isolation.
+
+### Step 1: Configure kube-ovn-controller
+
+Modify the kube-ovn-controller Deployment to disable connection tracking skip for destination logical port IPs:
+
+```bash
+kubectl edit deployment kube-ovn-controller -n kube-system
+```
+
+Add or modify the following argument:
+
+```yaml
+spec:
+  template:
+    spec:
+      containers:
+      - name: kube-ovn-controller
+        args:
+        - --ls-ct-skip-dst-lport-ips=false
+```
+
+:::caution
+
+`--ls-ct-skip-dst-lport-ips` controls whether to skip connection tracking (conntrack) for traffic destined to logical port IPs. The default value is `true`, which skips conntrack to improve performance. Setting it to `false` does not affect functionality but may slightly impact performance.
+
+However, for Underlay subnets with ACL-based isolation, you **must** set it to `false`. Otherwise, gateway-to-Pod traffic will fail (e.g., ping requests reach the Pod but replies are dropped), because ACL isolation uses `allow-related` which requires conntrack state; without it, replies cannot be identified as "related" and get dropped.
+
+:::
+
+### Step 2: Configure Subnet Isolation
+
+Configure the subnet with the following parameters:
+
+```yaml
+spec:
+  u2oInterconnection: true
+  private: true
+  allowSubnets:
+  - 10.0.0.0/24    # CIDR of the subnet allowed for inbound access
+  - 172.16.0.0/16  # Node network CIDR (REQUIRED)
+```
+
+**Parameters**:
+
+- `private: true`: Enables subnet isolation. This restricts inbound traffic to only the subnets specified in `allowSubnets`.
+- `allowSubnets`: An array of CIDR strings specifying which subnets are allowed for inbound access.
+
+:::caution
+
+**You must include the node network CIDR in `allowSubnets`**. Otherwise, nodes will not be able to communicate with Pods in this subnet, which may cause health checks, log collection, and other node-to-pod traffic to fail.
+
+:::
+
+:::note
+
+Setting `private: true` only restricts inbound traffic to the subnet. It does not affect outbound traffic from Pods within the subnet.
+
+:::