| layout | title | date | categories | tags | excerpt |
|---|---|---|---|---|---|
post |
openstack neutron dvr practice |
2016-01-28 09:00:30 -0800 |
Openstack |
neutron |
openstack neutron dvr practice |
172.17.42.50 controller
172.17.42.51 network
172.17.42.52 compute1
- /etc/neutron/neutron.conf
[DEFAULT]
verbose = True
router_distributed = True
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = True
- /etc/neutron/plugins/ml2/ml2_conf.ini
[ml2]
type_drivers = flat,vlan,gre,vxlan
tenant_network_types = vlan,gre,vxlan
mechanism_drivers = openvswitch,l2population
[ml2_type_flat]
flat_networks = external
[ml2_type_vlan]
network_vlan_ranges = external,vlan:1:1000
[ml2_type_gre]
tunnel_id_ranges = 1:1000
[ml2_type_vxlan]
vni_ranges = 1:1000
vxlan_group = 239.1.1.1
[securitygroup]
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
enable_security_group = True
enable_ipset = True
- start neturon service
systemctl start neutron-server.service
- packages
# yum install openstack-neutron openstack-neutron-ml2 \
openstack-neutron-openvswitch python-neutronclient ebtables ipset- /etc/sysctl.conf
net.ipv4.ip_forward=1
net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.all.rp_filter=0
- /etc/neutron/neutron.conf
[DEFAULT]
verbose = True
rpc_backend = rabbit
auth_strategy = keystone
[oslo_messaging_rabbit]
rabbit_host = controller
rabbit_userid = openstack
rabbit_password = 123456
[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = neutron
password = 123456
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
- /etc/neutron/plugins/ml2/ml2_conf.ini
[ovs]
local_ip = 172.18.42.51
bridge_mappings = vlan:br-vlan,external:br-ex
[agent]
l2_population = True
tunnel_types = gre,vxlan
enable_distributed_routing = True
arp_responder = True
[securitygroup]
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
enable_security_group = True
enable_ipset = True
#ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
- /etc/neutron/l3_agent.ini
[DEFAULT]
verbose = True
interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
use_namespaces = True
external_network_bridge = br-ex
router_delete_namespaces = True
agent_mode = dvr_snat
- /etc/neutron/dhcp_agent.ini
[DEFAULT]
verbose = True
interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
use_namespaces = True
dhcp_delete_namespaces = True
dnsmasq_config_file = /etc/neutron/dnsmasq-neutron.conf
- /etc/neutron/metadata_agent.ini
[DEFAULT]
verbose = True
nova_metadata_ip = controller
metadata_proxy_shared_secret = 123456
auth_uri = http://controller:5000
auth_url = http://controller:35357
auth_region = RegionOne
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = neutron
password = 123456
- start service
# systemctl start openvswitch
# ovs-vsctl add-br br-ex
# ovs-vsctl add-port br-ex eth2
# systemctl start neutron-openvswitch-agent.service neutron-dhcp-agent.service \
neutron-metadata-agent.service neutron-l3-agent.service
- /etc/sysctl.conf
net.ipv4.ip_forward=1
net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.all.rp_filter=0
net.bridge.bridge-nf-call-iptables=1
net.bridge.bridge-nf-call-ip6tables=1
- /etc/neutron/neutron.conf
[DEFAULT]
verbose = True
rpc_backend = rabbit
auth_strategy = keystone
[oslo_messaging_rabbit]
rabbit_host = controller
rabbit_userid = openstack
rabbit_password = 123456
[keystone_authtoken]
auth_uri = http://controller:5000
auth_url = http://controller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = neutron
password = 123456
[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
- /etc/neutron/plugins/ml2/ml2_conf.ini
[ovs]
local_ip = 172.18.42.52
bridge_mappings = vlan:br-vlan,external:br-ex
[agent]
l2_population = True
tunnel_types = gre,vxlan
enable_distributed_routing = True
arp_responder = True
[securitygroup]
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
enable_security_group = True
enable_ipset = True
#ln -s /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini
- /etc/neutron/l3_agent.ini
[DEFAULT]
verbose = True
interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
use_namespaces = True
external_network_bridge = br-ex
router_delete_namespaces = True
agent_mode = dvr
- /etc/neutron/metadata_agent.ini
[DEFAULT]
verbose = True
nova_metadata_ip = controller
metadata_proxy_shared_secret = 123456
auth_uri = http://controller:5000
auth_url = http://controller:35357
auth_region = RegionOne
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = neutron
password = 123456
- /etc/nova/nova.conf
[neutron]
url = http://controller:9696
auth_url = http://controller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
region_name = RegionOne
project_name = service
username = neutron
password = 123456
- start service
# systemctl start openvswitch
# ovs-vsctl add-br br-ex
# ovs-vsctl add-port br-ex eth2
# systemctl start neutron-openvswitch-agent.service \
neutron-metadata-agent.service neutron-l3-agent.service
[root@controller ~]# neutron agent-list
+--------------------------------------+--------------------+----------+-------+----------------+---------------------------+
| id | agent_type | host | alive | admin_state_up | binary |
+--------------------------------------+--------------------+----------+-------+----------------+---------------------------+
| 29d52888-1268-4351-97e2-36dcc8466c32 | Open vSwitch agent | compute1 | :-) | True | neutron-openvswitch-agent |
| 406a8a5e-209a-43c9-aeb1-94109a0c2ba4 | Metadata agent | compute1 | :-) | True | neutron-metadata-agent |
| 5dc96667-7f5f-4e3d-85aa-22759c7a4c5a | L3 agent | compute1 | :-) | True | neutron-l3-agent |
| 77c78491-d4e6-491f-8ac6-e6348fbc87c9 | L3 agent | network | :-) | True | neutron-l3-agent |
| 7945ac8b-42a7-4a6f-8af0-a825633abfe0 | Metadata agent | network | :-) | True | neutron-metadata-agent |
| 9b2f273e-9f7a-468c-a47a-f794a66f5c76 | DHCP agent | network | :-) | True | neutron-dhcp-agent |
| b0ebab6e-501a-40df-abc7-f870a3ff994d | Open vSwitch agent | network | :-) | True | neutron-openvswitch-agent |
+--------------------------------------+--------------------+----------+-------+----------------+---------------------------+
Creates a flat external network and a VXLAN project network.
- Create the external network
[root@controller ~]# neutron net-create ext-net --router:external \
> --provider:physical_network external --provider:network_type flat
Created a new network:
+---------------------------+--------------------------------------+
| Field | Value |
+---------------------------+--------------------------------------+
| admin_state_up | True |
| id | 8441b8e8-1dfb-484b-bdae-02a61936db9b |
| mtu | 0 |
| name | ext-net |
| provider:network_type | flat |
| provider:physical_network | external |
| provider:segmentation_id | |
| router:external | True |
| shared | False |
| status | ACTIVE |
| subnets | |
| tenant_id | 0b48811a7e614b1ba752a6544d4eba02 |
+---------------------------+--------------------------------------+- Create a subnet on the external network
[root@controller ~]# neutron subnet-create ext-net 203.0.113.0/24 --allocation-pool \
> start=203.0.113.10,end=203.0.113.20 --disable-dhcp \
> --gateway 203.0.113.1
Created a new subnet:
+-------------------+--------------------------------------------------+
| Field | Value |
+-------------------+--------------------------------------------------+
| allocation_pools | {"start": "203.0.113.10", "end": "203.0.113.20"} |
| cidr | 203.0.113.0/24 |
| dns_nameservers | |
| enable_dhcp | False |
| gateway_ip | 203.0.113.1 |
| host_routes | |
| id | ececc303-22d8-4804-a121-d98a4984be11 |
| ip_version | 4 |
| ipv6_address_mode | |
| ipv6_ra_mode | |
| name | |
| network_id | 8441b8e8-1dfb-484b-bdae-02a61936db9b |
| subnetpool_id | |
| tenant_id | 0b48811a7e614b1ba752a6544d4eba02 |
+-------------------+--------------------------------------------------+- Create the project network
[root@controller ~]# openstack project show demo
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Demo Project |
| domain_id | default |
| enabled | True |
| id | 54dda1538bf64ba986f8672884326761 |
| is_domain | False |
| name | demo |
| parent_id | None |
+-------------+----------------------------------+
[root@controller ~]# neutron net-create demo-net --tenant-id 54dda1538bf64ba986f8672884326761 \
> --provider:network_type vxlan
Created a new network:
+---------------------------+--------------------------------------+
| Field | Value |
+---------------------------+--------------------------------------+
| admin_state_up | True |
| id | 2ffdf0df-54cb-46e8-81d8-5b40d7cfd45e |
| mtu | 0 |
| name | demo-net |
| provider:network_type | vxlan |
| provider:physical_network | |
| provider:segmentation_id | 25 |
| router:external | False |
| shared | False |
| status | ACTIVE |
| subnets | |
| tenant_id | 54dda1538bf64ba986f8672884326761 |
+---------------------------+--------------------------------------+- Create a subnet on the project network
[root@controller ~]# source demo-openrc.sh
[root@controller ~]# neutron subnet-create demo-net --name demo-subnet --gateway 192.168.10.1 192.168.10.0/24
Created a new subnet:
+-------------------+----------------------------------------------------+
| Field | Value |
+-------------------+----------------------------------------------------+
| allocation_pools | {"start": "192.168.10.2", "end": "192.168.10.254"} |
| cidr | 192.168.10.0/24 |
| dns_nameservers | |
| enable_dhcp | True |
| gateway_ip | 192.168.10.1 |
| host_routes | |
| id | 6fceea95-4c1c-4631-84a8-ebe93d515f0a |
| ip_version | 4 |
| ipv6_address_mode | |
| ipv6_ra_mode | |
| name | demo-subnet |
| network_id | 2ffdf0df-54cb-46e8-81d8-5b40d7cfd45e |
| subnetpool_id | |
| tenant_id | 54dda1538bf64ba986f8672884326761 |
+-------------------+----------------------------------------------------+- Create a distributed project router
[root@controller ~]# neutron router-create demo-router
Created a new router:
+-----------------------+--------------------------------------+
| Field | Value |
+-----------------------+--------------------------------------+
| admin_state_up | True |
| external_gateway_info | |
| id | 3d4857d4-50db-412c-ab09-da1b48222b46 |
| name | demo-router |
| routes | |
| status | ACTIVE |
| tenant_id | 54dda1538bf64ba986f8672884326761 |
+-----------------------+--------------------------------------+- Attach the project network to the router
[root@controller ~]# neutron router-interface-add demo-router demo-subnet
Added interface 26693640-ee09-4b7b-a44d-a6f89c2c7125 to router demo-router.- Add a gateway to the external network for the project network on the router
[root@controller ~]# neutron router-gateway-set demo-router ext-net
Set gateway for router demo-router在网络节点，会看到snat, qrouter 和 qdhcp namespaces:
[root@network ~]# ip netns
snat-3d4857d4-50db-412c-ab09-da1b48222b46
qrouter-3d4857d4-50db-412c-ab09-da1b48222b46
qdhcp-2ffdf0df-54cb-46e8-81d8-5b40d7cfd45e
[root@network ~]# ip netns exec snat-3d4857d4-50db-412c-ab09-da1b48222b46 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
18: sg-ee7fdd84-0e: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether fa:16:3e:f1:96:8b brd ff:ff:ff:ff:ff:ff
inet 192.168.10.6/24 brd 192.168.10.255 scope global sg-ee7fdd84-0e
valid_lft forever preferred_lft forever
inet6 fe80::f816:3eff:fef1:968b/64 scope link
valid_lft forever preferred_lft forever
19: qg-6176d55e-ee: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether fa:16:3e:16:0b:9c brd ff:ff:ff:ff:ff:ff
inet 203.0.113.13/24 brd 203.0.113.255 scope global qg-6176d55e-ee
valid_lft forever preferred_lft forever
inet6 fe80::f816:3eff:fe16:b9c/64 scope link
valid_lft forever preferred_lft forever
[root@network ~]# ip netns exec qrouter-3d4857d4-50db-412c-ab09-da1b48222b46 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
17: qr-3e60aab4-57: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether fa:16:3e:ef:bc:7e brd ff:ff:ff:ff:ff:ff
inet 192.168.10.1/24 brd 192.168.10.255 scope global qr-3e60aab4-57
valid_lft forever preferred_lft forever
inet6 fe80::f816:3eff:feef:bc7e/64 scope link
valid_lft forever preferred_lft forever
[root@network ~]# ovs-vsctl show
899935c8-0797-47c0-9290-8b718396519b
Bridge br-int
fail_mode: secure
Port br-int
Interface br-int
type: internal
Port "sg-ee7fdd84-0e"
tag: 4095
Interface "sg-ee7fdd84-0e"
type: internal
Port "qr-3e60aab4-57"
tag: 4095
Interface "qr-3e60aab4-57"
type: internal
Port "qg-7cac7e10-cc"
tag: 4095
Interface "qg-7cac7e10-cc"
type: internal
Port "tap8311fca4-65"
tag: 4095
Interface "tap8311fca4-65"
type: internal
Bridge br-ex
Port "qg-6176d55e-ee"
Interface "qg-6176d55e-ee"
type: internal
Port br-ex
Interface br-ex
type: internal
Port "eth2"
Interface "eth2"
ovs_version: "2.4.0"external network gateway IP address for the project network on the router
[root@controller ~]# neutron router-port-list demo-router
+--------------------------------------+------+-------------------+-------------------------------------------------------------------------------------+
| id | name | mac_address | fixed_ips |
+--------------------------------------+------+-------------------+-------------------------------------------------------------------------------------+
| 3e60aab4-57d4-445d-ae94-890136ad2839 | | fa:16:3e:ef:bc:7e | {"subnet_id": "6fceea95-4c1c-4631-84a8-ebe93d515f0a", "ip_address": "192.168.10.1"} |
| 6176d55e-ee84-4e56-a8e3-93ce3cc640ef | | fa:16:3e:16:0b:9c | {"subnet_id": "ececc303-22d8-4804-a121-d98a4984be11", "ip_address": "203.0.113.13"} |
| ee7fdd84-0eb8-417e-98f3-66ecacf1fb81 | | fa:16:3e:f1:96:8b | {"subnet_id": "6fceea95-4c1c-4631-84a8-ebe93d515f0a", "ip_address": "192.168.10.6"} |
+--------------------------------------+------+-------------------+-------------------------------------------------------------------------------------+ping external gateway IP from external network
[root@external ~]# ping -c 3 203.0.113.13
PING 203.0.113.13 (203.0.113.13) 56(84) bytes of data.
64 bytes from 203.0.113.13: icmp_seq=1 ttl=64 time=0.450 ms
64 bytes from 203.0.113.13: icmp_seq=2 ttl=64 time=0.315 ms
64 bytes from 203.0.113.13: icmp_seq=3 ttl=64 time=0.221 ms
--- 203.0.113.13 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2000ms
rtt min/avg/max/mdev = 0.221/0.328/0.450/0.096 ms# neutron router-gateway-clear demo-router ext-net
Removed gateway from router demo-router
# neutron router-interface-delete demo-router demo-subnet
Removed interface from router demo-router.
# neutron router-delete demo-router
Deleted router: demo-router
# neutron subnet-delete demo-subnet
Deleted subnet: demo-subnet
# neutron net-delete demo-net
Deleted network: demo-net