Ubuntu 16.04
Sponsored Link

OpenStack Queens : Neutron Network (VXLAN)
2018/03/13
 
Configure virtual networking by OpenStack Network Service (Neutron).
For example, configure VXLAN type of networking on here.
Before it, Configure basic settings on Control Node, Network Node, Compute Node.
Furthermore, this example is based on the environment that Network Node has 2 network interfaces.
     ------------+---------------------------+---------------------------+------------
                 |                           |                           |
             eth0|10.0.0.30              eth0|10.0.0.50              eth0|10.0.0.51
     +-----------+-----------+   +-----------+-----------+   +-----------+-----------+
     |    [ Control Node ]   |   |    [ Network Node ]   |   |    [ Compute Node ]   |
     |                       |   |                       |   |                       |
     |  MariaDB    RabbitMQ  |   |        L2 Agent       |   |        Libvirt        |
     |  Memcached  httpd     |   |        L3 Agent       |   |     Nova Compute      |
     |  Keystone   Glance    |   |     Metadata Agent    |   |        L2 Agent       |
     |  Nova API             |   |                       |   |                       |
     |  Neutron Server       |   |                       |   |                       |
     |  Metadata Agent       |   |                       |   |                       |
     +-----------------------+   +-----------+-----------+   +-----------------------+
                                             |eth1

[1] Change settings on Control Node.
root@dlp ~(keystone)#
vi /etc/neutron/plugins/ml2/ml2_conf.ini
# line 130: add a value to tenant_network_types

tenant_network_types =
vxlan
# line 181: add

[ml2_type_flat]
flat_networks = physnet1
# line 235: add

[ml2_type_vxlan]
vni_ranges = 1:1000
root@dlp ~(keystone)#
systemctl restart neutron-server

[2] Change settings on Network Node.
root@network:~#
vi /etc/neutron/plugins/ml2/ml2_conf.ini
# line 130: add a value to tenant_network_types

tenant_network_types =
vxlan
# line 181: add

[ml2_type_flat]
flat_networks = physnet1
# line 235: add

[ml2_type_vxlan]
vni_ranges = 1:1000
root@network:~#
vi /etc/neutron/plugins/ml2/linuxbridge_agent.ini
# line 118: add

[agent]
prevent_arp_spoofing = True
# line 147: add

[linux_bridge]
physical_interface_mappings = physnet1:eth1
# line 201: add

[vxlan]
enable_vxlan = True
l2_population = True
root@network:~#
vi /etc/neutron/dhcp_agent.ini
# line 63: add

dnsmasq_config_file = /etc/neutron/dnsmasq-neutron.conf
root@network:~#
vi /etc/neutron/dnsmasq-neutron.conf
# create new

dhcp-option-force=26,1450
root@network:~#
for service in l3-agent dhcp-agent metadata-agent linuxbridge-agent; do
systemctl restart neutron-$service
done

[3] Change settings on Compute Node.
root@node01:~#
vi /etc/neutron/plugins/ml2/ml2_conf.ini
# line 130: add a value to tenant_network_types

tenant_network_types =
vxlan
# line 181: add

[ml2_type_flat]
flat_networks = physnet1
# line 235: add

[ml2_type_vxlan]
vni_ranges = 1:1000
root@node01:~#
vi /etc/neutron/plugins/ml2/linuxbridge_agent.ini
# line 118: add

[agent]
prevent_arp_spoofing = True
# line 201: add

[vxlan]
enable_vxlan = True
l2_population = True
root@node01:~#
systemctl restart neutron-linuxbridge-agent

[4] Create a Virtual router. It's OK to work on any node. (This example is on Control Node)
root@dlp ~(keystone)#
openstack router create router01

+-------------------------+--------------------------------------+
| Field                   | Value                                |
+-------------------------+--------------------------------------+
| admin_state_up          | UP                                   |
| availability_zone_hints |                                      |
| availability_zones      |                                      |
| created_at              | 2018-03-15T07:39:44Z                 |
| description             |                                      |
| distributed             | False                                |
| external_gateway_info   | None                                 |
| flavor_id               | None                                 |
| ha                      | False                                |
| id                      | dc18c5f9-9260-45d3-ba02-39aa5becb2a1 |
| name                    | router01                             |
| project_id              | 1ab4e37f25d14d4d8e8f5745c53bc885     |
| revision_number         | 0                                    |
| routes                  |                                      |
| status                  | ACTIVE                               |
| tags                    |                                      |
| updated_at              | 2018-03-15T07:39:44Z                 |
+-------------------------+--------------------------------------+
[5] Create internal network and associate with the router above.
# create internal network

root@dlp ~(keystone)#
openstack network create int_net --provider-network-type vxlan

+---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | UP                                   |
| availability_zone_hints   |                                      |
| availability_zones        |                                      |
| created_at                | 2018-03-15T07:40:16Z                 |
| description               |                                      |
| dns_domain                | None                                 |
| id                        | 40e03738-cd4b-49b4-9e64-fabcaac64dd5 |
| ipv4_address_scope        | None                                 |
| ipv6_address_scope        | None                                 |
| is_default                | False                                |
| is_vlan_transparent       | None                                 |
| mtu                       | 1450                                 |
| name                      | int_net                              |
| port_security_enabled     | True                                 |
| project_id                | 1ab4e37f25d14d4d8e8f5745c53bc885     |
| provider:network_type     | vxlan                                |
| provider:physical_network | None                                 |
| provider:segmentation_id  | 60                                   |
| qos_policy_id             | None                                 |
| revision_number           | 2                                    |
| router:external           | Internal                             |
| segments                  | None                                 |
| shared                    | False                                |
| status                    | ACTIVE                               |
| subnets                   |                                      |
| tags                      |                                      |
| updated_at                | 2018-03-15T07:40:16Z                 |
+---------------------------+--------------------------------------+

# create subnet in the internal network

root@dlp ~(keystone)#
openstack subnet create subnet1 --network int_net \
--subnet-range 192.168.100.0/24 --gateway 192.168.100.1 \
--dns-nameserver 10.0.0.10

+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| allocation_pools  | 192.168.100.2-192.168.100.254        |
| cidr              | 192.168.100.0/24                     |
| created_at        | 2018-03-15T07:40:38Z                 |
| description       |                                      |
| dns_nameservers   | 10.0.0.10                            |
| enable_dhcp       | True                                 |
| gateway_ip        | 192.168.100.1                        |
| host_routes       |                                      |
| id                | 9fdf51fe-31a9-4f89-8e33-6e3c00a37002 |
| ip_version        | 4                                    |
| ipv6_address_mode | None                                 |
| ipv6_ra_mode      | None                                 |
| name              | subnet1                              |
| network_id        | 40e03738-cd4b-49b4-9e64-fabcaac64dd5 |
| project_id        | 1ab4e37f25d14d4d8e8f5745c53bc885     |
| revision_number   | 0                                    |
| segment_id        | None                                 |
| service_types     |                                      |
| subnetpool_id     | None                                 |
| tags              |                                      |
| updated_at        | 2018-03-15T07:40:38Z                 |
+-------------------+--------------------------------------+

# set internal network to the router above

root@dlp ~(keystone)#
openstack router add subnet router01 subnet1
[6] Create external network and associate with the router above.
# create external network

root@dlp ~(keystone)#
openstack network create \
--provider-physical-network physnet1 \
--provider-network-type flat --external ext_net

+---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | UP                                   |
| availability_zone_hints   |                                      |
| availability_zones        |                                      |
| created_at                | 2018-03-15T07:41:32Z                 |
| description               |                                      |
| dns_domain                | None                                 |
| id                        | 13a8c6d1-bb29-4aa1-b698-31630852cb87 |
| ipv4_address_scope        | None                                 |
| ipv6_address_scope        | None                                 |
| is_default                | False                                |
| is_vlan_transparent       | None                                 |
| mtu                       | 1500                                 |
| name                      | ext_net                              |
| port_security_enabled     | True                                 |
| project_id                | 1ab4e37f25d14d4d8e8f5745c53bc885     |
| provider:network_type     | flat                                 |
| provider:physical_network | physnet1                             |
| provider:segmentation_id  | None                                 |
| qos_policy_id             | None                                 |
| revision_number           | 5                                    |
| router:external           | External                             |
| segments                  | None                                 |
| shared                    | False                                |
| status                    | ACTIVE                               |
| subnets                   |                                      |
| tags                      |                                      |
| updated_at                | 2018-03-15T07:41:32Z                 |
+---------------------------+--------------------------------------+

# create subnet in external network

root@dlp ~(keystone)#
openstack subnet create subnet2 \
--network ext_net --subnet-range 10.0.0.0/24 \
--allocation-pool start=10.0.0.200,end=10.0.0.254 \
--gateway 10.0.0.1 --dns-nameserver 10.0.0.10 --no-dhcp

+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| allocation_pools  | 10.0.0.200-10.0.0.254                |
| cidr              | 10.0.0.0/24                          |
| created_at        | 2018-03-15T07:41:51Z                 |
| description       |                                      |
| dns_nameservers   | 10.0.0.10                            |
| enable_dhcp       | False                                |
| gateway_ip        | 10.0.0.1                             |
| host_routes       |                                      |
| id                | 655fa742-2e84-4539-8d15-c008f1e4331e |
| ip_version        | 4                                    |
| ipv6_address_mode | None                                 |
| ipv6_ra_mode      | None                                 |
| name              | subnet2                              |
| network_id        | 13a8c6d1-bb29-4aa1-b698-31630852cb87 |
| project_id        | 1ab4e37f25d14d4d8e8f5745c53bc885     |
| revision_number   | 0                                    |
| segment_id        | None                                 |
| service_types     |                                      |
| subnetpool_id     | None                                 |
| tags              |                                      |
| updated_at        | 2018-03-15T07:41:51Z                 |
+-------------------+--------------------------------------+

# set gateway to the router above

root@dlp ~(keystone)#
openstack router set router01 --external-gateway ext_net

[7] By default, it's possible to access for all projects to external network, but for internal network, only admin projects can access to it, so grant access permission of internal network to a project you'd like to let users in the project use.
# show network RBAC list

root@dlp ~(keystone)#
openstack network rbac list

+--------------------------------------+-------------+--------------------------------------+
| ID                                   | Object Type | Object ID                            |
+--------------------------------------+-------------+--------------------------------------+
| e06d3040-80f1-447a-981a-fbfa4cda6dd5 | network     | 13a8c6d1-bb29-4aa1-b698-31630852cb87 |
+--------------------------------------+-------------+--------------------------------------+

# RBAC details (all projects can access only for access_as_external)

root@dlp ~(keystone)#
openstack network rbac show e06d3040-80f1-447a-981a-fbfa4cda6dd5

+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| action            | access_as_external                   |
| id                | e06d3040-80f1-447a-981a-fbfa4cda6dd5 |
| name              | None                                 |
| object_id         | 13a8c6d1-bb29-4aa1-b698-31630852cb87 |
| object_type       | network                              |
| project_id        | 1ab4e37f25d14d4d8e8f5745c53bc885     |
| target_project_id | *                                    |
+-------------------+--------------------------------------+

# show network list

root@dlp ~(keystone)#
openstack network list

+--------------------------------------+---------+--------------------------------------+
| ID                                   | Name    | Subnets                              |
+--------------------------------------+---------+--------------------------------------+
| 13a8c6d1-bb29-4aa1-b698-31630852cb87 | ext_net | 655fa742-2e84-4539-8d15-c008f1e4331e |
| 40e03738-cd4b-49b4-9e64-fabcaac64dd5 | int_net | 9fdf51fe-31a9-4f89-8e33-6e3c00a37002 |
+--------------------------------------+---------+--------------------------------------+

# show project list

root@dlp ~(keystone)#
openstack project list

+----------------------------------+-----------+
| ID                               | Name      |
+----------------------------------+-----------+
| 142ba5a5d91c4148a4caa9227e05b504 | hiroshima |
| 1ab4e37f25d14d4d8e8f5745c53bc885 | admin     |
| ffc35f92a94a4df8b512f342421ed01e | service   |
+----------------------------------+-----------+

# grant [access_as_shared] permission for [int_net] to [hiroshima] project

root@dlp ~(keystone)#
netID=$(openstack network list | grep int_net | awk '{ print $2 }')

root@dlp ~(keystone)#
prjID=$(openstack project list | grep hiroshima | awk '{ print $2 }')

root@dlp ~(keystone)#
openstack network rbac create --target-project $prjID --type network --action access_as_shared $netID

+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| action            | access_as_shared                     |
| id                | 8a6bde7c-3b1d-49c5-9cf5-5a05d94eb856 |
| name              | None                                 |
| object_id         | 40e03738-cd4b-49b4-9e64-fabcaac64dd5 |
| object_type       | network                              |
| project_id        | 1ab4e37f25d14d4d8e8f5745c53bc885     |
| target_project_id | 142ba5a5d91c4148a4caa9227e05b504     |
+-------------------+--------------------------------------+
[8] Login with a user who is in the project you granted access permission to internal network and Create and boot an instance.
# show flavor list

ubuntu@dlp ~(keystone)$
openstack flavor list

+----+----------+------+------+-----------+-------+-----------+
| ID | Name     |  RAM | Disk | Ephemeral | VCPUs | Is Public |
+----+----------+------+------+-----------+-------+-----------+
| 0  | m1.small | 2048 |   10 |         0 |     1 | True      |
+----+----------+------+------+-----------+-------+-----------+

# show image list

ubuntu@dlp ~(keystone)$
openstack image list

+--------------------------------------+------------+--------+
| ID                                   | Name       | Status |
+--------------------------------------+------------+--------+
| 217a694d-e526-4921-a018-6b1e6874ef44 | Ubuntu1604 | active |
+--------------------------------------+------------+--------+

# show network list

ubuntu@dlp ~(keystone)$
openstack network list

+--------------------------------------+---------+--------------------------------------+
| ID                                   | Name    | Subnets                              |
+--------------------------------------+---------+--------------------------------------+
| 13a8c6d1-bb29-4aa1-b698-31630852cb87 | ext_net | 655fa742-2e84-4539-8d15-c008f1e4331e |
| 40e03738-cd4b-49b4-9e64-fabcaac64dd5 | int_net | 9fdf51fe-31a9-4f89-8e33-6e3c00a37002 |
+--------------------------------------+---------+--------------------------------------+

# create a security group for instances

ubuntu@dlp ~(keystone)$
openstack security group create secgroup01

+-----------------+-----------------------------------------------------------------------------------+
| Field           | Value                                                                             |
+-----------------+-----------------------------------------------------------------------------------+
| created_at      | 2018-03-15T06:55:02Z                                                              |
| description     | secgroup01                                                                        |
| id              | 395dced0-e033-46d0-9ddd-ef78d196c2b1                                              |
| name            | secgroup01                                                                        |
| project_id      | 142ba5a5d91c4148a4caa9227e05b504                                                  |
| revision_number | 2                                                                                 |
| rules           | created_at='2018-03-15T06:55:03Z', direction='egress', ethertype='IPv4', id='...' |
|                 | created_at='2018-03-15T06:55:03Z', direction='egress', ethertype='IPv6', id='...' |
| updated_at      | 2018-03-15T06:55:03Z                                                              |
+-----------------+-----------------------------------------------------------------------------------+

# create a SSH keypair for connecting to instances

ubuntu@dlp ~(keystone)$
ssh-keygen -q -N ""

Enter file in which to save the key (/home/ubuntu/.ssh/id_rsa):
# add public-key

ubuntu@dlp ~(keystone)$
openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey

+-------------+-------------------------------------------------+
| Field       | Value                                           |
+-------------+-------------------------------------------------+
| fingerprint | ec:94:28:27:00:1e:90:09:24:b5:e5:23:79:26:ed:82 |
| name        | mykey                                           |
| user_id     | b7b1b4b96b714e458690dd893fbbe5f5                |
+-------------+-------------------------------------------------+

ubuntu@dlp ~(keystone)$
netID=$(openstack network list | grep int_net | awk '{ print $2 }')

ubuntu@dlp ~(keystone)$
openstack server create --flavor m1.small --image Ubuntu1604 --security-group secgroup01 --nic net-id=$netID --key-name mykey Ubuntu_1604
ubuntu@dlp ~(keystone)$
openstack server list

+--------------------------------------+-------------+--------+-----------------------+------------+----------+
| ID                                   | Name        | Status | Networks              | Image      | Flavor   |
+--------------------------------------+-------------+--------+-----------------------+------------+----------+
| 392e0512-ee22-40f0-87d9-18482434f604 | Ubuntu_1604 | ACTIVE | int_net=192.168.100.7 | Ubuntu1604 | m1.small |
+--------------------------------------+-------------+--------+-----------------------+------------+----------+
[9] Assign floating IP address to the Instance above.
ubuntu@dlp ~(keystone)$
openstack floating ip create ext_net

+---------------------+--------------------------------------+
| Field               | Value                                |
+---------------------+--------------------------------------+
| created_at          | 2018-03-15T07:47:21Z                 |
| description         |                                      |
| fixed_ip_address    | None                                 |
| floating_ip_address | 10.0.0.208                           |
| floating_network_id | 13a8c6d1-bb29-4aa1-b698-31630852cb87 |
| id                  | 35b9d89d-efe2-432f-865b-4d2c71d806b4 |
| name                | 10.0.0.208                           |
| port_id             | None                                 |
| project_id          | 142ba5a5d91c4148a4caa9227e05b504     |
| qos_policy_id       | None                                 |
| revision_number     | 0                                    |
| router_id           | None                                 |
| status              | DOWN                                 |
| subnet_id           | None                                 |
| updated_at          | 2018-03-15T07:47:21Z                 |
+---------------------+--------------------------------------+

ubuntu@dlp ~(keystone)$
openstack server add floating ip Ubuntu_1604 10.0.0.208

# confirm settings

ubuntu@dlp ~(keystone)$
openstack floating ip show 10.0.0.208

+---------------------+--------------------------------------+
| Field               | Value                                |
+---------------------+--------------------------------------+
| created_at          | 2018-03-15T07:47:21Z                 |
| description         |                                      |
| fixed_ip_address    | 192.168.100.7                        |
| floating_ip_address | 10.0.0.208                           |
| floating_network_id | 13a8c6d1-bb29-4aa1-b698-31630852cb87 |
| id                  | 35b9d89d-efe2-432f-865b-4d2c71d806b4 |
| name                | 10.0.0.208                           |
| port_id             | 6b4543b0-08d3-46f0-9bb9-88f3d83e8426 |
| project_id          | 142ba5a5d91c4148a4caa9227e05b504     |
| qos_policy_id       | None                                 |
| revision_number     | 2                                    |
| router_id           | dc18c5f9-9260-45d3-ba02-39aa5becb2a1 |
| status              | ACTIVE                               |
| subnet_id           | None                                 |
| updated_at          | 2018-03-15T07:47:59Z                 |
+---------------------+--------------------------------------+

ubuntu@dlp ~(keystone)$
openstack server list

+-----------+-------------+--------+-----------------------------------+------------+----------+
| ID        | Name        | Status | Networks                          | Image      | Flavor   |
+-----------+-------------+--------+-----------------------------------+------------+----------+
| 392e0512- | Ubuntu_1604 | ACTIVE | int_net=192.168.100.7, 10.0.0.208 | Ubuntu1604 | m1.small |
+-----------+-------------+--------+-----------------------------------+------------+----------+
[10] Configure security settings for the security group you created above to access with SSH and ICMP.
# permit ICMP

ubuntu@dlp ~(keystone)$
openstack security group rule create --protocol icmp --ingress default

+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| created_at        | 2018-03-15T07:10:38Z                 |
| description       |                                      |
| direction         | ingress                              |
| ether_type        | IPv4                                 |
| id                | ab347ca5-733c-4b8b-8517-c7b877e88c05 |
| name              | None                                 |
| port_range_max    | None                                 |
| port_range_min    | None                                 |
| project_id        | 142ba5a5d91c4148a4caa9227e05b504     |
| protocol          | icmp                                 |
| remote_group_id   | None                                 |
| remote_ip_prefix  | 0.0.0.0/0                            |
| revision_number   | 0                                    |
| security_group_id | 933b3c77-0b90-4914-8c96-2d33c7e986f5 |
| updated_at        | 2018-03-15T07:10:38Z                 |
+-------------------+--------------------------------------+

# permit SSH

ubuntu@dlp ~(keystone)$
openstack security group rule create --protocol tcp --dst-port 22:22 default

+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| created_at        | 2018-03-15T07:10:44Z                 |
| description       |                                      |
| direction         | ingress                              |
| ether_type        | IPv4                                 |
| id                | bf75faa3-0d56-46e1-8697-01c738e3cf11 |
| name              | None                                 |
| port_range_max    | 22                                   |
| port_range_min    | 22                                   |
| project_id        | 142ba5a5d91c4148a4caa9227e05b504     |
| protocol          | tcp                                  |
| remote_group_id   | None                                 |
| remote_ip_prefix  | 0.0.0.0/0                            |
| revision_number   | 0                                    |
| security_group_id | 933b3c77-0b90-4914-8c96-2d33c7e986f5 |
| updated_at        | 2018-03-15T07:10:44Z                 |
+-------------------+--------------------------------------+

ubuntu@dlp ~(keystone)$
openstack security group rule list

+--------------+-------------+-----------+------------+-----------------------------+-------------------+
| ID           | IP Protocol | IP Range  | Port Range | Remote Security Group       | Security Group    |
+--------------+-------------+-----------+------------+-----------------------------+-------------------+
| 2374f9c6-... | None        | None      |            | None                        | 395dced0-e033-... |
| 3e90d0fb-... | None        | None      |            | 933b3c77-0b90-4914-8c96-... | 933b3c77-0b90-... |
| 520d7b7d-... | None        | None      |            | None                        | 933b3c77-0b90-... |
| 72c7ef17-... | None        | None      |            | None                        | 933b3c77-0b90-... |
| 9225abd6-... | None        | None      |            | 933b3c77-0b90-4914-8c96-... | 933b3c77-0b90-... |
| ab347ca5-... | icmp        | 0.0.0.0/0 |            | None                        | 933b3c77-0b90-... |
| bf75faa3-... | tcp         | 0.0.0.0/0 | 22:22      | None                        | 933b3c77-0b90-... |
| fc204462-... | None        | None      |            | None                        | 395dced0-e033-... |
+--------------+-------------+-----------+------------+-----------------------------+-------------------+
[11] It's possible to login to the Instance to connect to the floating IP address with SSH like follows.
ubuntu@dlp ~(keystone)$
openstack server list

+-----------+-------------+--------+-----------------------------------+------------+----------+
| ID        | Name        | Status | Networks                          | Image      | Flavor   |
+-----------+-------------+--------+-----------------------------------+------------+----------+
| 392e0512- | Ubuntu_1604 | ACTIVE | int_net=192.168.100.7, 10.0.0.208 | Ubuntu1604 | m1.small |
+-----------+-------------+--------+-----------------------------------+------------+----------+

ubuntu@dlp ~(keystone)$
ssh -i mykey ubuntu@10.0.0.208

Warning: Identity file mykey not accessible: No such file or directory.
The authenticity of host '10.0.0.208 (10.0.0.208)' can't be established.
ECDSA key fingerprint is SHA256:z2vAoYo/XEYaVWPijjqxx/DXaHQu44XT9ro/9wDaJZg.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.0.208' (ECDSA) to the list of known hosts.
Welcome to Ubuntu 16.04.4 LTS (GNU/Linux 4.4.0-116-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

0 packages can be updated.
0 updates are security updates.

Last login: Thu Mar 15 11:19:07 2018
ubuntu@ubuntu-1604:~$    
# just logined
 
Tweet