|
OpenStack Mitaka : Neutron Network (FLAT)
2016/04/28 |
|
Configure virtual networking by OpenStack Network Service (Neutron).
For example, configure FLAT type of provider networking on here.
Furthermore, this example is based on the environment that Network Node and Compute Node have 2 network interfaces.
Before it, Configure basic settings on Control Node, Network Node, Compute Node.
|
+-------------+ +----+----+
| Name Server | | Gateway |
+------+------+ +----+----+
|10.0.0.10 |10.0.0.1
| |
+------------+-----------------+------------------+
| | | | 10.0.0.200-10.0.0.250
eth0|10.0.0.30 | eth0|10.0.0.50 | +-----------------+
+--------+---------+ | +-----------+----------+ | +---| Virtual Machine |
| [ Control Node ] | | | [ Network Node ] | | | +-----------------+
| Keystone | | | DHCP Agent | | | +-----------------+
| Glance | | | L3 Agent |eth1 | |---| Virtual Machine |
| Nova API | | | L2 Agent | | | +-----------------+
| Neutron Server | | | Metadata Agent | | | +-----------------+
+------------------+ | +----------------------+ +-----+---| Virtual Machine |
| | +-----------------+
| +----------------------+ | +-----------------+
| eth0| [ Compute Node ] | |---| Virtual Machine |
+-----| Nova Compute |eth1 | +-----------------+
10.0.0.51| L2 Agent | | +-----------------+
+----------------------+ +---| Virtual Machine |
+-----------------+
|
| [1] | Change settings like follows on both Network Node and Compute Node. |
|
# add bridge [root@network ~]# ovs-vsctl add-br br-eth1 # add eth1 to the port of the bridge above [root@network ~]# ovs-vsctl add-port br-eth1 eth1
[root@network ~]#
vi /etc/neutron/plugins/ml2/ml2_conf.ini # line 152: add [ml2_type_flat]
flat_networks = physnet1
[root@network ~]#
vi /etc/neutron/plugins/ml2/openvswitch_agent.ini # line 176: add [ovs]
bridge_mappings = physnet1:br-eth1
systemctl restart neutron-openvswitch-agent |
| [2] | Create network. It's OK to work on any node. (This example is on Control Node) |
|
[root@dlp ~(keystone)]#
tenantID=`openstack project list | grep service | awk '{print $2}'` # create network named "sharednet1" [root@dlp ~(keystone)]# neutron net-create --tenant-id $tenantID sharednet1 \ --shared --provider:network_type flat --provider:physical_network physnet1 Created a new network: +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | True | | availability_zone_hints | | | availability_zones | | | created_at | 2016-04-29T09:20:28 | | description | | | id | 2ac59cb1-3d1c-45a4-a9af-2957274432bc | | ipv4_address_scope | | | ipv6_address_scope | | | mtu | 1500 | | name | sharednet1 | | port_security_enabled | True | | provider:network_type | flat | | provider:physical_network | physnet1 | | provider:segmentation_id | | | router:external | False | | shared | True | | status | ACTIVE | | subnets | | | tags | | | tenant_id | 4a80b177558b49d7a58038770a344aeb | | updated_at | 2016-04-29T09:20:28 | +---------------------------+--------------------------------------+ # create subnet "10.0.0.0/24" in "sharednet1" [root@dlp ~(keystone)]# neutron subnet-create \ --tenant-id $tenantID --gateway 10.0.0.1 --dns-nameserver 10.0.0.1 \ --allocation-pool start=10.0.0.200,end=10.0.0.250 sharednet1 10.0.0.0/24 Created a new subnet:
+-------------------+----------------------------------------------+
| Field | Value |
+-------------------+----------------------------------------------+
| allocation_pools | {"start": "10.0.0.200", "end": "10.0.0.250"} |
| cidr | 10.0.0.0/24 |
| created_at | 2016-04-29T09:21:03 |
| description | |
| dns_nameservers | 10.0.0.1 |
| enable_dhcp | True |
| gateway_ip | 10.0.0.1 |
| host_routes | |
| id | 8db73b65-6792-4f46-8872-1a9cec5e7957 |
| ip_version | 4 |
| ipv6_address_mode | |
| ipv6_ra_mode | |
| name | |
| network_id | 2ac59cb1-3d1c-45a4-a9af-2957274432bc |
| subnetpool_id | |
| tenant_id | 4a80b177558b49d7a58038770a344aeb |
| updated_at | 2016-04-29T09:21:03 |
+-------------------+----------------------------------------------+
# confirm settings [root@dlp ~(keystone)]# neutron net-list +--------------------------------------+------------+--------------------------------------------------+ | id | name | subnets | +--------------------------------------+------------+--------------------------------------------------+ | 2ac59cb1-3d1c-45a4-a9af-2957274432bc | sharednet1 | 8db73b65-6792-4f46-8872-1a9cec5e7957 10.0.0.0/24 | +--------------------------------------+------------+--------------------------------------------------+ |
| [3] | Create and start a Virtual machine Instance with the network just created above. |
|
[root@dlp ~(keystone)]# netID=`neutron net-list | grep sharednet1 | awk '{print $2}'` [root@dlp ~(keystone)]# nova image-list +--------------------------------------+---------+--------+--------+ | ID | Name | Status | Server | +--------------------------------------+---------+--------+--------+ | cd41a1b9-9ba6-4681-9310-e4befaf71fa5 | CentOS7 | ACTIVE | | +--------------------------------------+---------+--------+--------+
[root@dlp ~(keystone)]#
[root@dlp ~(keystone)]# nova boot --flavor 2 --image CentOS7 --security-groups default --nic net-id=$netID CentOS_7
nova list +-----------+----------+--------+------------+-------------+-----------------------+ | ID | Name | Status | Task State | Power State | Networks | +-----------+----------+--------+------------+-------------+-----------------------+ | 6f6b330b- | CentOS_7 | ACTIVE | - | Running | sharednet1=10.0.0.201 | +-----------+----------+--------+------------+-------------+-----------------------+ |
| [4] | Configure security settings like follows to access with SSH and ICMP. |
|
# permit ICMP [root@dlp ~(keystone)]# neutron security-group-rule-create --direction ingress --protocol icmp default Created a new security_group_rule: +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | description | | | direction | ingress | | ethertype | IPv4 | | id | 2ee46326-17cf-4b0a-89ff-84d91e5522db | | port_range_max | | | port_range_min | | | protocol | icmp | | remote_group_id | | | remote_ip_prefix | | | security_group_id | daeb3c1f-67e1-4129-990c-49ca0504f841 | | tenant_id | 7a160aeddebd4e398fd22e6491f10baa | +-------------------+--------------------------------------+ # permit SSH [root@dlp ~(keystone)]# neutron security-group-rule-create --direction ingress --protocol tcp --port_range_min 22 --port_range_max 22 default Created a new security_group_rule: +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | description | | | direction | ingress | | ethertype | IPv4 | | id | e99bc736-a85c-4471-ba43-105b4cb8bd99 | | port_range_max | 22 | | port_range_min | 22 | | protocol | tcp | | remote_group_id | | | remote_ip_prefix | | | security_group_id | daeb3c1f-67e1-4129-990c-49ca0504f841 | | tenant_id | 7a160aeddebd4e398fd22e6491f10baa | +-------------------+--------------------------------------+[root@dlp ~(keystone)]# neutron security-group-rule-list +--------------------------------------+----------------+-----------+-----------+---------------+-----------------+ | id | security_group | direction | ethertype | port/protocol | remote | +--------------------------------------+----------------+-----------+-----------+---------------+-----------------+ | 2ee46326-17cf-4b0a-89ff-84d91e5522db | default | ingress | IPv4 | icmp | any | | 312684a0-534d-4053-98ed-ce8ddfd529f4 | default | ingress | IPv6 | any | default (group) | | 4ea4aa8d-792c-438f-966e-d01386786e97 | default | egress | IPv6 | any | any | | 5761e89a-f57f-48c6-866a-11a7f1a0e719 | default | ingress | IPv4 | any | default (group) | | 988eba63-3fb0-456d-a94a-c21aab5fedf3 | default | egress | IPv4 | any | any | | e99bc736-a85c-4471-ba43-105b4cb8bd99 | default | ingress | IPv4 | 22/tcp | any | +--------------------------------------+----------------+-----------+-----------+---------------+-----------------+ |
| [5] | Login to Instance. |
|
[root@dlp ~(keystone)]# ssh 10.0.0.201
The authenticity of host '10.0.0.201 (10.0.0.201)' can't be established.
ECDSA key fingerprint is 00:e7:be:4a:ff:1f:08:da:a5:86:23:51:5c:30:86:73.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.0.201' (ECDSA) to the list of known hosts.
root@10.0.0.201's password:
Last login: Fri Apr 29 02:31:00 2016
[root@host-10-0-0-201 ~]# # just logined
|