OpenStack Rocky : Configure Neutron Network (FLAT)2019/08/20 |
|
Configure virtual networking by OpenStack Network Service (Neutron).
For example, configure FLAT type of provider networking on here.
Before it, Configure basic settings on Control Node, Network Node, Compute Node.
Furthermore, this example is based on the environment that Network Node and Compute Node have 2 network interfaces.
And also eth1 is up without IP Address,
refer to here of [1] to up anonymous interface.
------------+---------------------------+---------------------------+------------
| | |
eth0|10.0.0.30 eth0|10.0.0.50 eth0|10.0.0.51
+-----------+-----------+ +-----------+-----------+ +-----------+-----------+
| [ Control Node ] | | [ Network Node ] | | [ Compute Node ] |
| | | | | |
| MariaDB RabbitMQ | | L2 Agent | | Libvirt |
| Memcached httpd | | L3 Agent | | Nova Compute |
| Keystone Glance | | Metadata Agent | | L2 Agent |
| Nova API | | Open vSwitch | | Open vSwitch |
| Neutron Server | | | | |
| Metadata Agent | | | | |
+-----------------------+ +-----------+-----------+ +-----------+-----------+
eth1|(UP with no IP) eth1|(UP with no IP)
|
| [1] | Change settings like follows on both Network Node and Compute Node. |
|
# add bridge and add the anonymous interface above to the bridge port root@network:~# ovs-vsctl add-br br-eth1 root@network:~# ovs-vsctl add-port br-eth1 eth1
root@network:~#
vi /etc/neutron/plugins/ml2/ml2_conf.ini # line 155: change [ml2_type_flat] ..... ..... flat_networks = physnet1
root@network:~#
vi /etc/neutron/plugins/ml2/openvswitch_agent.ini # line 195: uncomment and change bridge_mappings = physnet1:br-eth1
systemctl restart neutron-openvswitch-agent |
| [2] | Create network. It's OK to work on any node. (This example is on Control Node) |
|
root@dlp ~(keystone)#
projectID=$(openstack project list | grep service | awk '{print $2}') # create network named [sharednet1] root@dlp ~(keystone)# openstack network create --project $projectID \ --share --provider-network-type flat --provider-physical-network physnet1 sharednet1 Created a new network: +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2019-08-20T02:43:19Z | | description | | | dns_domain | None | | id | afd6e405-5fb6-4748-85a2-f6d2875c415e | | ipv4_address_scope | None | | ipv6_address_scope | None | | is_default | False | | is_vlan_transparent | None | | mtu | 1500 | | name | sharednet1 | | port_security_enabled | True | | project_id | af821885c5934a9395aeabe996751847 | | provider:network_type | flat | | provider:physical_network | physnet1 | | provider:segmentation_id | None | | qos_policy_id | None | | revision_number | 0 | | router:external | Internal | | segments | None | | shared | True | | status | ACTIVE | | subnets | | | tags | | | updated_at | 2019-08-20T02:43:19Z | +---------------------------+--------------------------------------+ # create subnet [10.0.0.0/24] in [sharednet1] root@dlp ~(keystone)# openstack subnet create subnet1 --network sharednet1 \ --project $projectID --subnet-range 10.0.0.0/24 \ --allocation-pool start=10.0.0.200,end=10.0.0.254 \ --gateway 10.0.0.1 --dns-nameserver 10.0.0.10 Created a new subnet: +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | allocation_pools | 10.0.0.200-10.0.0.254 | | cidr | 10.0.0.0/24 | | created_at | 2019-08-20T02:43:46Z | | description | | | dns_nameservers | 10.0.0.10 | | enable_dhcp | True | | gateway_ip | 10.0.0.1 | | host_routes | | | id | f783d148-97eb-44cb-b417-847a64473718 | | ip_version | 4 | | ipv6_address_mode | None | | ipv6_ra_mode | None | | name | subnet1 | | network_id | afd6e405-5fb6-4748-85a2-f6d2875c415e | | project_id | af821885c5934a9395aeabe996751847 | | revision_number | 0 | | segment_id | None | | service_types | | | subnetpool_id | None | | tags | | | updated_at | 2019-08-20T02:43:46Z | +-------------------+--------------------------------------+ # confirm settings root@dlp ~(keystone)# openstack network list +--------------------------------------+------------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+------------+--------------------------------------+ | afd6e405-5fb6-4748-85a2-f6d2875c415e | sharednet1 | f783d148-97eb-44cb-b417-847a64473718 | +--------------------------------------+------------+--------------------------------------+ |
| [3] | Create and start a Virtual machine Instance with the network just created above. |
|
# show flavor list debian@dlp ~(keystone)$ openstack flavor list +----+----------+------+------+-----------+-------+-----------+ | ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public | +----+----------+------+------+-----------+-------+-----------+ | 0 | m1.small | 2048 | 10 | 0 | 1 | True | +----+----------+------+------+-----------+-------+-----------+ # show image list debian@dlp ~(keystone)$ openstack image list +--------------------------------------+----------+--------+ | ID | Name | Status | +--------------------------------------+----------+--------+ | 2f489eea-ca80-471d-b450-31664cd284b1 | Debian10 | active | +--------------------------------------+----------+--------+ # show network list debian@dlp ~(keystone)$ openstack network list +--------------------------------------+------------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+------------+--------------------------------------+ | afd6e405-5fb6-4748-85a2-f6d2875c415e | sharednet1 | f783d148-97eb-44cb-b417-847a64473718 | +--------------------------------------+------------+--------------------------------------+ # create a security group for instances debian@dlp ~(keystone)$ openstack security group create secgroup01 +-----------------+-------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +-----------------+-------------------------------------------------------------------------------------------------------------------------------------------------------+ | created_at | 2019-08-20T02:45:14Z | | description | secgroup01 | | id | 07c69bfc-39d3-4366-b2c1-2bb4170a81d4 | | name | secgroup01 | | project_id | 6de0ab5f5ae24824820df0ab890bd84f | | revision_number | 1 | | rules | created_at='2019-08-20T02:45:14Z', direction='egress', ethertype='IPv4', id='153be9e2-6b9f-44ea-ae1e-ec4e5b3f7295', updated_at='2019-08-20T02:45:14Z' | | | created_at='2019-08-20T02:45:14Z', direction='egress', ethertype='IPv6', id='5908aa2b-eb4e-4e78-b840-e72edebfd314', updated_at='2019-08-20T02:45:14Z' | | tags | [] | | updated_at | 2019-08-20T02:45:14Z | +-----------------+-------------------------------------------------------------------------------------------------------------------------------------------------------+ # create a SSH keypair for connecting to instances debian@dlp ~(keystone)$ ssh-keygen -q -N "" Enter file in which to save the key (/home/debian/.ssh/id_rsa): # add public-key debian@dlp ~(keystone)$ openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey +-------------+-------------------------------------------------+ | Field | Value | +-------------+-------------------------------------------------+ | fingerprint | 03:aa:a1:74:b6:55:21:ac:76:f8:0e:07:de:fa:1c:b6 | | name | mykey | | user_id | 2af053ff367b47fc9e1a9139c29340b6 | +-------------+-------------------------------------------------+debian@dlp ~(keystone)$ netID=$(openstack network list | grep sharednet1 | awk '{ print $2 }')
debian@dlp ~(keystone)$
debian@dlp ~(keystone)$ openstack server create --flavor m1.small --image Debian10 --security-group secgroup01 --nic net-id=$netID --key-name mykey Debian_10
openstack server list +--------------------------------------+-----------+--------+-----------------------+----------+----------+ | ID | Name | Status | Networks | Image | Flavor | +--------------------------------------+-----------+--------+-----------------------+----------+----------+ | ec9dbe78-eac5-4c57-b08c-ea031eaab1bf | Debian_10 | ACTIVE | sharednet1=10.0.0.206 | Debian10 | m1.small | +--------------------------------------+-----------+--------+-----------------------+----------+----------+ |
| [4] | Configure security settings for the security group you created above to access with SSH and ICMP. |
|
# permit ICMP debian@dlp ~(keystone)$ openstack security group rule create --protocol icmp --ingress secgroup01 +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | created_at | 2019-08-20T02:54:01Z | | description | | | direction | ingress | | ether_type | IPv4 | | id | 03a5d08d-8b01-43e4-9849-53c7b5458f22 | | name | None | | port_range_max | None | | port_range_min | None | | project_id | 6de0ab5f5ae24824820df0ab890bd84f | | protocol | icmp | | remote_group_id | None | | remote_ip_prefix | 0.0.0.0/0 | | revision_number | 0 | | security_group_id | 07c69bfc-39d3-4366-b2c1-2bb4170a81d4 | | updated_at | 2019-08-20T02:54:01Z | +-------------------+--------------------------------------+ # permit SSH debian@dlp ~(keystone)$ openstack security group rule create --protocol tcp --dst-port 22:22 secgroup01 +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | created_at | 2019-08-20T02:54:18Z | | description | | | direction | ingress | | ether_type | IPv4 | | id | 7b2d80f2-4b89-4160-bd4a-116727094792 | | name | None | | port_range_max | 22 | | port_range_min | 22 | | project_id | 6de0ab5f5ae24824820df0ab890bd84f | | protocol | tcp | | remote_group_id | None | | remote_ip_prefix | 0.0.0.0/0 | | revision_number | 0 | | security_group_id | 07c69bfc-39d3-4366-b2c1-2bb4170a81d4 | | updated_at | 2019-08-20T02:54:18Z | +-------------------+--------------------------------------+debian@dlp ~(keystone)$ openstack security group rule list +--------------------------------------+-------------+-----------+------------+--------------------------------------+--------------------------------------+ | ID | IP Protocol | IP Range | Port Range | Remote Security Group | Security Group | +--------------------------------------+-------------+-----------+------------+--------------------------------------+--------------------------------------+ | 03a5d08d-8b01-43e4-9849-53c7b5458f22 | icmp | 0.0.0.0/0 | | None | 07c69bfc-39d3-4366-b2c1-2bb4170a81d4 | | 077d6310-32e8-4643-8aa0-35c57aee99c9 | None | None | | 821283f5-8f6d-4932-8af6-7937f8092e49 | 821283f5-8f6d-4932-8af6-7937f8092e49 | | 153be9e2-6b9f-44ea-ae1e-ec4e5b3f7295 | None | None | | None | 07c69bfc-39d3-4366-b2c1-2bb4170a81d4 | | 4d753844-28ef-4ce6-a385-cfc251b4b83f | None | None | | None | 821283f5-8f6d-4932-8af6-7937f8092e49 | | 5908aa2b-eb4e-4e78-b840-e72edebfd314 | None | None | | None | 07c69bfc-39d3-4366-b2c1-2bb4170a81d4 | | 64ca109b-c439-4991-9a78-07a30718d80f | None | None | | 821283f5-8f6d-4932-8af6-7937f8092e49 | 821283f5-8f6d-4932-8af6-7937f8092e49 | | 7b2d80f2-4b89-4160-bd4a-116727094792 | tcp | 0.0.0.0/0 | 22:22 | None | 07c69bfc-39d3-4366-b2c1-2bb4170a81d4 | | e0512e63-613c-4b93-889c-a38d0af108f6 | None | None | | None | 821283f5-8f6d-4932-8af6-7937f8092e49 | +--------------------------------------+-------------+-----------+------------+--------------------------------------+--------------------------------------+ |
| [5] | Login to Instance. |
|
debian@dlp ~(keystone)$ ssh debian@10.0.0.206 The authenticity of host '10.0.0.206 (10.0.0.206)' can't be established. ECDSA key fingerprint is SHA256:ZuXM7tU3Pp0+OJzLEIjxeXCFEj92Zt4bi6FY3ASOKL0. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '10.0.0.206' (ECDSA) to the list of known hosts. Linux debian-10 4.19.0-5-amd64 #1 SMP Debian 4.19.37-5+deb10u2 (2019-08-08) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. debian@debian-10:~$ # just logined |
| Sponsored Link |