OpenStack Wallaby : Neutron Network (VXLAN)2021/04/23 |
|
Configure virtual networking by OpenStack Network Service (Neutron).
For example, configure VXLAN type of networking on here.
Before it, Configure basic settings on Control Node, Network Node, Compute Node.
Furthermore, this example is based on the environment that Network Node has 2 network interfaces.
------------+---------------------------+---------------------------+------------
| | |
eth0|10.0.0.30 eth0|10.0.0.50 eth0|10.0.0.51
+-----------+-----------+ +-----------+-----------+ +-----------+-----------+
| [ Control Node ] | | [ Network Node ] | | [ Compute Node ] |
| | | | | |
| MariaDB RabbitMQ | | Open vSwitch | | Libvirt |
| Memcached httpd | | L2 Agent | | Nova Compute |
| Keystone Glance | | L3 Agent | | Open vSwitch |
| Nova API | | Metadata Agent | | L2 Agent |
| Neutron Server | | | | |
| Metadata Agent | | | | |
+-----------------------+ +-----------+-----------+ +-----------------------+
eth1|(UP with no IP)
|
| [1] | Change settings on Control Node. |
|
[root@dlp ~(keystone)]#
vi /etc/neutron/plugins/ml2/ml2_conf.ini # add a value to [tenant_network_types] [ml2] type_drivers = flat,vlan,gre,vxlan tenant_network_types = vxlan
# add to the end [ml2_type_flat] flat_networks = physnet1 [ml2_type_vxlan] vni_ranges = 1:1000 systemctl restart neutron-server |
| [2] | Change settings on Network Node. |
|
# add bridge [root@network ~]# ovs-vsctl add-br br-eth1
# add [eth1] to the port of the bridge above # replace the interface name [eth1] to your own environment [root@network ~]# ovs-vsctl add-port br-eth1 eth1
[root@network ~]#
vi /etc/neutron/plugins/ml2/ml2_conf.ini # add a value to [tenant_network_types] [ml2] type_drivers = flat,vlan,gre,vxlan tenant_network_types = vxlan
# add to the end [ml2_type_flat] flat_networks = physnet1 [ml2_type_vxlan] vni_ranges = 1:1000
[root@network ~]#
vi /etc/neutron/plugins/ml2/openvswitch_agent.ini # add to the end
[agent]
tunnel_types = vxlan
prevent_arp_spoofing = True
[ovs]
# specify IP address of this host for [local_ip]
local_ip = 10.0.0.50
bridge_mappings = physnet1:br-eth1
[root@network ~]#
for service in dhcp-agent l3-agent metadata-agent openvswitch-agent; do
systemctl restart neutron-$service done # if Firewalld is running, allow VXLAN port [root@network ~]# firewall-cmd --add-port=4789/udp --permanent [root@network ~]# firewall-cmd --reload |
| [3] | Change settings on Compute Node. |
|
[root@node01 ~]#
vi /etc/neutron/plugins/ml2/ml2_conf.ini # add a value to [tenant_network_types] [ml2] type_drivers = flat,vlan,gre,vxlan tenant_network_types = vxlan
# add to the end [ml2_type_flat] flat_networks = physnet1 [ml2_type_vxlan] vni_ranges = 1:1000
[root@node01 ~]#
vi /etc/neutron/plugins/ml2/openvswitch_agent.ini # add to the end
[agent]
tunnel_types = vxlan
prevent_arp_spoofing = True
[ovs]
# specify IP address of this host for [local_ip]
local_ip = 10.0.0.51
[root@node01 ~]#
systemctl restart neutron-openvswitch-agent
# if Firewalld is running, allow VXLAN port [root@node01 ~]# firewall-cmd --add-port=4789/udp --permanent [root@node01 ~]# firewall-cmd --reload |
| [4] | Create a Virtual router. It's OK to work on any node. (This example is on Control Node) |
|
[root@dlp ~(keystone)]# openstack router create router01 +-------------------------+--------------------------------------+ | Field | Value | +-------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2021-04-23T02:22:13Z | | description | | | distributed | False | | external_gateway_info | null | | flavor_id | None | | ha | False | | id | a6a5c309-82ce-4532-b571-52bba41a0646 | | name | router01 | | project_id | 5740dfa09acd480aaf87b406af946eaf | | revision_number | 1 | | routes | | | status | ACTIVE | | tags | | | updated_at | 2021-04-23T02:22:13Z | +-------------------------+--------------------------------------+ |
| [5] | Create internal network and associate with the router above. |
|
# create internal network [root@dlp ~(keystone)]# openstack network create private --provider-network-type vxlan +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2021-04-23T02:22:33Z | | description | | | dns_domain | None | | id | 7f1cc5be-3241-4916-8573-72ebb0e0c478 | | ipv4_address_scope | None | | ipv6_address_scope | None | | is_default | False | | is_vlan_transparent | None | | mtu | 1450 | | name | private | | port_security_enabled | True | | project_id | 5740dfa09acd480aaf87b406af946eaf | | provider:network_type | vxlan | | provider:physical_network | None | | provider:segmentation_id | 81 | | qos_policy_id | None | | revision_number | 1 | | router:external | Internal | | segments | None | | shared | False | | status | ACTIVE | | subnets | | | tags | | | updated_at | 2021-04-23T02:22:33Z | +---------------------------+--------------------------------------+ # create subnet in the internal network [root@dlp ~(keystone)]# openstack subnet create private-subnet --network private \ --subnet-range 192.168.100.0/24 --gateway 192.168.100.1 \ --dns-nameserver 10.0.0.10 +----------------------+--------------------------------------+ | Field | Value | +----------------------+--------------------------------------+ | allocation_pools | 192.168.100.2-192.168.100.254 | | cidr | 192.168.100.0/24 | | created_at | 2021-04-23T02:22:53Z | | description | | | dns_nameservers | 10.0.0.10 | | dns_publish_fixed_ip | None | | enable_dhcp | True | | gateway_ip | 192.168.100.1 | | host_routes | | | id | e504f452-1fd4-4d14-9d4a-33685ed93054 | | ip_version | 4 | | ipv6_address_mode | None | | ipv6_ra_mode | None | | name | private-subnet | | network_id | 7f1cc5be-3241-4916-8573-72ebb0e0c478 | | prefix_length | None | | project_id | 5740dfa09acd480aaf87b406af946eaf | | revision_number | 0 | | segment_id | None | | service_types | | | subnetpool_id | None | | tags | | | updated_at | 2021-04-23T02:22:53Z | +----------------------+--------------------------------------+ # set internal network to the router above [root@dlp ~(keystone)]# openstack router add subnet router01 private-subnet
|
| [6] | Create external network and associate with the router above. |
|
# create external network [root@dlp ~(keystone)]# openstack network create \ --provider-physical-network physnet1 \ --provider-network-type flat --external public +---------------------------+--------------------------------------+ | Field | Value | +---------------------------+--------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | | | created_at | 2021-04-23T02:23:28Z | | description | | | dns_domain | None | | id | 19a8f009-eaf8-46c8-a475-d10ed960627c | | ipv4_address_scope | None | | ipv6_address_scope | None | | is_default | False | | is_vlan_transparent | None | | mtu | 1500 | | name | public | | port_security_enabled | True | | project_id | 5740dfa09acd480aaf87b406af946eaf | | provider:network_type | flat | | provider:physical_network | physnet1 | | provider:segmentation_id | None | | qos_policy_id | None | | revision_number | 1 | | router:external | External | | segments | None | | shared | False | | status | ACTIVE | | subnets | | | tags | | | updated_at | 2021-04-23T02:23:28Z | +---------------------------+--------------------------------------+ # create subnet in the external network [root@dlp ~(keystone)]# openstack subnet create public-subnet \ --network public --subnet-range 10.0.0.0/24 \ --allocation-pool start=10.0.0.200,end=10.0.0.254 \ --gateway 10.0.0.1 --dns-nameserver 10.0.0.10 --no-dhcp +----------------------+--------------------------------------+ | Field | Value | +----------------------+--------------------------------------+ | allocation_pools | 10.0.0.200-10.0.0.254 | | cidr | 10.0.0.0/24 | | created_at | 2021-04-23T02:23:50Z | | description | | | dns_nameservers | 10.0.0.10 | | dns_publish_fixed_ip | None | | enable_dhcp | False | | gateway_ip | 10.0.0.1 | | host_routes | | | id | fbc54483-0b71-4df9-ad0d-bfc37cf3d267 | | ip_version | 4 | | ipv6_address_mode | None | | ipv6_ra_mode | None | | name | public-subnet | | network_id | 19a8f009-eaf8-46c8-a475-d10ed960627c | | prefix_length | None | | project_id | 5740dfa09acd480aaf87b406af946eaf | | revision_number | 0 | | segment_id | None | | service_types | | | subnetpool_id | None | | tags | | | updated_at | 2021-04-23T02:23:50Z | +----------------------+--------------------------------------+ # set gateway to the router above [root@dlp ~(keystone)]# openstack router set router01 --external-gateway public |
| [7] | By default, it's possible to access for all projects to external network, but for internal network, only admin projects can access to it, so grant access permission of internal network to a project you'd like to let users in the project use. |
|
# show network RBAC list [root@dlp ~(keystone)]# openstack network rbac list +--------------------------------------+-------------+--------------------------------------+ | ID | Object Type | Object ID | +--------------------------------------+-------------+--------------------------------------+ | 3b082c9d-ced2-48ba-8fc3-c9bb3f47d466 | network | 19a8f009-eaf8-46c8-a475-d10ed960627c | +--------------------------------------+-------------+--------------------------------------+ # RBAC details # all projects can access only to [access_as_external] [root@dlp ~(keystone)]# openstack network rbac show 3b082c9d-ced2-48ba-8fc3-c9bb3f47d466 +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | action | access_as_external | | id | 3b082c9d-ced2-48ba-8fc3-c9bb3f47d466 | | name | None | | object_id | 19a8f009-eaf8-46c8-a475-d10ed960627c | | object_type | network | | project_id | 5740dfa09acd480aaf87b406af946eaf | | target_project_id | * | +-------------------+--------------------------------------+ # show network list [root@dlp ~(keystone)]# openstack network list +--------------------------------------+---------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+---------+--------------------------------------+ | 19a8f009-eaf8-46c8-a475-d10ed960627c | public | fbc54483-0b71-4df9-ad0d-bfc37cf3d267 | | 7f1cc5be-3241-4916-8573-72ebb0e0c478 | private | e504f452-1fd4-4d14-9d4a-33685ed93054 | +--------------------------------------+---------+--------------------------------------+ # show project list [root@dlp ~(keystone)]# openstack project list +----------------------------------+-----------+ | ID | Name | +----------------------------------+-----------+ | 5740dfa09acd480aaf87b406af946eaf | admin | | 620c149e6cc84d7e8f446504cd3cd355 | service | | 9bdf6ca0e49a416da8df5554fbfdec74 | hiroshima | +----------------------------------+-----------+ # grant [access_as_shared] permission for [private] to [hiroshima] project [root@dlp ~(keystone)]# netID=$(openstack network list | grep private | awk '{ print $2 }') [root@dlp ~(keystone)]# prjID=$(openstack project list | grep hiroshima | awk '{ print $2 }') [root@dlp ~(keystone)]# openstack network rbac create --target-project $prjID --type network --action access_as_shared $netID +-------------------+--------------------------------------+ | Field | Value | +-------------------+--------------------------------------+ | action | access_as_shared | | id | 3b07e06b-aba6-437d-aeaf-83dd0001e18c | | name | None | | object_id | 7f1cc5be-3241-4916-8573-72ebb0e0c478 | | object_type | network | | project_id | 5740dfa09acd480aaf87b406af946eaf | | target_project_id | 9bdf6ca0e49a416da8df5554fbfdec74 | +-------------------+--------------------------------------+ |
| [8] | Login with a user who is in the project you granted access permission to internal network and Create and boot an instance. |
|
# show available [flavor] list [cent@dlp ~(keystone)]$ openstack flavor list +----+----------+------+------+-----------+-------+-----------+ | ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public | +----+----------+------+------+-----------+-------+-----------+ | 0 | m1.small | 2048 | 10 | 0 | 1 | True | +----+----------+------+------+-----------+-------+-----------+ # show available image list [cent@dlp ~(keystone)]$ openstack image list +--------------------------------------+-----------------+--------+ | ID | Name | Status | +--------------------------------------+-----------------+--------+ | a7f1ad19-4d09-498c-8152-404bf626af98 | CentOS-Stream-8 | active | +--------------------------------------+-----------------+--------+ # show available network list [cent@dlp ~(keystone)]$ openstack network list +--------------------------------------+---------+--------------------------------------+ | ID | Name | Subnets | +--------------------------------------+---------+--------------------------------------+ | 19a8f009-eaf8-46c8-a475-d10ed960627c | public | fbc54483-0b71-4df9-ad0d-bfc37cf3d267 | | 7f1cc5be-3241-4916-8573-72ebb0e0c478 | private | e504f452-1fd4-4d14-9d4a-33685ed93054 | +--------------------------------------+---------+--------------------------------------+ # create a security group for instances [cent@dlp ~(keystone)]$ openstack security group create secgroup01 +-----------------+-------------------------------------------------------------------------------+ | Field | Value | +-----------------+-------------------------------------------------------------------------------+ | created_at | 2021-04-23T02:11:08Z | | description | secgroup01 | | id | e10f49d8-8961-4716-9fd1-50d9bc833848 | | name | secgroup01 | | project_id | 9bdf6ca0e49a416da8df5554fbfdec74 | | revision_number | 1 | | rules | created_at='2021-04-23T02:11:08Z', direction='egress', ethertype='IPv6',..... | | | created_at='2021-04-23T02:11:08Z', direction='egress', ethertype='IPv4',..... | | stateful | True | | tags | [] | | updated_at | 2021-04-23T02:11:08Z | +-----------------+-------------------------------------------------------------------------------+ # create a SSH keypair for connecting to instances [cent@dlp ~(keystone)]$ ssh-keygen -q -N "" Enter file in which to save the key (/home/cent/.ssh/id_rsa): # add public-key [cent@dlp ~(keystone)]$ openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey +-------------+-------------------------------------------------+ | Field | Value | +-------------+-------------------------------------------------+ | created_at | None | | fingerprint | 18:f0:6a:99:8d:66:fb:32:e2:df:e6:88:39:55:f4:c5 | | id | mykey | | is_deleted | None | | name | mykey | | type | ssh | | user_id | b7aeb44b614d46f69b4a53ecee906800 | +-------------+-------------------------------------------------+[cent@dlp ~(keystone)]$ netID=$(openstack network list | grep private | awk '{ print $2 }')
[cent@dlp ~(keystone)]$
[cent@dlp ~(keystone)]$ openstack server create --flavor m1.small --image CentOS-Stream-8 --security-group secgroup01 --nic net-id=$netID --key-name mykey CentOS-St-8
openstack server list +--------------------------------------+-------------+--------+-------------------------+-----------------+----------+ | ID | Name | Status | Networks | Image | Flavor | +--------------------------------------+-------------+--------+-------------------------+-----------------+----------+ | a8916292-123a-430b-a308-c70a1ccfae5d | CentOS-St-8 | ACTIVE | private=192.168.100.219 | CentOS-Stream-8 | m1.small | +--------------------------------------+-------------+--------+-------------------------+-----------------+----------+ |
| [9] | Assign floating IP address to the Instance above. |
|
[cent@dlp ~(keystone)]$ openstack floating ip create public +---------------------+--------------------------------------+ | Field | Value | +---------------------+--------------------------------------+ | created_at | 2021-04-23T02:27:52Z | | description | | | dns_domain | None | | dns_name | None | | fixed_ip_address | None | | floating_ip_address | 10.0.0.239 | | floating_network_id | 19a8f009-eaf8-46c8-a475-d10ed960627c | | id | 9fe48929-e7ed-4baa-8e62-f62dceda6700 | | name | 10.0.0.239 | | port_details | None | | port_id | None | | project_id | 9bdf6ca0e49a416da8df5554fbfdec74 | | qos_policy_id | None | | revision_number | 0 | | router_id | None | | status | DOWN | | subnet_id | None | | tags | [] | | updated_at | 2021-04-23T02:27:52Z | +---------------------+--------------------------------------+
[cent@dlp ~(keystone)]$
openstack server add floating ip CentOS-St-8 10.0.0.239
# confirm settings [cent@dlp ~(keystone)]$ openstack floating ip show 10.0.0.239 +---------------------+---------------------------------------------------------------------------+ | Field | Value | +---------------------+---------------------------------------------------------------------------+ | created_at | 2021-04-23T02:27:52Z | | description | | | dns_domain | None | | dns_name | None | | fixed_ip_address | 192.168.100.219 | | floating_ip_address | 10.0.0.239 | | floating_network_id | 19a8f009-eaf8-46c8-a475-d10ed960627c | | id | 9fe48929-e7ed-4baa-8e62-f62dceda6700 | | name | 10.0.0.239 | | port_details | admin_state_up='True', device_id='a8916292-123a-430b-a308-c70a1ccfae..... | | port_id | 9ee8974c-d6a4-4fd4-b0f4-88e6918590d9 | | project_id | 9bdf6ca0e49a416da8df5554fbfdec74 | | qos_policy_id | None | | revision_number | 2 | | router_id | a6a5c309-82ce-4532-b571-52bba41a0646 | | status | ACTIVE | | subnet_id | None | | tags | [] | | updated_at | 2021-04-23T02:28:13Z | +---------------------+---------------------------------------------------------------------------+[cent@dlp ~(keystone)]$ openstack server list +--------------------------------------+-------------+--------+-------------------------------------+-----------------+----------+ | ID | Name | Status | Networks | Image | Flavor | +--------------------------------------+-------------+--------+-------------------------------------+-----------------+----------+ | a8916292-123a-430b-a308-c70a1ccfae5d | CentOS-St-8 | ACTIVE | private=10.0.0.239, 192.168.100.219 | CentOS-Stream-8 | m1.small | +--------------------------------------+-------------+--------+-------------------------------------+-----------------+----------+ |
| [10] | Configure security settings for the security group you created above to access with SSH and ICMP. |
|
# permit ICMP [cent@dlp ~(keystone)]$ openstack security group rule create --protocol icmp --ingress secgroup01 +-------------------------+--------------------------------------+ | Field | Value | +-------------------------+--------------------------------------+ | created_at | 2021-04-23T02:13:39Z | | description | | | direction | ingress | | ether_type | IPv4 | | id | 6320f85b-7283-49a3-8312-41fdba484a1d | | name | None | | port_range_max | None | | port_range_min | None | | project_id | 9bdf6ca0e49a416da8df5554fbfdec74 | | protocol | icmp | | remote_address_group_id | None | | remote_group_id | None | | remote_ip_prefix | 0.0.0.0/0 | | revision_number | 0 | | security_group_id | e10f49d8-8961-4716-9fd1-50d9bc833848 | | tags | [] | | updated_at | 2021-04-23T02:13:39Z | +-------------------------+--------------------------------------+ # permit SSH [cent@dlp ~(keystone)]$ openstack security group rule create --protocol tcp --dst-port 22:22 secgroup01 +-------------------------+--------------------------------------+ | Field | Value | +-------------------------+--------------------------------------+ | created_at | 2021-04-23T02:13:56Z | | description | | | direction | ingress | | ether_type | IPv4 | | id | 83791930-299d-47b8-9594-1db95481f570 | | name | None | | port_range_max | 22 | | port_range_min | 22 | | project_id | 9bdf6ca0e49a416da8df5554fbfdec74 | | protocol | tcp | | remote_address_group_id | None | | remote_group_id | None | | remote_ip_prefix | 0.0.0.0/0 | | revision_number | 0 | | security_group_id | e10f49d8-8961-4716-9fd1-50d9bc833848 | | tags | [] | | updated_at | 2021-04-23T02:13:56Z | +-------------------------+--------------------------------------+[cent@dlp ~(keystone)]$ openstack security group rule list secgroup01 +--------------------------------------+-------------+-----------+-----------+------------+-----------+-----------------------+----------------------+ | ID | IP Protocol | Ethertype | IP Range | Port Range | Direction | Remote Security Group | Remote Address Group | +--------------------------------------+-------------+-----------+-----------+------------+-----------+-----------------------+----------------------+ | 18507758-24fc-402e-a922-d687df9ae637 | None | IPv6 | ::/0 | | egress | None | None | | 6320f85b-7283-49a3-8312-41fdba484a1d | icmp | IPv4 | 0.0.0.0/0 | | ingress | None | None | | 83791930-299d-47b8-9594-1db95481f570 | tcp | IPv4 | 0.0.0.0/0 | 22:22 | ingress | None | None | | a49b478e-9ee4-4b23-8324-8be901eef459 | None | IPv4 | 0.0.0.0/0 | | egress | None | None | +--------------------------------------+-------------+-----------+-----------+------------+-----------+-----------------------+----------------------+ |
| [11] | It's possible to login to the Instance to connect to the floating IP address with SSH like follows. |
|
[cent@dlp ~(keystone)]$ openstack server list +--------------------------------------+-------------+--------+-------------------------------------+-----------------+----------+ | ID | Name | Status | Networks | Image | Flavor | +--------------------------------------+-------------+--------+-------------------------------------+-----------------+----------+ | a8916292-123a-430b-a308-c70a1ccfae5d | CentOS-St-8 | ACTIVE | private=10.0.0.239, 192.168.100.219 | CentOS-Stream-8 | m1.small | +--------------------------------------+-------------+--------+-------------------------------------+-----------------+----------+[cent@dlp ~(keystone)]$ ssh centos@10.0.0.239 The authenticity of host '10.0.0.239 (10.0.0.239)' can't be established. ECDSA key fingerprint is SHA256:/LfciH6cPZKPKXLrz29p/PydcIZ6EnoaFkk8B5YBLXQ. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.0.0.239' (ECDSA) to the list of known hosts. Activate the web console with: systemctl enable --now cockpit.socket [centos@centos-st-8 ~]$ # logined |
| Sponsored Link |