Networking Guide

1. In the dashboard, select Project > Network > Networks.

2. Click +Create Network and specify the following values:

   Field	Description
   Network Name	Descriptive name, based on the role that the network will perform. If you are integrating the network with an external VLAN, consider appending the VLAN ID number to the name. For example, webservers_122, if you are hosting HTTP web servers in this subnet, and your VLAN tag is 122. Or you might use internal-only if you intend to keep the network traffic private, and not integrate the network with an external network.
   Admin State	Controls whether the network is immediately available. Use this field to create the network in a Down state, where it is logically present but inactive. This is useful if you do not intend to enter the network into production immediately.

3. Click the Next button, and specify the following values in the Subnet tab:

   Field	Description
   Create Subnet	Determines whether to create a subnet. For example, you might not want to create a subnet if you intend to keep this network as a placeholder without network connectivity.
   Subnet Name	Enter a descriptive name for the subnet.
   Network Address	Enter the address in CIDR format, which contains the IP address range and subnet mask in one value. To determine the address, calculate the number of bits masked in the subnet mask and append that value to the IP address range. For example, the subnet mask 255.255.255.0 has 24 masked bits. To use this mask with the IPv4 address range 192.168.122.0, specify the address 192.168.122.0/24.
   IP Version	Specifies the internet protocol version, where valid types are IPv4 or IPv6. The IP address range in the Network Address field must match whichever version you select.
   Gateway IP	IP address of the router interface for your default gateway. This address is the next hop for routing any traffic destined for an external location, and must be within the range that you specify in the Network Address field. For example, if your CIDR network address is 192.168.122.0/24, then your default gateway is likely to be 192.168.122.1.
   Disable Gateway	Disables forwarding and isolates the subnet.

4. Click Next to specify DHCP options:

   • Enable DHCP - Enables DHCP services for this subnet. You can use DHCP to automate the distribution of IP settings to your instances.

   • IPv6 Address - Configuration Modes. If you create an IPv6 network, you must specify how to allocate IPv6 addresses and additional information:

     • No Options Specified - Select this option if you want to set IP addresses manually, or if you use a non OpenStack-aware method for address allocation.
     • SLAAC (Stateless Address Autoconfiguration) - Instances generate IPv6 addresses based on Router Advertisement (RA) messages sent from the OpenStack Networking router. Use this configuration to create an OpenStack Networking subnet with ra_mode set to slaac and address_mode set to slaac.
     • DHCPv6 stateful - Instances receive IPv6 addresses as well as additional options (for example, DNS) from the OpenStack Networking DHCPv6 service. Use this configuration to create a subnet with ra_mode set to dhcpv6-stateful and address_mode set to dhcpv6-stateful.
     • DHCPv6 stateless - Instances generate IPv6 addresses based on Router Advertisement (RA) messages sent from the OpenStack Networking router. Additional options (for example, DNS) are allocated from the OpenStack Networking DHCPv6 service. Use this configuration to create a subnet with ra_mode set to dhcpv6-stateless and address_mode set to dhcpv6-stateless.
   • Allocation Pools - Range of IP addresses that you want DHCP to assign. For example, the value 192.168.22.100,192.168.22.100 considers all up addresses in that range as available for allocation.
   • DNS Name Servers - IP addresses of the DNS servers available on the network. DHCP distributes these addresses to the instances for name resolution.
   • Host Routes - Static host routes. First, specify the destination network in CIDR format, followed by the next hop that you want to use for routing (for example, 192.168.23.0/24, 10.1.31.1). Provide this value if you need to distribute static routes to instances.

5. Click Create.

   You can view the complete network in the Networks tab. You can also click Edit to change any options as needed. When you create instances, you can configure them now to use its subnet, and they receive any specified DHCP options.

1. In the dashboard, select Admin > Networks > Create Network > Project.
2. Select the project that you want to host the new network with the Project drop-down list.

3. Review the options in Provider Network Type:

   • Local - Traffic remains on the local Compute host and is effectively isolated from any external networks.
   • Flat - Traffic remains on a single network and can also be shared with the host. No VLAN tagging or other network segregation takes place.
   • VLAN - Create a network using a VLAN ID that corresponds to a VLAN present in the physical network. This option allows instances to communicate with systems on the same layer 2 VLAN.
   • GRE - Use a network overlay that spans multiple nodes for private communication between instances. Traffic egressing the overlay must be routed.
   • VXLAN - Similar to GRE, and uses a network overlay to span multiple nodes for private communication between instances. Traffic egressing the overlay must be routed.

4. Click Create Network.

   Review the Project Network Topology to validate that the network has been successfully created.

1. In the dashboard, select Project > Network > Routers.

2. Select your virtual router name in the Routers list, and click Add Interface.

   In the Subnet list, select the name of your new subnet. You can optionally specify an IP address for the interface in this field.

3. Click Add Interface.

   Instances on your network can now communicate with systems outside the subnet.

1. In the dashboard, select Project > Network > Networks.

   Remove all router interfaces associated with the target network subnets.

   To remove an interface, find the ID number of the network that you want to delete by clicking on your target network in the Networks list, and looking at the ID field. All the subnets associated with the network share this value in the Network ID field.

2. Navigate to Project > Network > Routers, click the name of your virtual router in the Routers list, and locate the interface attached to the subnet that you want to delete.

   You can distinguish this subnet from the other subnets by the IP address that served as the gateway IP. You can further validate the distinction by ensuring that the network ID of the interface matches the ID that you noted in the previous step.

3. Click the Delete Interface button for the interface that you want to delete.
4. Select Project > Network > Networks, and click the name of your network.

5. Click the Delete Subnet button for the subnet that you want to delete.

   Note

   If you are still unable to remove the subnet at this point, ensure it is not already being used by any instances.

6. Select Project > Network > Networks, and select the network you would like to delete.
7. Click Delete Networks.

1. In the dashboard, select Project > Network > Networks.
2. Click the name of your network.
3. Select the target subnet, and click Delete Subnets.

1. In the dashboard, select Project > Network > Routers, and click Create Router.
2. Enter a descriptive name for the new router, and click Create router.
3. Click Set Gateway next to the entry for the new router in the Routers list.
4. In the External Network list, specify the network that you want to receive traffic destined for an external location.

5. Click Set Gateway.

   After you add a router, you must configure any subnets you have created to send traffic using this router. You do this by creating interfaces between the subnet and the router.

1. In the dashboard, select Project > Network > Routers, and click the name of the router that you want to delete.
2. Select the interfaces of type Internal Interface, and click Delete Interfaces.
3. From the Routers list, select the target router and click Delete Routers.

1. In the dashboard, select Project > Network > Network Topology.
2. Locate the router that you want to manage, hover your mouse over it, and click Add Interface.

3. Specify the Subnet that you want to connect to the router.

   You can also specify an IP address. The address is useful for testing and troubleshooting purposes, since a successful ping to this interface indicates that the traffic is routing as expected.

4. Click Add interface.

   The Network Topology diagram automatically updates to reflect the new interface connection between the router and subnet.

1. In the dashboard, select Project > Network > Routers.
2. Click the name of the router that hosts the interface that you want to delete.
3. Select the interface type (Internal Interface), and click Delete Interfaces.

1. Open /etc/sysconfig/network-scripts/ifcfg-eth0 in a text editor, and update the following parameters with values appropriate for the network at your site:

   • IPADDR
   • NETMASK GATEWAY

   • DNS1 (name server)

     Here is an example:

     # vi /etc/sysconfig/network-scripts/ifcfg-eth0
     DEVICE=eth0
     TYPE=OVSPort
     DEVICETYPE=ovs
     OVS_BRIDGE=br-ex
     ONBOOT=yes

2. Open /etc/sysconfig/network-scripts/ifcfg-br-ex in a text editor and update the virtual bridge parameters with the IP address values that were previously allocated to eth0:

   # vi /etc/sysconfig/network-scripts/ifcfg-br-ex
   DEVICE=br-ex
   DEVICETYPE=ovs
   TYPE=OVSBridge
   BOOTPROTO=static
   IPADDR=192.168.120.10
   NETMASK=255.255.255.0
   GATEWAY=192.168.120.1
   DNS1=192.168.120.1
   ONBOOT=yes

   You can now assign floating IP addresses to instances and make them available to the physical network.

1. To view all the ports that attach to the router named r1, run the following command:

   #  neutron router-port-list r1

   Example result:

   +--------------------------------------+------+-------------------+--------------------------------------------------------------------------------------+
   | id                                   | name | mac_address       | fixed_ips                                                                            |
   +--------------------------------------+------+-------------------+--------------------------------------------------------------------------------------+
   | b58d26f0-cc03-43c1-ab23-ccdb1018252a |      | fa:16:3e:94:a7:df | {"subnet_id": "a592fdba-babd-48e0-96e8-2dd9117614d3", "ip_address": "192.168.200.1"} |
   | c45e998d-98a1-4b23-bb41-5d24797a12a4 |      | fa:16:3e:ee:6a:f7 | {"subnet_id": "43f8f625-c773-4f18-a691-fd4ebfb3be54", "ip_address": "172.24.4.225"}  |
   +--------------------------------------+------+-------------------+--------------------------------------------------------------------------------------+

2. To view the details of each port, run the following command. Include the port ID of the port that you want to view. The result includes the port status, indicated in the following example as having an ACTIVE state:

   # openstack port show b58d26f0-cc03-43c1-ab23-ccdb1018252a

   Example result:

   +-----------------------+--------------------------------------------------------------------------------------+
   | Field                 | Value                                                                                |
   +-----------------------+--------------------------------------------------------------------------------------+
   | admin_state_up        | True                                                                                 |
   | allowed_address_pairs |                                                                                      |
   | binding:host_id       | node.example.com                                                      |
   | binding:profile       | {}                                                                                   |
   | binding:vif_details   | {"port_filter": true, "ovs_hybrid_plug": true}                                       |
   | binding:vif_type      | ovs                                                                                  |
   | binding:vnic_type     | normal                                                                               |
   | device_id             | 49c6ebdc-0e62-49ad-a9ca-58cea464472f                                                 |
   | device_owner          | network:router_interface                                                             |
   | extra_dhcp_opts       |                                                                                      |
   | fixed_ips             | {"subnet_id": "a592fdba-babd-48e0-96e8-2dd9117614d3", "ip_address": "192.168.200.1"} |
   | id                    | b58d26f0-cc03-43c1-ab23-ccdb1018252a                                                 |
   | mac_address           | fa:16:3e:94:a7:df                                                                    |
   | name                  |                                                                                      |
   | network_id            | 63c24160-47ac-4140-903d-8f9a670b0ca4                                                 |
   | security_groups       |                                                                                      |
   | status                | ACTIVE                                                                               |
   | tenant_id             | d588d1112e0f496fb6cac22f9be45d49                                                     |
   +-----------------------+--------------------------------------------------------------------------------------+

3. Perform step 2 for each port to retrieve its status.

1. Ping the gateway with ping <gateway-IP-address>.

   Consider this example, in which a network is created with these commands:

   # openstack network create --provider-network-type vlan --provider-physical-network phy-eno1 --provider-segment 120 provider
   # openstack subnet create --no-dhcp --allocation-pool start=192.168.120.1,end=192.168.120.153 --gateway 192.168.120.254 --network  provider public_subnet

   In this example, the gateway IP address is 192.168.120.254.

   $ ping 192.168.120.254

2. If the ping fails, do the following:

   1. Confirm that you have network flow for the associated VLAN.

      It is possible that the VLAN ID has not been set. In this example, OpenStack Networking is configured to trunk VLAN 120 to the provider network. (See --provider:segmentation_id=120 in the example in step 1.)

   2. Confirm the VLAN flow on the bridge interface using the command, ovs-ofctl dump-flows <bridge-name>.

      In this example the bridge is named br-ex:

      # ovs-ofctl dump-flows br-ex
      
       NXST_FLOW reply (xid=0x4):
        cookie=0x0, duration=987.521s, table=0, n_packets=67897, n_bytes=14065247, idle_age=0, priority=1 actions=NORMAL
        cookie=0x0, duration=986.979s, table=0, n_packets=8, n_bytes=648, idle_age=977, priority=2,in_port=12 actions=drop

1. List all the project networks using the openstack network list command:

   # (overcloud)[stack@osp13-undercloud ~]$ openstack network list
   +--------------------------------------+-------------+-------------------------------------------------------+
   | id                                   | name        | subnets                                               |
   +--------------------------------------+-------------+-------------------------------------------------------+
   | 9cb32fe0-d7fb-432c-b116-f483c6497b08 | web-servers | 453d6769-fcde-4796-a205-66ee01680bba 192.168.212.0/24 |
   | a0cc8cdd-575f-4788-a3e3-5df8c6d0dd81 | private     | c1e58160-707f-44a7-bf94-8694f29e74d3 10.0.0.0/24      |
   | baadd774-87e9-4e97-a055-326bb422b29b | private     | 340c58e1-7fe7-4cf2-96a7-96a0a4ff3231 192.168.200.0/24 |
   | 24ba3a36-5645-4f46-be47-f6af2a7d8af2 | public      | 35f3d2cb-6e4b-4527-a932-952a395c4bb3 172.24.4.224/28  |
   +--------------------------------------+-------------+-------------------------------------------------------+

   In this example,examine the web-servers network. Make a note of the id value in the web-server row (9cb32fe0-d7fb-432c-b116-f483c6497b08). This value is appended to the network namespace, which helps you identify the namespace in the next step.

2. List all the network namespaces using the ip netns list command:

   # ip netns list
   qdhcp-9cb32fe0-d7fb-432c-b116-f483c6497b08
   qrouter-31680a1c-9b3e-4906-bd69-cb39ed5faa01
   qrouter-62ed467e-abae-4ab4-87f4-13a9937fbd6b
   qdhcp-a0cc8cdd-575f-4788-a3e3-5df8c6d0dd81
   qrouter-e9281608-52a6-4576-86a6-92955df46f56

   The output contains a namespace that matches the web-servers network id. In this example the namespace is qdhcp-9cb32fe0-d7fb-432c-b116-f483c6497b08.

3. Examine the configuration of the web-servers network by running commands within the namespace, prefixing the troubleshooting commands with ip netns exec <namespace>:

   # ip netns exec qrouter-62ed467e-abae-4ab4-87f4-13a9937fbd6b route -n
   
   Kernel IP routing table
   Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
   0.0.0.0         172.24.4.225    0.0.0.0         UG    0      0        0 qg-8d128f89-87
   172.24.4.224    0.0.0.0         255.255.255.240 U     0      0        0 qg-8d128f89-87
   192.168.200.0   0.0.0.0         255.255.255.0   U     0      0        0 qr-8efd6357-96

Procedure

1. Identify the ID of the project you want to create the QoS policy for:

   (overcloud) $ openstack project list

   -------------------------------------------+
   | ID                               | Name    |
   -------------------------------------------+
   | 8c409e909fb34d69bc896ab358317d60 | admin   |
   | 92b6c16c7c7244378a062be0bfd55fa0 | service |
   -------------------------------------------+

2. Create the new QoS policy:

   (overcloud) $ openstack network qos policy create --share --project <project_ID> <policy_name>

3. Create new rules for the QoS policy:

   (overcloud) $ openstack network qos rule create --type <rule-type> [rule properties] <policy_name>

   Table 10.1. Rule properties

   Property	Description
   max_kbps	The maximum rate (in Kbps) that the instance can send.
   max_burst_kbps	The maximum amount of data (in kbits) that the port can send in an instant if the token buffer is full. The token buffer replenishes at a "max_kbps" rate. The burst value for TCP traffic can be set as 80% of desired bandwidth limit value. For example, if the bandwidth limit is set to 1000kbps then a burst value of 800kbps is sufficient. Note If the burst value is set too low, bandwidth usage is throttled even with a proper bandwidth limit setting, resulting in a lower than expected bandwidth. If the configured burst value is too high, too few packets could be limited, resulting in a higher than expected bandwidth limit.
   min-kbps	The minimum bandwidth (in Kbps) guaranteed to an instance.
   ingress/egress	The direction of traffic the rule is applied to. From the perspective of a cloud server, ingress indicates download, and egress indicates upload.
   dscp-mark	Specifies the decimal value of a DSCP mark.

4. Configure a port or network to apply the policy to. You can update an existing port or network, or create a new port or network to apply the policy to:

   • Apply the policy to an existing port:

     (overcloud) $ openstack port set --qos-policy <policy_name> <port_name|port_ID>

   • Create a new port:

     (overcloud) $ openstack port create --qos-policy <policy_name> --network <network_name|network_ID> <port_name|port_ID>

   • Apply the policy to an existing network:

     (overcloud) $ openstack network set --qos-policy <policy_name> <network_name|network_ID>

   • Create a new network:

     (overcloud) $ openstack network create --qos-policy <policy_name> <network_name>

Procedure

1. Create a custom environment file and add the NeutronBridgeMappings heat parameter with values that are appropriate for your site.

   parameter_defaults:
     NeutronBridgeMappings: "datacentre:br-ex,tenant:br-tenant"

   The NeutronBridgeMappings heat parameter associates a physical name (datacentre) to a bridge (br-ex).

   Note

   When the NeutronBridgeMappings parameter is not used, the default maps the external bridge on hosts (br-ex) to a physical name (datacentre).

2. To apply this configuration, deploy the overcloud, adding your custom environment file to the stack along with your other environment files.

   (undercloud) $ openstack overcloud deploy --templates \
     -e [your environment files]
     -e /home/stack/templates/<custom-environment-file>.yaml

3. You are ready for the next steps, which are the following:

   1. Using the network VLAN ranges, create the provider networks that represent the corresponding external networks. (You use the physical name when creating neutron provider networks or floating IP networks.)
   2. Connect the external networks to your project networks with router interfaces.

1. Identify the network that requires the trunk port connection. This would be the network that will contain the instance that requires access to the trunked VLANs. In this example, this is the public network:

   openstack network list
   +--------------------------------------+---------+--------------------------------------+
   | ID                                   | Name    | Subnets                              |
   +--------------------------------------+---------+--------------------------------------+
   | 82845092-4701-4004-add7-838837837621 | private | 434c7982-cd96-4c41-a8c9-b93adbdcb197 |
   | 8d8bc6d6-5b28-4e00-b99e-157516ff0050 | public  | 3fd811b4-c104-44b5-8ff8-7a86af5e332c |
   +--------------------------------------+---------+--------------------------------------+

2. Create the parent trunk port, and attach it to the network that the instance connects to. In this example, create a neutron port named parent-trunk-port on the public network. This trunk is the parent port, as you can use it to create subports.

   openstack port create --network public parent-trunk-port
   +-----------------------+-----------------------------------------------------------------------------+
   | Field                 | Value                                                                       |
   +-----------------------+-----------------------------------------------------------------------------+
   | admin_state_up        | UP                                                                          |
   | allowed_address_pairs |                                                                             |
   | binding_host_id       |                                                                             |
   | binding_profile       |                                                                             |
   | binding_vif_details   |                                                                             |
   | binding_vif_type      | unbound                                                                     |
   | binding_vnic_type     | normal                                                                      |
   | created_at            | 2016-10-20T02:02:33Z                                                        |
   | description           |                                                                             |
   | device_id             |                                                                             |
   | device_owner          |                                                                             |
   | extra_dhcp_opts       |                                                                             |
   | fixed_ips             | ip_address='172.24.4.230', subnet_id='dc608964-9af3-4fed-9f06-6d3844fb9b9b' |
   | headers               |                                                                             |
   | id                    | 20b6fdf8-0d43-475a-a0f1-ec8f757a4a39                                        |
   | mac_address           | fa:16:3e:33:c4:75                                                           |
   | name                  | parent-trunk-port                                                           |
   | network_id            | 871a6bd8-4193-45d7-a300-dcb2420e7cc3                                        |
   | project_id            | 745d33000ac74d30a77539f8920555e7                                            |
   | project_id            | 745d33000ac74d30a77539f8920555e7                                            |
   | revision_number       | 4                                                                           |
   | security_groups       | 59e2af18-93c6-4201-861b-19a8a8b79b23                                        |
   | status                | DOWN                                                                        |
   | updated_at            | 2016-10-20T02:02:33Z                                                        |
   +-----------------------+-----------------------------------------------------------------------------+

3. Create a trunk using the port that you created in step 2. In this example the trunk is named parent-trunk.

   openstack network trunk create --parent-port parent-trunk-port parent-trunk
   +-----------------+--------------------------------------+
   | Field           | Value                                |
   +-----------------+--------------------------------------+
   | admin_state_up  | UP                                   |
   | created_at      | 2016-10-20T02:05:17Z                 |
   | description     |                                      |
   | id              | 0e4263e2-5761-4cf6-ab6d-b22884a0fa88 |
   | name            | parent-trunk                         |
   | port_id         | 20b6fdf8-0d43-475a-a0f1-ec8f757a4a39 |
   | revision_number | 1                                    |
   | status          | DOWN                                 |
   | sub_ports       |                                      |
   | tenant_id       | 745d33000ac74d30a77539f8920555e7     |
   | updated_at      | 2016-10-20T02:05:17Z                 |
   +-----------------+--------------------------------------+

4. View the trunk connection:

   openstack network trunk list
   +--------------------------------------+--------------+--------------------------------------+-------------+
   | ID                                   | Name         | Parent Port                          | Description |
   +--------------------------------------+--------------+--------------------------------------+-------------+
   | 0e4263e2-5761-4cf6-ab6d-b22884a0fa88 | parent-trunk | 20b6fdf8-0d43-475a-a0f1-ec8f757a4a39 |             |
   +--------------------------------------+--------------+--------------------------------------+-------------+

5. View the details of the trunk connection:

   openstack network trunk show parent-trunk
   +-----------------+--------------------------------------+
   | Field           | Value                                |
   +-----------------+--------------------------------------+
   | admin_state_up  | UP                                   |
   | created_at      | 2016-10-20T02:05:17Z                 |
   | description     |                                      |
   | id              | 0e4263e2-5761-4cf6-ab6d-b22884a0fa88 |
   | name            | parent-trunk                         |
   | port_id         | 20b6fdf8-0d43-475a-a0f1-ec8f757a4a39 |
   | revision_number | 1                                    |
   | status          | DOWN                                 |
   | sub_ports       |                                      |
   | tenant_id       | 745d33000ac74d30a77539f8920555e7     |
   | updated_at      | 2016-10-20T02:05:17Z                 |
   +-----------------+--------------------------------------+

1. Create a neutron port.

   This port is a subport connection to the trunk. You must also specify the MAC address that you assigned to the parent port:

   openstack port create --network private --mac-address fa:16:3e:33:c4:75 subport-trunk-port
   +-----------------------+--------------------------------------------------------------------------+
   | Field                 | Value                                                                    |
   +-----------------------+--------------------------------------------------------------------------+
   | admin_state_up        | UP                                                                       |
   | allowed_address_pairs |                                                                          |
   | binding_host_id       |                                                                          |
   | binding_profile       |                                                                          |
   | binding_vif_details   |                                                                          |
   | binding_vif_type      | unbound                                                                  |
   | binding_vnic_type     | normal                                                                   |
   | created_at            | 2016-10-20T02:08:14Z                                                     |
   | description           |                                                                          |
   | device_id             |                                                                          |
   | device_owner          |                                                                          |
   | extra_dhcp_opts       |                                                                          |
   | fixed_ips             | ip_address='10.0.0.11', subnet_id='1a299780-56df-4c0b-a4c0-c5a612cef2e8' |
   | headers               |                                                                          |
   | id                    | 479d742e-dd00-4c24-8dd6-b7297fab3ee9                                     |
   | mac_address           | fa:16:3e:33:c4:75                                                        |
   | name                  | subport-trunk-port                                                       |
   | network_id            | 3fe6b758-8613-4b17-901e-9ba30a7c4b51                                     |
   | project_id            | 745d33000ac74d30a77539f8920555e7                                         |
   | project_id            | 745d33000ac74d30a77539f8920555e7                                         |
   | revision_number       | 4                                                                        |
   | security_groups       | 59e2af18-93c6-4201-861b-19a8a8b79b23                                     |
   | status                | DOWN                                                                     |
   | updated_at            | 2016-10-20T02:08:15Z                                                     |
   +-----------------------+--------------------------------------------------------------------------+

   Note

   If you receive the error HttpException: Conflict, confirm that you are creating the subport on a different network to the one that has the parent trunk port. This example uses the public network for the parent trunk port, and private for the subport.

2. Associate the port with the trunk (parent-trunk), and specify the VLAN ID (55):

   openstack network trunk set --subport port=subport-trunk-port,segmentation-type=vlan,segmentation-id=55 parent-trunk

1. Review the configuration of your network trunk:

   $ openstack network trunk list
   +--------------------------------------+--------------+--------------------------------------+-------------+
   | ID                                   | Name         | Parent Port                          | Description |
   +--------------------------------------+--------------+--------------------------------------+-------------+
   | 0e4263e2-5761-4cf6-ab6d-b22884a0fa88 | parent-trunk | 20b6fdf8-0d43-475a-a0f1-ec8f757a4a39 |             |
   +--------------------------------------+--------------+--------------------------------------+-------------+
   
   
   $ openstack network trunk show parent-trunk
   +-----------------+------------------------------------------------------------------------------------------------+
   | Field           | Value                                                                                          |
   +-----------------+------------------------------------------------------------------------------------------------+
   | admin_state_up  | UP                                                                                             |
   | created_at      | 2016-10-20T02:05:17Z                                                                           |
   | description     |                                                                                                |
   | id              | 0e4263e2-5761-4cf6-ab6d-b22884a0fa88                                                           |
   | name            | parent-trunk                                                                                   |
   | port_id         | 20b6fdf8-0d43-475a-a0f1-ec8f757a4a39                                                           |
   | revision_number | 2                                                                                              |
   | status          | DOWN                                                                                           |
   | sub_ports       | port_id='479d742e-dd00-4c24-8dd6-b7297fab3ee9', segmentation_id='55', segmentation_type='vlan' |
   | tenant_id       | 745d33000ac74d30a77539f8920555e7                                                               |
   | updated_at      | 2016-10-20T02:10:06Z                                                                           |
   +-----------------+------------------------------------------------------------------------------------------------+

2. Create an instance that uses the parent port-id as its vNIC:

   nova boot --image cirros --flavor m1.tiny testInstance --security-groups default --key-name sshaccess --nic port-id=20b6fdf8-0d43-475a-a0f1-ec8f757a4a39
   
   
   +--------------------------------------+-----------------------------------------------+
   | Property                             | Value                                         |
   +--------------------------------------+-----------------------------------------------+
   | OS-DCF:diskConfig                    | MANUAL                                        |
   | OS-EXT-AZ:availability_zone          |                                               |
   | OS-EXT-SRV-ATTR:host                 | -                                             |
   | OS-EXT-SRV-ATTR:hostname             | testinstance                                  |
   | OS-EXT-SRV-ATTR:hypervisor_hostname  | -                                             |
   | OS-EXT-SRV-ATTR:instance_name        |                                               |
   | OS-EXT-SRV-ATTR:kernel_id            |                                               |
   | OS-EXT-SRV-ATTR:launch_index         | 0                                             |
   | OS-EXT-SRV-ATTR:ramdisk_id           |                                               |
   | OS-EXT-SRV-ATTR:reservation_id       | r-juqco0el                                    |
   | OS-EXT-SRV-ATTR:root_device_name     | -                                             |
   | OS-EXT-SRV-ATTR:user_data            | -                                             |
   | OS-EXT-STS:power_state               | 0                                             |
   | OS-EXT-STS:task_state                | scheduling                                    |
   | OS-EXT-STS:vm_state                  | building                                      |
   | OS-SRV-USG:launched_at               | -                                             |
   | OS-SRV-USG:terminated_at             | -                                             |
   | accessIPv4                           |                                               |
   | accessIPv6                           |                                               |
   | adminPass                            | uMyL8PnZRBwQ                                  |
   | config_drive                         |                                               |
   | created                              | 2016-10-20T03:02:51Z                          |
   | description                          | -                                             |
   | flavor                               | m1.tiny (1)                                   |
   | hostId                               |                                               |
   | host_status                          |                                               |
   | id                                   | 88b7aede-1305-4d91-a180-67e7eac8b70d          |
   | image                                | cirros (568372f7-15df-4e61-a05f-10954f79a3c4) |
   | key_name                             | sshaccess                                     |
   | locked                               | False                                         |
   | metadata                             | {}                                            |
   | name                                 | testInstance                                  |
   | os-extended-volumes:volumes_attached | []                                            |
   | progress                             | 0                                             |
   | security_groups                      | default                                       |
   | status                               | BUILD                                         |
   | tags                                 | []                                            |
   | tenant_id                            | 745d33000ac74d30a77539f8920555e7              |
   | updated                              | 2016-10-20T03:02:51Z                          |
   | user_id                              | 8c4aea738d774967b4ef388eb41fef5e              |
   +--------------------------------------+-----------------------------------------------+

1. View the list of available networks:

   # openstack network list
   +--------------------------------------+-------------+-------------------------------------------------------+
   | id                                   | name        | subnets                                               |
   +--------------------------------------+-------------+-------------------------------------------------------+
   | fa9bb72f-b81a-4572-9c7f-7237e5fcabd3 | web-servers | 20512ffe-ad56-4bb4-b064-2cb18fecc923 192.168.200.0/24 |
   | bcc16b34-e33e-445b-9fde-dd491817a48a | private     | 7fe4a05a-4b81-4a59-8c47-82c965b0e050 10.0.0.0/24      |
   | 9b2f4feb-fee8-43da-bb99-032e4aaf3f85 | public      | 2318dc3b-cff0-43fc-9489-7d4cf48aaab9 172.24.4.224/28  |
   +--------------------------------------+-------------+-------------------------------------------------------+

2. View the list of projects:

   # openstack project list
   +----------------------------------+----------+
   | ID                               | Name     |
   +----------------------------------+----------+
   | 4b0b98f8c6c040f38ba4f7146e8680f5 | auditors |
   | 519e6344f82e4c079c8e2eabb690023b | services |
   | 80bf5732752a41128e612fe615c886c6 | demo     |
   | 98a2f53c20ce4d50a40dac4a38016c69 | admin    |
   +----------------------------------+----------+

3. Create a RBAC entry for the web-servers network that grants access to the auditors project (4b0b98f8c6c040f38ba4f7146e8680f5):

   # openstack network rbac create --type network --target-project 4b0b98f8c6c040f38ba4f7146e8680f5 --action access_as_shared web-servers
   Created a new rbac_policy:
   +----------------+--------------------------------------+
   | Field          | Value                                |
   +----------------+--------------------------------------+
   | action         | access_as_shared                     |
   | id             | 314004d0-2261-4d5e-bda7-0181fcf40709 |
   | object_id      | fa9bb72f-b81a-4572-9c7f-7237e5fcabd3 |
   | object_type    | network                              |
   | target_project | 4b0b98f8c6c040f38ba4f7146e8680f5     |
   | project_id     | 98a2f53c20ce4d50a40dac4a38016c69     |
   +----------------+--------------------------------------+

1. Run the openstack network rbac list command to retrieve the ID of your existing role-based access control (RBAC) policies:

   # openstack network rbac list
   +--------------------------------------+-------------+--------------------------------------+
   | id                                   | object_type | object_id                            |
   +--------------------------------------+-------------+--------------------------------------+
   | 314004d0-2261-4d5e-bda7-0181fcf40709 | network     | fa9bb72f-b81a-4572-9c7f-7237e5fcabd3 |
   | bbab1cf9-edc5-47f9-aee3-a413bd582c0a | network     | 9b2f4feb-fee8-43da-bb99-032e4aaf3f85 |
   +--------------------------------------+-------------+--------------------------------------+

2. Run the openstack network rbac-show command to view the details of a specific RBAC entry:

   # openstack network rbac show 314004d0-2261-4d5e-bda7-0181fcf40709
   +----------------+--------------------------------------+
   | Field          | Value                                |
   +----------------+--------------------------------------+
   | action         | access_as_shared                     |
   | id             | 314004d0-2261-4d5e-bda7-0181fcf40709 |
   | object_id      | fa9bb72f-b81a-4572-9c7f-7237e5fcabd3 |
   | object_type    | network                              |
   | target_project | 4b0b98f8c6c040f38ba4f7146e8680f5     |
   | project_id     | 98a2f53c20ce4d50a40dac4a38016c69     |
   +----------------+--------------------------------------+

1. Run the openstack network rbac list command to retrieve the ID of your existing role-based access control (RBAC) policies:

   # openstack network rbac list
   +--------------------------------------+-------------+--------------------------------------+
   | id                                   | object_type | object_id                            |
   +--------------------------------------+-------------+--------------------------------------+
   | 314004d0-2261-4d5e-bda7-0181fcf40709 | network     | fa9bb72f-b81a-4572-9c7f-7237e5fcabd3 |
   | bbab1cf9-edc5-47f9-aee3-a413bd582c0a | network     | 9b2f4feb-fee8-43da-bb99-032e4aaf3f85 |
   +--------------------------------------+-------------+--------------------------------------+

2. Run the openstack network rbac delete command to delete the RBAC, using the ID of the RBAC that you want to delete:

   # openstack network rbac delete 314004d0-2261-4d5e-bda7-0181fcf40709
   Deleted rbac_policy: 314004d0-2261-4d5e-bda7-0181fcf40709

1. You must configure the interface connected to the physical network for external network traffic on both the Compute and Controller nodes.
2. You must create a bridge on Compute and Controller nodes, with an interface for external network traffic.
3. You must configure Neutron to allow X to use this bridge.

1. Verify that the value for OS::TripleO::Compute::Net::SoftwareConfig in the environments/neutron-ovs-dvr.yaml file is the same as the current OS::TripleO::Controller::Net::SoftwareConfig value.

   Normally, you can find this value in the network environment file that you use when deploying the overcloud, for example, environments/net-multiple-nics.yaml. This value creates the appropriate external network bridge for the Compute node L3 agent.

   Note

   If you customize the network configuration of the Compute node, it may be necessary to add the appropriate configuration to those files instead.

2. Include the environments/neutron-ovs-dvr.yaml file in the deployment command when deploying the overcloud:

   $ openstack overcloud deploy --templates -e /usr/share/openstack-tripleo-heat-templates/environments/neutron-ovs-dvr.yaml

3. Verify that L3 HA is disabled.

   For production environments (or test environments that require special customization, for example, involving network isolation, dedicated NICs, among others) you can use the example environments as a guide. Ensure that the bridge mapping type parameters that the L2 agents use are correct, as well as any reference to external facing bridges for other agents,such as the L3 agent.

   Note

   The external bridge configuration for the L3 agent, while currently still provided, is deprecated and will be removed in the future.

1. Upgrade your deployment and validate that it is working correctly.

2. Run the director stack update to configure DVR.

   For more information, see Deploying DVR with ML2 OVS.

3. Confirm that routing functions correctly through the existing routers.
4. You cannot transition a L3 HA router to distributed directly. Instead, for each router, disable the L3 HA option, and then enable the distributed option:

1. Disable the router:

   $ openstack router set --disable

2. Clear high availability:

   $ openstack router set --no-ha

3. Configure the router to use DVR:

   $ openstack router set --distributed

1. Enable the router:

   $ openstack router set --enable

2. Confirm that distributed routing functions correctly.

Procedure

1. Create a load balancer (lb1) on the subnet (public-subnet):

   Note

   Replace the names in parentheses () with names that your site uses.

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public-subnet

2. Re-run the following command until the load balancer (lb1) shows a status that is ACTIVE and ONLINE:

   $ openstack loadbalancer show lb1

3. Create listener (listener1) with the allowed CIDRs:

   $ openstack loadbalancer listener create --name listener1 --protocol TCP --protocol-port 80 --allowed-cidr 192.0.2.0/24 --allowed-cidr 198.51.100/24 lb1

4. Create the default pool (pool1) for the listener (listener1):

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol TCP

5. Add members 192.0.2.10 and 192.0.2.11 on the subnet (private-subnet) to the pool (pool1) that you created:

   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool1
   
   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool1

Verification steps

1. Enter the following command:

   $ openstack loadbalancer listener show listener1

   You should see output similar to the following:

   +-----------------------------+--------------------------------------+
   | Field                       | Value                                |
   +-----------------------------+--------------------------------------+
   | admin_state_up              | True                                 |
   | connection_limit            | -1                                   |
   | created_at                  | 2019-12-09T11:38:05                  |
   | default_pool_id             | None                                 |
   | default_tls_container_ref   | None                                 |
   | description                 |                                      |
   | id                          | d26ba156-03c3-4051-86e8-f8997a202d8e |
   | insert_headers              | None                                 |
   | l7policies                  |                                      |
   | loadbalancers               | 2281487a-54b9-4c2a-8d95-37262ec679d6 |
   | name                        | listener1                            |
   | operating_status            | ONLINE                               |
   | project_id                  | 308ca9f600064f2a8b3be2d57227ef8f     |
   | protocol                    | TCP                                  |
   | protocol_port               | 80                                   |
   | provisioning_status         | ACTIVE                               |
   | sni_container_refs          | []                                   |
   | timeout_client_data         | 50000                                |
   | timeout_member_connect      | 5000                                 |
   | timeout_member_data         | 50000                                |
   | timeout_tcp_inspect         | 0                                    |
   | updated_at                  | 2019-12-09T11:38:14                  |
   | client_ca_tls_container_ref | None                                 |
   | client_authentication       | NONE                                 |
   | client_crl_container_ref    | None                                 |
   | allowed_cidrs               | 192.0.2.0/24                         |
   |                             | 198.51.100/24                        |
   +-----------------------------+--------------------------------------+

   The parameter, allowed_cidrs, is set to allow traffic only from 192.0.2.0/24 and 198.51.100/24.

2. To verify that the load balancer is secure, try to make a request to the listener from a client whose CIDR is not in the allowed_cidrs list; the request should not succeed. You should see output similar to the following:

   curl: (7) Failed to connect to 10.0.0.226 port 80: Connection timed out
   curl: (7) Failed to connect to 10.0.0.226 port 80: Connection timed out
   curl: (7) Failed to connect to 10.0.0.226 port 80: Connection timed out
   curl: (7) Failed to connect to 10.0.0.226 port 80: Connection timed out

1. Create the load balancer on a subnet:

   $ openstack loadbalancer create --name lb1 --vip-subnet-id private-subnet

2. Monitor the state of the load balancer:

   $ openstack loadbalancer show lb1

   When you see a status of Active and ONLINE, the load balancer is created and running and you can go to the next step.

   Note

   To check load balancer status from the Compute service (nova), use the openstack server list --all | grep amphora command. Creating load balancers can be a slow process (status displaying as PENDING) because load balancers are virtual machines (VMs) and not containers.

3. Create a listener:

   $ openstack loadbalancer listener create --name listener1 --protocol HTTP --protocol-port 80 lb1

4. Create the listener default pool:

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

5. Create a health monitor on the pool to test the “/healthcheck” path:

   $ openstack loadbalancer healthmonitor create --delay 5 --max-retries 4 --timeout 10 --type HTTP --url-path /healthcheck pool1

6. Add load balancer members to the pool:

   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool1
   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool1

7. Create a floating IP address on a public subnet:

   $ openstack floating ip create public

8. Associate this floating IP with the load balancer VIP port:

   $ openstack floating ip set --port `_LOAD_BALANCER_VIP_PORT_` `_FLOATING_IP_`

   Tip

   To locate LOAD_BALANCER_VIP_PORT, run the openstack loadbalancer show lb1 command.

1. Run the openstack loadbalancer show command to verify the load balancer settings:

   (overcloud) [stack@undercloud-0 ~]$ openstack loadbalancer show lb1
   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2018-04-18T12:28:34                  |
   | description         |                                      |
   | flavor              |                                      |
   | id                  | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | name                | lb1                                  |
   | operating_status    | ONLINE                               |
   | pools               | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | provider            | octavia                              |
   | provisioning_status | ACTIVE                               |
   | updated_at          | 2018-04-18T14:03:09                  |
   | vip_address         | 192.168.0.11                         |
   | vip_network_id      | 9bca13be-f18d-49a5-a83d-9d487827fd16 |
   | vip_port_id         | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 |
   | vip_qos_policy_id   | None                                 |
   | vip_subnet_id       | 5bd7334b-49b3-4849-b3a2-b0b83852dba1 |
   +---------------------+--------------------------------------+

2. Run the amphora list command to find the UUID of the amphora associated with load balancer lb1:

   (overcloud) [stack@undercloud-0 ~]$ openstack loadbalancer amphora list | grep <UUID of loadbalancer lb1>

3. Run the amphora show command with the amphora UUID to view amphora information:

   (overcloud) [stack@undercloud-0 ~]$ openstack loadbalancer amphora show 62e41d30-1484-4e50-851c-7ab6e16b88d0
   +-----------------+--------------------------------------+
   | Field           | Value                                |
   +-----------------+--------------------------------------+
   | id              | 62e41d30-1484-4e50-851c-7ab6e16b88d0 |
   | loadbalancer_id | 53a497b3-267d-4abc-968f-94237829f78f |
   | compute_id      | 364efdb9-679c-4af4-a80c-bfcb74fc0563 |
   | lb_network_ip   | 192.168.0.13                         |
   | vrrp_ip         | 10.0.0.11                            |
   | ha_ip           | 10.0.0.10                            |
   | vrrp_port_id    | 74a5c1b4-a414-46b8-9263-6328d34994d4 |
   | ha_port_id      | 3223e987-5dd6-4ec8-9fb8-ee34e63eef3c |
   | cert_expiration | 2020-07-16T12:26:07                  |
   | cert_busy       | False                                |
   | role            | BACKUP                               |
   | status          | ALLOCATED                            |
   | vrrp_interface  | eth1                                 |
   | vrrp_id         | 1                                    |
   | vrrp_priority   | 90                                   |
   | cached_zone     | nova                                 |
   | created_at      | 2018-07-17T12:26:07                  |
   | updated_at      | 2018-07-17T12:30:36                  |
   | image_id        | a3f9f3e4-92b6-4a27-91c8-ddc69714da8f |
   +-----------------+--------------------------------------+

4. Run the openstack loadbalancer listener show command to view the listener details:

   (overcloud) [stack@undercloud-0 ~]$ openstack loadbalancer listener show listener1
   ---------------------------------------------------------------------------------------------------+
   | Field                     | Value                                                                  |
   ---------------------------------------------------------------------------------------------------+
   | admin_state_up            | True                                                                   |
   | connection_limit          | -1                                                                     |
   | created_at                | 2018-04-18T12:51:25                                                    |
   | default_pool_id           | 627842b3-eed8-4f5f-9f4a-01a738e64d6a                                   |
   | default_tls_container_ref | http://10.0.0.101:9311/v1/secrets/7eafeabb-b4a1-4bc4-8098-b6281736bfe2 |
   | description               |                                                                        |
   | id                        | 09f28053-fde8-4c78-88b9-0f191d84120e                                   |
   | insert_headers            | None                                                                   |
   | l7policies                |                                                                        |
   | loadbalancers             | 788fe121-3dec-4e1b-8360-4020642238b0                                   |
   | name                      | listener1                                                              |
   | operating_status          | ONLINE                                                                 |
   | project_id                | dda678ca5b1241e7ad7bf7eb211a2fd7                                       |
   | protocol                  | TERMINATED_HTTPS                                                       |
   | protocol_port             | 443                                                                    |
   | provisioning_status       | ACTIVE                                                                 |
   | sni_container_refs        | []                                                                     |
   | updated_at                | 2018-04-18T14:03:09                                                    |
   ---------------------------------------------------------------------------------------------------+

5. Run the openstack loadbalancer pool show command to view the pool and load-balancer members:

   (overcloud) [stack@undercloud-0 ~]$ openstack loadbalancer pool show pool1
   +---------------------+--------------------------------------+
   | Field               | Value                                |
   +---------------------+--------------------------------------+
   | admin_state_up      | True                                 |
   | created_at          | 2018-04-18T12:53:49                  |
   | description         |                                      |
   | healthmonitor_id    |                                      |
   | id                  | 627842b3-eed8-4f5f-9f4a-01a738e64d6a |
   | lb_algorithm        | ROUND_ROBIN                          |
   | listeners           | 09f28053-fde8-4c78-88b9-0f191d84120e |
   | loadbalancers       | 788fe121-3dec-4e1b-8360-4020642238b0 |
   | members             | b85c807e-4d7c-4cbd-b725-5e8afddf80d2 |
   |                     | 40db746d-063e-4620-96ee-943dcd351b37 |
   | name                | pool1                                |
   | operating_status    | ONLINE                               |
   | project_id          | dda678ca5b1241e7ad7bf7eb211a2fd7     |
   | protocol            | HTTP                                 |
   | provisioning_status | ACTIVE                               |
   | session_persistence | None                                 |
   | updated_at          | 2018-04-18T14:03:09                  |
   +---------------------+--------------------------------------+

6. Run the openstack floating ip list command to verify the floating IP address:

   (overcloud) [stack@undercloud-0 ~]$ openstack floating ip list
   -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
   | ID                                   | Floating IP Address | Fixed IP Address | Port                                 | Floating Network                     | Project                          |
   -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
   | 89661971-fa65-4fa6-b639-563967a383e7 | 10.0.0.213          | 192.168.0.11     | 69a85edd-5b1c-458f-96f2-b4552b15b8e6 | fe0f3854-fcdc-4433-bc57-3e4568e4d944 | dda678ca5b1241e7ad7bf7eb211a2fd7 |
   -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

7. Verify HTTPS traffic flows across the load balancer:

   (overcloud) [stack@undercloud-0 ~]$ curl -v https://10.0.0.213 --insecure
   * About to connect() to 10.0.0.213 port 443 (#0)
   *   Trying 10.0.0.213...
   * Connected to 10.0.0.213 (10.0.0.213) port 443 (#0)
   * Initializing NSS with certpath: sql:/etc/pki/nssdb
   * skipping SSL peer certificate verification
   * SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
   * Server certificate:
   * 	subject: CN=www.example.com,O=Dis,L=Springfield,ST=Denial,C=US
   * 	start date: Apr 18 09:21:45 2018 GMT
   * 	expire date: Apr 18 09:21:45 2019 GMT
   * 	common name: www.example.com
   * 	issuer: CN=www.example.com,O=Dis,L=Springfield,ST=Denial,C=US
   > GET / HTTP/1.1
   > User-Agent: curl/7.29.0
   > Host: 10.0.0.213
   > Accept: */*
   >
   < HTTP/1.1 200 OK
   < Content-Length: 30
   <
   * Connection #0 to host 10.0.0.213 left intact

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   The values in parentheses are provided as examples. Replace these with values appropriate for your site.

   $ openssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p12

2. Using the Key Manager service, create a secret resource (tls_secret1) for the PKCS12 file.

   $ openstack secret store --name='tls_secret1' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server.p12)"

3. Create a load balancer (lb1) on the public subnet (public-subnet).

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public-subnet

4. Before you can proceed, the load balancer that you created (lb1) must be in an active and online state.

   Run the openstack loadbalancer show command, until the load balancer responds with an ACTIVE and ONLINE status. (You might need to run this command more than once.)

   $ openstack loadbalancer show lb1

5. Create a TERMINATED_HTTPS listener (listener1), and reference the secret resource as the default TLS container for the listener.

   $ openstack loadbalancer listener create --protocol-port 443 --protocol TERMINATED_HTTPS --name listener1 --default-tls-container=$(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1

6. Create a pool (pool1) and make it the default pool for the listener.

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

7. Add the non-secure HTTP back end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private-subnet) to the pool.

   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool1
   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool1

Procedure

1. For each of the TLS certificates in the SNI list, combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   In this example, you create two PKCS12 files (server.p12 and server2.p12) one for each certificate (www.example.com and www2.example.com).

   Note

   The values in parentheses are provided as examples. Replace these with values appropriate for your site.

   $ openssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p12
   
   $ openssl pkcs12 -export -inkey server2.key -in server2.crt -certfile ca-chain2.crt -passout pass: -out server2.p12

2. Using the Key Manager service, create secret resources (tls_secret1 and tls_secret2) for the PKCS12 file.

   $ openstack secret store --name='tls_secret1' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server.p12)"
   $ openstack secret store --name='tls_secret2' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server2.p12)"

3. Create a load balancer (lb1) on the public subnet (public-subnet).

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public-subnet

4. Before you can proceed, the load balancer that you created (lb1) must be in an active and online state.

   Run the openstack loadbalancer show command, until the load balancer responds with an ACTIVE and ONLINE status. (You might need to run this command more than once.)

   $ openstack loadbalancer show lb1

5. Create a TERMINATED_HTTPS listener (listener1), and reference both the secret resources using SNI.

   (Reference tls_secret1 as the default TLS container for the listener.)

   $ openstack loadbalancer listener create --protocol-port 443 \
   --protocol TERMINATED_HTTPS --name listener1 \
   --default-tls-container=$(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   --sni-container-refs $(openstack secret list | awk '/ tls_secret1 / {print $2}') \
   $(openstack secret list | awk '/ tls_secret2 / {print $2}') -- lb1

6. Create a pool (pool1) and make it the default pool for the listener.

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

7. Add the non-secure HTTP back end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private-subnet) to the pool.

   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool1
   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool1

Procedure

1. Combine the key (server.key), certificate (server.crt), and intermediate certificate chain (ca-chain.crt) into a single PKCS12 file (server.p12).

   Note

   The values in parentheses are provided as examples. Replace these with values appropriate for your site.

   $ openssl pkcs12 -export -inkey server.key -in server.crt -certfile ca-chain.crt -passout pass: -out server.p12

2. Using the Key Manager service, create a secret resource (tls_secret1) for the PKCS12 file.

   $ openstack secret store --name='tls_secret1' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < server.p12)"

3. Create a load balancer (lb1) on the public subnet (public-subnet).

   $ openstack loadbalancer create --name lb1 --vip-subnet-id public-subnet

4. Before you can proceed, the load balancer that you created (lb1) must be in an active and online state.

   Run the openstack loadbalancer show command, until the load balancer responds with an ACTIVE and ONLINE status. (You might need to run this command more than once.)

   $ openstack loadbalancer show lb1

5. Create a TERMINATED_HTTPS listener (listener1), and reference the secret resource as the default TLS container for the listener.

   $ openstack loadbalancer listener create --protocol-port 443 --protocol TERMINATED_HTTPS --name listener1 --default-tls-container=$(openstack secret list | awk '/ tls_secret1 / {print $2}') lb1

6. Create a pool (pool1) and make it the default pool for the listener.

   $ openstack loadbalancer pool create --name pool1 --lb-algorithm ROUND_ROBIN --listener listener1 --protocol HTTP

7. Add the non-secure HTTP back end servers (192.0.2.10 and 192.0.2.11) on the private subnet (private-subnet) to the pool.

   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.10 --protocol-port 80 pool1
   $ openstack loadbalancer member create --subnet-id private-subnet --address 192.0.2.11 --protocol-port 80 pool1

8. Create a non-secure, HTTP listener (listener2), and make its default pool, the same as the secure listener.

   $ openstack loadbalancer listener create --protocol-port 80 --protocol HTTP --name listener2 --default-pool pool1 lb1

1. Start the ssh-agent, and add your user identity key to the agent:

   [stack@undercloud-0] $ eval `ssh-agent -s`
   [stack@undercloud-0] $ ssh-add

2. Use SSH to connect to the Amphora instance:

   [stack@undercloud-0] $ ssh -A -t heat-admin@<controller node IP address> ssh cloud-user@<IP address of Amphora in load-balancing management network>

3. View the systemd journal:

   [cloud-user@amphora-f60af64d-570f-4461-b80a-0f1f8ab0c422 ~] $ sudo journalctl

   Refer to the journalctl man page for information about filtering journal output.

4. When you are finished viewing the journal, and have closed your connections to the Amphora instance and the Controller node, make sure that you stop the SSH agent:

   [stack@undercloud-0] $ exit

1. Retrieve the project ID of the Project where you want to create the IPv6 subnet. These values are unique between OpenStack deployments, so your values differ from the values in this example.

   # openstack project list
   +----------------------------------+----------+
   | ID                               | Name     |
   +----------------------------------+----------+
   | 25837c567ed5458fbb441d39862e1399 |    QA    |
   | f59f631a77264a8eb0defc898cb836af |  admin   |
   | 4e2e1951e70643b5af7ed52f3ff36539 |   demo   |
   | 8561dff8310e4cd8be4b6fd03dc8acf5 | services |
   +----------------------------------+----------+

2. Retrieve a list of all networks present in OpenStack Networking (neutron), and note the name of the network that you want to host the IPv6 subnet:

   # openstack network list
   +--------------------------------------+------------------+-------------------------------------------------------------+
   | id                                   | name             | subnets                                                     |
   +--------------------------------------+------------------+-------------------------------------------------------------+
   | 8357062a-0dc2-4146-8a7f-d2575165e363 | private          | c17f74c4-db41-4538-af40-48670069af70 10.0.0.0/24            |
   | 31d61f7d-287e-4ada-ac29-ed7017a54542 | public           | 303ced03-6019-4e79-a21c-1942a460b920 172.24.4.224/28        |
   | 6aff6826-4278-4a35-b74d-b0ca0cbba340 | database-servers |                                                             |
   +--------------------------------------+------------------+-------------------------------------------------------------+

3. Include the project ID and network name in the openstack subnet create command:

   # openstack subnet create --ip-version 6 --ipv6-address-mode dhcpv6-stateful --project 25837c567ed5458fbb441d39862e1399 --network database-servers --subnet-range fdf8:f53b:82e4::53/125 subnet_name
   
   Created a new subnet:
   +-------------------+--------------------------------------------------------------+
   | Field             | Value                                                        |
   +-------------------+--------------------------------------------------------------+
   | allocation_pools  | {"start": "fdf8:f53b:82e4::52", "end": "fdf8:f53b:82e4::56"} |
   | cidr              | fdf8:f53b:82e4::53/125                                       |
   | dns_nameservers   |                                                              |
   | enable_dhcp       | True                                                         |
   | gateway_ip        | fdf8:f53b:82e4::51                                           |
   | host_routes       |                                                              |
   | id                | cdfc3398-997b-46eb-9db1-ebbd88f7de05                         |
   | ip_version        | 6                                                            |
   | ipv6_address_mode | dhcpv6-stateful                                              |
   | ipv6_ra_mode      |                                                              |
   | name              |                                                              |
   | network_id        | 6aff6826-4278-4a35-b74d-b0ca0cbba340                         |
   | tenant_id         | 25837c567ed5458fbb441d39862e1399                             |
   +-------------------+--------------------------------------------------------------+

4. Validate this configuration by reviewing the network list. Note that the entry for database-servers now reflects the newly created IPv6 subnet:

   # openstack network list
   +--------------------------------------+------------------+-------------------------------------------------------------+
   | id                                   | name             | subnets                                                     |
   +--------------------------------------+------------------+-------------------------------------------------------------+
   | 6aff6826-4278-4a35-b74d-b0ca0cbba340 | database-servers | cdfc3398-997b-46eb-9db1-ebbd88f7de05 fdf8:f53b:82e4::50/125 |
   | 8357062a-0dc2-4146-8a7f-d2575165e363 | private          | c17f74c4-db41-4538-af40-48670069af70 10.0.0.0/24            |
   | 31d61f7d-287e-4ada-ac29-ed7017a54542 | public           | 303ced03-6019-4e79-a21c-1942a460b920 172.24.4.224/28        |
   +--------------------------------------+------------------+-------------------------------------------------------------+

   As a result of this configuration, instances that the QA project creates can receive a DHCP IPv6 address when added to the database-servers subnet:

   # openstack server list
   +--------------------------------------+------------+--------+------------+-------------+-------------------------------------+
   | ID                                   | Name       | Status | Task State | Power State | Networks                            |
   +--------------------------------------+------------+--------+------------+-------------+-------------------------------------+
   | fad04b7a-75b5-4f96-aed9-b40654b56e03 | corp-vm-01 | ACTIVE | -          | Running     | database-servers=fdf8:f53b:82e4::52 |
   +--------------------------------------+------------+--------+------------+-------------+-------------------------------------+

1. Configure Layer 3 HA in the /var/lib/config-data/neutron/etc/neutron/neutron.conf file by enabling L3 HA and defining the number of L3 agent nodes that you want to protect each virtual router:

   l3_ha = True
   max_l3_agents_per_router = 2
   min_l3_agents_per_router = 2

   L3 HA parameters:

   • l3_ha - When set to True, all virtual routers created from this point onwards default to HA (and not legacy) routers. Administrators can override the value for each router using the following option in the openstack router create command:

     # openstack router create --ha

     or

     # openstack router create --no-ha

   • max_l3_agents_per_router - Set this to a value between the minimum and total number of network nodes in your deployment.

     For example, if you deploy four OpenStack Networking nodes but set this parameter to 2, only two L3 agents protect each HA virtual router: one active, and one standby. In addition, each time a new L3 agent node is deployed, additional standby versions of the virtual routers are scheduled until the max_l3_agents_per_router limit is reached. As a result, you can scale out the number of standby routers by adding new L3 agents.

     In addition, each time a new L3 agent node is deployed, additional standby versions of the virtual routers are scheduled until the max_l3_agents_per_router limit is reached. As a result, you can scale out the number of standby routers by adding new L3 agents.

   • min_l3_agents_per_router - The minimum setting ensures that the HA rules remain enforced. This setting is validated during the virtual router creation process to ensure a sufficient number of L3 Agent nodes are available to provide HA.

     For example, if you have two network nodes and one becomes unavailable, no new routers can be created during that time, as you need at least min active L3 agents when creating a HA router.

2. Restart the neutron-server service to apply the changes:

   # systemctl restart neutron-server.service