openstack: conifgure vm with static ip on eth1

Question

I'm trying to create two trusty VMs with static IPs for eth1, but pings between the static addresses fail.

• Via havana dashboard, I created a network with a 10.16.1/24 subnet, disabled gateway, enabled dhcp with range 10.16.1.100,10.16.1.120.
• Launched 4 instances, each with two NICS; eth0 for my regular public interface, and eth1 for the 10.16.1/24 subnet.
• logged into two of the VM and created eth1.cfg, configured for dhcp

  auto eth1
  iface eth1 inet dhcp
  

• logged into the other two VM and created eth1.cfg, configured with static information

  auto eth1
  iface eth1 inet static
    address 10.16.1.2
    netmask 255.255.255.0
  

  • ifup eth1 on each vm

From each dhcp configured VM, I can ping the other dhcp configured VM, but not the statically configured VMs.

From the statically configured VMs, I can ping no other VM.

I also tried creating a router for the network, and adding an interface 10.16.1.254. But this made no apparent change. I also cannot ping the router from either VM.

What am I missing?

Answer 1

Its difficult to answer without more information. As your on the same network, I don't expect firewall rules to be an issue.

Are you using neutron or nova. Can you check all the neutron services are running ok?

neutron agent-list

It maybe worthwhile enabling dhcp, so that you can at least verify if the network is functioning.

Also are the VMs co-located on the same physical hypervisor, or are they spread across two. If they are spread across two, then are you using VLANs and have you configured your switch to support it ?

Its worth pointing out that statically configuring IPs, not reserved by Openstack worked prior to Icehouse, but changes in that release maybe causing you problems.

On the compute node hosting one of the VMs if you run

iptables -S | more

Search the output for your VMs MAC address e.g. mine is 'FA:16:3E:D0:1A:5D'

You will se some output like this:

-A neutron-openvswi-see719639-9 -s 192.168.0.83/32 -m mac --mac-source FA:16:3E:BB:75:7E -j RETURN
-A neutron-openvswi-see719639-9 -j DROP

This means it will only accept packets to that MAC address destined for 192.168.0 .83/32.

Answer 2

I believe this is consistent with my previous experimentation with trying to have a statically configured IP address on a neutron DHCP-enabled network. As I recall, what you are trying to do works if DHCP has been disabled for that particular neutron network, but will not work if it has been enabled.

In the case of the latter, a neutron port will be created for this VM interface with the IP assigned IP address. If you were to statically configure your guest VM to match this IP & subnet, it would work. If you try to statically configure your guest for an IP other than the IP in the neutron database, it will not. If nothing else, this is a form of IP spoof protection as it would not allow you to impersonate the IP of another VM on the same network, and is generally a good protection to have.

So, one option is to use a network with DHCP = disabled for your network. Another option is to statically configure the VM for the same IP that neutron has assigned.

One other anecdote: In one case I bridged an external network to an openstack network through a particular VLAN. This network had only statically configured physical servers, and no DHCP server. The openstack-side network I created with DHCP=enabled. I did this using a restricted allocation_range, to allocate IPs that would not be in conflict with existing static IPs on the same CIDR. Because neutron only manages bridged ports for VMs, this meant that other statically configured devices on the network (outside of openstack/neutron control) could talk to the DHCP'ed VMs on this network. But, this setup would not allow you to spin up a mix of static and DHCP VM/guests on the same neutron network that has DHCP=enabled.