1

I'm trying to create two trusty VMs with static IPs for eth1, but pings between the static addresses fail.

  • Via havana dashboard, I created a network with a 10.16.1/24 subnet, disabled gateway, enabled dhcp with range 10.16.1.100,10.16.1.120.
  • Launched 4 instances, each with two NICS; eth0 for my regular public interface, and eth1 for the 10.16.1/24 subnet.
  • logged into two of the VM and created eth1.cfg, configured for dhcp 
    auto eth1
iface eth1 inet dhcp
  • logged into the other two VM and created eth1.cfg, configured with static information 
    auto eth1
iface eth1 inet static
  address 10.16.1.2
  netmask 255.255.255.0
    • ifup eth1 on each vm

From each dhcp configured VM, I can ping the other dhcp configured VM, but not the statically configured VMs.

From the statically configured VMs, I can ping no other VM.

I also tried creating a router for the network, and adding an interface 10.16.1.254. But this made no apparent change. I also cannot ping the router from either VM.

What am I missing?

Improve this question
1
  • A friend suggested ask openstack - where I found the answer in this post; ask.openstack.org/en/question/8004/…. Essentially, neutron is going to allocate a port to the VM, and you need to associate the static IP back to the neutron port using the cli.
    – CAB
    Aug 28, 2014 at 21:39

2 Answers 2

Reset to default
1

Its difficult to answer without more information. As your on the same network, I don't expect firewall rules to be an issue.

Are you using neutron or nova. Can you check all the neutron services are running ok?

neutron agent-list

It maybe worthwhile enabling dhcp, so that you can at least verify if the network is functioning.

Also are the VMs co-located on the same physical hypervisor, or are they spread across two. If they are spread across two, then are you using VLANs and have you configured your switch to support it ?

Its worth pointing out that statically configuring IPs, not reserved by Openstack worked prior to Icehouse, but changes in that release maybe causing you problems.

On the compute node hosting one of the VMs if you run

iptables -S | more

Search the output for your VMs MAC address e.g. mine is 'FA:16:3E:D0:1A:5D'

You will se some output like this:

-A neutron-openvswi-see719639-9 -s 192.168.0.83/32 -m mac --mac-source FA:16:3E:BB:75:7E -j RETURN
-A neutron-openvswi-see719639-9 -j DROP

This means it will only accept packets to that MAC address destined for 192.168.0 .83/32.

Improve this answer
1
  • added dhcp to the mix, and updated my post. We use neutron. agent-list shows all happy, except all but one compute node are shutdown - which answers the second question. net-list does show my net; 7b1c22b6-ed18-4f53-91aa-4f692e0af8f4 10.16.1.0/24.
    – CAB
    Aug 27, 2014 at 18:25
1

I believe this is consistent with my previous experimentation with trying to have a statically configured IP address on a neutron DHCP-enabled network. As I recall, what you are trying to do works if DHCP has been disabled for that particular neutron network, but will not work if it has been enabled.

In the case of the latter, a neutron port will be created for this VM interface with the IP assigned IP address. If you were to statically configure your guest VM to match this IP & subnet, it would work. If you try to statically configure your guest for an IP other than the IP in the neutron database, it will not. If nothing else, this is a form of IP spoof protection as it would not allow you to impersonate the IP of another VM on the same network, and is generally a good protection to have.

So, one option is to use a network with DHCP = disabled for your network. Another option is to statically configure the VM for the same IP that neutron has assigned.

One other anecdote: In one case I bridged an external network to an openstack network through a particular VLAN. This network had only statically configured physical servers, and no DHCP server. The openstack-side network I created with DHCP=enabled. I did this using a restricted allocation_range, to allocate IPs that would not be in conflict with existing static IPs on the same CIDR. Because neutron only manages bridged ports for VMs, this meant that other statically configured devices on the network (outside of openstack/neutron control) could talk to the DHCP'ed VMs on this network. But, this setup would not allow you to spin up a mix of static and DHCP VM/guests on the same neutron network that has DHCP=enabled.

Improve this answer
1
  • Originally, DHCP was disabled. Even then, I noticed in the Horizon 'Instances' tab that each VM seemed to have been assigned an IP, as if DHCP were enabled. So, that is actually a neutron assigned 'port', even if it isn't served to the VM via DHCP. Going back to my static IP VM, I changed the static IP to match the neutron assigned port, and pings started working. So that makes sense given your explanation. Thanks. Have to think about this a bit, and learn more about neutron, obviously.
    – CAB
    Aug 28, 2014 at 14:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .