)]}'
{"doc/networking-guide/source/scenario_l3ha_ovs.rst":[{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":9,"context_line":"architecture with Virtual Router Redundancy Protocol (VRRP) to provide quick"},{"line_number":10,"context_line":"failover of layer-3 services."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"If the layer-3 (L3) agent on a network node fails or a network node loses"},{"line_number":13,"context_line":"connectivity with a peer, the ``keepalived`` service automatically migrates"},{"line_number":14,"context_line":"routing services and active connections to another network node. Similar to"},{"line_number":15,"context_line":"the legacy scenario, all network traffic that requires routing relies on a"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_b18a9b19","line":12,"updated":"2015-08-12 20:10:20.000000000","message":"Failover only occurs if a peer disconnects from the \u0027master\u0027. The l3 agent can crash and burn but if the data plane is not affected failover will not occur.","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":20,"context_line":"and L3HA mechanisms."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":".. note::"},{"line_number":23,"context_line":"   The migration process only retains the state of network connections for"},{"line_number":24,"context_line":"   instances with a floating IP address."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"The example configuration creates one flat external network and one VXLAN"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_517a3725","line":23,"updated":"2015-08-12 20:10:20.000000000","message":"migration -\u003e failover (I had to double take to understand what you meant here... \u0027migration\u0027 is a very overloaded term in OpenStack and in Neutron).","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"To improve understanding of network traffic flow, the network and compute"},{"line_number":58,"context_line":"nodes contain a separate network interface for project VLAN networks. In"},{"line_number":59,"context_line":"production environments, project VLAN networks can use any Open vSwitch"},{"line_number":60,"context_line":"bridge with access to a network interface. For example, the ``br-tun``"},{"line_number":61,"context_line":"bridge."},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_91b19fe2","line":59,"updated":"2015-08-12 20:10:20.000000000","message":"I don\u0027t know if you want to mix project VLAN networks and \u0027br-tun\u0027.","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":".. note::"},{"line_number":69,"context_line":"   To reduce the chance of \"split-brain\" issues, we recommend that you"},{"line_number":70,"context_line":"   deploy an odd quantity of network nodes with a minimum of three nodes."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":".. figure:: figures/scenario-l3ha-hw.png"},{"line_number":73,"context_line":"   :alt: Hardware layout"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_b1dffb0b","line":70,"updated":"2015-08-12 20:10:20.000000000","message":"So, you don\u0027t really need an odd number of nodes because keepalived doesn\u0027t use any quorum logic like Pacemaker does. If the operator is also using Pacemaker (Out of scope for this guide) then he does want an odd number of nodes per role (Network or controller).","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":75,"context_line":".. figure:: figures/scenario-l3ha-networks.png"},{"line_number":76,"context_line":"   :alt: Network layout"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":".. figure:: figures/scenario-l3ha-ovs-services.png"},{"line_number":79,"context_line":"   :alt: Service layout"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":".. note::"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_11d58fe3","line":78,"updated":"2015-08-12 20:10:20.000000000","message":"We\u0027ve talked about this before, just my 2 cents - I find it very confusing that the \u0027ml2 plugin\u0027 is on the network and compute nodes. Technically, it isn\u0027t. The network and compute nodes only have agents, which the ml2 plugin is not.","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":179,"context_line":"If the backup router stops receiving these packets, it assumes failure"},{"line_number":180,"context_line":"of the master router and promotes itself to the master router by configuring"},{"line_number":181,"context_line":"IP addresses on the interfaces in the ``qrouter`` namespace. In environments"},{"line_number":182,"context_line":"with more than one backup router, the router with the next highest priority"},{"line_number":183,"context_line":"becomes the master router."},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"Example configuration"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_517557c8","line":182,"updated":"2015-08-12 20:10:20.000000000","message":"Actually we don\u0027t use priorities, if you have more than a single backup the next master is random (I don\u0027t recall the details but keepalived breaks the tie using the highest IP or MAC address or similar).","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":215,"context_line":"      [ml2]"},{"line_number":216,"context_line":"      type_drivers \u003d flat,vlan,gre,vxlan"},{"line_number":217,"context_line":"      tenant_network_types \u003d vlan,gre,vxlan"},{"line_number":218,"context_line":"      mechanism_drivers \u003d openvswitch,l2population"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"      [ml2_type_flat]"},{"line_number":221,"context_line":"      flat_networks \u003d external"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_11526f35","line":218,"updated":"2015-08-12 20:10:20.000000000","message":"Halt! l3_ha doesn\u0027t work with l2pop in Kilo (We haven\u0027t backported the fix yet). Even when it will, I wouldn\u0027t recommend turning on l2pop because it makes your HA guarantees weaker. With l2pop on, failover will only work if your RPC/rabbit network is working, rabbit is up, and the neutron server is up. Without l2pop failover can work without all of those things.","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":287,"context_line":""},{"line_number":288,"context_line":"      [agent]"},{"line_number":289,"context_line":"      tunnel_types \u003d gre,vxlan"},{"line_number":290,"context_line":"      l2_population \u003d True"},{"line_number":291,"context_line":""},{"line_number":292,"context_line":"      [securitygroup]"},{"line_number":293,"context_line":"      firewall_driver \u003d neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_3128cb99","line":290,"updated":"2015-08-12 20:10:20.000000000","message":"Same comment about l2pop configuration.","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":322,"context_line":"      verbose \u003d True"},{"line_number":323,"context_line":"      interface_driver \u003d neutron.agent.linux.interface.OVSInterfaceDriver"},{"line_number":324,"context_line":"      dhcp_driver \u003d neutron.agent.linux.dhcp.Dnsmasq"},{"line_number":325,"context_line":"      use_namespaces \u003d True"},{"line_number":326,"context_line":"      dhcp_delete_namespaces \u003d True"},{"line_number":327,"context_line":""},{"line_number":328,"context_line":"#. (Optional) Reduce MTU for VXLAN/GRE project networks."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_71109359","line":325,"updated":"2015-08-12 20:10:20.000000000","message":"Note that use_namespaces defaults to True.","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":396,"context_line":"      bridge_mappings \u003d vlan:br-vlan"},{"line_number":397,"context_line":""},{"line_number":398,"context_line":"      [agent]"},{"line_number":399,"context_line":"      tunnel_types \u003d gre,vxlan"},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"      [securitygroup]"},{"line_number":402,"context_line":"      firewall_driver \u003d neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_d53cf2c9","line":399,"updated":"2015-08-12 20:10:20.000000000","message":"Hmm, l2pop is off on the compute nodes but on the network and controller nodes. This won\u0027t work, you can\u0027t mix and match in this case.","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":400,"context_line":""},{"line_number":401,"context_line":"      [securitygroup]"},{"line_number":402,"context_line":"      firewall_driver \u003d neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver"},{"line_number":403,"context_line":"      enable_security_group \u003d True"},{"line_number":404,"context_line":"      enable_ipset \u003d True"},{"line_number":405,"context_line":""},{"line_number":406,"context_line":"   Replace ``TUNNEL_INTERFACE_IP_ADDRESS`` with the IP address of the interface"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_554f826a","line":403,"updated":"2015-08-12 20:10:20.000000000","message":"both this line and the next are the default values FYI.","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":582,"context_line":"      +-----------------------+--------------------------------------+"},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"   .. note::"},{"line_number":585,"context_line":"      Default policy might prevent the ``ha`` flag from appearing in the"},{"line_number":586,"context_line":"      command output. To see all fields, run the"},{"line_number":587,"context_line":"      ``neutron router-show demo-router`` command using the administrative"},{"line_number":588,"context_line":"      project credentials."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_559d42ba","line":585,"updated":"2015-08-12 20:10:20.000000000","message":"Maybe you can word this stronger: the default policy.json shipped as part of the Neutron git repo allows only admins to see the \u0027HA\u0027 flag of a router, or manually control it upon creation. Users cannot control what kind of router they create (This is determined in neutron.conf) nor can they see what type of router they got.","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"782678840d1363824d9a30018c8c91a45bf16d28","unresolved":false,"context_lines":[{"line_number":907,"context_line":""},{"line_number":908,"context_line":"      --- 203.0.113.102 ping statistics ---"},{"line_number":909,"context_line":"      4 packets transmitted, 4 received, 0% packet loss, time 3002ms"},{"line_number":910,"context_line":"      rtt min/avg/max/mdev \u003d 0.929/1.539/3.183/0.951 ms"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_f5da4e77","line":910,"updated":"2015-08-12 20:10:20.000000000","message":"One command you\u0027re missing (I think I haven\u0027t missed it) is neutron l3-agent-list-hosting-router \u003crouter_id\u003e which will show you all of the agents hosting the router and the HA state on that agent. In this case it should show network1 and network2, one should be active and the other standby. If both are active then you don\u0027t have network connectivity between the network nodes for whatever reason (Port binding failure as a result of a misconfiguration etc).","commit_id":"b05ace4940d7bba6d92a896763a1c52c0aa1d808"},{"author":{"_account_id":8873,"name":"Assaf Muller","email":"amuller@redhat.com","username":"amuller"},"change_message_id":"09fc887033167f6a33539d004db711176635da45","unresolved":false,"context_lines":[{"line_number":9,"context_line":"architecture with Virtual Router Redundancy Protocol (VRRP) using"},{"line_number":10,"context_line":"``keepalived`` to provide quick failover of layer-3 services. See"},{"line_number":11,"context_line":":ref:`packet-flow` for VRRP operation. Similar to the legacy scenario, all"},{"line_number":12,"context_line":"network traffic on a project network that requires routing actively traverses"},{"line_number":13,"context_line":"only one network node regardless of the quantity of network nodes providing HA"},{"line_number":14,"context_line":"for the router. Therefore, this high-availabilty implementation addresses"},{"line_number":15,"context_line":"failure situations rather than bandwidth constraints that limit performance."}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa1b9901_e1c2ca33","line":12,"updated":"2015-08-19 21:17:53.000000000","message":"Maybe there\u0027s room here to mention that if you have more than a single project, and more than a single router, then routers will be placed randomly on your network nodes, utilizing the bandwidth of them all. The HA solution allows you to scale out your network nodes comfortably.","commit_id":"8df31c7acf5997f9adb592c01bd3e4a5fd3c0f21"}]}