Re: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Hi Vincent, Yes, there have been some code optimization and bug fixes going into the master branch. I am going to request the Mitaka release today after the patch for fixing the tempest version mismatch issue is merged. I would suggest that you use the Mitaka release. Thanks, Cathy From: Vincent.Chao [mailto:vincentcha...@gmail.com] Sent: Wednesday, August 31, 2016 7:43 PM To: OpenStack Development Mailing List (not for usage questions); Cathy Zhang Cc: Alioune Subject: Re: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC Hi Neutrons, I met this situation once in the release Liberty. Here is the thing. When the create_port_chain() is called, (@networking-sfc/networking_sfc/services/sfc/drivers/ovs/driver.py) it goes the following code path -> _thread_update_path_nodes() ->_update_path_node_flowrules() ->_update_path_node_port_flowrules() ->_build_portchain_flowrule_body() ->_update_path_node_next_hops() ->_get_port_subnet_gw_info_by_port_id ->_get_port_subnet_gw_info()raise exc.SfcNoSubnetGateway if you didn't give the network a router, it raises SfcNoSubnetGateway . And then back to the plugin.py: create_port_chain(), cache the exception sfc_exc.SfcDriverError as e In this exception, there is a delete_port_chain() method. But due to the synchronization problem between DB and ovs-bridge, it will delete failure. I hope this info. could help anyone who uses a liberty version. Next time, don't forget giving a router before creating a port chain. I don't see this code path in the master branch. It may be better in mitaka. Thanks Vincent 2016-08-31 2:19 GMT+08:00 Cathy Zhang <cathy.h.zh...@huawei.com<mailto:cathy.h.zh...@huawei.com>>: Hi Alioune, It is weird that when you create a port chain, you get a “chain delete failed” error message. We never had this problem. Chain deletion is only involved when you do “delete chain” or “update chain”. Not sure which networking code file combination you are using or whether it is because your system is not properly cleaned up or not properly installed. We are going to release the networking-sfc mitaka version soon. I would suggest that you wait a little bit and then use the official released mitaka version and reinstall the feature on your system. Thanks, Cathy From: Alioune [mailto:baliou...@gmail.com<mailto:baliou...@gmail.com>] Sent: Tuesday, August 30, 2016 8:03 AM To: OpenStack Development Mailing List (not for usage questions) Cc: Cathy Zhang; Mohan Kumar; Henry Fourie Subject: Re: [openstack-dev][neutron][networking-sfc] Unable to create openstack SFC Hi, Have you received my previous email ? Regards, On 15 August 2016 at 13:39, Alioune <baliou...@gmail.com<mailto:baliou...@gmail.com>> wrote: Hi all, I'm trying to launch Openstack SFC as explained in[1] by creating 2 SFs, 1 Web Server (DST) and the DHCP namespace as the SRC. I've installed OVS (Open vSwitch) 2.3.90 with Linux kernel 3.13.0-62 and the neutron L2-agent runs correctly. I followed the process by creating classifier, port pairs and port_group but I got a wrong message "delete_port_chain failed." when creating port_chain [2] I tried to create the neutron ports with and without the option "--no-security-groups" then tcpdpump on SFs tap interfaces but the ICMP packets don't go through the SFs. Can anyone advice to fix? that ? What's your channel on IRC ? Regards, [1] https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining [2] vagrant@ubuntu:~/openstack_sfc$ ./08-os_create_port_chain.sh delete_port_chain failed. vagrant@ubuntu:~/openstack_sfc$ cat 08-os_create_port_chain.sh #!/bin/bash neutron port-chain-create --port-pair-group PG1 --port-pair-group PG2 --flow-classifier FC1 PC1 [3] Output OVS Flows vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-tun -O OpenFlow13 OFPST_FLOW reply (OF1.3) (xid=0x2): cookie=0xbc2e9105125301dc, duration=9615.385s, table=0, n_packets=146, n_bytes=11534, priority=1,in_port=1 actions=resubmit(,2) cookie=0xbc2e9105125301dc, duration=9615.382s, table=0, n_packets=0, n_bytes=0, priority=0 actions=drop cookie=0xbc2e9105125301dc, duration=9615.382s, table=2, n_packets=5, n_bytes=490, priority=0,dl_dst=00:00:00:00:00:00/01:00:00:00:00:00 actions=resubmit(,20) cookie=0xbc2e9105125301dc, duration=9615.381s, table=2, n_packets=141, n_bytes=11044, priority=0,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 actions=resubmit(,22) cookie=0xbc2e9105125301dc, duration=9615.380s, table=3, n_packets=0, n_bytes=0, priority=0 actions=drop cookie=0xbc2e9105125301dc, duration=9615.380s, table=4, n_packets=0, n_bytes=0, priority=0 actions=drop cookie=0xbc2e9105125301dc, duration=8617.106s, table=4, n_packets=0, n_bytes=0, priority=1,tun_id=0x40e actions=push_vlan:0x8100,set_field:4097->vlan_vid,resubmit(,10) cookie=0xbc2e9105125301dc, duration=9615.379s, table=6, n_packets=0, n_bytes=0, priority=0 actions=
[openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Hi all, Thanks Vincent for this confimation. I've noticed that error to the team here [1]. I think it could be interesting to update the wiki in order to signal new comer the network requirements for building a chain. @ Cathy: I can create port chain but it just works once for me. After analysing OVS entries, it's probably due to flows misconfiguration. Regards, [1] http://lists.openstack.org/pipermail/openstack-dev/2016- August/101817.html On 1 September 2016 at 04:42, Vincent.Chao <vincentcha...@gmail.com <javascript:_e(%7B%7D,'cvml','vincentcha...@gmail.com');>> wrote: > Hi Neutrons, > > I met this situation once in the release Liberty. > Here is the thing. > When the create_port_chain() is called, (@networking-sfc/networking_sf > c/services/sfc/drivers/ovs/driver.py) > it goes the following code path >-> _thread_update_path_nodes() >->_update_path_node_flowrules() >->_update_path_node_port_flowrules() >->_build_portchain_flowrule_body() >->_update_path_node_next_hops() >->_get_port_subnet_gw_info_by_port_id >->_get_port_subnet_gw_info()raise exc.SfcNoSubnetGateway > if you didn't give the network a router, it raises SfcNoSubnetGateway . > And then back to the plugin.py: create_port_chain(), cache the exception > sfc_exc.SfcDriverError as e > In this exception, there is a delete_port_chain() method. > But due to the synchronization problem between DB and ovs-bridge, it will > delete failure. > I hope this info. could help anyone who uses a liberty version. > Next time, don't forget giving a router before creating a port chain. > > I don't see this code path in the master branch. > It may be better in mitaka. > > Thanks > Vincent > > > > 2016-08-31 2:19 GMT+08:00 Cathy Zhang <cathy.h.zh...@huawei.com > <javascript:_e(%7B%7D,'cvml','cathy.h.zh...@huawei.com');>>: > >> Hi Alioune, >> >> >> >> It is weird that when you create a port chain, you get a “chain delete >> failed” error message. >> >> We never had this problem. Chain deletion is only involved when you do >> “delete chain” or “update chain”. >> >> Not sure which networking code file combination you are using or whether >> it is because your system is not properly cleaned up or not properly >> installed. >> >> We are going to release the networking-sfc mitaka version soon. >> >> I would suggest that you wait a little bit and then use the official >> released mitaka version and reinstall the feature on your system. >> >> >> >> Thanks, >> >> Cathy >> >> >> >> *From:* Alioune [mailto:baliou...@gmail.com >> <javascript:_e(%7B%7D,'cvml','baliou...@gmail.com');>] >> *Sent:* Tuesday, August 30, 2016 8:03 AM >> *To:* OpenStack Development Mailing List (not for usage questions) >> *Cc:* Cathy Zhang; Mohan Kumar; Henry Fourie >> *Subject:* Re: [openstack-dev][neutron][networking-sfc] Unable to create >> openstack SFC >> >> >> >> Hi, >> >> Have you received my previous email ? >> >> >> >> Regards, >> >> >> >> On 15 August 2016 at 13:39, Alioune <baliou...@gmail.com >> <javascript:_e(%7B%7D,'cvml','baliou...@gmail.com');>> wrote: >> >> Hi all, >> >> I'm trying to launch Openstack SFC as explained in[1] by creating 2 SFs, >> 1 Web Server (DST) and the DHCP namespace as the SRC. >> >> I've installed OVS (Open vSwitch) 2.3.90 with Linux kernel 3.13.0-62 and >> the neutron L2-agent runs correctly. >> >> I followed the process by creating classifier, port pairs and port_group >> but I got a wrong message "delete_port_chain failed." when creating >> port_chain [2] >> >> I tried to create the neutron ports with and without the option >> "--no-security-groups" then tcpdpump on SFs tap interfaces but the ICMP >> packets don't go through the SFs. >> >> >> >> Can anyone advice to fix? that ? >> >> What's your channel on IRC ? >> >> >> >> Regards, >> >> >> >> >> >> [1] https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining >> >> [2] >> >> vagrant@ubuntu:~/openstack_sfc$ ./08-os_create_port_chain.sh >> >> delete_port_chain failed. >> >> vagrant@ubuntu:~/openstack_sfc$ cat 08-os_create_port_chain.sh >> >> #!/bin/bash >> >> >> >> neutron port-chain-create --port-pair-group PG1 --port-pair-group PG2 >> --flow-classifier FC1 PC1 >> >> >> >> [3] Output OVS
Re: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Hi Neutrons, I met this situation once in the release Liberty. Here is the thing. When the create_port_chain() is called, (@networking-sfc/networking_sfc/services/sfc/drivers/ovs/driver.py) it goes the following code path -> _thread_update_path_nodes() ->_update_path_node_flowrules() ->_update_path_node_port_flowrules() ->_build_portchain_flowrule_body() ->_update_path_node_next_hops() ->_get_port_subnet_gw_info_by_port_id ->_get_port_subnet_gw_info()raise exc.SfcNoSubnetGateway if you didn't give the network a router, it raises SfcNoSubnetGateway . And then back to the plugin.py: create_port_chain(), cache the exception sfc_exc.SfcDriverError as e In this exception, there is a delete_port_chain() method. But due to the synchronization problem between DB and ovs-bridge, it will delete failure. I hope this info. could help anyone who uses a liberty version. Next time, don't forget giving a router before creating a port chain. I don't see this code path in the master branch. It may be better in mitaka. Thanks Vincent 2016-08-31 2:19 GMT+08:00 Cathy Zhang <cathy.h.zh...@huawei.com>: > Hi Alioune, > > > > It is weird that when you create a port chain, you get a “chain delete > failed” error message. > > We never had this problem. Chain deletion is only involved when you do > “delete chain” or “update chain”. > > Not sure which networking code file combination you are using or whether > it is because your system is not properly cleaned up or not properly > installed. > > We are going to release the networking-sfc mitaka version soon. > > I would suggest that you wait a little bit and then use the official > released mitaka version and reinstall the feature on your system. > > > > Thanks, > > Cathy > > > > *From:* Alioune [mailto:baliou...@gmail.com] > *Sent:* Tuesday, August 30, 2016 8:03 AM > *To:* OpenStack Development Mailing List (not for usage questions) > *Cc:* Cathy Zhang; Mohan Kumar; Henry Fourie > *Subject:* Re: [openstack-dev][neutron][networking-sfc] Unable to create > openstack SFC > > > > Hi, > > Have you received my previous email ? > > > > Regards, > > > > On 15 August 2016 at 13:39, Alioune <baliou...@gmail.com> wrote: > > Hi all, > > I'm trying to launch Openstack SFC as explained in[1] by creating 2 SFs, 1 > Web Server (DST) and the DHCP namespace as the SRC. > > I've installed OVS (Open vSwitch) 2.3.90 with Linux kernel 3.13.0-62 and > the neutron L2-agent runs correctly. > > I followed the process by creating classifier, port pairs and port_group > but I got a wrong message "delete_port_chain failed." when creating > port_chain [2] > > I tried to create the neutron ports with and without the option > "--no-security-groups" then tcpdpump on SFs tap interfaces but the ICMP > packets don't go through the SFs. > > > > Can anyone advice to fix? that ? > > What's your channel on IRC ? > > > > Regards, > > > > > > [1] https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining > > [2] > > vagrant@ubuntu:~/openstack_sfc$ ./08-os_create_port_chain.sh > > delete_port_chain failed. > > vagrant@ubuntu:~/openstack_sfc$ cat 08-os_create_port_chain.sh > > #!/bin/bash > > > > neutron port-chain-create --port-pair-group PG1 --port-pair-group PG2 > --flow-classifier FC1 PC1 > > > > [3] Output OVS Flows > > > > vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-tun -O OpenFlow13 > > OFPST_FLOW reply (OF1.3) (xid=0x2): > > cookie=0xbc2e9105125301dc, duration=9615.385s, table=0, n_packets=146, > n_bytes=11534, priority=1,in_port=1 actions=resubmit(,2) > > cookie=0xbc2e9105125301dc, duration=9615.382s, table=0, n_packets=0, > n_bytes=0, priority=0 actions=drop > > cookie=0xbc2e9105125301dc, duration=9615.382s, table=2, n_packets=5, > n_bytes=490, priority=0,dl_dst=00:00:00:00:00:00/01:00:00:00:00:00 > actions=resubmit(,20) > > cookie=0xbc2e9105125301dc, duration=9615.381s, table=2, n_packets=141, > n_bytes=11044, priority=0,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 > actions=resubmit(,22) > > cookie=0xbc2e9105125301dc, duration=9615.380s, table=3, n_packets=0, > n_bytes=0, priority=0 actions=drop > > cookie=0xbc2e9105125301dc, duration=9615.380s, table=4, n_packets=0, > n_bytes=0, priority=0 actions=drop > > cookie=0xbc2e9105125301dc, duration=8617.106s, table=4, n_packets=0, > n_bytes=0, priority=1,tun_id=0x40e actions=push_vlan:0x8100,set_ > field:4097->vlan_vid,resubmit(,10) > > cookie=0xbc2e9105125301dc, duration=9615.379s, table=6, n_packets=0, > n_bytes=0, priority=0 actions=drop > > cookie=0xbc2e9105
Re: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Hi Alioune, It is weird that when you create a port chain, you get a “chain delete failed” error message. We never had this problem. Chain deletion is only involved when you do “delete chain” or “update chain”. Not sure which networking code file combination you are using or whether it is because your system is not properly cleaned up or not properly installed. We are going to release the networking-sfc mitaka version soon. I would suggest that you wait a little bit and then use the official released mitaka version and reinstall the feature on your system. Thanks, Cathy From: Alioune [mailto:baliou...@gmail.com] Sent: Tuesday, August 30, 2016 8:03 AM To: OpenStack Development Mailing List (not for usage questions) Cc: Cathy Zhang; Mohan Kumar; Henry Fourie Subject: Re: [openstack-dev][neutron][networking-sfc] Unable to create openstack SFC Hi, Have you received my previous email ? Regards, On 15 August 2016 at 13:39, Alioune <baliou...@gmail.com<mailto:baliou...@gmail.com>> wrote: Hi all, I'm trying to launch Openstack SFC as explained in[1] by creating 2 SFs, 1 Web Server (DST) and the DHCP namespace as the SRC. I've installed OVS (Open vSwitch) 2.3.90 with Linux kernel 3.13.0-62 and the neutron L2-agent runs correctly. I followed the process by creating classifier, port pairs and port_group but I got a wrong message "delete_port_chain failed." when creating port_chain [2] I tried to create the neutron ports with and without the option "--no-security-groups" then tcpdpump on SFs tap interfaces but the ICMP packets don't go through the SFs. Can anyone advice to fix? that ? What's your channel on IRC ? Regards, [1] https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining [2] vagrant@ubuntu:~/openstack_sfc$ ./08-os_create_port_chain.sh delete_port_chain failed. vagrant@ubuntu:~/openstack_sfc$ cat 08-os_create_port_chain.sh #!/bin/bash neutron port-chain-create --port-pair-group PG1 --port-pair-group PG2 --flow-classifier FC1 PC1 [3] Output OVS Flows vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-tun -O OpenFlow13 OFPST_FLOW reply (OF1.3) (xid=0x2): cookie=0xbc2e9105125301dc, duration=9615.385s, table=0, n_packets=146, n_bytes=11534, priority=1,in_port=1 actions=resubmit(,2) cookie=0xbc2e9105125301dc, duration=9615.382s, table=0, n_packets=0, n_bytes=0, priority=0 actions=drop cookie=0xbc2e9105125301dc, duration=9615.382s, table=2, n_packets=5, n_bytes=490, priority=0,dl_dst=00:00:00:00:00:00/01:00:00:00:00:00 actions=resubmit(,20) cookie=0xbc2e9105125301dc, duration=9615.381s, table=2, n_packets=141, n_bytes=11044, priority=0,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 actions=resubmit(,22) cookie=0xbc2e9105125301dc, duration=9615.380s, table=3, n_packets=0, n_bytes=0, priority=0 actions=drop cookie=0xbc2e9105125301dc, duration=9615.380s, table=4, n_packets=0, n_bytes=0, priority=0 actions=drop cookie=0xbc2e9105125301dc, duration=8617.106s, table=4, n_packets=0, n_bytes=0, priority=1,tun_id=0x40e actions=push_vlan:0x8100,set_field:4097->vlan_vid,resubmit(,10) cookie=0xbc2e9105125301dc, duration=9615.379s, table=6, n_packets=0, n_bytes=0, priority=0 actions=drop cookie=0xbc2e9105125301dc, duration=9615.379s, table=10, n_packets=0, n_bytes=0, priority=1 actions=learn(table=20,hard_timeout=300,priority=1,cookie=0xbc2e9105125301dc,NXM_OF_VLAN_TCI[0..11],NXM_OF_ETH_DST[]=NXM_OF_ETH_SRC[],load:0->NXM_OF_VLAN_TCI[],load:NXM_NX_TUN_ID[]->NXM_NX_TUN_ID[],output:NXM_OF_IN_PORT[]),output:1 cookie=0xbc2e9105125301dc, duration=9615.378s, table=20, n_packets=5, n_bytes=490, priority=0 actions=resubmit(,22) cookie=0xbc2e9105125301dc, duration=9615.342s, table=22, n_packets=146, n_bytes=11534, priority=0 actions=drop vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-int -O OpenFlow13 OFPST_FLOW reply (OF1.3) (xid=0x2): cookie=0xbc2e9105125301dc, duration=6712.090s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=7,icmp_type=136 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6709.623s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=8,icmp_type=136 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6555.755s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=10,icmp_type=136 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6559.596s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=9,icmp_type=136 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6461.028s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=11,icmp_type=136 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6712.071s, table=0, n_packets=13, n_bytes=546, priority=10,arp,in_port=7 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6709.602s, table=0, n_packets=0, n_bytes=0, priority=10,arp,in_port=8 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6555.727s, table=0, n_packets=0, n_bytes=0, priority=10,arp,in_port=10 actions=resubmit(
Re: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Hi, Have you received my previous email ? Regards, On 15 August 2016 at 13:39, Aliounewrote: > Hi all, > I'm trying to launch Openstack SFC as explained in[1] by creating 2 SFs, 1 > Web Server (DST) and the DHCP namespace as the SRC. > I've installed OVS (Open vSwitch) 2.3.90 with Linux kernel 3.13.0-62 and > the neutron L2-agent runs correctly. > I followed the process by creating classifier, port pairs and port_group > but I got a wrong message "delete_port_chain failed." when creating > port_chain [2] > I tried to create the neutron ports with and without the option > "--no-security-groups" then tcpdpump on SFs tap interfaces but the ICMP > packets don't go through the SFs. > > Can anyone advice to fix? that ? > What's your channel on IRC ? > > Regards, > > > [1] https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining > [2] > vagrant@ubuntu:~/openstack_sfc$ ./08-os_create_port_chain.sh > delete_port_chain failed. > vagrant@ubuntu:~/openstack_sfc$ cat 08-os_create_port_chain.sh > #!/bin/bash > > neutron port-chain-create --port-pair-group PG1 --port-pair-group PG2 > --flow-classifier FC1 PC1 > > [3] Output OVS Flows > > vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-tun -O OpenFlow13 > OFPST_FLOW reply (OF1.3) (xid=0x2): > cookie=0xbc2e9105125301dc, duration=9615.385s, table=0, n_packets=146, > n_bytes=11534, priority=1,in_port=1 actions=resubmit(,2) > cookie=0xbc2e9105125301dc, duration=9615.382s, table=0, n_packets=0, > n_bytes=0, priority=0 actions=drop > cookie=0xbc2e9105125301dc, duration=9615.382s, table=2, n_packets=5, > n_bytes=490, priority=0,dl_dst=00:00:00:00:00:00/01:00:00:00:00:00 > actions=resubmit(,20) > cookie=0xbc2e9105125301dc, duration=9615.381s, table=2, n_packets=141, > n_bytes=11044, priority=0,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 > actions=resubmit(,22) > cookie=0xbc2e9105125301dc, duration=9615.380s, table=3, n_packets=0, > n_bytes=0, priority=0 actions=drop > cookie=0xbc2e9105125301dc, duration=9615.380s, table=4, n_packets=0, > n_bytes=0, priority=0 actions=drop > cookie=0xbc2e9105125301dc, duration=8617.106s, table=4, n_packets=0, > n_bytes=0, priority=1,tun_id=0x40e actions=push_vlan:0x8100,set_ > field:4097->vlan_vid,resubmit(,10) > cookie=0xbc2e9105125301dc, duration=9615.379s, table=6, n_packets=0, > n_bytes=0, priority=0 actions=drop > cookie=0xbc2e9105125301dc, duration=9615.379s, table=10, n_packets=0, > n_bytes=0, priority=1 actions=learn(table=20,hard_ > timeout=300,priority=1,cookie=0xbc2e9105125301dc,NXM_OF_ > VLAN_TCI[0..11],NXM_OF_ETH_DST[]=NXM_OF_ETH_SRC[],load:0- > >NXM_OF_VLAN_TCI[],load:NXM_NX_TUN_ID[]->NXM_NX_TUN_ID[], > output:NXM_OF_IN_PORT[]),output:1 > cookie=0xbc2e9105125301dc, duration=9615.378s, table=20, n_packets=5, > n_bytes=490, priority=0 actions=resubmit(,22) > cookie=0xbc2e9105125301dc, duration=9615.342s, table=22, n_packets=146, > n_bytes=11534, priority=0 actions=drop > vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-int -O OpenFlow13 > OFPST_FLOW reply (OF1.3) (xid=0x2): > cookie=0xbc2e9105125301dc, duration=6712.090s, table=0, n_packets=0, > n_bytes=0, priority=10,icmp6,in_port=7,icmp_type=136 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6709.623s, table=0, n_packets=0, > n_bytes=0, priority=10,icmp6,in_port=8,icmp_type=136 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6555.755s, table=0, n_packets=0, > n_bytes=0, priority=10,icmp6,in_port=10,icmp_type=136 > actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6559.596s, table=0, n_packets=0, > n_bytes=0, priority=10,icmp6,in_port=9,icmp_type=136 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6461.028s, table=0, n_packets=0, > n_bytes=0, priority=10,icmp6,in_port=11,icmp_type=136 > actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6712.071s, table=0, n_packets=13, > n_bytes=546, priority=10,arp,in_port=7 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6709.602s, table=0, n_packets=0, > n_bytes=0, priority=10,arp,in_port=8 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6555.727s, table=0, n_packets=0, > n_bytes=0, priority=10,arp,in_port=10 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6559.574s, table=0, n_packets=12, > n_bytes=504, priority=10,arp,in_port=9 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6461.005s, table=0, n_packets=15, > n_bytes=630, priority=10,arp,in_port=11 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=9620.388s, table=0, n_packets=514, > n_bytes=49656, priority=0 actions=NORMAL > cookie=0xbc2e9105125301dc, duration=9619.277s, table=0, n_packets=0, > n_bytes=0, priority=20,mpls actions=resubmit(,10) > cookie=0xbc2e9105125301dc, duration=6712.111s, table=0, n_packets=25, > n_bytes=2674, priority=9,in_port=7 actions=resubmit(,25) > cookie=0xbc2e9105125301dc, duration=6559.621s, table=0, n_packets=24, > n_bytes=2576, priority=9,in_port=9 actions=resubmit(,25) >
Re: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Hi Mohan, The packets are not going through the SFs after setting the chain and I think that this error is due to a misconfiguration of the pipelines in br-int. I used the flow classifier [0] but only the network address " 55.55.55.0/24" is put in pipeline flow entries see [1] [2] and not the explicit address of the source " 55.55.55.8/24" or destination " 55.55.55.7/24" The source instance can successfully ping the destination before setting up the port chain, after building the chain the ICMP packets are leaving from the source to the destination see [3] but it seems that they are not correctly switched in br-int. Any suggestion to solve that ? [0] "neutron flow-classifier-create --ethertype IPv4 --source-ip-prefix 55.55.55.8/24 --logical-source-port 9ee874fc-aaec-477d-af41-0d0e872bb209 --destination-ip-prefix 55.55.55.7/24 --logical-destination-port d2eea910-4e6c-4f30-947a-849fba7447a4 --protocol icmp FC1" [1] sudo ovs-ofctl dump-flows br-int -O OpenFlow13 table=0 OFPST_FLOW reply (OF1.3) (xid=0x2): cookie=0x990756dc81846819, duration=1848.233s, table=0, n_packets=0, n_bytes=0, priority=10,arp,in_port=4 actions=resubmit(,24) cookie=0x990756dc81846819, duration=1833.939s, table=0, n_packets=0, n_bytes=0, priority=10,arp,in_port=6 actions=resubmit(,24) cookie=0x990756dc81846819, duration=1811.307s, table=0, n_packets=29, n_bytes=1218, priority=10,arp,in_port=8 actions=resubmit(,24) cookie=0x990756dc81846819, duration=1850.150s, table=0, n_packets=12, n_bytes=504, priority=10,arp,in_port=3 actions=resubmit(,24) cookie=0x990756dc81846819, duration=1837.405s, table=0, n_packets=11, n_bytes=462, priority=10,arp,in_port=5 actions=resubmit(,24) cookie=0x990756dc81846819, duration=1825.399s, table=0, n_packets=26, n_bytes=1092, priority=10,arp,in_port=7 actions=resubmit(,24) cookie=0x990756dc81846819, duration=4244.694s, table=0, n_packets=329, n_bytes=35178, priority=0 actions=NORMAL cookie=0x990756dc81846819, duration=4244.276s, table=0, n_packets=0, n_bytes=0, priority=20,mpls actions=resubmit(,10) cookie=0x990756dc81846819, duration=1850.182s, table=0, n_packets=21, n_bytes=2282, priority=9,in_port=3 actions=resubmit(,25) cookie=0x990756dc81846819, duration=1848.328s, table=0, n_packets=3, n_bytes=230, priority=9,in_port=4 actions=resubmit(,25) cookie=0x990756dc81846819, duration=1837.480s, table=0, n_packets=21, n_bytes=2282, priority=9,in_port=5 actions=resubmit(,25) cookie=0x990756dc81846819, duration=1834.008s, table=0, n_packets=2, n_bytes=140, priority=9,in_port=6 actions=resubmit(,25) cookie=0x990756dc81846819, duration=1825.467s, table=0, n_packets=27, n_bytes=2870, priority=9,in_port=7 actions=resubmit(,25) cookie=0x990756dc81846819, duration=1811.437s, table=0, n_packets=179, n_bytes=24558, priority=9,in_port=8 actions=resubmit(,25) cookie=0x990756dc81846819, duration=1850.166s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=3,icmp_type=136 actions=resubmit(,24) cookie=0x990756dc81846819, duration=1848.266s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=4,icmp_type=136 actions=resubmit(,24) cookie=0x990756dc81846819, duration=1837.433s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=5,icmp_type=136 actions=resubmit(,24) cookie=0x990756dc81846819, duration=1825.436s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=7,icmp_type=136 actions=resubmit(,24) cookie=0x990756dc81846819, duration=1833.966s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=6,icmp_type=136 actions=resubmit(,24) cookie=0x990756dc81846819, duration=1811.353s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=8,icmp_type=136 actions=resubmit(,24) cookie=0x990756dc81846819, duration=592.988s, table=0, n_packets=305, n_bytes=29890, priority=30,icmp,in_port=8,nw_src=55.55.55.0/24,nw_dst= 55.55.55.0/24 actions=group:1 cookie=0x990756dc81846819, duration=592.835s, table=0, n_packets=0, n_bytes=0, priority=30,icmp,in_port=4,nw_src=55.55.55.0/24,nw_dst= 55.55.55.0/24 actions=group:2 cookie=0x990756dc81846819, duration=592.750s, table=0, n_packets=0, n_bytes=0, priority=30,icmp,in_port=6,nw_src=55.55.55.0/24,nw_dst= 55.55.55.0/24 actions=NORMAL [2] sudo ovs-ofctl dump-flows br-int -O OpenFlow13 table=5 OFPST_FLOW reply (OF1.3) (xid=0x2): cookie=0x990756dc81846819, duration=660.337s, table=5, n_packets=0, n_bytes=0, priority=1,ip,dl_dst=fa:16:3e:ee:ac:9a,nw_src=55.55.55.0/24 actions=push_mpls:0x8847,set_field:65791->mpls_label,set_mpls_ttl(255),push_vlan:0x8100,set_field:4097->vlan_vid,resubmit(,10) cookie=0x990756dc81846819, duration=660.104s, table=5, n_packets=0, n_bytes=0, priority=1,ip,dl_dst=fa:16:3e:9b:2b:91,nw_src=55.55.55.0/24 actions=push_mpls:0x8847,set_field:65790->mpls_label,set_mpls_ttl(254),push_vlan:0x8100,set_field:4097->vlan_vid,resubmit(,10) cookie=0x990756dc81846819, duration=660.325s, table=5, n_packets=0, n_bytes=0, priority=0,dl_dst=fa:16:3e:ee:ac:9a
Re: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Alioune, tcpdump in SF ingress / egress tap interfaces will show packets flows . I guess the packet not going through SFs . You may check flow_rules packet counter and actions field (actions=drop) on br_int to find where the packet actually get dropping . Please make sure you disabled security groups on SF attached ports : neutron port-update --no-security-groups neutron port-update --port-security-enabled=False Thanks., Mohankumar.N On Wed, Aug 17, 2016 at 6:01 PM, Aliounewrote: > Hi all, > I've solved the error. > In fact I did not create a router attached to the tenant subnet and > according to neutron logs that was the first exception raised while > creating port-chain. > Now the port-chain has been created and some flows entries have been > pushed in br-int. I think I could be interesting to update the wiki. > > When running a ping from the source to the dst, I can see ICMP (request > and reply) packets from the Tap interface of the source but I can not see > them in the Taps of SFs. > Is there a way to display packets (with wireshark or tcpdump ) going > inbout and outbount of the SFs ? > > Regards, > > On 16 August 2016 at 16:06, Mohan Kumar wrote: > >> Hi Alioune, >> >> Could you share neutron log as well ? also let us know your sfc code >> base., If possible shall we have quick chat on this in neutron IRC channel ? >> >> Thanks., >> Mohankumar.N >> >> On Mon, Aug 15, 2016 at 5:09 PM, Alioune wrote: >> >>> Hi all, >>> I'm trying to launch Openstack SFC as explained in[1] by creating 2 SFs, >>> 1 Web Server (DST) and the DHCP namespace as the SRC. >>> I've installed OVS (Open vSwitch) 2.3.90 with Linux kernel 3.13.0-62 and >>> the neutron L2-agent runs correctly. >>> I followed the process by creating classifier, port pairs and port_group >>> but I got a wrong message "delete_port_chain failed." when creating >>> port_chain [2] >>> I tried to create the neutron ports with and without the option >>> "--no-security-groups" then tcpdpump on SFs tap interfaces but the ICMP >>> packets don't go through the SFs. >>> >>> Can anyone advice to fix? that ? >>> What's your channel on IRC ? >>> >>> Regards, >>> >>> >>> [1] https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining >>> [2] >>> vagrant@ubuntu:~/openstack_sfc$ ./08-os_create_port_chain.sh >>> delete_port_chain failed. >>> vagrant@ubuntu:~/openstack_sfc$ cat 08-os_create_port_chain.sh >>> #!/bin/bash >>> >>> neutron port-chain-create --port-pair-group PG1 --port-pair-group PG2 >>> --flow-classifier FC1 PC1 >>> >>> [3] Output OVS Flows >>> >>> vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-tun -O OpenFlow13 >>> OFPST_FLOW reply (OF1.3) (xid=0x2): >>> cookie=0xbc2e9105125301dc, duration=9615.385s, table=0, n_packets=146, >>> n_bytes=11534, priority=1,in_port=1 actions=resubmit(,2) >>> cookie=0xbc2e9105125301dc, duration=9615.382s, table=0, n_packets=0, >>> n_bytes=0, priority=0 actions=drop >>> cookie=0xbc2e9105125301dc, duration=9615.382s, table=2, n_packets=5, >>> n_bytes=490, priority=0,dl_dst=00:00:00:00:00:00/01:00:00:00:00:00 >>> actions=resubmit(,20) >>> cookie=0xbc2e9105125301dc, duration=9615.381s, table=2, n_packets=141, >>> n_bytes=11044, priority=0,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 >>> actions=resubmit(,22) >>> cookie=0xbc2e9105125301dc, duration=9615.380s, table=3, n_packets=0, >>> n_bytes=0, priority=0 actions=drop >>> cookie=0xbc2e9105125301dc, duration=9615.380s, table=4, n_packets=0, >>> n_bytes=0, priority=0 actions=drop >>> cookie=0xbc2e9105125301dc, duration=8617.106s, table=4, n_packets=0, >>> n_bytes=0, priority=1,tun_id=0x40e actions=push_vlan:0x8100,set_f >>> ield:4097->vlan_vid,resubmit(,10) >>> cookie=0xbc2e9105125301dc, duration=9615.379s, table=6, n_packets=0, >>> n_bytes=0, priority=0 actions=drop >>> cookie=0xbc2e9105125301dc, duration=9615.379s, table=10, n_packets=0, >>> n_bytes=0, priority=1 actions=learn(table=20,hard_ti >>> meout=300,priority=1,cookie=0xbc2e9105125301dc,NXM_OF_VLAN_T >>> CI[0..11],NXM_OF_ETH_DST[]=NXM_OF_ETH_SRC[],load:0->NXM_OF_ >>> VLAN_TCI[],load:NXM_NX_TUN_ID[]->NXM_NX_TUN_ID[],output:NXM_ >>> OF_IN_PORT[]),output:1 >>> cookie=0xbc2e9105125301dc, duration=9615.378s, table=20, n_packets=5, >>> n_bytes=490, priority=0 actions=resubmit(,22) >>> cookie=0xbc2e9105125301dc, duration=9615.342s, table=22, n_packets=146, >>> n_bytes=11534, priority=0 actions=drop >>> vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-int -O OpenFlow13 >>> OFPST_FLOW reply (OF1.3) (xid=0x2): >>> cookie=0xbc2e9105125301dc, duration=6712.090s, table=0, n_packets=0, >>> n_bytes=0, priority=10,icmp6,in_port=7,icmp_type=136 >>> actions=resubmit(,24) >>> cookie=0xbc2e9105125301dc, duration=6709.623s, table=0, n_packets=0, >>> n_bytes=0, priority=10,icmp6,in_port=8,icmp_type=136 >>> actions=resubmit(,24) >>> cookie=0xbc2e9105125301dc, duration=6555.755s, table=0, n_packets=0, >>> n_bytes=0,
Re: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Hi all, I've solved the error. In fact I did not create a router attached to the tenant subnet and according to neutron logs that was the first exception raised while creating port-chain. Now the port-chain has been created and some flows entries have been pushed in br-int. I think I could be interesting to update the wiki. When running a ping from the source to the dst, I can see ICMP (request and reply) packets from the Tap interface of the source but I can not see them in the Taps of SFs. Is there a way to display packets (with wireshark or tcpdump ) going inbout and outbount of the SFs ? Regards, On 16 August 2016 at 16:06, Mohan Kumarwrote: > Hi Alioune, > > Could you share neutron log as well ? also let us know your sfc code > base., If possible shall we have quick chat on this in neutron IRC channel ? > > Thanks., > Mohankumar.N > > On Mon, Aug 15, 2016 at 5:09 PM, Alioune wrote: > >> Hi all, >> I'm trying to launch Openstack SFC as explained in[1] by creating 2 SFs, >> 1 Web Server (DST) and the DHCP namespace as the SRC. >> I've installed OVS (Open vSwitch) 2.3.90 with Linux kernel 3.13.0-62 and >> the neutron L2-agent runs correctly. >> I followed the process by creating classifier, port pairs and port_group >> but I got a wrong message "delete_port_chain failed." when creating >> port_chain [2] >> I tried to create the neutron ports with and without the option >> "--no-security-groups" then tcpdpump on SFs tap interfaces but the ICMP >> packets don't go through the SFs. >> >> Can anyone advice to fix? that ? >> What's your channel on IRC ? >> >> Regards, >> >> >> [1] https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining >> [2] >> vagrant@ubuntu:~/openstack_sfc$ ./08-os_create_port_chain.sh >> delete_port_chain failed. >> vagrant@ubuntu:~/openstack_sfc$ cat 08-os_create_port_chain.sh >> #!/bin/bash >> >> neutron port-chain-create --port-pair-group PG1 --port-pair-group PG2 >> --flow-classifier FC1 PC1 >> >> [3] Output OVS Flows >> >> vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-tun -O OpenFlow13 >> OFPST_FLOW reply (OF1.3) (xid=0x2): >> cookie=0xbc2e9105125301dc, duration=9615.385s, table=0, n_packets=146, >> n_bytes=11534, priority=1,in_port=1 actions=resubmit(,2) >> cookie=0xbc2e9105125301dc, duration=9615.382s, table=0, n_packets=0, >> n_bytes=0, priority=0 actions=drop >> cookie=0xbc2e9105125301dc, duration=9615.382s, table=2, n_packets=5, >> n_bytes=490, priority=0,dl_dst=00:00:00:00:00:00/01:00:00:00:00:00 >> actions=resubmit(,20) >> cookie=0xbc2e9105125301dc, duration=9615.381s, table=2, n_packets=141, >> n_bytes=11044, priority=0,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 >> actions=resubmit(,22) >> cookie=0xbc2e9105125301dc, duration=9615.380s, table=3, n_packets=0, >> n_bytes=0, priority=0 actions=drop >> cookie=0xbc2e9105125301dc, duration=9615.380s, table=4, n_packets=0, >> n_bytes=0, priority=0 actions=drop >> cookie=0xbc2e9105125301dc, duration=8617.106s, table=4, n_packets=0, >> n_bytes=0, priority=1,tun_id=0x40e actions=push_vlan:0x8100,set_f >> ield:4097->vlan_vid,resubmit(,10) >> cookie=0xbc2e9105125301dc, duration=9615.379s, table=6, n_packets=0, >> n_bytes=0, priority=0 actions=drop >> cookie=0xbc2e9105125301dc, duration=9615.379s, table=10, n_packets=0, >> n_bytes=0, priority=1 actions=learn(table=20,hard_ti >> meout=300,priority=1,cookie=0xbc2e9105125301dc,NXM_OF_VLAN_ >> TCI[0..11],NXM_OF_ETH_DST[]=NXM_OF_ETH_SRC[],load:0->NXM_ >> OF_VLAN_TCI[],load:NXM_NX_TUN_ID[]->NXM_NX_TUN_ID[],output: >> NXM_OF_IN_PORT[]),output:1 >> cookie=0xbc2e9105125301dc, duration=9615.378s, table=20, n_packets=5, >> n_bytes=490, priority=0 actions=resubmit(,22) >> cookie=0xbc2e9105125301dc, duration=9615.342s, table=22, n_packets=146, >> n_bytes=11534, priority=0 actions=drop >> vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-int -O OpenFlow13 >> OFPST_FLOW reply (OF1.3) (xid=0x2): >> cookie=0xbc2e9105125301dc, duration=6712.090s, table=0, n_packets=0, >> n_bytes=0, priority=10,icmp6,in_port=7,icmp_type=136 >> actions=resubmit(,24) >> cookie=0xbc2e9105125301dc, duration=6709.623s, table=0, n_packets=0, >> n_bytes=0, priority=10,icmp6,in_port=8,icmp_type=136 >> actions=resubmit(,24) >> cookie=0xbc2e9105125301dc, duration=6555.755s, table=0, n_packets=0, >> n_bytes=0, priority=10,icmp6,in_port=10,icmp_type=136 >> actions=resubmit(,24) >> cookie=0xbc2e9105125301dc, duration=6559.596s, table=0, n_packets=0, >> n_bytes=0, priority=10,icmp6,in_port=9,icmp_type=136 >> actions=resubmit(,24) >> cookie=0xbc2e9105125301dc, duration=6461.028s, table=0, n_packets=0, >> n_bytes=0, priority=10,icmp6,in_port=11,icmp_type=136 >> actions=resubmit(,24) >> cookie=0xbc2e9105125301dc, duration=6712.071s, table=0, n_packets=13, >> n_bytes=546, priority=10,arp,in_port=7 actions=resubmit(,24) >> cookie=0xbc2e9105125301dc, duration=6709.602s, table=0, n_packets=0, >> n_bytes=0, priority=10,arp,in_port=8 actions=resubmit(,24) >>
Re: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Hi Alioune, Please find me in IRC * #openstack-neutron *name:* mohankumar* Yes ,the error looks confusing , but logs at "2016-08-16 17:32:35.255 " showing networking_sfc.services.sfc.drivers.ovs.driver function called as *'ingress': None * , Hence the create port_chain at sfc driver manager failed . Please check q-svc log in neutron-log.zip port_chain db record created then sfc driver got failed hence the code attempting to remove db entry but it can't remove due to key constraints . https://github.com/openstack/networking-sfc/blob/33d8014c1ef2d7a83578145f44bc41b1453cb257/networking_sfc/services/sfc/plugin.py#L41-L57 So you getting both errors (from q-svc log) [01;31m2016-08-16 17:32:35.654 TRACE networking_sfc.services.sfc.plugin [01;35m [00mSfcDriverError: create_port_chain failed. 01;31m2016-08-16 17:32:35.976 TRACE networking_sfc.services.sfc.plugin [01;35m [00mSfcDriverError: delete_port_chain failed. we not seen such issue in master / liberty stable branch , please let me know your sfc code base or you did any local code changes ? Thanks., Mohankumar.N On Tue, Aug 16, 2016 at 9:15 PM, Aliounewrote: > Hi Mohan, > > You can find the neutron logs on the attached. > I used the sripts below for the lab. > Please cloud you give the networking-sfc channel and your username ? > Regards, > > cat create_sfc_ports.sh > #!/bin/bash > > neutron port-create --name p1 net1 > neutron port-create --name p2 net1 > neutron port-create --name p3 net1 > neutron port-create --name p4 net1 > > #In part 4: I've added 4 instances in this step. 2 SFs , source and dst > nova boot --flavor m1.tiny --image cirros-0.3.4-x86_64-uec --nic > port-id=$(neutron port-list | grep -w p1 | awk '{print $2}') --nic > port-id=$(neutron port-list | grep -w p2 | awk '{print $2}') vmvx1 > nova boot --flavor m1.tiny --image cirros-0.3.4-x86_64-uec --nic > port-id=$(neutron port-list | grep -w p3 | awk '{print $2}') --nic > port-id=$(neutron port-list | grep -w p4 | awk '{print $2}') vmvx2 > # the source vm has 55.55.55.8 and the dsl 55.55.55.7 > cat create_flow_classifier.sh > > neutron flow-classifier-create \ > --ethertype IPv4 \ > --source-ip-prefix 55.55.55.8/32 \ > --logical-source-port 1b2ec7a7-b6ae-48db-bc5c-76970f0da4fd \ > --destination-ip-prefix 55.55.55.7/32 \ > --protocol icmp FC1 > > cat create_port_pair.sh > > #!/usr/bin/env bash > neutron port-pair-create --ingress=p1 --egress=p2 PP1 > > neutron port-pair-create --ingress=p3 --egress=p4 PP2 > > cat create_port_group.sh > #!/usr/bin/env bash > > neutron port-pair-group-create --port-pair PP1 PG1 > neutron port-pair-group-create --port-pair PP2 PG2 > > cat create_port_chain.sh > #!/bin/bash > > neutron port-chain-create --port-pair-group PG1 --port-pair-group PG2 > --flow-classifier FC1 PC1 > > > > > > > On 16 August 2016 at 16:06, Mohan Kumar wrote: > >> Hi Alioune, >> >> Could you share neutron log as well ? also let us know your sfc code >> base., If possible shall we have quick chat on this in neutron IRC channel ? >> >> Thanks., >> Mohankumar.N >> >> On Mon, Aug 15, 2016 at 5:09 PM, Alioune wrote: >> >>> Hi all, >>> I'm trying to launch Openstack SFC as explained in[1] by creating 2 SFs, >>> 1 Web Server (DST) and the DHCP namespace as the SRC. >>> I've installed OVS (Open vSwitch) 2.3.90 with Linux kernel 3.13.0-62 and >>> the neutron L2-agent runs correctly. >>> I followed the process by creating classifier, port pairs and port_group >>> but I got a wrong message "delete_port_chain failed." when creating >>> port_chain [2] >>> I tried to create the neutron ports with and without the option >>> "--no-security-groups" then tcpdpump on SFs tap interfaces but the ICMP >>> packets don't go through the SFs. >>> >>> Can anyone advice to fix? that ? >>> What's your channel on IRC ? >>> >>> Regards, >>> >>> >>> [1] https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining >>> [2] >>> vagrant@ubuntu:~/openstack_sfc$ ./08-os_create_port_chain.sh >>> delete_port_chain failed. >>> vagrant@ubuntu:~/openstack_sfc$ cat 08-os_create_port_chain.sh >>> #!/bin/bash >>> >>> neutron port-chain-create --port-pair-group PG1 --port-pair-group PG2 >>> --flow-classifier FC1 PC1 >>> >>> [3] Output OVS Flows >>> >>> vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-tun -O OpenFlow13 >>> OFPST_FLOW reply (OF1.3) (xid=0x2): >>> cookie=0xbc2e9105125301dc, duration=9615.385s, table=0, n_packets=146, >>> n_bytes=11534, priority=1,in_port=1 actions=resubmit(,2) >>> cookie=0xbc2e9105125301dc, duration=9615.382s, table=0, n_packets=0, >>> n_bytes=0, priority=0 actions=drop >>> cookie=0xbc2e9105125301dc, duration=9615.382s, table=2, n_packets=5, >>> n_bytes=490, priority=0,dl_dst=00:00:00:00:00:00/01:00:00:00:00:00 >>> actions=resubmit(,20) >>> cookie=0xbc2e9105125301dc, duration=9615.381s, table=2, n_packets=141, >>> n_bytes=11044, priority=0,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 >>>
Re: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Hi Alioune, Could you share neutron log as well ? also let us know your sfc code base., If possible shall we have quick chat on this in neutron IRC channel ? Thanks., Mohankumar.N On Mon, Aug 15, 2016 at 5:09 PM, Aliounewrote: > Hi all, > I'm trying to launch Openstack SFC as explained in[1] by creating 2 SFs, 1 > Web Server (DST) and the DHCP namespace as the SRC. > I've installed OVS (Open vSwitch) 2.3.90 with Linux kernel 3.13.0-62 and > the neutron L2-agent runs correctly. > I followed the process by creating classifier, port pairs and port_group > but I got a wrong message "delete_port_chain failed." when creating > port_chain [2] > I tried to create the neutron ports with and without the option > "--no-security-groups" then tcpdpump on SFs tap interfaces but the ICMP > packets don't go through the SFs. > > Can anyone advice to fix? that ? > What's your channel on IRC ? > > Regards, > > > [1] https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining > [2] > vagrant@ubuntu:~/openstack_sfc$ ./08-os_create_port_chain.sh > delete_port_chain failed. > vagrant@ubuntu:~/openstack_sfc$ cat 08-os_create_port_chain.sh > #!/bin/bash > > neutron port-chain-create --port-pair-group PG1 --port-pair-group PG2 > --flow-classifier FC1 PC1 > > [3] Output OVS Flows > > vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-tun -O OpenFlow13 > OFPST_FLOW reply (OF1.3) (xid=0x2): > cookie=0xbc2e9105125301dc, duration=9615.385s, table=0, n_packets=146, > n_bytes=11534, priority=1,in_port=1 actions=resubmit(,2) > cookie=0xbc2e9105125301dc, duration=9615.382s, table=0, n_packets=0, > n_bytes=0, priority=0 actions=drop > cookie=0xbc2e9105125301dc, duration=9615.382s, table=2, n_packets=5, > n_bytes=490, priority=0,dl_dst=00:00:00:00:00:00/01:00:00:00:00:00 > actions=resubmit(,20) > cookie=0xbc2e9105125301dc, duration=9615.381s, table=2, n_packets=141, > n_bytes=11044, priority=0,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 > actions=resubmit(,22) > cookie=0xbc2e9105125301dc, duration=9615.380s, table=3, n_packets=0, > n_bytes=0, priority=0 actions=drop > cookie=0xbc2e9105125301dc, duration=9615.380s, table=4, n_packets=0, > n_bytes=0, priority=0 actions=drop > cookie=0xbc2e9105125301dc, duration=8617.106s, table=4, n_packets=0, > n_bytes=0, priority=1,tun_id=0x40e actions=push_vlan:0x8100,set_ > field:4097->vlan_vid,resubmit(,10) > cookie=0xbc2e9105125301dc, duration=9615.379s, table=6, n_packets=0, > n_bytes=0, priority=0 actions=drop > cookie=0xbc2e9105125301dc, duration=9615.379s, table=10, n_packets=0, > n_bytes=0, priority=1 actions=learn(table=20,hard_ > timeout=300,priority=1,cookie=0xbc2e9105125301dc,NXM_OF_ > VLAN_TCI[0..11],NXM_OF_ETH_DST[]=NXM_OF_ETH_SRC[],load:0- > >NXM_OF_VLAN_TCI[],load:NXM_NX_TUN_ID[]->NXM_NX_TUN_ID[], > output:NXM_OF_IN_PORT[]),output:1 > cookie=0xbc2e9105125301dc, duration=9615.378s, table=20, n_packets=5, > n_bytes=490, priority=0 actions=resubmit(,22) > cookie=0xbc2e9105125301dc, duration=9615.342s, table=22, n_packets=146, > n_bytes=11534, priority=0 actions=drop > vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-int -O OpenFlow13 > OFPST_FLOW reply (OF1.3) (xid=0x2): > cookie=0xbc2e9105125301dc, duration=6712.090s, table=0, n_packets=0, > n_bytes=0, priority=10,icmp6,in_port=7,icmp_type=136 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6709.623s, table=0, n_packets=0, > n_bytes=0, priority=10,icmp6,in_port=8,icmp_type=136 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6555.755s, table=0, n_packets=0, > n_bytes=0, priority=10,icmp6,in_port=10,icmp_type=136 > actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6559.596s, table=0, n_packets=0, > n_bytes=0, priority=10,icmp6,in_port=9,icmp_type=136 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6461.028s, table=0, n_packets=0, > n_bytes=0, priority=10,icmp6,in_port=11,icmp_type=136 > actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6712.071s, table=0, n_packets=13, > n_bytes=546, priority=10,arp,in_port=7 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6709.602s, table=0, n_packets=0, > n_bytes=0, priority=10,arp,in_port=8 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6555.727s, table=0, n_packets=0, > n_bytes=0, priority=10,arp,in_port=10 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6559.574s, table=0, n_packets=12, > n_bytes=504, priority=10,arp,in_port=9 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=6461.005s, table=0, n_packets=15, > n_bytes=630, priority=10,arp,in_port=11 actions=resubmit(,24) > cookie=0xbc2e9105125301dc, duration=9620.388s, table=0, n_packets=514, > n_bytes=49656, priority=0 actions=NORMAL > cookie=0xbc2e9105125301dc, duration=9619.277s, table=0, n_packets=0, > n_bytes=0, priority=20,mpls actions=resubmit(,10) > cookie=0xbc2e9105125301dc, duration=6712.111s, table=0, n_packets=25, > n_bytes=2674, priority=9,in_port=7 actions=resubmit(,25) >
Re: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Hi all, You can see below the debuf logs at the creation of service chain Regards, vagrant@ubuntu:~/openstack_sfc$ neutron --debug port-chain-create --port-pair-group PG1 --port-pair-group PG2 --flow-classifier FC15 PC1 DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://192.168.56.15:35357/v2.0 -H "Accept: application/json" -H "User-Agent: python-keystoneclient" DEBUG: keystoneclient.session RESP: [200] Content-Length: 340 Vary: X-Auth-Token Keep-Alive: timeout=5, max=100 Server: Apache/2.4.7 (Ubuntu) Connection: Keep-Alive Date: Mon, 15 Aug 2016 14:36:00 GMT Content-Type: application/json x-openstack-request-id: req-5efa5391-4c7e-4b5e-81ec-ba2b304bc423 RESP BODY: {"version": {"status": "stable", "updated": "2014-04-17T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v2.0+json"}], "id": "v2.0", "links": [{"href": "http://192.168.56.15:35357/v2.0/;, "rel": "self"}, {"href": "http://docs.openstack.org/;, "type": "text/html", "rel": "describedby"}]}} DEBUG: stevedore.extension found extension EntryPoint.parse('table = cliff.formatters.table:TableFormatter') DEBUG: stevedore.extension found extension EntryPoint.parse('json = cliff.formatters.json_format:JSONFormatter') DEBUG: stevedore.extension found extension EntryPoint.parse('shell = cliff.formatters.shell:ShellFormatter') DEBUG: stevedore.extension found extension EntryPoint.parse('value = cliff.formatters.value:ValueFormatter') DEBUG: stevedore.extension found extension EntryPoint.parse('yaml = cliff.formatters.yaml_format:YAMLFormatter') DEBUG: stevedore.extension found extension EntryPoint.parse('yaml = clifftablib.formatters:YamlFormatter') DEBUG: stevedore.extension found extension EntryPoint.parse('json = clifftablib.formatters:JsonFormatter') DEBUG: stevedore.extension found extension EntryPoint.parse('html = clifftablib.formatters:HtmlFormatter') DEBUG: networking_sfc.cli.port_chain.PortChainCreate get_data(Namespace(chain_parameters=None, columns=[], description=None, flow_classifiers=[u'FC15'], formatter='table', max_width=0, name=u'PC1', noindent=False, port_pair_groups=[u'PG1', u'PG2'], prefix='', request_format='json', tenant_id=None, variables=[])) DEBUG: keystoneclient.auth.identity.v2 Making authentication request to http://192.168.56.15:35357/v2.0/tokens DEBUG: stevedore.extension found extension EntryPoint.parse('port_pair = networking_sfc.cli.port_pair') DEBUG: stevedore.extension found extension EntryPoint.parse('port_pair_group = networking_sfc.cli.port_pair_group') DEBUG: stevedore.extension found extension EntryPoint.parse('flow_classifier = networking_sfc.cli.flow_classifier') DEBUG: stevedore.extension found extension EntryPoint.parse('port_chain = networking_sfc.cli.port_chain') DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://192.168.56.15:9696/v2.0/sfc/port_pair_groups.json?fields=id=PG1 -H "User-Agent: python-neutronclient" -H "Accept: application/json" -H "X-Auth-Token: {SHA1}b64a4351e9ee74a640d7070a3a16db1961215260" DEBUG: keystoneclient.session RESP: [200] Date: Mon, 15 Aug 2016 14:36:01 GMT Connection: keep-alive Content-Type: application/json; charset=UTF-8 Content-Length: 70 X-Openstack-Request-Id: req-63790c14-8c02-4b0d-b44d-185cdbdfbf10 RESP BODY: {"port_pair_groups": [{"id": "128aee07-96b7-45cd-9090-699a60e57bf4"}]} DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://192.168.56.15:9696/v2.0/sfc/port_pair_groups.json?fields=id=PG2 -H "User-Agent: python-neutronclient" -H "Accept: application/json" -H "X-Auth-Token: {SHA1}b64a4351e9ee74a640d7070a3a16db1961215260" DEBUG: keystoneclient.session RESP: [200] Date: Mon, 15 Aug 2016 14:36:01 GMT Connection: keep-alive Content-Type: application/json; charset=UTF-8 Content-Length: 70 X-Openstack-Request-Id: req-186c74b5-c878-4bad-8f51-1a8601612a5b RESP BODY: {"port_pair_groups": [{"id": "d4f47717-2dd0-4c2f-84a2-469802c0c922"}]} DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://192.168.56.15:9696/v2.0/sfc/flow_classifiers.json?fields=id=FC15 -H "User-Agent: python-neutronclient" -H "Accept: application/json" -H "X-Auth-Token: {SHA1}b64a4351e9ee74a640d7070a3a16db1961215260" DEBUG: keystoneclient.session RESP: [200] Date: Mon, 15 Aug 2016 14:36:01 GMT Connection: keep-alive Content-Type: application/json; charset=UTF-8 Content-Length: 70 X-Openstack-Request-Id: req-9cac1849-d9c3-48b3-b20f-cd11948a549c RESP BODY: {"flow_classifiers": [{"id": "020a9ceb-3451-47af-ba09-650202009217"}]} DEBUG: keystoneclient.session REQ: curl -g -i -X POST http://192.168.56.15:9696/v2.0/sfc/port_chains.json -H "User-Agent: python-neutronclient" -H "Content-Type: application/json" -H "Accept: application/json" -H "X-Auth-Token: {SHA1}b64a4351e9ee74a640d7070a3a16db1961215260" -d '{"port_chain": {"flow_classifiers": ["020a9ceb-3451-47af-ba09-650202009217"], "name": "PC1", "port_pair_groups": ["128aee07-96b7-45cd-9090-699a60e57bf4", "d4f47717-2dd0-4c2f-84a2-469802c0c922"]}}' DEBUG: keystoneclient.session RESP:
[openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Please use the following configuration devstack: stable/mitakanetworking-sfc: masterLinux kerenl: 3.19.8 (if you have a multi-node setup).OVS: 2.4+ Weekly IRC meeting information is atMeetings/ServiceFunctionChainingMeeting - OpenStack | | | | || | | | | | Meetings/ServiceFunctionChainingMeeting - OpenStack | | | | #openstack-meeting-4 Thanks,Farhad. Date: Mon, 15 Aug 2016 13:39:05 +0200 From: Alioune <baliou...@gmail.com> To: "OpenStack Development Mailing List (not for usage questions)" <openstack-dev@lists.openstack.org> Subject: [openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC Message-ID: <calvly2dkp770z_u3p+b8ddsg9_rtgpgf_c6eijv5dopkurz...@mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hi all, I'm trying to launch Openstack SFC as explained in[1] by creating 2 SFs, 1 Web Server (DST) and the DHCP namespace as the SRC. I've installed OVS (Open vSwitch) 2.3.90 with Linux kernel 3.13.0-62 and the neutron L2-agent runs correctly. I followed the process by creating classifier, port pairs and port_group but I got a wrong message "delete_port_chain failed." when creating port_chain [2] I tried to create the neutron ports with and without the option "--no-security-groups" then tcpdpump on SFs tap interfaces but the ICMP packets don't go through the SFs. Can anyone advice to fix? that ? What's your channel on IRC ? Regards, __ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
[openstack-dev] [neutron][networking-sfc] Unable to create openstack SFC
Hi all, I'm trying to launch Openstack SFC as explained in[1] by creating 2 SFs, 1 Web Server (DST) and the DHCP namespace as the SRC. I've installed OVS (Open vSwitch) 2.3.90 with Linux kernel 3.13.0-62 and the neutron L2-agent runs correctly. I followed the process by creating classifier, port pairs and port_group but I got a wrong message "delete_port_chain failed." when creating port_chain [2] I tried to create the neutron ports with and without the option "--no-security-groups" then tcpdpump on SFs tap interfaces but the ICMP packets don't go through the SFs. Can anyone advice to fix? that ? What's your channel on IRC ? Regards, [1] https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining [2] vagrant@ubuntu:~/openstack_sfc$ ./08-os_create_port_chain.sh delete_port_chain failed. vagrant@ubuntu:~/openstack_sfc$ cat 08-os_create_port_chain.sh #!/bin/bash neutron port-chain-create --port-pair-group PG1 --port-pair-group PG2 --flow-classifier FC1 PC1 [3] Output OVS Flows vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-tun -O OpenFlow13 OFPST_FLOW reply (OF1.3) (xid=0x2): cookie=0xbc2e9105125301dc, duration=9615.385s, table=0, n_packets=146, n_bytes=11534, priority=1,in_port=1 actions=resubmit(,2) cookie=0xbc2e9105125301dc, duration=9615.382s, table=0, n_packets=0, n_bytes=0, priority=0 actions=drop cookie=0xbc2e9105125301dc, duration=9615.382s, table=2, n_packets=5, n_bytes=490, priority=0,dl_dst=00:00:00:00:00:00/01:00:00:00:00:00 actions=resubmit(,20) cookie=0xbc2e9105125301dc, duration=9615.381s, table=2, n_packets=141, n_bytes=11044, priority=0,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 actions=resubmit(,22) cookie=0xbc2e9105125301dc, duration=9615.380s, table=3, n_packets=0, n_bytes=0, priority=0 actions=drop cookie=0xbc2e9105125301dc, duration=9615.380s, table=4, n_packets=0, n_bytes=0, priority=0 actions=drop cookie=0xbc2e9105125301dc, duration=8617.106s, table=4, n_packets=0, n_bytes=0, priority=1,tun_id=0x40e actions=push_vlan:0x8100,set_field:4097->vlan_vid,resubmit(,10) cookie=0xbc2e9105125301dc, duration=9615.379s, table=6, n_packets=0, n_bytes=0, priority=0 actions=drop cookie=0xbc2e9105125301dc, duration=9615.379s, table=10, n_packets=0, n_bytes=0, priority=1 actions=learn(table=20,hard_timeout=300,priority=1,cookie=0xbc2e9105125301dc,NXM_OF_VLAN_TCI[0..11],NXM_OF_ETH_DST[]=NXM_OF_ETH_SRC[],load:0->NXM_OF_VLAN_TCI[],load:NXM_NX_TUN_ID[]->NXM_NX_TUN_ID[],output:NXM_OF_IN_PORT[]),output:1 cookie=0xbc2e9105125301dc, duration=9615.378s, table=20, n_packets=5, n_bytes=490, priority=0 actions=resubmit(,22) cookie=0xbc2e9105125301dc, duration=9615.342s, table=22, n_packets=146, n_bytes=11534, priority=0 actions=drop vagrant@ubuntu:~$ sudo ovs-ofctl dump-flows br-int -O OpenFlow13 OFPST_FLOW reply (OF1.3) (xid=0x2): cookie=0xbc2e9105125301dc, duration=6712.090s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=7,icmp_type=136 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6709.623s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=8,icmp_type=136 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6555.755s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=10,icmp_type=136 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6559.596s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=9,icmp_type=136 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6461.028s, table=0, n_packets=0, n_bytes=0, priority=10,icmp6,in_port=11,icmp_type=136 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6712.071s, table=0, n_packets=13, n_bytes=546, priority=10,arp,in_port=7 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6709.602s, table=0, n_packets=0, n_bytes=0, priority=10,arp,in_port=8 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6555.727s, table=0, n_packets=0, n_bytes=0, priority=10,arp,in_port=10 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6559.574s, table=0, n_packets=12, n_bytes=504, priority=10,arp,in_port=9 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=6461.005s, table=0, n_packets=15, n_bytes=630, priority=10,arp,in_port=11 actions=resubmit(,24) cookie=0xbc2e9105125301dc, duration=9620.388s, table=0, n_packets=514, n_bytes=49656, priority=0 actions=NORMAL cookie=0xbc2e9105125301dc, duration=9619.277s, table=0, n_packets=0, n_bytes=0, priority=20,mpls actions=resubmit(,10) cookie=0xbc2e9105125301dc, duration=6712.111s, table=0, n_packets=25, n_bytes=2674, priority=9,in_port=7 actions=resubmit(,25) cookie=0xbc2e9105125301dc, duration=6559.621s, table=0, n_packets=24, n_bytes=2576, priority=9,in_port=9 actions=resubmit(,25) cookie=0xbc2e9105125301dc, duration=6555.777s, table=0, n_packets=2, n_bytes=140, priority=9,in_port=10 actions=resubmit(,25) cookie=0xbc2e9105125301dc, duration=6461.082s, table=0, n_packets=47, n_bytes=4830, priority=9,in_port=11 actions=resubmit(,25) cookie=0xbc2e9105125301dc, duration=6709.646s, table=0, n_packets=3,