I'm marking this bug as incomplete for MAAS, since it's not clear what
actually needs to be fixed in MAAS. It seems like this needs to be fixed
at a lower level.
** Changed in: maas
Status: New => Incomplete
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to isc-dhcp in Ubuntu.
https://bugs.launchpad.net/bugs/1677668
Title:
no GARPs during ephemeral boot
Status in MAAS:
Incomplete
Status in cloud-init package in Ubuntu:
Incomplete
Status in isc-dhcp package in Ubuntu:
Confirmed
Bug description:
Deploys time out with an error on the console that says,
"Can not apply stage final, no datasource found! Likely bad things to
come!"
How to duplicate:
MAAS Version 2.1.3+bzr5573-0ubuntu1 (16.04.1)
1) Rack Controller and Region Controller in different VLANs
2) Use Cisco ASA as the router with "ARP Inspection" enabled
3) Clear the router ARP cache
4) Deploy 2 maas machines with interfaces set to "Static assign"
5) Observe deploys successfully
6) Release both machines and swap IP's.
7) Redeploy the same 2 machines
8) Observe deploy failure with the machine consoles stuck in the "ubuntu
login" screen with "Can not apply stage final, no datasource Found! Likely bad
things to come!"
The root cause is that during ephemeral PXE booting, no GARPs are sent, which
in our environment will cause our router (Cisco ASA) to hold on to ARP table
entries until it expires (default= 4 hours). Then combined with ASA feature
"ARP Inspection" will drop packets from a MaaS machine using the previously
used IP from a different MaaS machine.
The ephemeral boot image ephemeral-ubuntu-amd64-ga-16.04-xenial-daily.
Running tcpdump on the Rack Controller, showed no GARPs from the
deploying MaaS machine. If there were GARPs sent, then the router
would refresh its ARP cache thus avoiding the ARP Inspection dropping.
[Excerpt from Cisco ASA]
http://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/cli/general/asa-94-general-config/basic-arp-mac.pdf
When you enable ARP inspection, the ASA compares the MAC address, IP address,
and source interface in
all ARP packets to static entries in the ARP table, and takes the following
actions:
• If the IP address, MAC address, and source interface match an ARP entry,
the packet is passed through.
• If there is a mismatch between the MAC address, the IP address, or the
interface, then the ASA drops
the packet.
• If the ARP packet does not match any entries in the static ARP table, then
you can set the ASA to either
forward the packet out all interfaces (flood), or to drop the packet.
To manage notifications about this bug go to:
https://bugs.launchpad.net/maas/+bug/1677668/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
