F5 Agent for OpenStack Neutron Documentation

Transcription

1 F5 Agent for OpenStack Neutron Documentation Release b1 F5 Networks Jul 26, 2017

2

3 Contents 1 Global Routed mode 3 2 L2-adjacent mode 7 3 Device Driver Settings/iControl Driver Settings 15 4 Set up BIG-IP High Availability mode 17 5 version b Downloads 23 7 Guides 25 8 Installation 27 9 Architecture Modes of Operation Configure the F5 Agent for OpenStack Neutron F5 Agent Configuration File Configuration File Examples Unsupported Features Upgrade 47 i

4 ii

5 OpenStack version: Mitaka Contents 1

6 2 Contents

7 CHAPTER 1 Global Routed mode The F5 Agent for OpenStack Neutron L2 segmentation mode settings and L3 segmentation mode settings tell the F5 agent about BIG-IP devices L2 and L3 network configurations. Learn more 1.1 Caveats In global routed mode, the F5 Agent for OpenStack Neutron assumes that all L3 virtual IP addresses are globally routable. This means that all virtual IPs listen on all VLANs accessible to the BIG-IP (in other words, there is no VLAN segmentation). Global routed mode uses the BIG-IP global route domain (0). This precludes the use of overlapping subnets/ip addresses amongst tenants. 1.2 Configuration 1. Edit the F5 Agent Configuration File Use your text editor of choice to edit the F5 Agent Configuration File as appropriate for your environment. vim /etc/neutron/services/f5/f5-openstack-agent.ini 1. Set up the Device driver settings and HA mode. 2. Define the L2- and L3-segmentation settings for Global Routed Mode. 3

8 Table 1.1: Global Routed Mode settings Setting Description global_routed_modeboolean; set to True to make all VIPs and pool members globally routable use_namespaces Boolean; forced to False in global routed mode. f5_snat_mode Boolean; forced to True in global routed mode. Uses automap SNATs to allocate self IP addresses for LBaaS objects. f5_snat_addresses_per_subnet Integer; forced to 0 in global routed mode; the BIG-IP device s local self IP is also the SNAT address. f5_common_external_networks Boolean; when True, the agent adds all external Neutron networks to the global routing table (the BIG-IP /Common partition) and route domain 0. L3 Segmentation Mode Settings Global Routed Mode - No L2 or L3 Segmentation on BIG-IP f5_global_routed_mode = True use_namespaces = False SNAT Mode and SNAT Address Counts f5_snat_mode = True f5_snat_addresses_per_subnet = 0 f5_common_external_networks = True Sample Global Routed Mode configuration file 1.3 Learn more In global routed mode (f5_global_routed_mode=true), the F5 Agent for OpenStack Neutron assumes the following: All LBaaS objects are accessible via global L3 routes. All virtual IPs are routable from clients. All pool members are routable from BIG-IP devices. All required L2 and L3 Network objects (including routes) must exist on your BIG-IP devices before you deploy the F5 agent in OpenStack. 1.4 Use Case Global routed mode is generally used for undercloud BIG-IP hardware deployments. The BIG-IP device resides at the services tier in the external provider network. 4 Chapter 1. Global Routed mode

9 Fig. 1.1: Global routed mode Fig. 1.2: BIG-IP undercloud deployment 1.4. Use Case 5

10 In global routed mode, the F5 agent automatically uses BIG-IP Local Traffic Manager (LTM) secure network address translation (SNAT) automapping. The BIG-IP Local Traffic Manager automatically creates a SNAT pool of existing self IP addresses. For incoming traffic, Local Traffic Manager maps the origin IP address to an IP address from the SNAT pool. This ensures that the server response returns to the client through the BIG-IP system. For server-initiated traffic, Local Traffic Manager maps the server IP address to an IP address from the SNAT pool, effectively hiding the server s actual IP address from clients. Important: Because SNAT automap allocates existing self IP addresses into a SNAT pool, you should create enough self IPs to handle anticipated connection loads before deploying the F5 Agent for OpenStack Neutron in global routed mode Next steps If this is your initial launch, start the F5 agent. If you have updated the configurations for a running F5 agent instance, restart the service: systemctl systemctl start f5-openstack-agent \ CentOS service f5-oslbaasv2-agent start \ Ubuntu See the F5 Integration for OpenStack documentation for more information. 1 In an overcloud deployment, BIG-IP Virtual Edition (VE) may allocate IP addresses automatically. 6 Chapter 1. Global Routed mode

11 CHAPTER 2 L2-adjacent mode L2-adjacent mode (f5_global_routed_mode = False) is the default mode of operation for the F5 Agent for OpenStack Neutron (F5 agent). The F5 agent does not automatically detect any network or BIG-IP configurations. You must provide the appropriate L2/L3 network settings for your BIG-IP device(s) in the L2 segmentation mode and L3 segmentation mode sections of the F5 agent configuration file. Learn more 2.1 Prerequisites You should have VLANs and VxLAN or GRE tunnels configured as appropriate for your environment. If you re using GRE or VxLAN tunnels, you must have a BIG-IP Better or Best license that supports SDN. Warning: Many L3 segmentation mode parameters depend on other configuration parameters. Read the text in the F5 Agent Configuration File carefully before changing these settings to ensure they don t conflict. 2.2 Configuration 1. Edit the F5 Agent Configuration File Use your text editor of choice to edit the F5 Agent Configuration File as appropriate for your environment. vim /etc/neutron/services/f5/f5-openstack-agent.ini See also: Sample Configuration file for GRE Sample Configuration file for VXLAN 1. Set up the Device driver settings and HA mode. 7

12 2. Set up the appropriate L2- and L3-segmentation settings for your deployment Interface and port mapping f5_external_physical_mappings Maps Neutron networks with type VLAN to a specific BIG-IP interface. It follows the format physical_network:interface_name:tagged, where: physical_network is the external provider network (Neutron s provider:physical_network). interface_name is the name of a BIG-IP interface or LAG trunk. tagged is a boolean indicating whether or not the BIG-IP should enforce VLAN tagging. standalone example: f5_external_physical_mappings = default:1.1:true pair or scalen example: f5_external_physical_mappings = default:1.3:true Note: If using pair or scalen on a 3-NIC device, use interface 1.3. Interface 1.1 usually maps to an external VLAN and 1.2 to internal VLANs. vlan_binding_driver Binds tagged VLANs to specific BIG-IP ports. For example, if an LBaaS icontrol endpoint uses tagged VLANs, and you add a VLAN tagged network to a specific BIG-IP device, the facing switch port needs to allow traffic for that VLAN tag through to the correct BIG-IP port. Caution: This setting requires a custom software hook. If you choose to write one, keep the following in mind: A vlan_binding_driver class must reference an icontrol VLANBindingBase subclass. You must provide the methods to bind VLAN tags to ports and prune unused VLAN tags. the path to your custom software hook vlan_binding_driver = f5-openstack-agent.drivers.bigip.vlan_binding.mybindingdriver Tunneling f5_vtep_ f5_vtep_folder: The name of the BIG-IP partition in which the VTEP (VxLAN tunnel endpoint) resides; the default partition is /Common. f5_vtep_selfip_name: The name of the VTEP self IP. Can be a single entry or a comma-separated list (one per BIG-IP device); must be in cidr (h/m) format. The VTEP self IPs must already exist on the BIG-IP device(s). 8 Chapter 2. L2-adjacent mode

13 Device Tunneling (VTEP) selfips f5_vtep_folder = Common f5_vtep_selfip_name = my_vtep Hint: If you re not using GRE or VxLAN tunneling, you can comment these settings out or set both to None. advertised_tunnel_types Tells the F5 agent what type of tunnel(s) connect the BIG-IP device(s) to controller/compute node(s) in OpenStack (GRE or VxLAN). This can be a single entry or comma-separated values. If you are not using tunnels, leave this setting blank. Note: The F5 Agent for OpenStack Neutron creates profiles for all available tunnel types on the BIG-IP device(s) when you start it for the first time. See Neutron to BIG-IP command mapping for more information. Tunnel types If you are using only gre tunnels: advertised_tunnel_types = gre If you are using only vxlan tunnels: advertised_tunnel_types = vxlan If you are using both gre and vxlan tunnel networks: advertised_tunnel_types = gre,vxlan If you are NOT using tunnel networks (vlans only): advertised_tunnel_types = Routing f5_populate_static_arp A boolean indicating whether or not you want to create static arp entries for pool member IP addresses on VxLAN or GRE tunnel networks. The static ARP entry is in addition to the tunnel forwarding database (FDB) entry for the pool member. It helps avoid the need to learn the member s MAC address via flooding. Static ARP population for members on tunnel networks f5_populate_static_arp = True 2.2. Configuration 9

14 l2_population A boolean indicating whether or not the BIG-IP device should use the L2 population service to update FBD tunnel entries. Important: If you re running any other OpenStack tunnel agents, be sure to set all of them up the same way. l2_population = True use_namespaces A boolean indicating whether or not the BIG-IP should use tenant routing tables to route traffic. Set this value to True to allow overlapping subnet IP addresses. use_namespaces = True max_namespaces_per_tenant An integer indicating the maximum number of route domains allowed per tenant. This allows a tenant to have overlapping IP subnets. max_namespaces_per_tenant = 1 f5_route_domain_strictness A boolean indicating whether VIPS and members in different tenants can communicate with each other. Set this value to True to force the BIG-IP to prefer tenant routing tables over the global routing table and provide tenant isolation. f5_route_domain_strictness = False f5_snat_mode A boolean indicating whether or not to use SNATs. f5_snat_addresses_per_subnet An integer indicating the number of self IP addresses the BIG-IP device should add to a SNAT pool for each subnet. 10 Chapter 2. L2-adjacent mode

15 f5_snat_mode = True f5_snat_addresses_per_subnet = 1 f5_common_external_networks A boolean that controls how the BIG-IP device routes traffic on Neutron networks. Set this value to True to use the global routing table for traffic on all Neutron networks with the external router type. f5_common_external_networks = True common_network_ids A name-value pair mapping BIG-IP VLANs to Neutron networks; multiple values can be comma-separated. The first value is the Neutron network ID; the second is the BIG-IP network name. For example, if the Internet VLAN on your BIG-IP device, /Common/external, has the Neutron uuid e2-449e-bb56-ce47cc9d2680, the entry would look like this: Common Networks common_network_ids = e2-449e-bb56-ce47cc9d2680:external You can separate multiple values with commas, as shown below. common_network_ids = e2-449e-bb56-ce47cc9d2680:external,396e06a0-05c7-4a49-8e86-04bb83d14438:vlan1222 l3_binding_driver A software hook that binds L3 addresses to specific ports, allowing communications between Nova guest instances. Important: If you re managing overcloud BIG-IP VE instances, uncomment this line in the F5 Agent Configuration File. l3_binding_driver = f5_openstack_agent.lbaasv2.drivers.bigip.l3_binding. AllowedAddressPairs 2.2. Configuration 11

16 2.2.4 Software-defined networking f5_network_segment_physical_network The name of the network segment where the BIG-IP device resides. f5_network_segment_polling_interval The number of seconds to wait between polling Neutron for a network_id to segmentation_id mapping (default=10). f5_pending_services_timeout The maximum number of seconds to wait for network discovery before a pending service errors out (default=60). Tip: These Hierarchical Port Binding settings allow you to integrate and manage SDN services using F5 LBaaS. If you re not using this feature, comment out all three settings, or set them to None, to avoid errors. Hierarchical Port Binding f5_network_segment_physical_network = <switch_name> Periodically scan for disconected listeners (a.k.a virtual servers). The interval is number of seconds between attempts. f5_network_segment_polling_interval = 10 f5_pending_services_timeout = Learn more Example Use Case Typically, the F5 Agent for OpenStack Neutron manages one (1) or more BIG-IP devices deployed in the services tier of an external provider network. The BIG-IP devices may have direct lines of communication with nodes in the OpenStack cloud (VXLAN or GRE tunnels) or they may connect to the same VLAN subnet(s) as OpenStack nodes. The F5 agent can also manage BIG-IP Virtual Edition (VE) instances deployed over the cloud (or overcloud) using L2-adjacent mode. These VE instances would connect to individual OpenStack nodes via VLANs, as opposed to VXLAN or GRE tunnels. This type of deployment is commonly used as part of a software-defined networking (SDN) solution, such as with Cisco ACI. Important: The F5 agent L2/L3 segmentation mode settings must match the configurations of your existing external network and BIG-IP device(s). 12 Chapter 2. L2-adjacent mode

17 Fig. 2.1: L2-adjacent BIG-IP device cluster 2.4 Next steps If this is your initial launch, start the F5 agent. If you have updated the configurations for a running F5 agent, restart the service: CentOS: systemctl systemctl start f5-openstack-agent Ubuntu service f5-oslbaasv2-agent start See the F5 Integration for OpenStack documentation for more information Next steps 13

18 14 Chapter 2. L2-adjacent mode

19 CHAPTER 3 Device Driver Settings/iControl Driver Settings The Device Driver Settings in the F5 Agent Configuration File provide the means of communication between the F5 Agent for OpenStack Neutron and BIG-IP device(s). Do not change this setting. The icontrol Driver Settings identify the BIG-IP device(s) that you want the F5 agent to manage and record the login information the agent will use to communicate with the BIG-IP(s). If you want to use the F5 Agent for OpenStack Neutron to manage BIG-IP devices from within your OpenStack cloud, you must provide the correct information in this section of the agent config file. The F5 agent can manage a standalone device or a device service cluster. See also: Manage BIG-IP Clusters with F5 LBaaSv2 3.1 Configuration 1. Edit the F5 Agent Configuration File Use your text editor of choice to edit the F5 Agent Configuration File as appropriate for your environment. vim /etc/neutron/services/f5/f5-openstack-agent.ini 1. Enter the icontrol endpoint(s), username, and password for your BIG-IP(s). icontrol_hostname: The IP address(es) of the BIG-IP(s) the agent will manage. If you re using multiple devices, provide a comma-separated list containing the management IP address of each device. icontrol_vcmp_hostname: The IP address(es) of the BIG-IP device(s) used for vcmp icontrol_username: The username of the adminstrative user; must have access to all BIG-IP devices. icontrol_password: The password of the adminstrative user; must have access to all BIG-IP devices. Device Driver - icontrol Driver Setting 15

20 icontrol_hostname = \\ replace with the IP address(es) of your BIG- IP(s) icontrol_vcmp_hostname = icontrol_username = admin icontrol_password = admin 2. Set up the F5 Agent for OpenStack Neutron to use L2-adjacent mode or Global Routed mode. 16 Chapter 3. Device Driver Settings/iControl Driver Settings

21 CHAPTER 4 Set up BIG-IP High Availability mode 4.1 Overview HA, or, high availability, mode refers to high availability of the BIG-IP device(s). The F5 Agent for OpenStack Neutron can configure BIG-IP to operate in standalone, pair, or scalen mode. The F5 agent configures LBaaS objects on HA BIG-IP devices in real time. Learn more 4.2 Caveats If you only have one (1) BIG-IP device deployed, you must use standalone mode. In this context, HA pertains to the BIG-IP device(s), not to the F5 agent. 4.3 Configuration 1. Edit the F5 Agent Configuration File Use your text editor of choice to edit the F5 Agent Configuration File as appropriate for your environment. vim /etc/neutron/services/f5/f5-openstack-agent.ini 1. Set the Device driver settings. 2. Set f5_ha_type as appropriate for your environment. standalone: A single BIG-IP device pair: An active-standby pair of BIG-IP devices scalen: An active device service cluster of 2 to 4 BIG-IP devices 17

22 HA mode f5_ha_type = standalone 3. Set up the F5 Agent for OpenStack Neutron to use L2-adjacent mode or Global Routed mode. 4.4 Learn more Use Case High availability modes provide redundancy, helping to ensure service interruptions don t occur if a device goes down. standalone mode utilizes a single BIG-IP device; here, high availability means that BIG-IP core services are up and running, and VLANs are able to send and receive traffic to and from the device. pair mode requires two (2) BIG-IP devices and provides active-standby operation. When an event occurs that prevents the active BIG-IP device from processing network traffic, the standby device immediately begins processing that traffic so users experience no interruption in service. The standby device takes over the entire traffic load, avoiding a loss in performance. scalen mode requires a device service cluster of two (2) - four (4) BIG-IP devices. Scalen allows you to configure multiple active devices, each of which can fail over to other available active devices (activeactive mode). For example, if two BIG-IP devices are using active-active mode, both devices in the pair actively handling traffic. If an event occurs that prevents one device from processing traffic, that traffic automatically directs to the other active device. Note: When failover occurs on an active-active cluster, a secondary device takes over the peer traffic load in addition to its current load. Depending on device configuration and capabilities, there may be a reduction in performance. 18 Chapter 4. Set up BIG-IP High Availability mode

23 Fig. 4.1: BIG-IP HA pair using active-standby mode 4.4. Learn more 19

24 20 Chapter 4. Set up BIG-IP High Availability mode

25 CHAPTER 5 version b1 The F5 Agent for OpenStack Neutron (f5-openstack-agent) is an OpenStack Neutron plugin agent. It works in conjunction with the F5 Driver for OpenStack LBaaS to manage F5 BIG-IP Local Traffic Manager (LTM) services via the OpenStack Neutron API. See also: For more information about how the F5 agent interacts with the Neutron API and BIG-IP devices, see Architecture. 21

26 22 Chapter 5. version b1

27 CHAPTER 6 Downloads 23

28 24 Chapter 6. Downloads

29 CHAPTER 7 Guides See the F5 Integration for OpenStack user documentation. 25

30 26 Chapter 7. Guides

31 CHAPTER 8 Installation Follow the instructions for your distribution below to install the F5 Agent for OpenStack Neutron on your Neutron controller. Tip: You can use the f5-openstack-ansible project to deploy the F5 agent, F5 Driver for OpenStack LBaaS, and all project dependencies. See Deploy OpenStack Agent and Driver with Ansible for more information. 8.1 Debian 1. Download f5-openstack-agent and its dependencies (f5-icontrol-rest-python and f5-common-python). 2. Install all three (3) packages. curl -L -O download/v9.3.3.b1/python-f5-openstack-agent_9.3.3.b1-1_1404_all.deb curl -L -O download/v2.3.3/python-f5-sdk_ _1404_all.deb curl -L -O releases/download/v1.3.0/python-f5-icontrol-rest_ _1404_all.deb dpkg -i python-f5-icontrol-rest_ _1404_all.deb dpkg -i python-f5-sdk_ _1404_all.deb dpkg -i python-f5-openstack-agent_9.3.3.b1-1_1404_all.deb 8.2 Pip Install the f5-openstack-agent release package from GitHub. pip install git+ 27

32 Tip: to install from HEAD on a specific branch. For example: pip install git RPM 1. Download f5-openstack-agent and its dependencies (f5-icontrol-rest-python and f5-common-python). 2. Install all three (3) packages. curl -L -O download/v2.3.3/f5-sdk el7.noarch.rpm curl -L -O releases/download/v1.3.0/f5-icontrol-rest el7.noarch.rpm curl -L -O download/v9.3.3.b1/f5-openstack-agent b1-1.el7.noarch.rpm rpm -ivh f5-icontrol-rest el7.noarch.rpm f5-sdk el7. noarch.rpm f5-openstack-agent b1-1.el7.noarch.rpm 8.4 Next Steps Install the F5 driver for OpenStack LBaaSv2. Configure the F5 Agent for OpenStack Neutron. 28 Chapter 8. Installation

33 CHAPTER 9 Architecture The F5 Driver for OpenStack LBaaS assigns LBaaS tasks from the Neutron RPC Messaging queue to the F5 Agent for OpenStack Neutron. The F5 agent translates the Neutron LBaaS API calls to icontrol REST API calls and configures the requested objects on the BIG-IP device(s) identified in the F5 Agent Configuration File. When the F5 agent and F5 driver run on your OpenStack Neutron Controller, you can use the standard neutron lbaas commands to manage BIG-IP LTM objects. 2 The table below shows the corresponding icontrol endpoint and BIG-IP object for each neutron lbaas-* create command. Table 9.1: OpenStack Neutron to F5 icontrol REST/BIG-IP command mapping Command URI Configurations Applied neutron Creates new BIG-IP partition; lbaas-loadbalancer-create mgmt/tm/sys/folder/ ~Project_<os_tenant_id> name uses the OpenStack uuid and tenant ID neutron Creates new BIG-IP virtual lbaas-listener-create mgmt/tm/ltm/virtual/ server in the tenant s partition neutron Creates new pool on the virtual lbaas-pool-createmgmt/tm/ltm/pool/ server neutron Creates new pool member on lbaas-member-create mgmt/tm/ltm/pool/ the virtual server ~Project_<os_tenant_id>~pool1/ members/ neutron Creates new health monitor for lbaas-healthmonitor-create mgmt/tm/ltm/monitor/http/ the pool 2 See the Neutron LBaaS documentation 29

34 30 Chapter 9. Architecture

35 CHAPTER 10 Modes of Operation Global Routed Mode L2/L3-Adjacent Mode 31

36 32 Chapter 10. Modes of Operation

37 CHAPTER 11 Configure the F5 Agent for OpenStack Neutron 1. Use your text editor of choice to edit the F5 Agent Configuration File as appropriate for your environment. vim /etc/neutron/services/f5/f5-openstack-agent.ini 1. Start the F5 agent. Once you have configured the F5 agent, you can use the appropriate command(s) for your OS to start or stop the agent service. CentOS systemctl enable f5-openstack-agent systemctl start f5-openstack-agent systemctl stop f5-openstack-agent.service Ubuntu service f5-oslbaasv2-agent start service f5-oslbaasv2-agent stop 33

38 34 Chapter 11. Configure the F5 Agent for OpenStack Neutron

39 CHAPTER 12 F5 Agent Configuration File The F5 Agent Configuration File (/etc/neutron/services/f5/f5-openstack-agent.ini) tells the F5 Agent for OpenStack Neutron about the network architecture and how/where the BIG-IP device(s) fit in. The configuration parameters tell the agent: 1. where to find the BIG-IP device(s) you expect it to manage, and 2. what settings are already applied on the BIG-IP device(s). The latter impacts how the F5 agent configures BIG-IP objects in response to Neutron API calls. Important: Use the appropriate F5 Agent for OpenStack Neutron configuration parameters for your network architecture and existing BIG-IP configurations. The F5 Agent for OpenStack Neutron has two (2) modes of operation: Global routed mode and L2/L3-adjacent mode. The mode you should use depends on where your BIG-IP device(s) reside in the network architecture. Global routed mode use with BIG-IP hardware devices that connect directly to the OpenStack provider network. L2/L3-adjacent mode if your BIG-IP devices or Virtual Edition (VE) instances connect to the provider network via VLANs and/or VXLAN/GRE tunnels. Each section below corresponds to a section of the F5 Agent Configuration File. 35

40 12.1 DEFAULT SETTINGS Parameter Type Description Allowed Values Recommended Value debug booleansets the log level to DEBUG. True, False True periodic_interval integer service_resync_intervate- inger Sets the number of seconds between the agent s attempts to sync its state with Neutron Sets the frequency at which the agent discards its service cache and syncs with the Neutron LBaaS service. Any number of seconds, expressed as an integer Any number of seconds, expressed as an integer Default= ENVIRONMENT SETTINGS Default=500 Parameter string Sets the default prefix applied to all BIG-IP LTM objects in the tenant partition. Any string beginning with an alpha character. Type Description Allowed Values Recommended Value environment_prefix Default=Project 12.3 STATIC AGENT CONFIGURATION SETTINGS Parameter Type Description Allowed Values Recommended Value static_agent_configuration_data keyvalue Defines static agent identification data sent to the single key-value pair N/A Neutron LBaaS plugin; used to identify agent for OR comma-separated pair custom pool-to-agent scheduling. list of key-value pairs 36 Chapter 12. F5 Agent Configuration File

41 12.4 DEVICE SETTINGS Parameter Type Description Allowed Values Recommended Value f5_ha_type string Defines the BIG-IP Default=standalone standalone: device high availability (HA) mode. single BIG-IP device pair: active/standby pair (2 BIG- IP devices) scalen: active/active device cluster (3 or more BIG-IP devices) DEVICE SETTINGS 37

42 38 Chapter 12. F5 Agent Configuration File

43 12.5 L2 SEGMENTATION MODE SETTINGS Parameter Type Description Allowed Values Recommended Value f5_external_physical_mappings string Binds VLANs to string in the Default= default:1.1:true BIG-IP interfaces format physical_network:interface_name:tagged ; tells the agent about the interface s The agent will use VLAN tagging the default mapping settings if you don t define mappings for specific VLANs. Example: ext_net:1.1:true maps the external physical network named ext_net to BIG-IP interface 1.1; tells the agent that 1.1 is a tagged interface. Tagged interfaces accept traffic from multiple VLANs. Untagged interfaces accept traffic from a single VLAN. vlan_binding_driver string Software hook The N/A allowing VLANinterface-port vlan_binding_driver allows you to bind mapping and prune VLAN ids to specific ports. A vlan_binding_driver class must: reference a subclass of VLANBindingBase contain methods that bind and prune VLAN tags to specific ports interface_port_static_mappings JSON dictionary Enabled by vlan_binding_driver; maps BIG-IP devices and interfaces to specific ports f5_vtep_folder string The BIG-IP partition containing the desired VTEP. f5_vtep_selfip_name string The name of the BIG-IP self IP to use as the VTEP. JSON dictionaries N/A mapping BIG-IP devices and interfaces to ports. Follows the format { device_name :{ interface_id : port_id } N/A /Common N/A vtep L2 SEGMENTATION MODE SETTINGS 39 advertised_tunnel_typestring The type of tunnel vxlan, gre vxlan

44 1 See Hierarchical Port Binding. 40 Chapter 12. F5 Agent Configuration File

45 12.6 L3 SEGMENTATION MODE SETTINGS Parameter Type Description Allowed Values Recommended Value f5_global_routed_modeboolean Defines how the TRUE: BIG-IP device(s) FALSE BIG-IP devices connect di- connect to the rectly to the Opennetwork Stack provider network. (L2 routing only) FALSE: BIG-IP devices use VXLAN or GRE tunnels to bridge physical/ virtualized network segments. (L2 & L3 routing; L2- use_namespaces boolean Tells the agent if you re using BIG-IP route domains max_namespaces_per_tenant integer Sets the maximum number of namespaces/route tables the agent can allocate per tenant f5_route_domain_strictness boolean Controls the agent s access to BIG-IP global routing table (route domain 0) Requires use_namespaces=true adjacent mode ) TRUE: you re using BIG-IP route domains to segment tenant network traffic. FALSE: you re not using route domains; tenant networks cannot use overlapping subnets. Any integer, with the caveat that using more than 1 namespace per tenant is NOT a recommended practice. TRUE: the agent can only access BIG-IP tenant route domains; it cannot consult the global routing table. VIPs and members can only communicate if they are in the same tenant. FALSE: the agent can look for a destination route in the global routing table if it can t find a match in the tenant TRUE Forced to FALSE if f5_global_routed_mode = TRUE route domains. VIPs and members can communicate L3 SEGMENTATION MODE SETTINGS across tenants. Set to FALSE to ensure the agent has 41 access to external routes on the Open- 1 FALSE

46 12.7 DEVICE DRIVER/iCONTROL DRIVER SETTINGS Parameter Type Description Allowed Values Recommended Value f5_bigip_lbaas_device_driver string The icontrol device driver DO NOT CHANGE THIS SETTING FROM THE DEFAULT VALUE. icontrol_hostname string The IP address, or DNS-resolvable single or comma-separated list N/A hostname, of your BIG-IP de- vice(s) and/or vcmp guest(s) icontrol_vcmp_hostname string The IP address of your vcmp host single IP address N/A icontrol_username string The username of an account on the The username of an account with permis- N/A BIG-IP device sion to create partitions and create/manage Local Traffic and Network objects icontrol_password string Password for the BIG-IP user account See BIG-IP password requirements. N/A 12.8 CERTIFICATE MANAGER SETTINGS Important: The settings in this section only apply if you are using the OpenStack Barbican service. If you aren t using Barbican, leave this section commented out. Parameter Type Description Allowed Values Recommended Value f5_openstack_agent.lbaasv2.drivers.bigip. barbican_cert.barbicancertmanager auth_version string OpenStack Keystone v2, v3 N/A auth version os_auth_url string Keystone auth URL N/A os_username string OpenStack username N/A os_password string OpenStack password N/A os_user_domain_name string OpenStack user account domain os_project_name string OpenStack project (tenant) name os_project_domain_name string OpenStack project domain cert_manager string the agent BarbicanCertManager driver Default=None N/A N/A N/A 42 Chapter 12. F5 Agent Configuration File

47 CHAPTER 13 Configuration File Examples The example configuration files provided here can help guide you in setting up the F5 Agent for OpenStack Neutron to work with your specific environment. Global routed mode Download global routed mode example L2-adjacent mode Download GRE example Download VLAN example Download VXLAN example 43

48 44 Chapter 13. Configuration File Examples

49 CHAPTER 14 Unsupported Features The items shown in the table below are not supported in the current release. Table 14.1: Unsupported Features in b1 Feature Project Distributed Virtual Router (DVR) Neutron Role Based Access Control (RBAC) Neutron Agent High Availability (HA) 3 F5 OpenStack 3 Similar to BIG-IP high availability, but applies to the F5 agent processes. 45

50 46 Chapter 14. Unsupported Features

51 CHAPTER 15 Upgrade To upgrade to/install a different version of f5-openstack-agent, you ll need to uninstall your current version first. Perform the steps below on every server running F5 agent. Danger: If you use pip install --upgrade to upgrade the F5 LBaaSv2 agent, packages that other OpenStack components use might be negatively impacted. F5 does not recommend using pip install --upgrade to upgrade the f5-openstack-agent package. 1. Copy the F5 agent configuration file to a different directory (for example, ~/f5-upgrade-temp). Warning: Your configuration file (/etc/neutron/services/f5/f5-openstack-agent.ini gets overwritten when you install a new package. If you don t save a copy elsewhere, you will lose your config settings. $ cp /etc/neutron/services/f5/f5-openstack-agent.ini ~/f5-upgrade-temp 2. Move or rename the F5 agent log file. Your new F5 agent will not start if it finds an existing f5-openstack-agent.log file. You can either move the log file to a new location, or rename it. $ mv /var/log/neutron/f5-openstack-agent.log ~/f5-upgrade-temp 3. Stop and remove the current version of the F5 agent. $ sudo service f5-oslbaasv2-agent stop $ pip uninstall f5-openstack-agent Listing 15.1: Debian/Ubuntu 47

52 Listing 15.2: Red Hat/CentOS $ sudo systemctl stop f5-openstack-agent $ sudo systemctl disable f5-openstack-agent $ sudo pip uninstall f5-openstack-agent 4. Follow the installation instructions to install a different version of the F5 agent. 5. Copy your configuration file back into /etc/neutron/services/f5. Tip: It s good practice to compare your saved copy of the configuration file with the new one created during installation. Verify that the only differences between the two are those required for your deployment. If new options appear in the config file, see supported features and configuration parameters for explanations and config instructions. $ cp ~/f5-upgrade-temp/f5-openstack-agent.ini /etc/neutron/services/f5/f5- openstack-agent.ini 48 Chapter 15. Upgrade

53 Index D debian f5-openstack-agent downloads, 21 f5-openstack-agent install, 27 downloads debian, f5-openstack-agent, 21 rpm, f5-openstack-agent, 21 F f5-openstack-agent architecture, 28 BIG-IP HA, 16 BIG-IP High Availability, 16 BIG-IP setup, 13 certificate manager settings, 42 configuration file examples, 42 configure, 31 default settings, 35 device driver settings, 13 device driver/icontrol driver settings, 42 device settings, 36 downloads debian, 21 downloads rpm, 21 environment settings, 36 global routed mode, 1 High Availability; HA, 16 icontrol driver settings, 13 install, 25 install debian, 27 install pip, 27 install rpm, 28 L2 segmentation mode settings, 37 L2-adjacent mode, 6 L3 segmentation mode settings, 40 static agent configuration settings, 36 supported features, 29 unsupported features, 43 upgrade, 45 H High Availability; HA f5-openstack-agent, 16 I install debian, f5-openstack-agent, 27 pip, f5-openstack-agent, 27 rpm, f5-openstack-agent, 28 P pip f5-openstack-agent install, 27 R rpm f5-openstack-agent downloads, 21 f5-openstack-agent install, 28 49