H3C VCF Controller. OpenStack Plug-ins Installation Guide. New H3C Technologies Co., Ltd. Document version: 5W

Transcription

1 H3C VCF Controller OpenStack Plug-ins Installation Guide New H3C Technologies Co., Ltd. Document version: 5W

2 Copyright 2018, New H3C Technologies Co., Ltd. and its licensors All rights reserved No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of New H3C Technologies Co., Ltd. Trademarks Except for the trademarks of New H3C Technologies Co., Ltd., any trademarks that may be mentioned in this document are the property of their respective owners. Notice The information in this document is subject to change without notice. All contents in this document, including statements, information, and recommendations, are believed to be accurate, but they are presented without warranty of any kind, express or implied. H3C shall not be liable for technical or editorial errors or omissions contained herein.

3 Preface This installation guide describes the procedures for installing and removing the VCF OpenStack plug-ins. This preface includes the following topics about the documentation: Audience. Conventions. Documentation feedback. Audience This documentation is intended for: Network planners. Field technical support and servicing engineers. Network administrators working with H3C VCF controllers. Conventions The following information describes the conventions used in the documentation. GUI conventions Convention Boldface > Description Window names, button names, field names, and menu items are in Boldface. For example, the New User window opens; click OK. Multi-level menus are separated by angle brackets. For example, File > Create > Folder. Symbols Convention WARNING! CAUTION: IMPORTANT: NOTE: TIP: Description An alert that calls attention to important information that if not understood or followed can result in personal injury. An alert that calls attention to important information that if not understood or followed can result in data loss, data corruption, or damage to hardware or software. An alert that calls attention to essential information. An alert that contains additional or supplementary information. An alert that provides helpful information. Documentation feedback You can your comments about product documentation to We appreciate your comments.

4 Contents Overview 1 VCF Neutron plug-ins 1 Nova patch 1 Openvswitch-agent patch 1 Preparing for the installation 2 Hardware requirements 2 Software requirements 2 Installing OpenStack plug-ins 3 Installing the Python tools 3 Installing the VCF Neutron plug-ins 3 Prerequisites 3 Installation procedure 4 Verifying the installation 8 Parameters and fields 9 Removing the VCF Neutron plug-ins 14 Upgrading the VCF Neutron plug-ins 15 Installing the Nova patch 15 Prerequisites 15 Installation procedure 15 Verifying the installation 18 Removing the Nova patch 18 Upgrading the Nova patch 19 Installing the openvswitch-agent patch 19 Prerequisites 19 Installation procedure 19 Verifying the installation 19 Removing the openvswitch-agent patch 20 Upgrading the openvswitch-agent patch 20 Configuring the metadata service for network nodes 20 FAQ 22 The Python tools cannot be installed using the apt-get command when a proxy server is used for Internet access. What should I do? 22 Do VCF Neutron plug-ins support HA? 22 i

5 Overview This document describes how to install the virtual converged framework (VCF) Neutron plug-ins, Nova patch, and openvswitch-agent patch that are compatible with OpenStack on Ubuntu. VCF Neutron plug-ins Neutron is a type of OpenStack services used to manage all virtual networking infrastructures (VNIs) in an OpenStack environment. It provides virtual network services to the devices managed by OpenStack computing services. VCF Neutron plug-ins are developed for VCF controller based on the OpenStack framework. VCF Neutron plug-ins can obtain network configuration from OpenStack through REST APIs and synchronize the configuration to the VCF controllers. They can obtain settings for the tenants' networks, subnets, routers, ports, FW, LB, or VPN. Different types of VCF Neutron plug-ins can provide the following features for tenants: VCF Neutron Core plug-in Allows tenants to use basic network communication for cores, including networks, subnets, routers, and ports. VCF Neutron L3_Routing Allows tenants to forward traffic to each other at Layer 3. VCF Neutron FWaaS plug-in Allows tenants to create firewall services. VCF Neutron LBaaS plug-in Allows tenants to create LB services. VCF Neutron VPNaaS plug-in Allows tenants to create VPN services. Nova patch Nova is an OpenStack computing controller that provides virtual services for users. The virtual services include creating, starting up, shutting down, and migrating virtual machines and setting configuration information for the virtual machines, such as CPU and memory information. The Nova patch enables virtual machines created by OpenStack to access networks managed by VCF controllers. Openvswitch-agent patch The open source openvswitch-agent process on an OpenStack compute node might fail to deploy VLAN flow tables to open source vswitches when the following conditions exist: The kernel-based virtual machine (KVM) technology is used on the node. The hierarchical port binding feature is configured on the node. To resolve this problem, you must install the openvswitch-agent patch. 1

6 Preparing for the installation Hardware requirements Table 1 shows the hardware requirements for installing the VCF Neutron plug-ins, Nova patch, or openvswitch-agent patch on a server or virtual machine. Table 1 Hardware requirements CPU Memory size Disk space Single-core and multicore CPUs 2 GB and above 5 GB and above Software requirements Table 2 shows the software requirements for installing the VCF Neutron plug-ins, Nova patch, or openvswitch-agent patch. Table 2 Software requirements Item OpenStack Supported version OpenStack Kilo on Ubuntu OpenStack Liberty on Ubuntu OpenStack Mitaka on Ubuntu OpenStack Ocata on Ubuntu OpenStack Pike on Ubuntu IMPORTANT: Before you install the OpenStack plug-ins, make sure the following requirements are met: Your system has Internet access because the system must first access the Internet to set up the installation environment. Make sure the OpenStack environment is deployed correctly. For example, the /etc/hosts file on all nodes has the host name-ip address mappings. For information about the OpenStack environment deployment, see the installation guide for the specific OpenStack version on the official website. 2

7 Installing OpenStack plug-ins The VCF Neutron plug-ins, Nova patch, and openvswitch-agent patch can be installed on different OpenStack versions. The installation package varies by OpenStack version. However, you can use the same procedure to install the Neutron plug-ins, Nova patch, or openvswitch-agent patch on different OpenStack versions. This document uses OpenStack Kilo as an example. Install the VCF Neutron plug-ins on an OpenStack controller node and install the Nova patch and openvswitch-agent patch on an OpenStack compute node. Before installation, you must install the Python tools on the associated node. Installing the Python tools Before installing the plug-ins, first you must download the Python tools online and install them. To download and install the Python tools: 1. Update the software source list. sudo apt-get update 2. Download and install the Python tools. If the system prompts a confirmation message, enter Y. sdn@ubuntu:~$ sudo apt-get install python-pip python-setuptools Installing the VCF Neutron plug-ins Prerequisites The VCF Neutron plug-ins are included in the VCF OpenStack package. Perform the following steps to download the VCF OpenStack package from the H3C website: 1. In the Web browser address bar, enter Select SDN > H3C Virtual Converged Framework Controller, and download the VCF OpenStack package of the required version. 2. Copy the VCF OpenStack package to the installation directory on the server or virtual machine, or upload it to the installation directory through FTP, TFTP, or SCP. NOTE: If you decide to upload the VCF OpenStack package through FTP or TFTP, use the binary mode to avoid damage to the package. 3

8 Installation procedure CAUTION: The QoS feature will not operate correctly if you configure the database connection in configuration file neutron.conf as follows: [database] connection = mysql:// This is an open source bug in OpenStack. To prevent this problem, configure the database connection as follows: [database] connection = mysql+pymysql:// The three dots ( ) in the command line represents the neutron database link information. Some parameters must be configured with the required values as described in "Parameters and fields." To install the VCF Neutron plug-ins: 1. Change the working directory to where the VCF OpenStack package (an.egg file) is saved, and install the package on the OpenStack controller node. The name of the VCF OpenStack package is VCF_CONTROLLER_PLUGIN-version1_version2-py2.7. version1 represents the version of the package. version2 represents the version of OpenStack. In the following example, the VCF OpenStack package is saved to the path /home/sdn. sdn@ubuntu:~$ cd /home/sdn sdn@ubuntu:~$ sudo easy_install VCF_CONTROLLER_PLUGIN-E2183_kilo_ py2.7.egg 2. Install the VCF Neutron plug-ins. sdn@ubuntu:~$ sudo h3c-vcfplugin controller install Install the neutron plugin modifying: /usr/lib/python2.7/dist-packages/neutron/plugins/ml2/managers.py modify success, backuped at: /usr/lib/python2.7/dist-packages/neutron/plugins/ml2/managers.py.h3c_bak NOTE: The contents below the modifying: line indicate the modified open source Neutron file and the backup path of the file before modification. 3. Modify the neutron.conf configuration file. a. Use the vi editor to open the neutron.conf configuration file. sdn@ubuntu:~$ sudo vi /etc/neutron/neutron.conf b. Press I to switch to the insert mode, and modify the neutron.conf configuration file based on the service version and service type configured in the OpenStack environment. For information about the parameters, see "neutron.conf." For load balancing service V1 (only plug-ins on OpenStack Kilo , Liberty, and Mitaka support this configuration, and plug-ins on OpenStack Ocata and Pike do not support this configuration): [DEFAULT] core_plugin = ml2 4

9 service_plugins = h3c_vcfplugin.l3_router.h3c_l3_router_plugin.h3cl3routerplugin,firewall,lbaas, vpnaas [service_providers] service_provider=firewall:h3c:h3c_vcfplugin.fw.h3c_fwplugin_driver.h3cfwaasdri ver:default service_provider=loadbalancer:h3c:h3c_vcfplugin.lb.h3c_lbplugin_driver.h3clbaa splugindriver:default service_provider=vpn:h3c:h3c_vcfplugin.vpn.h3c_vpnplugin_driver.h3cvpnplugindr iver:default For load balancing service V2 (only plug-ins on OpenStack Kilo , Liberty, Mitaka, and Ocata support this configuration): [DEFAULT] core_plugin = ml2 service_plugins = h3c_vcfplugin.l3_router.h3c_l3_router_plugin.h3cl3routerplugin,firewall,neutro n_lbaas.services.loadbalancer.plugin.loadbalancerpluginv2,vpnaas [service_providers] service_provider=firewall:h3c:h3c_vcfplugin.fw.h3c_fwplugin_driver.h3cfwaasdri ver:default service_provider=loadbalancerv2:h3c:h3c_vcfplugin.lb.h3c_lbplugin_driver_v2.h3 CLbaasv2PluginDriver:default service_provider=vpn:h3c:h3c_vcfplugin.vpn.h3c_vpnplugin_driver.h3cvpnplugindr iver:default For QoS service (only plug-ins on OpenStack Liberty, Mitaka, and Ocata support this configuration): In this example, load balancing V2 service is also configured. You can choose to configure load balancing V1 on demand. Plug-ins on OpenStack Ocata support only load balancing V2. [DEFAULT] core_plugin = ml2 service_plugins = h3c_vcfplugin.l3_router.h3c_l3_router_plugin.h3cl3routerplugin,firewall,neutro n_lbaas.services.loadbalancer.plugin.loadbalancerpluginv2,vpnaas,qos [service_providers] service_provider=firewall:h3c:h3c_vcfplugin.fw.h3c_fwplugin_driver.h3cfwaasdri ver:default service_provider=loadbalancerv2:h3c:h3c_vcfplugin.lb.h3c_lbplugin_driver_v2.h3 CLbaasv2PluginDriver:default service_provider=vpn:h3c:h3c_vcfplugin.vpn.h3c_vpnplugin_driver.h3cvpnplugindr iver:default [qos] notification_drivers = message_queue,qos_h3c For Pike plug-ins: [DEFAULT] core_plugin = ml2 service_plugins = h3c_l3_router,firewall,lbaasv2,vpnaas,qos [service_providers] service_provider=firewall:h3c: networking_h3c.fw.h3c_fwplugin_driver.h3cfwaasdriver:default 5

10 service_provider=loadbalancerv2:h3c: networking_h3c.lb.h3c_lbplugin_driver_v2.h3clbaasv2plugindriver:default service_provider=vpn:h3c: networking_h3c.vpn.h3c_vpnplugin_driver.h3cvpnplugindriver:default c. Press Esc to quit the insert mode, and enter :wq to exit the vi editor and save the neutron.conf file. 4. Modify the ml2_conf.ini configuration file. a. Use the vi editor to open the ml2_conf.ini configuration file. sudo vi /etc/neutron/plugins/ml2/ml2_conf.ini b. Press I to switch to the insert mode, and set the parameters in the ml2_conf.ini configuration file. For information about the parameters, see"ml2_conf.ini." [ml2] type_drivers = vxlan,vlan tenant_network_types = vxlan,vlan mechanism_drivers = ml2_h3c extension_drivers = ml2_extension_h3c,qos [ml2_type_vlan] network_vlan_ranges = physicnet1:1000:2999 [ml2_type_vxlan] vni_ranges = 1:500 c. Press Esc to quit the insert mode, and enter :wq to exit the vi editor and save the ml2_conf.ini file. 5. Modify the local_settings.py configuration file. a. Use the vi editor to open the local_settings.py configuration file. sdn@ubuntu:~$ sudo vi /etc/openstack-dashboard/local_settings.py b. Press I to switch to the insert mode. Set the values for the LB, FW, and VPN fields in the OPENSTACK_NEUTRON_NETWORK parameter to enable the associated configuration pages in OpenStack Web. For information about the fields, see "OPENSTACK_NEUTRON_NETWORK." OPENSTACK_NEUTRON_NETWORK = { 'enable_lb': True, 'enable_firewall': True, 'enable_quotas': True, 'enable_vpn': True, # The profile_support option is used to detect if an external router can be # configured via the dashboard. When using specific plugins the # profile_support can be turned on if needed. 'profile_support': None, #'profile_support': 'cisco', } c. Press Esc to quit the insert mode, and enter :wq to exit the vi editor and save the local_settings.py file. 6. Modify the ml2_conf_h3c.ini or neutron.conf configuration file. a. Use the vi editor to open the ml2_conf_h3c.ini configuration file, and then press I to switch to the insert mode. Skip this step for Pike plug-ins. sdn@ubuntu:~$ sudo vi /etc/neutron/plugins/ml2/ml2_conf_h3c.ini b. Use the vi editor to open the neutron.conf configuration file, and then press I to switch to the insert mode. Press Shift+G to move the cursor the end of the file before modification. Skip this step for Ocata and earlier versions. 6

11 sudo vi /etc/neutron/neutron.conf c. Set the parameters in the configuration file. For information about the parameters, see "ml2_conf_h3c.ini." [VCFCONTROLLER] url = username = sdn password = skyline123 domain = sdn timeout = 1800 retry = 10 vnic_type=ovs hybrid_vnic = True default_tenant_mode = False ip_mac_binding = True denyflow_age =300 white_list = False binddefaultrouter = False auto_create_tenant_to_vcfc = True router_binding_public_vrf = False enable_subnet_dhcp = False dhcp_lease_time = 365 firewall_type = GATEWAY lb_type = GATEWAY resource_mode = NFV auto_delete_tenant_to_vcfc = True auto_create_resource = True nfv_ha = True vds_name = VDS1 enable_metadata = False use_neutron_credential = False enable_security_group = True disable_internal_l3flow_offload = True firewall_force_audit = True enable_l3_router_rpc_notify = False output_json_log = False lb_enable_snat = False empty_rule_action = deny enable_l3_vxlan = False l3_vni_ranges = 10000:10100 vendor_rpc_topic = VENDOR_PLUGIN vsr_descriptor_name = VSR_IRF vlb_descriptor_name = VLB_IRF vfw_descriptor_name = VFW_IRF generate_vrf_based_on_router_name = False hierarchical_port_binding_physicnets = ANY hierarchical_port_binding_physicnets_prefix = physicnet network_force_flat = True directly_external = OFF directly_external_suffix = DMZ 7

12 d. Press Esc to quit the insert mode, and enter :wq to exit the vi editor and save the configuration file. 7. If you have set the white_list parameter to True, perform the following tasks: Delete the username, password, and domain parameters in the ml2_conf_h3c.ini configuration file. Add an authentication-free user to the VCF controller: On the top navigation bar of the VCF controller Web interface, select Controller > System > Authentication. Click Add. Enter the IP address of Neutron server, and specify the role as Admin. Click OK. 8. If you have set the binddefaultrouter parameter to True, perform the following steps: a. On the top navigation bar of the VCF controller Web interface, select vnetwork > vrouter. b. Click Add vrouter. Configure the vrouter name as defaultrouter and the tenant as default, and select Public network VRF. Click OK. 9. If you have set the use_neutron_credential parameter to True, perform the following steps: a. On the top navigation bar of the VCF controller Web interface, select Controller > System > Users. b. Click Add user. Configure the username as neutron and the role as Admin, and set the password to the one that is used with username neutron in OpenStack. Click OK. 10. Restart the neutron-server service. sudo service neutron-server restart neutron-server stop/waiting neutron-server start/running, process Restart the h3c-agent service. sudo service h3c-agent restart h3c-agent stop/waiting h3c-agent start/running, process 4678 Verifying the installation # Verify that the VCF OpenStack package is correctly installed. If the correct software and OpenStack versions are displayed, the package is successfully installed. sdn@ubuntu:~$ sudo pip freeze grep VCF VCF-CONTROLLER-PLUGIN==E2183-kilo # Verify that the neutron-server service is enabled. The service is enabled if its state is running. sdn@ubuntu:~$ sudo service neutron-server status neutron-server start/running, process 1849 # Verify that the h3c-agent service is enabled. The service is enabled if its state is running. sdn@ubuntu:~$ sudo service h3c-agent status h3c-agent start/running, process

13 Parameters and fields This section describes parameters in configuration files and fields included in parameters. neutron.conf Parameter Required value Description core_plugin service_plugins service_provider notification_driver s ml2 h3c_vcfplugin.l3_router.h3c_l3_router _plugin.h3cl3routerplugin,firewall,lb aas,vpnaas FIREWALL:H3C:h3c_vcfplugin.f w.h3c_fwplugin_driver.h3cfwaa sdriver:default LOADBALANCER:H3C:h3c_vcfp lugin.lb.h3c_lbplugin_driver.h3c LbaasPluginDriver:default VPN:H3C:h3c_vcfplugin.vpn.h3c _vpnplugin_driver.h3cvpnplugin Driver:default message_queue,qos_h3c Used for loading the core plug-in ml2 to OpenStack. Used for loading the extension plug-ins to OpenStack. Directory where the extension plug-ins are saved. Name of the QoS notification driver. ml2_conf.ini Parameter Required value Description type_drivers tenant_network_types vxlan,vlan vxlan,vlan Driver type. vxlan must be specified as the first driver type. Type of the networks to which the tenants belong. vxlan must be specified as the first driver type. For intranet, only vxlan is available. For extranet, only vlan is available. mechanism_drivers ml2_h3c Name of the ml2 driver. extension_drivers network_vlan_ranges vni_ranges ml2_extension_h3c,qos N/A N/A Name of the ml2 extension driver. Available names include ml2_extension_h3c and qos. If the QoS feature is not enabled on OpenStack, you do not need to specify the value qos for this field. Plug-ins on OpenStack Kilo do not support the QoS driver. Value range for the VLAN ID of the extranet, for example, physicnet1:1000:2999. Value range for the VXLAN ID of the intranet, for example, 1:500. OPENSTACK_NEUTRON_NETWORK Field enable_lb Description Whether to enable or disable the LB configuration page. 9

14 Field enable_firewall enable_vpn Description Whether to enable or disable the FW configuration page. Whether to enable or disable the VPN configuration page. ml2_conf_h3c.ini Parameter url username password domain timeout retry vnic_type hybrid_vnic ip_mac_binding denyflow_age white_list binddefaultrouter Description HTTPS URL address of the VCF controller, for example, Username for logging in to the VCF controller, for example, sdn. You do not need to configure a username if the use_neutron_credential parameter is set to True. Password for logging in to the VCF controller, for example, skyline123. You do not need to configure a password if the use_neutron_credential parameter is set to True. Name of the domain where the VCF controller resides, for example, sdn. The amount of time that the Neutron server waits for a response from the VCF controller in seconds, for example, 1800 seconds. As a best practice, set the waiting time greater than or equal to 1800 seconds. Maximum times for sending connection requests from the Neutron server to the VCF controller, for example, 10. Type of the virtual NIC that the virtual machine supports: ovs or phy. Plug-ins on OpenStack Kilo support both types of virtual NICs. Plug-ins on OpenStack Liberty and later versions do not support this parameter. Whether to enable or disable the feature of mapping OpenStack VLAN to VCF controller VXLAN. Whether to enable or disable IP-MAC binding. Anti-spoofing flow table aging time for the virtual distributed switch (VDS), an integer in the range of 1 to 3600 seconds, for example, 300 seconds. Whether to enable or disable the authentication-free user feature on OpenStack. Whether to enable or disable the feature of binding networks to the VCF controller default router. 10

15 Parameter Description Plugins on OpenStack Ocata and later versions do not support this parameter. auto_create_tenant_to_vcfc router_binding_public_vrf enable_subnet_dhcp dhcp_lease_time firewall_type lb_type Whether to enable or disable the feature of automatically creating tenants on the VCF controller. Whether to use the public network VRF for creating a vrouter. True Use. False Do not use. Whether to disable or enable DHCP for creating a vsubnet. Valid time for vsubnet IP addresses obtained from the DHCP address pool in days, for example, 365 days. Mode of the firewall created on the VCF controller. GATEWAY Gateway type firewall, which is available only when the value of the resource_mode parameter is set to NFV or NFV_SHARE. CGSR Gateway service type firewall on a context. This type of firewalls are available only when the value of the resource_mode parameter is set to CORE_GATEWAY. Each CGSR type firewall uses an independent context. CGSR_SHARE Gateway service type firewall on a context. This type of firewalls are available only when the value of the resource_mode parameter is set to CORE_GATEWAY. All CGSR_SHARE type firewalls use the same context even if they belong to different tenants. NFV_CGSR Gateway service type firewall on a VNF. This type of firewalls are available only when the value of the resource_mode parameter is set to CORE_GATEWAY. Each NFV_CGSR type firewall uses an independent VNF. Mode of the load balancer created on the VCF controller. SERVICE_CHAIN Service chain type load balancer. This type is available only when the value of the resource_mode parameter is set to NFV or NFV_SHARE. SERVICE_CHAIN load balancers that belong to one tenant use the same VNF. SERVICE_CHAIN load balancers that belong to different tenants use different VNFs. SERVICE_CHAIN_SHARE Service chain type load balancer, which is available only when the value of the resource_mode parameter is set to NFV or NFV_SHARE. All SERVICE_CHAIN_SHARE type load balancers share the same VNF even if they belong to different tenants. GATEWAY Gateway type load balancer. This type is available only when the value of the resource_mode parameter is set to NFV or NFV_SHARE. CGSR Gateway service type load balancer on a context. This type of load balancers are available only when the value of the resource_mode parameter is set to CORE_GATEWAY. CGSR type load balancers that belong to one tenant use the same context. CGSR type load balancers that belong to different tenants use different contexts. CGSR_SHARE Gateway service type load balancer on a context. This type of load balancers are available only when the value of the resource_mode parameter is set to CORE_GATEWAY. All CGSR_SHARE type load balancers use the same context even if they belong to different tenants. 11

16 Parameter resource_mode auto_delete_tenant_to_vcfc auto_create_resource nfv_ha vds_name enable_metadata use_neutron_credential enable_security_group disable_internal_l3flow_offloa d firewall_force_audit Description NFV_CGSR Gateway service type load balancer on a VNF. This type of load balancers are available only when the value of the resource_mode parameter is set to CORE_GATEWAY. NFV_CGSR type load balancers that belong to one tenant use the same VNF. NFV_CGSR type load balancers that belong to different tenants use different VNFs. Type of the resource created on the VCF controller. The available values are as follows: SELF_GATEWAY Independent gateway resource. NFV VNF resource. NFV_SHARE VNF resource, which can be shared by multiple tenants. CORE_GATEWAY Gateway service resource. Whether to enable or disable the feature of automatically removing tenants from the VCF controller. Whether to enable or disable the feature of automatically creating resources. Whether configure the NFV and NFV_SHARE resources to support stack. True Support. False Do not support. Name of the VDS, for example, VDS1. After deleting a VDS and recreating a VDS with the same name, you must perform the following tasks on the controller node for the new VDS to take effect: Reboot the neutron-server service. Reboot the h3c-agent service. Whether to enable or disable metadata for OpenStack. If you enable this feature, you must set the enable_l3_router_rpc_notify parameter to True. Whether to use the OpenStack Neutron username and password to communicate with the VCF controller. True Use. False Do not use. Whether to enable or disable the feature of deploying security group rules to the VCF controller. Whether to enable or disable the gateway to forward traffic inside the Overlay network. True Disable. False Enable. Whether to audit firewall policies synchronized to the VCF controller by OpenStack. The default value is True for the plug-ins on OpenStack Kilo and is False for the plug-ins on OpenStack Liberty and later 12

17 Parameter enable_l3_router_rpc_notify output_json_log lb_enable_snat empty_rule_action enable_l3_vxlan Description versions. True Audits firewall policies synchronized to the VCF controller by OpenStack. The auditing state of the synchronized policies on the controller is True (audited). False Does not audit firewall policies synchronized to the VCF controller by OpenStack. The synchronized policies on the controller retain their previous auditing state. Whether to enable or disable the feature of sending Layer 3 routing events through RPC. Whether to output REST API messages to the OpenStack operating logs in JSON format for communication between the VCF Neutron plugins and VCF controller. Whether to enable or disable Source Network Address Translation (SNAT) for load balancers on the VCF controller. Set the action for security policies that do not contain any ACL rules on the VCF controller. In the current software version, only the deny action is supported. Whether to enable or disable the feature of using Layer 3 VXLAN IDs (L3VNIs) to mark Layer 3 flows between vrouters on the VCF controller. By default, this feature is disabled. l3_vni_ranges Set the value range for the L3VNI, for example, 10000: vendor_rpc_topic vsr_descriptor_name vlb_descriptor_name vfw_descriptor_name RPC topic of the vendor. This parameter is required when the vendor needs to obtain Neutron data from the VCF Neutron plug-ins. The available values are as follows: VENDOR_PLUGIN Default value, which means that the parameter does not take effect. DP_PLUGIN RPC topic of DPtech. The value of this parameter must be negotiated by the vendor and H3C. VNF descriptor name of the VNF virtual gateway resource created on VNF manager 3.0. This parameter is available only when the value of the resource_mode parameter is set to NFV. When you configure this parameter, make sure its value is the same as the VNF descriptor name specified on the VNF manager of the VCF controller. VNF descriptor name of the virtual load balancing resource created on VNF manager 3.0. This parameter is available only when the value of the resource_mode parameter is set to NFV or the value of the lb_type parameter is set to NFV_CGSR. When you configure this parameter, make sure its value is the same as the VNF descriptor name specified on the VNF manager of the VCF controller. VNF descriptor name of the virtual firewall resource created on VNF manager 3.0. This parameter is available only when the value of the resource_mode parameter is set to NFV or the value of the firewall_type parameter is set to NFV_CGSR. When you configure this parameter, make sure its value is the same as the VNF descriptor name specified on the VNF 13

18 Parameter generate_vrf_based_on_rout er_name hierarchical_port_binding_ph ysicnets hierarchical_port_binding_ph ysicnets_prefix network_force_flat directly_external directly_external_suffix Description manager of the VCF controller. Whether to use the vrouter name configured on OpenStack as the VRF name to deploy to the VCF controller. The default value is False. When the parameter is set to True, make sure the vrouter name configured on OpenStack is a string of up to 31 case-sensitive characters that contains only letters and digits. Policy for OpenStack to select a physical VLAN when performing hierarchical port binding. The available values are as follows: ANY Default value, which means any VLAN is selected from all physical VLANs for VLAN ID assignment. PREFIX A VLAN is selected from all physical VLANs matching the specified prefix for VLAN ID assignment. This parameter is supported only on Mitaka and Ocata plug-ins. Prefix for matching physical VLANs. The default value is physicnet. This parameter is available only when you set the value of the hierarchical_port_binding_physicnets parameter to PREFIX. This parameter is supported only on Mitaka and Ocata plug-ins. Whether to enable forcible conversion of an external network to a flat network. The value can only be set to True if the external network is a VXLAN. Whether traffic to the external network is directly forwarded by the gateway. The available values are as follows: ANY Traffic to the external network is directly forwarded by the gateway to the external network. OFF Traffic to the external network is forwarded by the gateway to the firewall and then to the external network. SUFFIX Traffic that matches the vrouter name suffix is forwarded by the gateway to the firewall and then to the external network. vrouter name suffix (DMZ for example). This parameter is available only when you set the value of the directly_external parameter to SUFFIX. Removing the VCF Neutron plug-ins You must remove the VCF Neutron plug-ins before removing the VCF OpenStack package. To remove the VCF Neutron plug-ins: 1. Remove the VCF Neutron plug-ins by using either of the following methods: Enter y to remove the database for the VCF Neutron plug-ins at the same time. As a best practice, remove the configurations for the SERVICE_CHAIN type firewalls, or GATEWAY or SERVICE_CHAIN type load balancers on OpenStack before you remove the plug-ins. Enter n to retain the database. When you install new VCF Neutron plug-ins, the plug-ins automatically read the configuration file from the database. sdn@ubuntu:~$ sudo h3c-vcfplugin controller uninstall Uninstall the neutron plugin whether to drop database tables:(y/n): 2. Remove the VCF OpenStack package. sdn@ubuntu:~$ sudo pip uninstall VCF-CONTROLLER-PLUGIN Uninstalling VCF-CONTROLLER-PLUGIN: /usr/local/lib/python2.7/dist-packages/ VCF_CONTROLLER_PLUGIN-E2183_kilo_ py2.7.egg 14

19 Proceed (y/n)? y Successfully uninstalled VCF-CONTROLLER-PLUGIN-E2183-kilo Upgrading the VCF Neutron plug-ins CAUTION: Services might be interrupted during the VCF Neutron plug-ins upgrade procedure. The default parameter settings for VCF Neutron plug-ins might vary by OpenStack version (Kilo , Liberty, Mitaka, and Ocata). Modify the default parameter settings for VCF Neutron plug-ins when upgrading the OpenStack version to ensure that the plug-ins have the same configurations before and after the upgrade. To upgrade the VCF Neutron plug-ins, you must remove the current version first, and install the new version. For information about installing the VCF Neutron plug-ins, see "Installing the VCF Neutron plug-ins." For information about removing the VCF Neutron plug-ins, see "Removing the VCF Neutron plug-ins." Installing the Nova patch Prerequisites The Nova patch is included in the VCF OpenStack package. Perform the following steps to download the VCF OpenStack package from the H3C website: 1. In the Web browser address bar, enter Select SDN > H3C Virtual Converged Framework Controller, and download the VCF OpenStack package of the required version. 2. Copy the VCF OpenStack package to the installation directory on the server or virtual machine, or upload it to the installation directory through FTP, TFTP, or SCP. NOTE: If you decide to upload the VCF OpenStack package through FTP or TFTP, use the binary mode to avoid damage to the package. Installation procedure Based on your network environment, choose one step between step 3 and step 4. To install the Nova patch: 1. Change the working directory to where the VCF OpenStack package (an.egg file) is saved, and install the package on the OpenStack compute node. The name of the VCF OpenStack package is VCF_CONTROLLER_PLUGIN-version1_version2-py2.7. version1 represents the version of the package. version2 represents the version of OpenStack. In this example, the VCF OpenStack package is saved to the path /home/compute. sdn@ubuntu:~$ cd /home/compute sdn@ubuntu:~$ sudo easy_install VCF_CONTROLLER_PLUGIN-E2183_kilo_ py2.7.egg 2. Install the Nova patch. sdn@ubuntu:~$ sudo h3c-vcfplugin compute install Install the nova patch 15

20 modifying: /usr/lib/python2.7/site-packages/nova/virt/vmwareapi/vmops.py modify success, backuped at: /usr/lib/python2.7/site-packages/nova/virt/vmwareapi/vmops.py.h3c_bak NOTE: The contents below the modifying: line indicate the modified open source Neutron file and the backup path of the file before modification. 3. In a host overlay scenario, modify the nova.conf configuration file as follows. If the hypervisor type of the compute node is KVM (plug-ins on OpenStack Ocata and later versions do not support this hypervisor type), perform the following steps: a. Use the vi editor to open the nova.conf configuration file. sdn@ubuntu:~$ sudo vi /etc/nova/nova.conf b. Press I to switch to the insert mode, and set the parameters in the nova.conf configuration file as follows. For descriptions of the parameters, see Table 3. [s1020v] s1020v = True member_status = True [neutron] ovs_bridge = vds1-br c. Press Esc to quit the insert mode, and enter :wq to exit the vi editor and save the nova.conf file. If the hypervisor type of the compute node is VMware vcenter, perform the following steps: a. Stop the neutron-openvswitch-agent service and disable the system to start the service at startup. sdn@ubuntu:~$ sudo service neutron-openvswitch-agent stop sdn@ubuntu:~$ sudo systemctl disable neutron-openvswitch-agent.service b. Use the vi editor to open the nova.conf configuration file. sdn@ubuntu:~$ sudo vi /etc/nova/nova.conf c. Press I to switch to the insert mode, and set the parameters in the nova.conf configuration file as follows. For descriptions of the parameters, see Table 3. [DEFAULT] compute_driver = vmwareapi.vmwarevcdriver [vmware] host_ip = host_username = sdn host_password = skyline123 cluster_name = vcenter insecure = true [s1020v] s1020v = True vds = VDS2 d. Press Esc to quit the insert mode, and enter :wq to exit the vi editor and save the nova.conf file. 4. In a network overlay scenario, modify the nova.conf configuration file as follows: If the hypervisor type of the compute node is KVM, you do not need to install the Nova patch. If the hypervisor type of the compute node is VMware vcenter, perform the following steps: 16

21 a. Stop the neutron-openvswitch-agent service and disable the system to start the service at startup. sudo service neutron-openvswitch-agent stop sudo systemctl disable neutron-openvswitch-agent.service b. Select vnetwork > Host from the top navigation tree of the VCF controller webpage to identify whether the compute node is online. If the compute node is online, delete the compute node. c. Execute the neutron agent-list command on the controller node to identify whether the database contains the agent of the compute node. If the database contains the agent of the compute node, use the neutron agent-delete id command to delete it. The id argument represents the agent ID of the compute node, for example, 25c3d3ac b505-ed619b741a52. sudo neutron agent-list id agent_type host 25c3d3ac b505-ed619b741a52 Open vswitch agent compute3 sudo neutron agent-delete 25c3d3ac b505-ed619b741a52 Deleted agent: 25c3d3ac b505-ed619b741a52 d. Use the vi editor to open the nova.conf configuration file. sudo vi /etc/nova/nova.conf e. Press I to switch to the insert mode, and set the parameters in the nova.conf configuration file as follows. For descriptions of the parameters, see Table 3. [DEFAULT] compute_driver = vmwareapi.vmwarevcdriver [vmware] host_ip = host_username = sdn host_password = skyline123 cluster_name = vcenter insecure = True [s1020v] s1020v = False vds = VDS2 uplink_teaming_policy = loadbalance_srcid f. Press Esc to quit the insert mode, and enter :wq to exit the vi editor and save the nova.conf file. Table 3 Parameters in the configuration file Parameter s1020v member_status vds Description Whether to use the H3C S1020V vswitch to forward the traffic between vswitches and the traffic between the vswitches and the external network: True Use the H3C S1020V vswitch. False Do not use the H3C S1020V vswitch. Whether to enable or disable the feature of modifying the status of members on OpenStack load balancers. VDS to which the host in the vcenter belongs. In this example, the host belongs to VDS2. In the host overlay networking, you can only 17

22 Parameter ovs_bridge compute_driver Description specify the VDS that the VCF controller synchronizes to the vcenter. In the network overlay networking, you can specify an existing VDS on demand. Name of the bridge for the H3C S1020V vswitch. Make sure the bridges created on all H3C S1020V vswitches use the same name. Name of the driver used by the compute node for virtualization. host_ip IP address used to log in to the vcenter, for example, host_username host_password cluster_name insecure uplink_teaming_policy Username for logging in to the vcenter, for example, sdn. Password for logging in to the vcenter, for example, skyline123. Name of the team in the vcenter environment, for example, vcenter. Whether to enable or disable security check. True Do not perform security check. False Perform security check. This value is not supported in the current software version. Uplink routing policy. loadbalance_srcid Source vport-based routing. loadbalance_ip IP hash-based routing. loadbalance_srcmac Source MAC hash-based routing. loadbalance_loadbased Physical NIC load-based routing. failover_explicit Explicit failover order-based routing. 5. Restart the openstack-nova-compute service. sudo service nova-compute restart Verifying the installation # Verify that the VCF OpenStack package is correctly installed. If the correct software and OpenStack versions are displayed, the package is successfully installed. sdn@ubuntu:~$ sudo pip freeze grep VCF VCF-CONTROLLER-PLUGIN==E2183-kilo # Verify that the openstack-nova-compute service is enabled. The service is enabled if its state is running. sdn@ubuntu:~$ sudo service nova-compute status nova-compute start/running, process 184 Removing the Nova patch You must remove the Nova patch before removing the VCF OpenStack package. To remove the Nova patch: 1. Remove the Nova patch. sdn@ubuntu:~$ sudo h3c-vcfplugin compute uninstall Uninstall the nova patch 2. Remove the VCF OpenStack package. sdn@ubuntu:~$ sudo pip uninstall VCF-CONTROLLER-PLUGIN Uninstalling VCF-CONTROLLER-PLUGIN: 18

23 /usr/local/lib/python2.7/dist-packages/ VCF_CONTROLLER_PLUGIN-E2183-kilo py2.7.egg Proceed (y/n)? y Successfully uninstalled VCF-CONTROLLER-PLUGIN-E2183-kilo Upgrading the Nova patch CAUTION: Services might be interrupted during the Nova patch upgrade procedure. To upgrade the Nova patch, you must remove the current version first, and install the new version. For information about installing the Nova patch, see "Installing the Nova patch." For information about removing the Nova patch, see "Removing the Nova patch." Installing the openvswitch-agent patch Prerequisites The openvswitch-agent patch is included in the VCF OpenStack package. Perform the following steps to download the VCF OpenStack package from the H3C website: 1. In the Web browser address bar, enter Select SDN > H3C Virtual Converged Framework Controller, and download the VCF OpenStack package of the required version. 2. Copy the VCF OpenStack package to the installation directory on the server or virtual machine, or upload it to the installation directory through FTP, TFTP, or SCP. NOTE: If you decide to upload the VCF OpenStack package through FTP or TFTP, use the binary mode to avoid damage to the package. Installation procedure To install the openvswitch-agent patch: 1. Change the working directory to where the VCF OpenStack package (an.egg file) is saved, and install the package on the OpenStack compute node. The name of the VCF OpenStack package is VCF_CONTROLLER_PLUGIN-version1_version2-py2.7. version1 represents the version of the package. version2 represents the version of OpenStack. sdn@ubuntu:~$ cd /home/compute sdn@ubuntu:~$ sudo easy_install VCF_CONTROLLER_PLUGIN-E2183_kilo_ py2.7.egg 2. Install the openvswitch-agent patch. sdn@ubuntu:~$ sudo h3c-vcfplugin openvswitch install 3. Restart the openvswitch-agent service. sdn@ubuntu:~$ sudo service neutron-plugin-openvswitch-agent restart Verifying the installation # Verify that the VCF OpenStack package is correctly installed. If the correct software and OpenStack versions are displayed, the package is successfully installed. 19

24 sudo pip freeze grep VCF VCF-CONTROLLER-PLUGIN===E2183-kilo # Verify that the openvswitch-agent service is enabled. The service is enabled if its state is running. sdn@ubuntu:~$ sudo service neutron-plugin-openvswitch-agent status neutron-plugin-openvswitch-agent start/running, process 184 Removing the openvswitch-agent patch You must remove the openvswitch-agent patch before removing the VCF OpenStack package. To remove the openvswitch-agent patch: 1. Remove the openvswitch-agent patch. sdn@ubuntu:~$ sudo h3c-vcfplugin openvswitch uninstall 2. Remove the VCF OpenStack package. sdn@ubuntu:~$ sudo pip uninstall VCF-CONTROLLER-PLUGIN Uninstalling VCF-CONTROLLER-PLUGIN-E2183-kilo : /usr/bin/h3c-agent /usr/bin/h3c-vcfplugin /usr/lib/python2.7/site-packages/vcf_controller_plugin-e2183_kilo_ py2.7.egg Proceed (y/n)? y Successfully uninstalled VCF-CONTROLLER-PLUGIN-E2183-kilo Upgrading the openvswitch-agent patch CAUTION: Services might be interrupted during the openvswitch-agent patch upgrade procedure. To upgrade the openvswitch-agent patch, you must remove the current version first, and install a new version. For information about installing the openvswitch-agent patch, see "Installing the openvswitch-agent patch." For information about removing the openvswitch-agent patch, see "Removing the openvswitch-agent patch." Configuring the metadata service for network nodes OpenStack supports obtaining metadata from network nodes for VMs through DHCP or L3 gateway. H3C supports only the DHCP method. To configure the metadata service for network nodes: 1. Download the OpenStack installation guide from the OpenStack official website and follow the installation guide to configure the metadata service for the network nodes. 2. Configure the network nodes to provide metadata service through DHCP. a. Use the vi editor to open configuration file dhcp_agent.ini. sdn@ubuntu:~$ sudo vi /etc/neutron/dhcp_agent.ini b. Press I to switch to the insert mode, and modify configuration file dhcp_agent.ini as follows: force_metadata = True 20

25 Set the value to True for the force_metadata parameter to force the network nodes to provide metadata service through DHCP. c. Press Esc to quit the insert mode, and enter :wq to exit the vi editor and save the dhcp_agent.ini configuration file. 21

26 FAQ The Python tools cannot be installed using the apt-get command when a proxy server is used for Internet access. What should I do? Configure HTTP proxy by performing the following steps: 1. Make sure the server or the virtual machine can correctly access the HTTP proxy server. 2. At the CLI of the Ubuntu, use the vi editor to open the apt.conf configuration file. If the apt.conf configuration file does not exist, this step creates the file. sdn@ubuntu:~$ sudo vi /etc/apt/apt.conf 3. Press I to switch to the insert mode, and provide HTTP proxy information as follows: If the server does not require authentication, enter HTTP proxy information in the following format: Acquire:: " If the server requires authentication, enter HTTP proxy information in the following format: Acquire:: " Table 4 describes the arguments in HTTP proxy information. Table 4 Arguments in HTTP proxy information Field username Description Username for logging in to the proxy server, for example, sdn. password Password for logging in to the proxy server, for example, yourproxyaddress IP address of the proxy server, for example, proxyport Port number of the proxy server, for example, Acquire:: " ~ ~ 4. Press Esc to quit the insert mode, and enter :wq to exit the vi editor and save the apt.conf file. Do VCF Neutron plug-ins support HA? VCF Neutron plug-ins mainly run the neutron-server and h3c-agent processes. These two processes support HA only when cooperating with a third-party cluster resource manager such as Pacemaker. As a stateless process, the neutron-server supports two HA modes: active/passive and active/active. Based on the neutron-l3-agent process, the h3c-agent supports only the active/passive HA mode. 22