From: Hui Xiang <[email protected]>
Date: Thursday, July 27, 2017 at 3:18 AM
To: Darrell Ball <[email protected]>
Cc: "[email protected]" <[email protected]>
Subject: Re: [ovs-discuss] OVS-DPDK IP fragmentation require
Blow is the diagram (using OVS-DPDK):
1. For packets coming to vm1 from internet where could have MTU 1500, there
could be including some fragmented packets,
how does the ALC/Security groups handle these fragmented packets? do
nothing and pass it next which may pass the packets
should be dropped or any special handling?
Lets assume the fragments get thru. the physical switch and/or firewall.
Are you using DPDK in GW and using OVS kernel datapath in br-int where you
apply ACL/Security groups policy ?
2. For packets egress from vm1, if all internal physical switch support Jumbo
Frame, that's fine, but if there are some physical swithes
just support 1500/2000 MTU, then fragmented packets generated again. The
ACL/Security groups face problem as item 1 as well.
For packets that reach the physical switches on the way out, then the decision
how to handle them is at the physical switch/router
The packets may be fragmented at this point; depending on the switch; there
will be HW firewall policies to contend with, so depends.
[nline image 1]
On Thu, Jul 27, 2017 at 2:49 PM, Darrell Ball
<[email protected]<mailto:[email protected]>> wrote:
From: Hui Xiang <[email protected]<mailto:[email protected]>>
Date: Wednesday, July 26, 2017 at 9:43 PM
To: Darrell Ball <[email protected]<mailto:[email protected]>>
Cc: "[email protected]<mailto:[email protected]>"
<[email protected]<mailto:[email protected]>>
Subject: Re: [ovs-discuss] OVS-DPDK IP fragmentation require
Thanks Darrell, comment inline.
On Thu, Jul 27, 2017 at 12:08 PM, Darrell Ball
<[email protected]<mailto:[email protected]>> wrote:
From:
<[email protected]<mailto:[email protected]>>
on behalf of Hui Xiang <[email protected]<mailto:[email protected]>>
Date: Wednesday, July 26, 2017 at 7:47 PM
To: "[email protected]<mailto:[email protected]>"
<[email protected]<mailto:[email protected]>>
Subject: [ovs-discuss] OVS-DPDK IP fragmentation require
Hi guys,
Seems OVS-DPDK still missing IP fragmentation support, is there any schedule
to have it?
OVS 2.9
I'm transferring to use OVN, but for those nodes which have external network
connection, they may face this problem,
except to configure Jumbo frames, is there any other workaround?
I am not clear on the situation however.
You mention about configuring jumbo frames which means you can avoid the
fragments by doing this ?
No, I can't guarantee that, only can do it inside OpenStack, it is limited.
If this is true, then this is the best way to proceed since performance will be
better.
What is wrong with jumbo frames ?
It's good but it's limited can't be guaranteed, so I am asking is there any
other way without IP fragmentation so far.
It sounds like you want to avoid IP fragmentation; so far so good.
I am not sure I understand the whole picture though.
Maybe you can describe what you see ?; maybe a simple diagram would help ?
BR.
Hui.
_______________________________________________
discuss mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-discuss
