It seems that this patch, that added proxy ARP support did not make it in:
[ovs-dev] [PATCH] ovn: Support ARP proxy in logical switches
So I thought I might be able to manually create an entry into the MAC
Binding table
# ovn-sbctl find Datapath_Binding external_ids:name=lr_vcn3|grep _uuid
_uuid : db21ed8c-16a5-4afb-aa51-5bbaae5bda29
ovn-sbctl create MAC_Binding
datapath=db21ed8c-16a5-4afb-aa51-5bbaae5bda29
logical_port=lr_vcn3-vcn3_subnet1 ip="192.16.1.106"
mac='"40:44:00:00:00:60"'
But that did not help, it seems that there are further steps needed,
from ovn-sbctl(8)
"Thus, a create command must generally be
accompanied by additional commands within
the same
ovs-vsctl invocation to add a chain of references
to the
newly created record from the top-level
Open_vSwitch
record. The EXAMPLES section gives some
examples that
show how to do this."
unfortunately there is no EXAMPLES section in the man page.
Pretty much out of ideas at this stage. So any pointers would be much
appreciated.
Thanks
On 01/05/2020 19:48, Brendan Doyle wrote:
Hi,
I'm having an issue with proxy ARP
I have a VM ca-rain06-vmovs-3 (192.16.1.6) and I want to use an
unassigned IP (192.16.1.106) in that VM's subnet to "map" to an
underlay IP 253.255.0.33, such that when I ping 192.16.1.106
pkts sent from ca-rain06-vmovs-3 to 192.16.1.106 have the dst IP
192.16.1.106 changed to 253.255.0.33 by a gateway and are sent
onto the underlay by that gateway.
The gateway is lr_vcn3, and it has the following NAT and routes
(253.255.0.1) is the default router in the underlay.
# ovn-nbctl lr-route-list lr_vcn3
IPv4 Routes
192.16.1.106 253.255.0.1 dst-ip
lr_vcn3_gw-ls_external_vcn3
0.0.0.0/0 253.255.0.1 dst-ip
lr_vcn3_gw-ls_external_vcn3
[root@ca-rain01 ~]# ovn-nbctl lr-nat-list lr_vcn3
TYPE EXTERNAL_IP EXTERNAL_PORT
LOGICAL_IP EXTERNAL_MAC LOGICAL_PORT
dnat 253.255.0.33 192.16.1.106
snat 253.255.2.2 192.16.1.6
But what I see is an ARP in the overlay looking for the MAC of
192.16.1.106 and nobody responds. I would have thought that lr_vcn3
would respond as it has a route for 192.16.1.106
I tried adding proxy ARP to no avail on various ports:
ovn-nbctl set Logical_Switch_Port vcn3_subnet1-lr_vcn3
options:arp_proxy=true
ovn-nbctl set Logical_router_port lr_vcn3-vcn3_subnet1
options:arp_proxy=true
ovn-nbctl set Logical_Switch_Port ls_external_vcn3-lr_vcn3_gw
options:arp_proxy=true
ovn-nbctl set Logical_router_port lr_vcn3_gw-ls_external_vcn3
options:arp_proxy=true
I think what I need is an entry in Ingress Table 11 for the vcn3_subnet1
Logical switch port that replies to the ARP request with the router MAC
Here is my setup, and North Bound config
Any thoughts
Thanks
# Setup gateway
#
ovn-nbctl ls-add ls_external_vcn3
ovn-nbctl lsp-add ls_external_vcn3 ln-ls_external_vcn3
ovn-nbctl lsp-set-type ln-ls_external_vcn3 localnet
ovn-nbctl lsp-set-addresses ln-ls_external_vcn3 unknown
ovn-nbctl lsp-set-options ln-ls_external_vcn3 network_name=physnet
# Create a distributed router port (40:44:00:00:10:10 253.255.31.3)
#
ovn-nbctl lrp-add lr_vcn3 lr_vcn3_gw-ls_external_vcn3
40:44:00:00:10:10 253.255.31.3/16
ovn-nbctl lsp-add ls_external_vcn3 ls_external_vcn3-lr_vcn3_gw
ovn-nbctl lsp-set-type ls_external_vcn3-lr_vcn3_gw router
ovn-nbctl lsp-set-addresses ls_external_vcn3-lr_vcn3_gw router
ovn-nbctl lsp-set-options ls_external_vcn3-lr_vcn3_gw
router-port=lr_vcn3_gw-ls_external_vcn3
# Tell the lr_vcn3 to use the underlay default router to get to the world
#
ovn-nbctl lr-route-add lr_vcn3 "0.0.0.0/0" 253.255.0.1
lr_vcn3_gw-ls_external_vcn3
# Add specific route for 192.16.1.106
# We want lr_vcn3 to respond to ARPs for 192.16.1.106
# Then DNAT pkts with dst of 192.16.1.106 to have a dst of 253.255.0.33
#
ovn-nbctl lr-route-add lr_vcn3 "192.16.1.106" 253.255.0.1
lr_vcn3_gw-ls_external_vcn3
# Add NAT rules
#
# SNAT using IP 253.255.2.2 so pkts from with ca-rain06-vmovs-3 src IP
# get an underlay IP of 253.255.2.2
ovn-nbctl lr-nat-add lr_vcn3 snat 253.255.2.2 192.16.1.6
# DNAT using 253.255.0.33
# So pkts sent to 192.16.1.106 get dst replaced with 253.255.0.33
# And pkts received from underlay with dst get dst replaced with
# 253.255.0.33
#
ovn-nbctl lr-nat-add lr_vcn3 dnat 253.255.0.33 192.16.1.106
# Schedule the distributed gateway port
#
ovn-nbctl lrp-set-gateway-chassis lr_vcn3_gw-ls_external_vcn3
ca-rain05 15
ovn-nbctl lrp-set-gateway-chassis lr_vcn3_gw-ls_external_vcn3
ca-rain06 20
ovn-nbctl lrp-set-gateway-chassis lr_vcn3_gw-ls_external_vcn3
ca-rain17 10
# Test
# From overlay VM ca-rain06-vmovs-3 (192.16.1.6)
# ping 192.16.1.106
[ca-rain06-vmovs-3 ~]# ping -c1 192.16.1.106
# tcpdump shows lr_vcn3_gw does not respond to ARP request
# Would have thought it would as it has a route for 192.16.1.106
00:05:05.882784 52:54:00:02:55:96 > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has
192.16.1.106 tell 192.16.1.6, length 28
0x0000: ffff ffff ffff 5254 0002 5596 0806 0001
0x0010: 0800 0604 0001 5254 0002 5596 c010 0106
0x0020: 0000 0000 0000 c010 016a
00:00:01.061217 52:54:00:02:55:96 > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has
192.16.1.106 tell 192.16.1.6, length 28
0x0000: ffff ffff ffff 5254 0002 5596 0806 0001
0x0010: 0800 0604 0001 5254 0002 5596 c010 0106
0x0020: 0000 0000 0000 c010 016a
# My North Bound DB:
switch 6631a7a5-018f-496c-b8d3-af17d5e997ae (ls_external_vcn3)
port ln-ls_external_vcn3
type: localnet
addresses: ["unknown"]
port ls_external_vcn3-lr_vcn3_gw
type: router
router-port: lr_vcn3_gw-ls_external_vcn3
switch 2f8cce6f-b41c-4a90-8785-9f56d808ac14 (ls_vcn3)
port 284195d2-9280-4334-900e-571ecd00327a
addresses: ["52:54:00:02:55:96 192.16.1.6"]
port 269089c4-9464-41ec-9f63-6b3804b34b07
addresses: ["52:54:00:30:38:35 192.16.1.5"]
port vcn3_subnet1-lr_vcn3
type: router
addresses: ["40:44:00:00:00:60"]
router-port: lr_vcn3-vcn3_subnet1
router 36c64fdf-4842-4543-95bc-9bfe731af4d3 (lr_vcn3)
port lr_vcn3-vcn3_subnet1
mac: "40:44:00:00:00:60"
networks: ["192.16.1.1/24"]
port lr_vcn3_gw-ls_external_vcn3
mac: "40:44:00:00:10:10"
networks: ["253.255.31.3/16"]
gateway chassis: [ca-rain06 ca-rain05 ca-rain17]
nat 5e179df6-15c7-403e-99a7-1e453cbc0493
external ip: "253.255.2.2"
logical ip: "192.16.1.6"
type: "snat"
nat e4dab2ac-7be0-4127-818e-d24b71c14f4b
external ip: "253.255.0.33"
logical ip: "192.16.1.106"
type: "dnat"
MAC bindings
--------------
_uuid : d82e70a0-2212-4566-a929-b7cf3c091e8c
datapath : db21ed8c-16a5-4afb-aa51-5bbaae5bda29
ip : "192.16.1.6"
logical_port : lr_vcn3-vcn3_subnet1
mac : "52:54:00:02:55:96"
_uuid : fe33814e-8001-4697-ad7e-087b1f4ed98d
datapath : db21ed8c-16a5-4afb-aa51-5bbaae5bda29
ip : "192.16.1.5"
logical_port : lr_vcn3-vcn3_subnet1
mac : "52:54:00:30:38:35"
_uuid : aa2f0e96-5ec7-452c-8a5f-aaec5d5b6c7c
datapath : db21ed8c-16a5-4afb-aa51-5bbaae5bda29
ip : "::"
logical_port : lr_vcn3-vcn3_subnet1
mac : "00:00:00:00:00:00"
# Try configure proxy ARP - But on what?
#
# vcn3_subnet1-lr_vcn3 - Logical switch port on ls_vcn3 that connects
to Logical Router lr_vcn3
# lr_vcn3-vcn3_subnet1 - Logical router port on lr_vcn3 that connects
to Logical switch ls_vcn3
# ls_external_vcn3-lr_vcn3_gw - LS port on ls_external_vcn3 that
connects to the gateway
# lr_vcn3_gw-ls_external_vcn3 - LR gateway port
#
# No joy - with vcn3_subnet1-lr_vcn3
ovn-nbctl set Logical_Switch_Port vcn3_subnet1-lr_vcn3
options:arp_proxy=true
# No joy - with lr_vcn3-vcn3_subnet1
ovn-nbctl set Logical_router_port lr_vcn3-vcn3_subnet1
options:arp_proxy=true
# No Joy with - ls_external_vcn3-lr_vcn3_gw
ovn-nbctl set Logical_Switch_Port ls_external_vcn3-lr_vcn3_gw
options:arp_proxy=true
# lr_vcn3_gw-ls_external_vcn3
ovn-nbctl set Logical_router_port lr_vcn3_gw-ls_external_vcn3
options:arp_proxy=true
_______________________________________________
discuss mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-discuss
_______________________________________________
discuss mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-discuss
