Seems like a tweak would be to identify virtual IPs as separate to the primary IP on a port:<br> you don't need to permit spoofing of the actual host IP for each host in the HA cluster; you just need to permit spoofing of the virtual IP. This would be safer than disabling the spoofing rules, and avoid configuration errors such as setting the primary IP of one node in the cluster to be a virtual IP on another node - neutron would reject that as the primary IP would be known as that.<br>
<br>-Rob<br><br><div class="gmail_quote">On 5 July 2013 09:33, Aaron Rosen <span dir="ltr"><<a href="mailto:arosen@nicira.com" target="_blank">arosen@nicira.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">[Moving to list]<div><br></div><div>Hi Sam, </div><div><br></div><div>responses inline <br><br><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">Samuel Bercovici</b> <span dir="ltr"><<a href="mailto:SamuelB@radware.com" target="_blank">SamuelB@radware.com</a>></span><br>
Date: Thu, Jun 27, 2013 at 1:43 PM<br>Subject: Chalenges with highly available service VMs<br>To: "Mark McClain (<a href="mailto:mark.mcclain@dreamhost.com" target="_blank">mark.mcclain@dreamhost.com</a>)" <<a href="mailto:mark.mcclain@dreamhost.com" target="_blank">mark.mcclain@dreamhost.com</a>>, "<a href="mailto:arosen@nicira.com" target="_blank">arosen@nicira.com</a>" <<a href="mailto:arosen@nicira.com" target="_blank">arosen@nicira.com</a>><br>
Cc: Samuel Bercovici <<a href="mailto:SamuelB@radware.com" target="_blank">SamuelB@radware.com</a>>, Avishay Balderman <<a href="mailto:AvishayB@radware.com" target="_blank">AvishayB@radware.com</a>>, "<a href="mailto:gary.kotton@gmail.com" target="_blank">gary.kotton@gmail.com</a>" <<a href="mailto:gary.kotton@gmail.com" target="_blank">gary.kotton@gmail.com</a>>, "<a href="mailto:gkotton@redhat.com" target="_blank">gkotton@redhat.com</a>" <<a href="mailto:gkotton@redhat.com" target="_blank">gkotton@redhat.com</a>><br>
<br><br>
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p><span style="font-size:14pt">Hi,<u></u><u></u></span></p>
<p><span style="font-size:14pt"><u></u> <u></u></span></p>
<p><span style="font-size:14pt">As part of provisioning load balancer service VMs we have encountered the following changes.<u></u><u></u></span></p>
<p><span style="font-size:14pt">Our planned HA model for this release is going to use a strategy in which IP addresses are configured on the HA VM pair in the same way but only the active box is “connected” to the network and answers ARP
request.<u></u><u></u></span></p>
<p><span style="font-size:14pt">When the 1<sup>st</sup> VM fails and after the 2<sup>nd</sup> VM detects this, it will do a GARP and will take ownership on the IP addresses.<u></u><u></u></span></p>
<p><span style="font-size:14pt">The assumption is the underlying L2 network can support IP to MAC discovery.<u></u><u></u></span></p>
<p><span style="font-size:14pt"><u></u> </span></p><p><i style="font-size:large">[arosen] - yup makes sense. </i><br></p><p><span style="font-size:14pt"><br></span></p>
<p><span style="font-size:14pt">The challenge that we are facing is that currently each Neutron port, automatically gets “security” protection via IP tables which is intended to prevent IP spoofing.
<u></u><u></u></span></p>
<p><span style="font-size:14pt">If the load balancer service VM gets configured with an IP (ex: VIP) this security blocks traffic to the IP until the Neutron port gets updated with this addition IP.<u></u><u></u></span></p>
<p><span style="font-size:14pt">In addition the IP should be allocated/marked as used in a Neutron subnet and currency AFAIK there is no means to allocate an IP address without attaching it to a Neutron port.<u></u><u></u></span></p>
<p><span style="font-size:14pt">I do not know how a network based on Nicira behaves as AFAIK it does not use IP tables.<u></u><u></u></span></p>
<p><span style="font-size:14pt"><u></u> <u></u></span></p>
<p><span style="font-size:14pt">In the case of 2 machines acting as an HA pair the same IP address needs to be assigned to two Neutron ports so that the IP tables rules will be update correctly for bot. AFAIK this (IP attached to two Neutron
Pots) is currently not supported.<u></u><u></u></span></p>
<p><span style="font-size:14pt">As I expect that get 10s-100s VIPs mapped to the same Neutron port, I am worried that having many rules in a chain will have an impact.<u></u><u></u></span></p>
<p><span style="font-size:14pt"><u></u> <u></u></span></p>
<p><span style="font-size:14pt">Follows a few options to solve this:<u></u><u></u></span></p>
<p><u></u><span style="font-size:14pt"><span>1.<span style="font-style:normal;font-variant:normal;font-weight:normal;font-size:7pt;line-height:normal;font-family:'Times New Roman'">
</span></span></span><u></u><span dir="LTR"></span><span style="font-size:14pt">Define a Neutron port as a Neutron service port. In this case the assumption is that the VM/Port belongs to the cloud infrastructure and hence no need to specify the IP tables
rules that prevents “MAC” spoofing or “IP” spoofing (which are some of the different strategies to achieve HA). Potentially add support in Nova so that when a VM marked as service VM in nova is provisioned, than the Neutron ports of this VM will be defines
as Neutron service ports.<u></u><u></u></span></p><p><span style="font-size:14pt"><br></span></p><p><font size="4"><i>[arosen] - there is already an extension that does this though only the nvp plugin implements it at the time though it shouldn't be very hard to add support for it in other plugins. </i></font><a href="https://github.com/openstack/quantum/blob/master/quantum/extensions/portsecurity.py" target="_blank">https://github.com/openstack/quantum/blob/master/quantum/extensions/portsecurity.py</a></p>
<p><br></p>
<p><u></u><span style="font-size:14pt"><span>2.<span style="font-style:normal;font-variant:normal;font-weight:normal;font-size:7pt;line-height:normal;font-family:'Times New Roman'">
</span></span></span><u></u><span dir="LTR"></span><span style="font-size:14pt">Add support for assigning the same IP address to two Neutron ports<u></u><u></u></span></p>
<p><span style="font-size:14pt">[arosen] - there is a blueprint for pluggable ipam which might work for this. That said. it seems like it might also be worth while to add an extension that allows you to add/remove ip/mac address pairs to a port. </span></p>
<p><span style="font-size:14pt"><br></span></p><p><span style="font-size:14pt"> <u></u></span></p>
<p><span style="font-size:14pt">What do you think?<u></u><u></u></span></p>
<p><span style="font-size:14pt"><u></u> <u></u></span></p>
<p><span style="font-size:14pt">Regards,<u></u><u></u></span></p>
<p><span style="font-size:14pt"> -Sam.<u></u><u></u></span></p>
<p><span style="font-size:14pt"><u></u> <u></u></span></p>
</div>
</div>
</div><br></div></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Robert Collins <<a href="mailto:rbtcollins@hp.com" target="_blank">rbtcollins@hp.com</a>><br>Distinguished Technologist<br>HP Cloud Services