<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<span id="OLK_SRC_BODY_SECTION">
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div dir="ltr"><br>
-- (rebroadcast to dev community from prior unicast discussion) --<br>
<br>
Hi Nir<br>
<br>
Sorry if the description is misleading. Didn't want a large title, and hoped that the description would provide those additional details to clarify the real goal of what's included and what's not included.<br>
<br>
#1. Yes, it's only the gateway port. With that said, there are a series of BP that are being worked to support the dual-stack use case (although not necessarily dependent on each other) across Neutron, including internal ports facing the tenant.<br>
<a href="https://blueprints.launchpad.net/neutron/+spec/allow-multiple-subnets-on-gateway-port">https://blueprints.launchpad.net/neutron/+spec/allow-multiple-subnets-on-gateway-port</a><br>
<a href="https://blueprints.launchpad.net/neutron/+spec/dnsmasq-mode-keyword">https://blueprints.launchpad.net/neutron/+spec/dnsmasq-mode-keyword</a><br>
<a href="https://blueprints.launchpad.net/neutron/+spec/neutronclient-support-dnsmasq-mode-keyword">https://blueprints.launchpad.net/neutron/+spec/neutronclient-support-dnsmasq-mode-keyword</a><br>
<a href="https://blueprints.launchpad.net/neutron/+spec/dnsmasq-bind-into-qrouter-namespace">https://blueprints.launchpad.net/neutron/+spec/dnsmasq-bind-into-qrouter-namespace</a><br>
<a href="https://blueprints.launchpad.net/neutron/+spec/dnsmasq-ipv6-slaac">https://blueprints.launchpad.net/neutron/+spec/dnsmasq-ipv6-slaac</a><br>
<a href="https://blueprints.launchpad.net/neutron/+spec/dnsmasq-ipv6-dhcpv6-relay-agent">https://blueprints.launchpad.net/neutron/+spec/dnsmasq-ipv6-dhcpv6-relay-agent</a><br>
<a href="https://blueprints.launchpad.net/neutron/+spec/dnsmasq-ipv6-dhcpv6-stateful">https://blueprints.launchpad.net/neutron/+spec/dnsmasq-ipv6-dhcpv6-stateful</a><br>
<a href="https://blueprints.launchpad.net/neutron/+spec/dnsmasq-ipv6-dhcpv6-stateless">https://blueprints.launchpad.net/neutron/+spec/dnsmasq-ipv6-dhcpv6-stateless</a></div>
</blockquote>
</span>
<div><br>
</div>
<div>I'd suggest popping into the ipv6-subteam's meetings [1] and having further discussions about this as well. We've been working on address allocation for the most part, but routing and service integration will need to be the next step.</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>
<div>
<div dir="ltr"><br>
<br>
#2. Surely it's possible to have multiple v4 and v6 [global] addresses on the interface, but for the gateway port, I don't have a specific use case. To remain consistent with current feature capability (single v4 IP), I continue to restrict a single IP from
each flavor. With that said, there's nothing technically preventing this. It can be done; however, the CLI and Horizon would likely need significant changes. Right now, the code is written such that it explicitly prevents it. As I mentioned before, I actually
had to add code in to disallow multiple addresses of the same flavor and send back an error to the user. Of course, we can evolve it in the future if a use-case warrants it.</div>
</div>
</div>
</blockquote>
</span>
<div><br>
</div>
<div>The use case is for networks that rely on IP allocations for security. You may want a pair of separate routed blocks on the same network for, say, a public network for the web server to get through a policy to the Internet, but a separate address to get
to an internal-only database cluster somewhere. I'm not saying it's the greatest way to do things, but I am sure there are people running networks this way. The alternative would be to spin up another port on another network and configure another gateway
port as well.</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>
<div>
<div dir="ltr"><br>
<br>
Thanks<br>
Randy<br>
<br>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Thu, Jan 9, 2014 at 4:16 AM, Nir Yechiel <span dir="ltr">
<<a href="mailto:nyechiel@redhat.com" target="_blank">nyechiel@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div style="font-size:12pt;font-family:verdana,helvetica,sans-serif">
<div>Hi Randy,<br>
</div>
<div><br>
</div>
<div>I don't have a specific use case. I just wanted to understand the scope here as the name of this blueprint ("allow multiple subnets on gateway port for router") could be a bit misleading.
</div>
<div><br>
</div>
<div>Two questions I have though:</div>
<div><br>
</div>
<div>1. Is this talking specifically about the gateway port to the provider's next-hop router or relevant for all ports in virtual routers as well?<br>
</div>
<div>2. There is a fundamental difference between v4 and v6 address assignment. With IPv4 I agree that one IP address per port is usually enough (there is the concept of secondary IP, but I am not sure it's really common). With IPv6 however you can sure have
more then one (global) IPv6 on an interface. Shouldn't we support this?<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks,<br>
</div>
<div>Nir<br>
</div>
<div><br>
</div>
<hr>
<div style="font-size:12pt;font-style:normal;font-family:Helvetica,Arial,sans-serif;text-decoration:none;font-weight:normal">
<b>From: </b>"Randy Tuttle" <<a href="mailto:randy.m.tuttle@gmail.com" target="_blank">randy.m.tuttle@gmail.com</a>><br>
<b>To: </b>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br>
<b>Cc: </b><a href="mailto:rantuttl@cisco.com" target="_blank">rantuttl@cisco.com</a><br>
<b>Sent: </b>Tuesday, December 31, 2013 6:43:50 PM<br>
<b>Subject: </b>Re: [openstack-dev] [Neutron] Allow multiple subnets on gateway port for router
<div>
<div class="h5"><br>
<div><br>
</div>
<div dir="ltr">
<div>
<div>
<div>Hi Nir<br>
<div><br>
</div>
</div>
Good question. There's absolutely no reason not to allow more than 2 subnets, or even 2 of the same IP versions on the gateway port. In fact, in our POC we allowed this (or, more specifically, we did not disallow it). However, for the gateway port to the provider's
next-hop router, we did not have a specific use case beyond an IPv4 and an IPv6. Moreover, in Neutron today, only a single subnet is allowed per interface (either v4 or v6). So all we are doing is opening up the gateway port to support what it does today (i.e.,
v4 or v6) plus allow IPv4 and IPv6 subnets to co-exist on the gateway port (and same network/vlan). Our principle use case is to enable IPv6 in an existing IPv4 environment.<br>
<br>
</div>
Do you have a specific use case requiring 2 or more of the same IP-versioned subnets on a gateway port?<br>
<div><br>
</div>
</div>
<div>Thanks<br>
</div>
Randy<br>
</div>
<div class="gmail_extra"><br>
<div><br>
</div>
<div class="gmail_quote">On Tue, Dec 31, 2013 at 4:59 AM, Nir Yechiel <span dir="ltr">
<<a href="mailto:nyechiel@redhat.com" target="_blank">nyechiel@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div style="font-size:12pt;font-family:verdana,helvetica,sans-serif">
<div>Hi,<br>
</div>
<div><br>
</div>
<div>With regards to <a href="https://blueprints.launchpad.net/neutron/+spec/allow-multiple-subnets-on-gateway-port," target="_blank">
https://blueprints.launchpad.net/neutron/+spec/allow-multiple-subnets-on-gateway-port,</a> can you please clarify this statement: "We will disallow more that two subnets, and exclude allowing 2 IPv4 or 2 IPv6 subnets".<br>
The use case for dual-stack with one IPv4 and one IPv6 address associated to the same port is clear, but what is the reason to disallow more than two IPv4/IPv6 subnets to a port?<br>
</div>
<div><br>
</div>
<div>Thanks and happy holidays!<span><span style="color:#888888" color="#888888"><br>
</span></span></div>
<span><span style="color:#888888" color="#888888">
<div>Nir<br>
</div>
<div><br>
</div>
<div><span></span><br>
</div>
</span></span></div>
</div>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br>
</blockquote>
</div>
<br>
</div>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div>
</div>
</div>
<div><br>
</div>
</div>
</div>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</span>
<div><br>
</div>
<div><br>
</div>
<div>-Anthony </div>
<div><br>
</div>
<div>[1] <a href="https://wiki.openstack.org/wiki/Meetings/Neutron-IPv6-Subteam">https://wiki.openstack.org/wiki/Meetings/Neutron-IPv6-Subteam</a></div>
</body>
</html>