<div dir="ltr"><div>Hello James; I made the db update before live migrating the virtual machine, but the node where I migrated continues to create the qbr bridge also if it is configured with openvswitch firewall.</div><div>The difference if that if I do not update the database I can ping the migrated vm, while now I cannot</div><div>Ignazio<br> </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Il giorno gio 12 mar 2020 alle ore 13:30 James Denton <<a href="mailto:james.denton@rackspace.com">james.denton@rackspace.com</a>> ha scritto:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_7849307343667592196WordSection1">
<p class="MsoNormal">Hi Ignazio,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I tested a process that converted iptables_hybrid to openvswitch in-place, but not without a hard reboot of the VM and some massaging of the existing bridges/veths. Since you are live-migrating, though, you might be able to get around
that.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Regardless, to make this work, I had to update the port’s vif_details in the Neutron DB and set ‘ovs_hybrid_plug’ to false. Something like this:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">> use neutron;<u></u><u></u></p>
<p class="MsoNormal">> update ml2_port_bindings set vif_details='{"port_filter": true, "bridge_name": "br-int", "datapath_type": "system", "ovs_hybrid_plug": false}' where port_id='3d88982a-6b39-4f7e-8772-69367c442939' limit 1;<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">So, perhaps making that change prior to moving the VM back to the other compute node will do the trick.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Good luck!<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">James<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-color:rgb(181,196,223) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">Ignazio Cassano <<a href="mailto:ignaziocassano@gmail.com" target="_blank">ignaziocassano@gmail.com</a>><br>
<b>Date: </b>Thursday, March 12, 2020 at 6:41 AM<br>
<b>To: </b>openstack-discuss <<a href="mailto:openstack-discuss@lists.openstack.org" target="_blank">openstack-discuss@lists.openstack.org</a>><br>
<b>Subject: </b>[qeeens][neutron] migrating from iptables_hybrid to openvswitch<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div style="border:1pt solid rgb(156,101,0);padding:2pt">
<p class="MsoNormal" style="line-height:12pt;background:rgb(255,235,156) none repeat scroll 0% 0%"><b><span style="font-size:10pt;color:rgb(156,101,0)">CAUTION:</span></b><span style="font-size:10pt;color:black"> This message originated externally, please use caution when clicking on links or
opening attachments!<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal">Hello All, I am facing some problems migrating from iptables_hybrid frirewall to openvswitch firewall on centos 7 queens,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">I am doing this because I want enable security groups logs which require openvswitch firewall.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">I would like to migrate without restarting my instances.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">I startded moving all instances from compute node 1.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Then I configured openvswitch firewall on compute node 1,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Instances migrated from compute node 2 to compute node 1 without problems.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Once the compute node 2 was empty, I migrated it to openvswitch.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">But now instances does not migrate from node 1 to node 2 because it requires the presence of qbr bridge on node 2<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This happened because migrating instances from node2 with iptables_hybrid to compute node 1 with openvswitch, does not put the tap under br-int as requested by openvswich firewall, but qbr is still present on compute node 1.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Once I enabled openvswitch on compute node 2, migration from compute node 1 fails because it exprects qbr on compute node 2 .<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">So I think I should moving on the fly tap interfaces from qbr to br-int on compute node 1 before migrating to compute node 2 but it is a huge work on a lot of instances.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Any workaround, please ?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Ignazio<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</blockquote></div>