<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt">Sam,<br><br>I wrote a blog post about this a while back <a href="http://techbackground.blogspot.ie/2013/06/path-mtu-discovery-and-gre.html">http://techbackground.blogspot.ie/2013/06/path-mtu-discovery-and-gre.html</a><br><br>Basically the GRE tunnel between the node with the instance and the node with the quantum router is reducing the overall path MTU, and the ICMP error sent back to the sender requesting the packet size to be reduced is being blocked or ignored.<br><br>Just today I have been looking at the Linux 3.5 kernel and OVS 1.11.0, and the behaviour seems to have changed - now there is IP fragementation happening between the nodes instead.<br><br>Re, Darragh.<br><div><span></span><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div
style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font face="Arial" size="2"> <b><span style="font-weight:bold;">From:</span></b> Samuel Winchenbach <swinchen@gmail.com><br> <b><span style="font-weight: bold;">To:</span></b> Darragh O'Reilly <dara2002-openstack@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "openstack-operators@lists.openstack.org" <openstack-operators@lists.openstack.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, 1 October 2013, 21:02<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Openstack-operators] [Grizzly] Multiple l3-agent hosts, single network.<br> </font> </div> <div class="y_msg_container"><br><div id="yiv2264966077"><div dir="ltr"><div class="yiv2264966077gmail_default" style="font-family:courier new,
monospace;">That worked great. What is going on there? </div><div class="yiv2264966077gmail_default" style="font-family:courier new, monospace;"><br></div><div class="yiv2264966077gmail_default" style="font-family:courier new, monospace;">
If I run the VM on the same physical machine as the L3 agent I do not need to set the MTU.</div><div class="yiv2264966077gmail_default" style="font-family:courier new, monospace;"><br></div><div class="yiv2264966077gmail_default" style="font-family:courier new, monospace;">
Interesting.</div><div class="yiv2264966077gmail_default" style="font-family:courier new, monospace;"><br></div><div class="yiv2264966077gmail_default" style="font-family:courier new, monospace;">Sam</div></div><div class="yiv2264966077gmail_extra"><br><br><div class="yiv2264966077gmail_quote">
On Tue, Oct 1, 2013 at 11:02 AM, Darragh O'Reilly <span dir="ltr"><<a rel="nofollow" ymailto="mailto:dara2002-openstack@yahoo.com" target="_blank" href="mailto:dara2002-openstack@yahoo.com">dara2002-openstack@yahoo.com</a>></span> wrote:<br><blockquote class="yiv2264966077gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Sam,<br>
<br>
<br>
being able to reach http but not https sites sounds like the mtu issue we have seen before. As a quick test try reducing the mtu on the instance:<br>
<br>
$ sudo ip link set mtu 1400 dev eth0<br>
<br>
and see if the wget to the https site works.<br>
<br>
<br>
Re, Darragh.<br>
<div><div class="yiv2264966077h5"><br>
<br>
>Hello,<br>
><br>
><br>
>I have two external network hosts (test1 and test2) both running the l3 agent on the same network (XXX.YYY.0.0/24). I am using OVS/namespace/gre networking. When a neutron/quantum router is set to use the l3-agent on test1 everything works fine. If I set the same router to use the l3-agent on test2 I experience some odd problems: From within a VM using the router on test2 I can wget files from http sites but not from https sites. I have noticed that the iptables (not within any namespace) are VERY different for the two servers:<br>
><br>
><br>
>Working l3-agent (test1) iptables: <a rel="nofollow" target="_blank" href="http://paste.openstack.org/show/47695/">http://paste.openstack.org/show/47695/</a><br>
>Non-working l3-agent (test2) iptables: <a rel="nofollow" target="_blank" href="http://paste.openstack.org/show/47696/">http://paste.openstack.org/show/47696/</a><br>
><br>
><br>
>Notice that the iptables for test1 contain chains for the security groups such as quantum-openvswi-i435b8f52-6. I do not see anything like this on test2.<br>
><br>
><br>
><br>
><br>
>Does anyone have any idea what might be causing this issue?<br>
><br>
><br>
>Thanks!<br>
>Sam<br>
><br>
><br>
><br>
><br>
</div></div>>_______________________________________________<br>
>OpenStack-operators mailing list<br>
><a rel="nofollow" ymailto="mailto:OpenStack-operators@lists.openstack.org" target="_blank" href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.openstack.org</a><br>
><a rel="nofollow" target="_blank" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
><br>
><br>
><br>
<br>
_______________________________________________<br>
OpenStack-operators mailing list<br>
<a rel="nofollow" ymailto="mailto:OpenStack-operators@lists.openstack.org" target="_blank" href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.openstack.org</a><br>
<a rel="nofollow" target="_blank" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
</blockquote></div><br></div></div><br><br></div> </div> </div> </blockquote></div> </div></body></html>