<div dir="ltr">Take a look at the installation guide for Liberty at docs.openstack.org... the architecture supports attaching VMs to public/external and private/project networks.</div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Oct 25, 2015 at 6:39 AM, Neil Jerram <span dir="ltr"><<a href="mailto:Neil.Jerram@metaswitch.com" target="_blank">Neil.Jerram@metaswitch.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">
For assigning a routable public IP to a VM, James and Kevin have described using an external network, but I think there might be a second possibility. Namely, a shared, non-external network, with a subnet with the routable IP range that you want to assign from,
and connected via a Neutron router to the outside world. </div>
<div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">
<br>
</div>
<div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">
Would that also work? Would the L3 agent in that case avoid doing an unnecessary NAT?</div>
<div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">
<br>
</div>
<div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">
Thanks, </div>
<div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">
Neil</div>
<div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">
<br>
</div>
<div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">
PS. Adam - you might also like to check out my L3-only networking spec at <a href="https://review.openstack.org/#/c/238895/" target="_blank">https://review.openstack.org/#/c/238895/</a>, as it describes IP addressing like what you describe, and might align more generally with what you have in mind. </div>
<div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">
<span style="font-size:initial;text-align:initial;line-height:initial"> </span></div>
<div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">
</div>
<table width="100%" style="background-color:white;border-spacing:0px">
<tbody>
<tr>
<td colspan="2" style="font-size:initial;text-align:initial;background-color:rgb(255,255,255)">
<div style="border-style:solid none none;border-top-color:rgb(181,196,223);border-top-width:1pt;padding:3pt 0in 0in;font-family:Tahoma,'BB Alpha Sans','Slate Pro';font-size:10pt">
<div><b>From: </b>Kevin Benton</div>
<div><b>Sent: </b>Sunday, 25 October 2015 06:34</div>
<div><b>To: </b>James Denton</div>
<div><b>Cc: </b>OpenStack Operators</div>
<div><b>Subject: </b>Re: [Openstack-operators] [Neutron] public and private fixed IPs</div>
</div>
</td>
</tr>
</tbody>
</table><div><div class="h5">
<div style="border-style:solid none none;border-top-color:rgb(186,188,209);border-top-width:1pt;font-size:initial;text-align:initial;background-color:rgb(255,255,255)">
</div>
<br>
<div>
<p dir="ltr">Yes, as long as the network is marked as both 'shared' and external, a tenant can attach VMs and router gateway interfaces directly to it.
</p>
<div class="gmail_quote">On Oct 25, 2015 2:47 PM, "James Denton" <<a href="mailto:james.denton@rackspace.com" target="_blank">james.denton@rackspace.com</a>> wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Adam,<br>
<br>
If you're asking whether or not a VM can be attached to an 'external' network so that the 'public' ip is the fixed IP of them VM, then yes. A Neutron router can also be attached to the same network so that instances in non-routable tenant networks can obtain
floating IPs from the same 'public' network. At one time non-admin users were not allowed to attach VMs to 'external' networks but I believe that restriction was removed around Kilo or so.<br>
<br>
James<br>
<br>
Sent from my iPhone<br>
<br>
> On Oct 25, 2015, at 2:15 PM, Adam Lawson <<a href="mailto:alawson@aqorn.com" target="_blank">alawson@aqorn.com</a>> wrote:<br>
><br>
> Hi everyone!<br>
><br>
> When using KVM, does Neutron support binding a public routable address<br>
> to one VM in one tenant as a fixed IP that is accessible outside the<br>
> cloud (no floating IP for remote access) and a VM in a separate tenant<br>
> with private fixed IP's with optional floating IP? Would this be<br>
> possible on a per tenant or per region basis?<br>
><br>
> I'm working on a cloud approach that allows either scenario.<br>
><br>
> Long story short, I'm trying to support two options in the same cloud<br>
> (if possible) so a department/tenant can deploy instances with public<br>
> IP's that are directly accessible by the rest of the enterprise (no<br>
> NAT) and a second department/tenant that deploys all of their VM's<br>
> within the context of a private/isolated tenant network with optional<br>
> floating IP's.<br>
><br>
> Thoughts on how this would be handled? Is it as simple as assigning a<br>
> public subnet to a tenant as the fixed/tenant network?<br>
><br>
> //adam<br>
><br>
> --<br>
><br>
> *Adam Lawson*<br>
><br>
> AQORN, Inc.<br>
> 427 North Tatnall Street<br>
> Ste. 58461<br>
> Wilmington, Delaware 19801-2230<br>
> Toll-free: (844) 4-AQORN-NOW ext. 101<br>
> International: <a href="tel:%2B1%20302-387-4660" value="+13023874660" target="_blank">+1 302-387-4660</a><br>
> Direct: <a href="tel:%2B1%20916-246-2072" value="+19162462072" target="_blank">+1 916-246-2072</a><br>
><br>
> _______________________________________________<br>
> OpenStack-operators mailing list<br>
> <a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.openstack.org</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" rel="noreferrer" target="_blank">
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
<br>
_______________________________________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
</blockquote>
</div>
</div>
</div></div></div>
<br>_______________________________________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
<br></blockquote></div><br></div>