<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>Hi Chris,</div>
<div><br>
</div>
<div>>> If I set --router:external=False on the Public net, will that cause Neutron to create a purely virtual router based on an instance instead of playing games with the hardware NIC? </div>
<div><br>
</div>
<div>No. It simply means that routers cannot be attached to the network using the router-gateway-set command. It would not be treated as an ‘external’ or ‘floating IP’ network, so to speak.</div>
<div><br>
</div>
<div>If you can SSH to instances connected to the public network, as well as the OpenStack dashboard, from the private instances, then MTU should be OK (if you’re using VXLAN). Normally MTU issues manifest themselves as SSH connections that appear to hang during
the setup, dropped packets, etc. But I would expect the three-way handshake to be completed in either case.</div>
<div><br>
</div>
<div>At this point, I recommend performing a tcpdump on the qg-* interface of the router, or the other end of that interface that resides in the external bridge, to see what TCP/UDP traffic looks like as it leaves your instance. Verify that it’s being NAT’d
properly as the SNAT address or the floating IP address. Perform the same cap on the physical interface of the server, maybe filtering on the IP you’re trying to reach to reduce the noise. You want to trace the packets as the leave the instance through the
various bridges, veths, and lastly the physical interface.</div>
<div><br>
</div>
<div>James</div>
<div>
<div id="">
<div><br>
</div>
<div>
<div class="">
<div class="">
<div class="">
<div class=""></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:12pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Christopher Hull <<a href="mailto:chrishull42@gmail.com">chrishull42@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, March 31, 2016 at 1:09 PM<br>
<span style="font-weight:bold">To: </span>Neil Jerram <<a href="mailto:Neil.Jerram@metaswitch.com">Neil.Jerram@metaswitch.com</a>><br>
<span style="font-weight:bold">Cc: </span>openstack-operators <<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack-operators] [neutron] Interesting networking issue - need help<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">
<div>If I set --router:external=False on the Public net, will that cause Neutron to create a purely virtual router based on an instance instead of playing games with the hardware NIC? Sure, that will "burn an instance", but it will have the advantage in that
it might actually work! :-)<br>
<br>
</div>
-Chris<br>
<br>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div class="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div>
<div>- Christopher T. Hull<br>
</div>
<div>I am presently seeking a new career opportunity Please see career page<br>
</div>
<div><a href="http://chrishull.com/career" target="_blank">http://chrishull.com/career</a><br>
</div>
<div>333 Orchard Ave, Sunnyvale CA. 94085<br>
(415) 385 4865<br>
</div>
<div><a href="mailto:chrishull42@gmail.com" target="_blank">chrishull42@gmail.com</a><br>
</div>
<a href="http://chrishull.com" target="_blank">http://chrishull.com</a><br>
<br>
</div>
</div>
<div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">On Thu, Mar 31, 2016 at 11:05 AM, Christopher Hull <span dir="ltr">
<<a href="mailto:chrishull42@gmail.com" target="_blank">chrishull42@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div>All by IP. Private instances can't get hostnames because they can't get TCP/UDP back from DNS, so all testing is via IP.<br>
<br>
</div>
-Chris<br>
<br>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div><span class="">
<div>- Christopher T. Hull<br>
</div>
<div>I am presently seeking a new career opportunity Please see career page<br>
</div>
<div><a href="http://chrishull.com/career" target="_blank">http://chrishull.com/career</a><br>
</div>
<div>333 Orchard Ave, Sunnyvale CA. 94085<br>
<a href="tel:%28415%29%20385%204865" value="+14153854865" target="_blank">(415) 385 4865</a><br>
</div>
<div><a href="mailto:chrishull42@gmail.com" target="_blank">chrishull42@gmail.com</a><br>
</div>
</span><a href="http://chrishull.com" target="_blank">http://chrishull.com</a><br>
<br>
</div>
</div>
<div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div class="h5"><br>
<div class="gmail_quote">On Thu, Mar 31, 2016 at 10:51 AM, Neil Jerram <span dir="ltr">
<<a href="mailto:Neil.Jerram@metaswitch.com" target="_blank">Neil.Jerram@metaswitch.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span>On 31/03/16 18:40, Christopher Hull wrote:<br>
> Hi all;<br>
> Was originally DNS issue, but that was a downstream symptom.<br>
><br>
> Instances on Private net can't access internet TCP, but CAN ICMP. ping all.<br>
> Details:<br>
> 1. Instances on Public net work perfectly.<br>
> 2. Instances on Private net can fully access Public net instances, both<br>
> virtual and physical boxes.<br>
> ssh from Private to Public instance works.<br>
> http to OpenStack dashboard (physical box) from Private instance works.<br>
> 3. Private instances can ping everything, including the internet.<br>
<br>
</span>By IP or by hostname?<br>
<span><br>
> 4. Private instances can NOT TCP to my ATT gateway. (public net)<br>
> HTTP to ATT gateway which has a web interface fails.<br>
> Same is true for internet. Ping, but no TCP (UDP?)<br>
<br>
</span>Again, are these TCP attempts to an IP or to a hostname?<br>
<br>
Just want to be sure that this isn't still a name resolution issue.<br>
<br>
Neil<br>
<span><br>
<br>
> 5. Floating IPs work. I think the Neutron Router is fine.<br>
><br>
> Any ideas??<br>
> -Chris<br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
> - Christopher T. Hull<br>
> I am presently seeking a new career opportunity Please see career page<br>
> <a href="http://chrishull.com/career" rel="noreferrer" target="_blank">http://chrishull.com/career</a><br>
> 333 Orchard Ave, Sunnyvale CA. 94085<br>
> <a href="tel:%28415%29%20385%204865" value="+14153854865" target="_blank">(415) 385 4865</a><br>
</span>> <a href="mailto:chrishull42@gmail.com" target="_blank">chrishull42@gmail.com</a> <mailto:<a href="mailto:chrishull42@gmail.com" target="_blank">chrishull42@gmail.com</a>><br>
> <a href="http://chrishull.com" rel="noreferrer" target="_blank">http://chrishull.com</a><br>
><br>
><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</span>
</body>
</html>