Here is what happened on a different thread:<br><a href="http://buriedlede.blogspot.com/2012/07/debugging-networking-problems-with.html">http://buriedlede.blogspot.com/2012/07/debugging-networking-problems-with.html</a><br>
<br>I feel that using this might solve your issue too without changing iptables drivers...<br><br><div class="gmail_quote">On Fri, Jul 20, 2012 at 12:58 PM, Wael Ghandour (wghandou) <span dir="ltr"><<a href="mailto:wghandou@cisco.com" target="_blank">wghandou@cisco.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
<br>
<div><span style="text-indent:0px;letter-spacing:normal;font-variant:normal;text-align:-webkit-auto;font-style:normal;font-weight:normal;line-height:normal;border-collapse:separate;text-transform:none;font-size:medium;white-space:normal;font-family:Helvetica;word-spacing:0px">
<div>
<div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px;font:normal normal normal 12px/normal Verdana;min-height:15px">
Yup, that has definitely helped, thanks a bunch Xu.<br>
<br>
</div>
<div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px;font:normal normal normal 12px/normal Verdana;min-height:15px">
<span style="letter-spacing:0px"></span><br>
</div>
<div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px;font:normal normal normal 12px/normal Verdana">
<span style="letter-spacing:0px">Regards,</span></div>
<div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px;font:normal normal normal 12px/normal Verdana;min-height:15px">
<span style="letter-spacing:0px"></span><br>
</div>
<div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px;font:normal normal normal 12px/normal Verdana">
<span style="letter-spacing:0px">Wael</span></div>
</div>
<div><span style="letter-spacing:0px"><br>
</span></div>
</span><br>
</div><div><div class="h5">
<br>
<div>
<div>On Jul 20, 2012, at 8:09 AM, Xu (Simon) Chen wrote:</div>
<br>
<blockquote type="cite">Yes, one solution is to modify the iptables driver, so that you don't SNAT for internal subnets...
<div><br>
</div>
<div>So, at the beginning of the nova-network-floating-snat rules, you add something like this:</div>
<div>-A nova-network-floating-snat -s <a href="http://10.0.0.0/24" target="_blank">10.0.0.0/24</a> -d
<a href="http://10.0.0.0/24" target="_blank">10.0.0.0/24</a> -j ACCEPT</div>
<div>...</div>
<div>
<div>-A nova-network-floating-snat -s <a href="http://10.0.88.16/32" target="_blank">10.0.88.16/32</a> -j SNAT --to-source pub1</div>
<div>-A nova-network-floating-snat -s <a href="http://10.0.16.7/32" target="_blank">10.0.16.7/32</a> -j SNAT --to-source pub2</div>
<div>-A nova-network-floating-snat -s <a href="http://10.0.4.11/32" target="_blank">10.0.4.11/32</a> -j SNAT --to-source pub3</div>
<div><br>
</div>
<div>Then it should solve the unnecessary NATting issue...</div>
<br>
<div class="gmail_quote">On Fri, Jul 20, 2012 at 10:13 AM, Wael Ghandour (wghandou)
<span dir="ltr"><<a href="mailto:wghandou@cisco.com" target="_blank">wghandou@cisco.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word"><br>
<div><span style="line-height:normal;text-indent:0px;border-collapse:separate;letter-spacing:normal;text-align:-webkit-auto;font-variant:normal;text-transform:none;font-size:medium;white-space:normal;font-family:Helvetica;word-spacing:0px">
<div>
<div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px;font:normal normal normal 12px/normal Verdana;min-height:15px">
I can confirm that the VM traffic is undergoing NAT with using its floating IP on the
<i style="font-weight:bold">private</i> interface of the nova-compute node when it tries to reach the private address of the VMs belonging to the same tenant and on other compute nodes. That obviously is breaking internal connectivity....<br>
<br>
</div>
<div style="font-weight:normal;font-style:normal;margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px;font:normal normal normal 12px/normal Verdana;min-height:15px">
<span style="letter-spacing:0px"></span><br>
</div>
<div style="font-weight:normal;font-style:normal;margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px;font:normal normal normal 12px/normal Verdana">
<span style="letter-spacing:0px">Regards,</span></div>
<div style="font-weight:normal;font-style:normal;margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px;font:normal normal normal 12px/normal Verdana;min-height:15px">
<span style="letter-spacing:0px"></span><br>
</div>
<div style="font-weight:normal;font-style:normal;margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px;font:normal normal normal 12px/normal Verdana">
<span style="letter-spacing:0px">Wael</span></div>
</div>
<div style="font-weight:normal;font-style:normal"><span style="letter-spacing:0px"><br>
</span></div>
</span><br>
</div>
<div>
<div><br>
<div>
<div>On Jul 20, 2012, at 5:42 AM, Xu (Simon) Chen wrote:</div>
<br>
<blockquote type="cite">There was an issue that we saw in an earlier nova-network...
<div><br>
</div>
<div>Due to multi_host configuration, the nova-network runs on every nova-compute node. Therefore the floating IP assignment happens on the compute nodes directly. So between two VMs within the same tenant on different hosts, private->public SNAT happens unnecessarily.</div>
<div><br>
</div>
<div>Not sure if this is fixed in Essex...<br>
<br>
<div class="gmail_quote">On Fri, Jul 20, 2012 at 3:49 AM, Edgar Magana (eperdomo)
<span dir="ltr"><<a href="mailto:eperdomo@cisco.com" target="_blank">eperdomo@cisco.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal">Folks,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We are using Essex for our multi-host OpenStack deployment with Vlan Manager.<u></u><u></u></p>
<p class="MsoNormal">All the private IPs are working as expected in a multi-tenant scenario but the problem that we are seen is with Floating IPs.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We have three tenants, all of them are able to use Floating IPs and then VMs are reachable from the public network but the inter VMs connectivity by private IPs is totally lost. Once we dissociate the Floating IPs to the corresponding
VMs, the connectivity is back. The odd part is that we are seeing this behavior in just two of the three tenants that we have tested so far.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Is anyone aware of any bug or misconfiguration in Nova-network that could explain this behavior? We will be running more tests and we can provide detailed information of our environment if needed.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks for your help,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Edgar<u></u><u></u></p>
</div>
</div>
<br>
_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</blockquote>
</div>
<br>
</div></div></div>
</blockquote></div><br>