Assistance with Configuring fdb_age_threshold in OVN with Kolla-Ansible
Hi Stackers, Over the past few days, we encountered an issue during the migration of VMs from a customer environment to our OpenStack cloud. Both environments were connected via a cross-connect network (a VLAN-type network spanning the cloud and the customer environment), which resulted in duplicate MAC addresses in our OVN database. This occurred because the migrated VM retained the same MAC address as previously used in the customer's environment(so "ovn-sbctl list fdb" returned a port which was no-longer used and leads to such duplication) . To address the issue, we used the following command to clear the FDB database: ovn-sbctl --all destroy fdb While researching further, we came across the `fdb_age_threshold` configuration [1], which seemed to be a useful feature to prevent similar issues in the future. We attempted to implement it in our Kolla-Ansible environment by adding the following configuration to ` */etc/kolla/config/neutron/ml2_conf.ini*`: [ovn] fdb_age_threshold = 920 After deploying the changes, however, we noticed that the setting did not take effect in OVN. The configuration only applied successfully after we executed a manual script to propagate the setting directly to OVN [2]. Anyway such change is applicable only for exsisting networks, so it is far from perfect solution. Could you provide guidance on whether this behavior is due to incorrect documentation, an error in our configuration process, or an additional requirement needed to enable this feature? Any insights would be greatly appreciated. Thank you in advance for your support! /Jan Wasilewski **References:** [1] https://docs.openstack.org/neutron/latest/configuration/ml2-conf.html#ovn.fd... [2] https://paste.openstack.org/show/b9xUcnG6GXmCdSbSReG0/
Hi Jan, What openstack version are you using, just curious? I just tried this on the master branch and it works just fine. I set the `fdb_age_threshold` in the [ovn] section of the ml2_config.ini, just like you shown. Then I restarted the neutron server and created a new provider network. Lastly, I confirmed that the fdb_age_treshold was set in the other_config column of the OVN NB DB logical switch column. Looking at the neutron code, the fdb_age_threshold gets only set on the provider networks[1]. I.e networks with set provider network attribute[2][3]. Your manual script sets fdb_age_threshold on all logical switches. [1] https://opendev.org/openstack/neutron/src/commit/b7beb59fe18eaa0de61cd81c82d... [2] https://opendev.org/openstack/neutron/src/commit/b7beb59fe18eaa0de61cd81c82d... [3] https://docs.openstack.org/neutron/latest/admin/intro-os-networking.html#pro... I hope this helps -Miro On Mon, Jan 20, 2025 at 11:26 AM Jan Wasilewski <finarffin@gmail.com> wrote:
Hi Stackers,
Over the past few days, we encountered an issue during the migration of VMs from a customer environment to our OpenStack cloud. Both environments were connected via a cross-connect network (a VLAN-type network spanning the cloud and the customer environment), which resulted in duplicate MAC addresses in our OVN database. This occurred because the migrated VM retained the same MAC address as previously used in the customer's environment(so "ovn-sbctl list fdb" returned a port which was no-longer used and leads to such duplication) .
To address the issue, we used the following command to clear the FDB database: ovn-sbctl --all destroy fdb
While researching further, we came across the `fdb_age_threshold` configuration [1], which seemed to be a useful feature to prevent similar issues in the future. We attempted to implement it in our Kolla-Ansible environment by adding the following configuration to ` */etc/kolla/config/neutron/ml2_conf.ini*`: [ovn] fdb_age_threshold = 920
After deploying the changes, however, we noticed that the setting did not take effect in OVN. The configuration only applied successfully after we executed a manual script to propagate the setting directly to OVN [2]. Anyway such change is applicable only for exsisting networks, so it is far from perfect solution.
Could you provide guidance on whether this behavior is due to incorrect documentation, an error in our configuration process, or an additional requirement needed to enable this feature? Any insights would be greatly appreciated.
Thank you in advance for your support! /Jan Wasilewski
**References:** [1] https://docs.openstack.org/neutron/latest/configuration/ml2-conf.html#ovn.fd...
-- - Miro
Hi Miro, Thank you for your response. To answer your question, we are using OpenStack 2023.2 (Bobcat) with OVN 23.09 [1], so enabling this option should theoretically be possible according to the documentation. I initially assumed that this parameter would only apply to newly created networks. To test this, I created a new VLAN network [2], but the option is still not visible in OVN [3]. I am wondering if I might be missing something or if there is a gap in the implementation. Additionally, when I searched for the pattern `ovn_const.LS_OPTIONS_FDB_AGE_THRESHOLD` in the `ovn_client.py` file used by our OVN containers, I couldn’t locate it. Is there a possibility that this change was overlooked in the current implementation? Thank you in advance for your guidance. Best regards /Jan Wasilewski References: [1] https://paste.openstack.org/show/b5oFVHJdKX7r3j00qunc/ [2] https://paste.openstack.org/show/boHGj6dcY4IKANn93xgf/ [3] https://paste.openstack.org/show/b46Wfoni1vK5I5vcYnNj/ wt., 21 sty 2025 o 03:59 Miro Tomaska <mtomaska@redhat.com> napisał(a):
Hi Jan,
What openstack version are you using, just curious? I just tried this on the master branch and it works just fine. I set the `fdb_age_threshold` in the [ovn] section of the ml2_config.ini, just like you shown. Then I restarted the neutron server and created a new provider network. Lastly, I confirmed that the fdb_age_treshold was set in the other_config column of the OVN NB DB logical switch column. Looking at the neutron code, the fdb_age_threshold gets only set on the provider networks[1]. I.e networks with set provider network attribute[2][3]. Your manual script sets fdb_age_threshold on all logical switches.
[1] https://opendev.org/openstack/neutron/src/commit/b7beb59fe18eaa0de61cd81c82d... [2] https://opendev.org/openstack/neutron/src/commit/b7beb59fe18eaa0de61cd81c82d... [3] https://docs.openstack.org/neutron/latest/admin/intro-os-networking.html#pro...
I hope this helps
-Miro
On Mon, Jan 20, 2025 at 11:26 AM Jan Wasilewski <finarffin@gmail.com> wrote:
Hi Stackers,
Over the past few days, we encountered an issue during the migration of VMs from a customer environment to our OpenStack cloud. Both environments were connected via a cross-connect network (a VLAN-type network spanning the cloud and the customer environment), which resulted in duplicate MAC addresses in our OVN database. This occurred because the migrated VM retained the same MAC address as previously used in the customer's environment(so "ovn-sbctl list fdb" returned a port which was no-longer used and leads to such duplication) .
To address the issue, we used the following command to clear the FDB database: ovn-sbctl --all destroy fdb
While researching further, we came across the `fdb_age_threshold` configuration [1], which seemed to be a useful feature to prevent similar issues in the future. We attempted to implement it in our Kolla-Ansible environment by adding the following configuration to ` */etc/kolla/config/neutron/ml2_conf.ini*`: [ovn] fdb_age_threshold = 920
After deploying the changes, however, we noticed that the setting did not take effect in OVN. The configuration only applied successfully after we executed a manual script to propagate the setting directly to OVN [2]. Anyway such change is applicable only for exsisting networks, so it is far from perfect solution.
Could you provide guidance on whether this behavior is due to incorrect documentation, an error in our configuration process, or an additional requirement needed to enable this feature? Any insights would be greatly appreciated.
Thank you in advance for your support! /Jan Wasilewski
**References:** [1] https://docs.openstack.org/neutron/latest/configuration/ml2-conf.html#ovn.fd...
-- - Miro
participants (2)
-
Jan Wasilewski
-
Miro Tomaska