l3_agent.ini¶

agent_mode¶

Type:	string
Default:	legacy
Valid Values:	dvr, dvr_snat, legacy, dvr_no_external

The working mode for the agent. Allowed modes are: ‘legacy’ - this preserves the existing behavior where the L3 agent is deployed on a centralized networking node to provide L3 services like DNAT, and SNAT. Use this mode if you do not want to adopt DVR. ‘dvr’ - this mode enables DVR functionality and must be used for an L3 agent that runs on a compute host. ‘dvr_snat’ - this enables centralized SNAT support in conjunction with DVR. This mode must be used for an L3 agent running on a centralized node (or in single-host deployments, e.g. devstack). ‘dvr_no_external’ - this mode enables only East/West DVR routing functionality for a L3 agent that runs on a compute host, the North/South functionality such as DNAT and SNAT will be provided by the centralized network node that is running in ‘dvr_snat’ mode. This mode should be used when there is no external network connectivity on the compute host.

metadata_port¶

Type:	port number
Default:	9697
Minimum Value:	0
Maximum Value:	65535

TCP Port used by Neutron metadata namespace proxy.

handle_internal_only_routers¶

Type:	boolean
Default:	true

Indicates that this L3 agent should also handle routers that do not have an external network gateway configured. This option should be True only for a single agent in a Neutron deployment, and may be False for all agents if all routers must have an external network gateway.

gateway_external_network_id¶

Type:	string
Default:	u''

When external_network_bridge is set, each L3 agent can be associated with no more than one external network. This value should be set to the UUID of that external network. To allow L3 agent support multiple external networks, both the external_network_bridge and gateway_external_network_id must be left empty.

Warning

This option is deprecated for removal. Its value may be silently ignored in the future.

ipv6_gateway¶

Type:	string
Default:	u''

With IPv6, the network used for the external gateway does not need to have an associated subnet, since the automatically assigned link-local address (LLA) can be used. However, an IPv6 gateway address is needed for use as the next-hop for the default route. If no IPv6 gateway address is configured here, (and only then) the neutron router will be configured to get its default route from router advertisements (RAs) from the upstream router; in which case the upstream router must also be configured to send these RAs. The ipv6_gateway, when configured, should be the LLA of the interface on the upstream router. If a next-hop using a global unique address (GUA) is desired, it needs to be done via a subnet allocated to the network and not through this parameter.

prefix_delegation_driver¶

Type:	string
Default:	dibbler

Driver used for ipv6 prefix delegation. This needs to be an entry point defined in the neutron.agent.linux.pd_drivers namespace. See setup.cfg for entry points included with the neutron source.

enable_metadata_proxy¶

Type:	boolean
Default:	true

Allow running metadata proxy.

metadata_access_mark¶

Type:	string
Default:	0x1

Iptables mangle mark used to mark metadata valid requests. This mark will be masked with 0xffff so that only the lower 16 bits will be used.

external_ingress_mark¶

Type:	string
Default:	0x2

Iptables mangle mark used to mark ingress from external network. This mark will be masked with 0xffff so that only the lower 16 bits will be used.

external_network_bridge¶

Type:	string
Default:	u''

Name of bridge used for external network traffic. When this parameter is set, the L3 agent will plug an interface directly into an external bridge which will not allow any wiring by the L2 agent. Using this will result in incorrect port statuses. This option is deprecated and will be removed in Ocata.

Warning

This option is deprecated for removal. Its value may be silently ignored in the future.

periodic_interval¶

Type:	integer
Default:	40

Seconds between running periodic tasks.

api_workers¶

Type:	integer
Default:	<None>

Number of separate API worker processes for service. If not specified, the default is equal to the number of CPUs available for best performance.

rpc_workers¶

Type:	integer
Default:	1

Number of RPC worker processes for service.

rpc_state_report_workers¶

Type:	integer
Default:	1

Number of RPC worker processes dedicated to state reports queue.

periodic_fuzzy_delay¶

Type:	integer
Default:	5

Range of seconds to randomly delay when starting the periodic task scheduler to reduce stampeding. (Disable by setting to 0)

ha_confs_path¶

Type:	string
Default:	$state_path/ha_confs

Location to store keepalived/conntrackd config files

ha_vrrp_auth_type¶

Type:	string
Default:	PASS
Valid Values:	AH, PASS

VRRP authentication type

ha_vrrp_auth_password¶

Type:	string
Default:	<None>

VRRP authentication password

ha_vrrp_advert_int¶

Type:	integer
Default:	2

The advertisement interval in seconds

ha_keepalived_state_change_server_threads¶

Type:	integer
Default:	(1 + <num_of_cpus>) / 2
Minimum Value:	1

Number of concurrent threads for keepalived server connection requests. More threads create a higher CPU load on the agent node.

ha_vrrp_health_check_interval¶

Type:	integer
Default:	0

The VRRP health check interval in seconds. Values > 0 enable VRRP health checks. Setting it to 0 disables VRRP health checks. Recommended value is 5. This will cause pings to be sent to the gateway IP address(es) - requires ICMP_ECHO_REQUEST to be enabled on the gateway. If gateway fails, all routers will be reported as master, and master election will be repeated in round-robin fashion, until one of the router restore the gateway connection.

pd_confs¶

Type:	string
Default:	$state_path/pd

Location to store IPv6 PD files.

vendor_pen¶

Type:	string
Default:	8888

A decimal value as Vendor’s Registered Private Enterprise Number as required by RFC3315 DUID-EN.

ra_confs¶

Type:	string
Default:	$state_path/ra

Location to store IPv6 RA config files

min_rtr_adv_interval¶

Type:	integer
Default:	30

MinRtrAdvInterval setting for radvd.conf

max_rtr_adv_interval¶

Type:	integer
Default:	100

MaxRtrAdvInterval setting for radvd.conf

ovs_integration_bridge¶

Type:	string
Default:	br-int

Name of Open vSwitch bridge to use

ovs_use_veth¶

Type:	boolean
Default:	false

Uses veth for an OVS interface or not. Support kernels with limited namespace support (e.g. RHEL 6.5) and rate limiting on router’s gateway port so long as ovs_use_veth is set to True.

interface_driver¶

Type:	string
Default:	<None>

The driver used to manage the virtual interface.

availability_zone¶

Type:	string
Default:	nova

Availability zone of this node

extensions¶

Type:	list
Default:	u''

Extensions list to use

report_interval¶

Type:	floating point
Default:	30

Seconds between nodes reporting state to server; should be less than agent_down_time, best if it is half or less than agent_down_time.

log_agent_heartbeats¶

Type:	boolean
Default:	false

Log agent heartbeats

ovsdb_interface¶

Type:	string
Default:	native
Valid Values:	vsctl, native

The interface for interacting with the OVSDB

Warning

This option is deprecated for removal. Its value may be silently ignored in the future.

ovsdb_connection¶

Type:	string
Default:	tcp:127.0.0.1:6640

The connection string for the OVSDB backend. Will be used by ovsdb-client when monitoring and used for the all ovsdb commands when native ovsdb_interface is enabled

ssl_key_file¶

Type:	string
Default:	<None>

The SSL private key file to use when interacting with OVSDB. Required when using an “ssl:” prefixed ovsdb_connection

ssl_cert_file¶

Type:	string
Default:	<None>

The SSL certificate file to use when interacting with OVSDB. Required when using an “ssl:” prefixed ovsdb_connection

ssl_ca_cert_file¶

Type:	string
Default:	<None>

The Certificate Authority (CA) certificate to use when interacting with OVSDB. Required when using an “ssl:” prefixed ovsdb_connection

ovsdb_timeout¶

Type:	integer
Default:	10

Timeout in seconds for ovsdb commands. If the timeout expires, ovsdb commands will fail with ALARMCLOCK error.

Deprecated Variations¶

Group	Name
DEFAULT	ovs_vsctl_timeout

bridge_mac_table_size¶

Type:	integer
Default:	50000

The maximum number of MAC addresses to learn on a bridge managed by the Neutron OVS agent. Values outside a reasonable range (10 to 1,000,000) might be overridden by Open vSwitch according to the documentation.

igmp_snooping_enable¶

Type:	boolean
Default:	false

Enable IGMP snooping for integration bridge. If this option is set to True, support for Internet Group Management Protocol (IGMP) is enabled in integration bridge. Setting this option to True will also enable Open vSwitch mcast-snooping-disable-flood-unregistered flag. This option will disable flooding of unregistered multicast packets to all ports. The switch will send unregistered multicast packets only to ports connected to multicast routers.