Distributed Virtual Routing with VRRP¶

Controller node configuration¶

1. Add the following to /etc/neutron/neutron.conf:

   [DEFAULT]
   core_plugin = ml2
   service_plugins = router
   allow_overlapping_ips = True
   router_distributed = True
   l3_ha = True
   l3_ha_net_cidr = 169.254.192.0/18
   max_l3_agents_per_router = 3
   

   When the router_distributed = True flag is configured, routers created by all users are distributed. Without it, only privileged users can create distributed routers by using --distributed True.

   Similarly, when the l3_ha = True flag is configured, routers created by all users default to HA.

   It follows that with these two flags set to True in the configuration file, routers created by all users will default to distributed HA routers (DVR HA).

   The same can explicitly be accomplished by a user with administrative credentials setting the flags in the openstack router create command:

   $ openstack router create name-of-router --distributed --ha
   

   Note

   The max_l3_agents_per_router determine the number of backup DVR/SNAT routers which will be instantiated.

2. Add the following to /etc/neutron/plugins/ml2/ml2_conf.ini:

   [ml2]
   type_drivers = flat,vxlan
   tenant_network_types = vxlan
   mechanism_drivers = openvswitch,l2population
   extension_drivers = port_security
   
   [ml2_type_flat]
   flat_networks = external
   
   [ml2_type_vxlan]
   vni_ranges = MIN_VXLAN_ID:MAX_VXLAN_ID
   

   Replace MIN_VXLAN_ID and MAX_VXLAN_ID with VXLAN ID minimum and maximum values suitable for your environment.

   Note

   The first value in the tenant_network_types option becomes the default project network type when a regular user creates a network.

Network nodes¶

1. Configure the Open vSwitch agent. Add the following to /etc/neutron/plugins/ml2/openvswitch_agent.ini:

   [ovs]
   local_ip = TUNNEL_INTERFACE_IP_ADDRESS
   bridge_mappings = external:br-ex
   
   [agent]
   enable_distributed_routing = True
   tunnel_types = vxlan
   l2_population = True
   

   Replace TUNNEL_INTERFACE_IP_ADDRESS with the IP address of the interface that handles VXLAN project networks.

2. Configure the L3 agent. Add the following to /etc/neutron/l3_agent.ini:

   [DEFAULT]
   ha_vrrp_auth_password = password
   interface_driver = openvswitch
   external_network_bridge =
   agent_mode = dvr_snat
   

   Note

   The external_network_bridge option intentionally contains no value.

Compute nodes¶

1. Configure the Open vSwitch agent. Add the following to /etc/neutron/plugins/ml2/openvswitch_agent.ini:

   [ovs]
   local_ip = TUNNEL_INTERFACE_IP_ADDRESS
   bridge_mappings = external:br-ex
   
   [agent]
   enable_distributed_routing = True
   tunnel_types = vxlan
   l2_population = True
   
   [securitygroup]
   firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
   

2. Configure the L3 agent. Add the following to /etc/neutron/l3_agent.ini:

   [DEFAULT]
   interface_driver = openvswitch
   external_network_bridge =
   agent_mode = dvr
   

   Replace TUNNEL_INTERFACE_IP_ADDRESS with the IP address of the interface that handles VXLAN project networks.

Keepalived VRRP health check¶

The health of your keepalived instances can be automatically monitored via a bash script that verifies connectivity to all available and configured gateway addresses. In the event that connectivity is lost, the master router is rescheduled to another node.

If all routers lose connectivity simultaneously, the process of selecting a new master router will be repeated in a round-robin fashion until one or more routers have their connectivity restored.

To enable this feature, edit the l3_agent.ini file:

ha_vrrp_health_check_interval = 30

Where ha_vrrp_health_check_interval indicates how often in seconds the health check should run. The default value is 0, which indicates that the check should not run at all.