neutron基础五（vxlans）

架构图画的有点屎，凑合看
[img]http://dl2.iteye.com/upload/attachment/0114/6523/e7efc208-23c6-34f5-aced-43c563f1a63a.jpg[/img]
架构就是两台服务器
192.168.139.55
192.168.139.221
两台机器先都关闭防火墙，iptables selinux等
[code="java"]
# systemctl stop firewalld
# systemctl disable firewalld
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
Removed symlink /etc/systemd/system/basic.target.wants/firewalld.service.
#
# iptables -F
[/code]


在每个服务器上分建立两个namespace：zou和huiying
服务器和namespace通过veth peer连接
55服务器上的两个namespace中的ip都是 10.1.0.5
221服务器上的两个namespace中的ip都是10.1.0.6

每台服务器上设置个两个vxlan，remote都设置成[color=red]对方的ip[/color]
每台服务器建立两个桥接，每个桥接都对应一个namespace，
桥接上一头接连接namespace的veth 中的一头
另一头接vxlan

这样保证一台服务器上的某个namespace
和另一个服务器上的相同的namespace之间是可以互相ping通的，而且namespace之间的ip是可以相同且互不影响的

现在192.168.139.221这台机器上操作：
开启vxlan的内核模块
[code="java"]
# modprobe vxlan
# lsmod|grep vxlan
vxlan 41236 0
ip6_udp_tunnel 12755 1 vxlan
udp_tunnel 13187 1 vxlan
[/code]

添加两个namespace
[code="java"]
# ip netns add zou
# ip netns add huiying
# ip netns
[/code]

添加veth peer，并把一头扔进namespace
[code="java"]
# ip link add zouveth0 type veth peer name zouveth1
# ip link add hyveth0 type veth peer name hyveth1
#
# ip link set zouveth1 netns zou
# ip link set hyveth1 netns huiying
#
# ip netns exec zou ip addr add dev zouveth1 10.1.0.5/24
# ip netns exec huiying ip addr add dev hyveth1 10.1.0.5/24
# ip netns exec zou ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
5: zouveth1@if6: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
link/ether ca:c6:5f:d3:4d:78 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 10.1.0.5/24 scope global zouveth1
valid_lft forever preferred_lft forever
[/code]

建立两个桥接
并把veth peer的另一头放到桥上
[code="java"]
# brctl addbr br-zou
# brctl addbr br-hy
# brctl show
bridge name bridge id STP enabled interfaces
br-hy 8000.000000000000 no
br-zou 8000.000000000000 no
virbr0 8000.525400f67072 yes virbr0-nic
#
# brctl addif br-zou zouveth0
# brctl addif br-hy hyveth0
[/code]

简历两个vxlan，并把他绑定到对应的桥上，
[color=red]注意vxlan的remote 指向另一头的ip[/color]
[code="java"]
# ip link add vxlan-10 type vxlan id 10 remote 192.168.139.55 dev eth0
vxlan: destination port not specified
Will use Linux kernel default (non-standard value)
Use 'dstport 4789' to get the IANA assigned value
Use 'dstport 0' to get default and quiet this message
#
#
# ip link add vxlan-20 type vxlan id 20 remote 192.168.139.55 dev eth0
vxlan: destination port not specified
Will use Linux kernel default (non-standard value)
Use 'dstport 4789' to get the IANA assigned value
Use 'dstport 0' to get default and quiet this message
#
# brctl addif br-zou vxlan-10
# brctl addif br-hy vxlan-20
# brctl show
bridge name bridge id STP enabled interfaces
br-hy 8000.2a1d69b51d52 no hyveth0
vxlan-20
br-zou 8000.1a724b6efa37 no vxlan-10
zouveth0
virbr0 8000.525400f67072 yes virbr0-nic
[/code]
这种配置是点对点的，
[b][color=red]如果是多台机器[/color][/b]
使用[color=red]组播[/color]地址

 
ip link add vxlan-10 type vxlan id 10 group 224.0.0.2 dev eth0 dstport 4789

参考
[url]http://www.cnblogs.com/sammyliu/p/4985907.html[/url]
查看vxlan
[code="java"]
# ip -d link show vxlan-10
11: vxlan-10: <BROADCAST,MULTICAST> mtu 1450 qdisc noop master br-zou state DOWN mode DEFAULT
link/ether 92:fa:81:6a:1a:53 brd ff:ff:ff:ff:ff:ff promiscuity 1
vxlan id 10 remote 192.168.139.55 dev eth0 srcport 0 0 dstport 8472 ageing 300 addrgenmode eui64
# ip -d link show vxlan-20
12: vxlan-20: <BROADCAST,MULTICAST> mtu 1450 qdisc noop master br-hy state DOWN mode DEFAULT
link/ether 2a:1d:69:b5:1d:52 brd ff:ff:ff:ff:ff:ff promiscuity 1
vxlan id 20 remote 192.168.139.55 dev eth0 srcport 0 0 dstport 8472 ageing 300 addrgenmode eui64
#
[/code]

把相应的veth peer namespace中的lo，桥，vxlan都up起来
[code="java"]
# ip link set dev zouveth0 up
# ip link set dev hyveth0 up
#
# ip netns exec zou ip link set dev zouveth1 up
# ip netns exec huiying ip link set dev hyveth1 up
#
# ip netns exec zou ip link set dev lo up
# ip netns exec huiying ip link set dev lo up
#
# ip link set dev br-zou up
#
# ip link set dev br-hy up
#
# ip link set dev vxlan-10 up
#
# ip link set dev vxlan-20 up
[/code]


配置另一台机器139.55，类似的操作，只要把vxlan的remote的ip指向221

modprobe vxlan
lsmod|grep vxlan

ip netns add zou
ip netns add huiying
ip netns show

ip link add zouveth0 type veth peer name zouveth1 
ip link add hyveth0 type veth peer name hyveth1

ip link set zouveth1 netns zou
ip link set hyveth1 netns huiying

ip netns exec zou ip a add dev zouveth1 10.1.0.5/24
ip netns exec huiying ip a add dev hyveth1 10.1.0.5/24

brctl addbr br-zou
brctl addbr br-hy

brctl addif br-zou zouveth0
brctl addif br-hy hyveth0
brctl show

ip link add vxlan-10 type vxlan id 10 remote 192.168.139.221 dev eth0
ip link add vxlan-20 type vxlan id 20 remote 192.168.139.221 dev eth0

ip -d link show vxlan-10
ip -d link show vxlan-20

brctl addif br-zou vxlan-10
brctl addif br-hy vxlan-20
brctl show


ip link set dev zouveth0 up
ip link set dev hyveth0 up

ip netns exec zou ip link set dev zouveth1 up
ip netns exec huiying ip link set dev hyveth1 up

ip netns exec zou ip link set dev lo up
ip netns exec huiying ip link set dev lo up

ip link set dev br-zou up
ip link set dev br-hy up

ip link set dev vxlan-10 up
ip link set dev vxlan-20 up

这样55对应的两个namespace中的IP都为 10.1.0.5
221对应的两个namespace重点ip都为 10.1.0.6

在55中
先查看vxlan的mac地址
[code="java"]
# ip netns exec zou ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
5: zouveth1@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT qlen 1000
link/ether da:6f:4f:60:05:cd brd ff:ff:ff:ff:ff:ff link-netnsid 0
#
[/code]
再ping 221那台机器上的namespace中的ip
[code="java"]
# ip netns exec zou ping 10.1.0.6
PING 10.1.0.6 (10.1.0.6) 56(84) bytes of data.
64 bytes from 10.1.0.6: icmp_seq=1 ttl=64 time=0.026 ms
64 bytes from 10.1.0.6: icmp_seq=2 ttl=64 time=0.031 ms
[/code]

在221上查看
zou这个namespace中
[code="java"]
# ip netns exec zou tcpdump -i zouveth1 -e -l -v|grep "da.*6f"
tcpdump: listening on zouveth1, link-type EN10MB (Ethernet), capture size 65535 bytes
15:12:13.848660 da:6f:4f:60:05:cd (oui Unknown) > ca:c6:5f:d3:4d:78 (oui Unknown), ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 63120, offset 0, flags [DF], proto ICMP (1), length 84)
15:12:13.848693 ca:c6:5f:d3:4d:78 (oui Unknown) > da:6f:4f:60:05:cd (oui Unknown), ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 16897, offset 0, flags [none], proto ICMP (1), length 84)
15:12:14.849065 da:6f:4f:60:05:cd (oui Unknown) > ca:c6:5f:d3:4d:78 (oui Unknown), ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 63121, offset 0, flags [DF], proto ICMP (1), length 84)
15:12:14.849095 ca:c6:5f:d3:4d:78 (oui Unknown) > da:6f:4f:60:05:cd (oui Unknown), ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 16898, offset 0, flags [none], proto ICMP (1), length 84)
[/code]

可以对比对应的mac地址观察

另一个命名空间huiying则没有反应
[code="java"]
# ip netns exec huiying tcpdump -i hyveth1 -e -l -v|grep "da.*6f"
tcpdump: listening on hyveth1, link-type EN10MB (Ethernet), capture size 65535 bytes
[/code]

[color=red]bridge fdb[/color]
[code="java"]
# bridge fdb
01:00:5e:00:00:01 dev eth0 self permanent
33:33:00:00:00:01 dev eth0 self permanent
33:33:ff:aa:80:17 dev eth0 self permanent
01:00:5e:00:00:fb dev eth0 self permanent
52:54:00:71:94:cc dev virbr0-nic master virbr0 permanent
02:79:96:c5:98:ab dev virbr0 vlan 1 master virbr0 permanent
52:54:00:71:94:cc dev virbr0-nic vlan 1 master virbr0 permanent
01:00:5e:00:00:01 dev virbr0-nic self permanent
33:33:00:00:00:01 dev zouveth0 self permanent
01:00:5e:00:00:01 dev zouveth0 self permanent
33:33:ff:72:d9:0a dev zouveth0 self permanent
33:33:00:00:00:01 dev hyveth0 self permanent
01:00:5e:00:00:01 dev hyveth0 self permanent
33:33:ff:b6:40:3f dev hyveth0 self permanent
de:6b:2c:60:e9:c5 dev vxlan-10 vlan 1 master br-zou permanent
ca:c6:5f:d3:4d:78 dev vxlan-10 master br-zou
7a:c0:eb:72:d9:0a dev zouveth0 vlan 1 master br-zou permanent
da:6f:4f:60:05:cd dev zouveth0 master br-zou
7a:c0:eb:72:d9:0a dev zouveth0 master br-zou permanent
de:6b:2c:60:e9:c5 dev vxlan-10 master br-zou permanent
46:78:2b:25:71:e9 dev br-zou vlan 1 master br-zou permanent
4a:30:4f:b6:40:3f dev hyveth0 vlan 1 master br-hy permanent
fa:09:12:47:8f:77 dev br-hy vlan 1 master br-hy permanent
0e:f6:b2:b5:cb:d9 dev vxlan-20 vlan 1 master br-hy permanent
0e:f6:b2:b5:cb:d9 dev vxlan-20 master br-hy permanent
4a:30:4f:b6:40:3f dev hyveth0 master br-hy permanent
00:00:00:00:00:00 dev vxlan-10 dst 192.168.139.221 via eth0 self permanent
ca:c6:5f:d3:4d:78 dev vxlan-10 dst 192.168.139.221 self
00:00:00:00:00:00 dev vxlan-20 dst 192.168.139.221 via eth0 self permanent
#
[/code]


######################总结

#任何一台机器


ip link
brctl show
brctl addbr br-hao
ip link 
brctl addbr br-ning
ip link set br-hao up
ip link set br-ning up
ip netns add hao
ip netns
ip link add haoveth0 type veth peer name haoveth1
ip link add ningveth0 type veth peer name ningveth1
ip link set haoveth1 netns hao
ip link set ningveth1 nents ning
ip link set ningveth1 netns ning
ip link set ningveth0 up
ip link set haoveth0 up
ip netns exec hao ip link set haoveth1 up
ip netns exec ning ip link set ningveth1 up
ip netns exec hao ip link set lo up
ip netns exec ning ip link set lo up

brctl addif br-hao haoveth0
brctl addif br-ning ningveth0

ip netns exec hao ip addr
ip netns exec hao ip link
ip netns exec hao ifconfig
ip netns exec ning ifconfig

ip link add vxlan-10 type vxlan id 10  group 224.0.0.2 dev eth0 dstport  4789
ip link add vxlan-20 type vxlan id 20  group 224.0.0.2 dev eth0 dstport  4790
ip link set vxlan-10 up 
brctl addif br-hao vxlan-10
ip link set vxlan-20 up 
brctl addif br-ning vxlan-20

ip netns exec hao ip addr add dev haoveth1 10.1.0.6/24
ip netns exec ning  ip addr add dev ningveth1 10.1.0.6/24

#这里的ip改一下

brctl addif br-hao vxlan-10
ip netns exec hao ip link
ip netns exec hao ifconfig
ip netns exec hao ping 10.1.0.5
ip netns exec ning ping 10.1.0.5