networking-sfc流程实例解析1

openstack测试命令

#创建网络
openstack network create sfc-net-test1
openstack network create sfc-net-test2
openstack network create sfc-net-test3
openstack network create sfc-net-test4
#创建了网
openstack subnet create --network sfc-net-test1 --subnet-range 1.0.0.0/24 sfc-subnet-test1
openstack subnet create --network sfc-net-test2 --subnet-range 2.0.0.0/24 sfc-subnet-test2
openstack subnet create --network sfc-net-test3 --subnet-range 3.0.0.0/24 sfc-subnet-test3
openstack subnet create --network sfc-net-test4 --subnet-range 4.0.0.0/24 sfc-subnet-test4
#创建port
openstack port create --network sfc-net-test1 --enable sfc-port-test0
openstack port create --network sfc-net-test1 --enable sfc-port-test1
openstack port create --network sfc-net-test2 --enable sfc-port-test2
openstack port create --network sfc-net-test2 --enable sfc-port-test3
openstack port create --network sfc-net-test3 --enable sfc-port-test4
openstack port create --network sfc-net-test3 --enable sfc-port-test5
openstack port create --network sfc-net-test4 --enable sfc-port-test6
openstack port create --network sfc-net-test4 --enable sfc-port-test7
#disable security group 和 port security以免影响流量
openstack port set --no-security-group sfc-port-test0
openstack port set --no-security-group sfc-port-test1
openstack port set --no-security-group sfc-port-test2
openstack port set --no-security-group sfc-port-test3
openstack port set --no-security-group sfc-port-test4
openstack port set --no-security-group sfc-port-test5
openstack port set --no-security-group sfc-port-test6
openstack port set --no-security-group sfc-port-test7
openstack port set --disable-port-security sfc-port-test0
openstack port set --disable-port-security sfc-port-test1
openstack port set --disable-port-security sfc-port-test2
openstack port set --disable-port-security sfc-port-test3
openstack port set --disable-port-security sfc-port-test4
openstack port set --disable-port-security sfc-port-test5
openstack port set --disable-port-security sfc-port-test6
openstack port set --disable-port-security sfc-port-test7
#创建flavor
openstack flavor create --ram 4096 --disk 60 --vcpus 4 centos7-flavor
#创建VM
openstack server create --image centos7-hw --flavor centos7-flavor --port sfc-port-test0 sfc-src
openstack server create --image centos7-hw --flavor centos7-flavor --port sfc-port-test1 --port sfc-port-test2 sfc-sf-test1
openstack server create --image centos7-hw --flavor centos7-flavor --port sfc-port-test3 --port sfc-port-test4 sfc-sf-test2
openstack server create --image centos7-hw --flavor centos7-flavor --port sfc-port-test5 --port sfc-port-test6 sfc-sf-test3
openstack server create --image centos7-hw --flavor centos7-flavor --port sfc-port-test7 sfc-dst

#创建port pair，我们的VM就是SF，不支持解释MPLS和NSH头，所以correlation用默认的None，weight默认为1，不考虑支持LB
openstack sfc port pair create --ingress sfc-port-test1 --egress sfc-port-test2 port-pair-test1
openstack sfc port pair create --ingress sfc-port-test3 --egress sfc-port-test4 port-pair-test2
openstack sfc port pair create --ingress sfc-port-test5 --egress sfc-port-test6 port-pair-test3
#创建port pair group，一个group包含不对port pair，简单测试不支持LB
openstack sfc port pair group create --port-pair port-pair-test1 port-pair-group-test1
openstack sfc port pair group create --port-pair port-pair-test2 port-pair-group-test2
openstack sfc port pair group create --port-pair port-pair-test3 port-pair-group-test3
#创建流量classifier，一定要指定--logical-source-port，从哪一个口出来的流量开始走port chain
openstack sfc flow classifier create --source-ip-prefix 1.0.0.0/24 --destination-ip-prefix 4.0.0.0/24 --logical-source-port sfc-port-test0 --logical-destination-port sfc-port-test7 sfc-flow-class-test1
#创建port chain，因为网线拓扑简单，流量简单，指定为对称的
openstack sfc port chain create --chain-parameters symmetric=true --flow-classifier sfc-flow-class-test1 --port-pair-group port-pair-group-test1 --port-pair-group port-pair-group-test2 --port-pair-group port-pair-group-test3 sfc-port-chain-test1

清除环境命令

openstack sfc port chain delete sfc-port-chain-test1
penstack sfc flow classifier delete sfc-flow-class-test1
openstack sfc port pair group delete port-pair-group-test1
openstack sfc port pair group delete port-pair-group-test2
openstack sfc port pair group delete port-pair-group-test3
openstack sfc port pair delete port-pair-test1
openstack sfc port pair delete port-pair-test2
openstack sfc port pair delete port-pair-test3
openstack server delete sfc-src
openstack server delete sfc-sf-test1
openstack server delete sfc-sf-test2
openstack server delete sfc-sf-test3
openstack server delete sfc-dst
openstack port delete sfc-port-test0
openstack port delete sfc-port-test1
openstack port delete sfc-port-test2
openstack port delete sfc-port-test3
openstack port delete sfc-port-test4
openstack port delete sfc-port-test5
openstack port delete sfc-port-test6
openstack port delete sfc-port-test7

配置虚拟机sfc-src,sfc-sf-test1,sfc-sf-test2,sfc-sf-test3,sfc-dst

关闭所有主机的iptables，以及firewalld
# systemctl stop firewalld
# systemctl stop iptables
 
在sfc-src上配置ARP:
# arp -s 1.0.0.1 fa:16:3e:ee:ee:ee
 
在sfc-sf-test1，sfc-sf-test2上配置路由转发, 把eth0的流量转发到eth1上去:
# echo 1 > /proc/sys/net/ipv4/ip_forward
# ip route add 4.0.0.0/24 dev eth1
# arp -s 4.0.0.213 fa:16:3e:ee:ee:dd    #这里得IP为sfc-dst实例IP

在sfc-sf-test3上配置路由转发, 把eth0的流量转发到eth1上去:
# echo 1 > /proc/sys/net/ipv4/ip_forward

这里特别注意：sfc-sf-test3不用配置route和arp

其次：双向流程还需要配置返回路由。
在sfc-des上配置ARP:
#arp -s 1.0.0.1 fa:16:3e:ee:ee:cc

在sfc-sf-test2，sfc-sf-test3上配置路由转发, 把eth0的流量转发到eth1上去:
# ip route add 1.0.0.0/24 dev eth0
# arp -s 1.0.0.10 fa:16:3e:ee:ee:dd       #这里得IP为sfc-src实例IP

最后ping 测试