Ask Your Question
0

Openstack Neutron Instances not getting IP addresses

asked 2017-01-27 15:23:39 -0500

jbdkz100 gravatar image

updated 2017-05-30 09:26:51 -0500

rbowen gravatar image

I have built a test Openstack Environment, identical to the Newton install guide:

http://docs.openstack.org/newton/install-guide-rdo/

My Cirros images only get assigned a DHCP address when the CentOS7 firewall is disabled on both Controller and Compute.

NICs on both Controller and Compute are in the public zone. I have issued the following commands on both for DHCP ports:

firewall-cmd --zone=public --add-port=67/udp --permanent
firewall-cmd --zone=public --add-port=68/udp --permanent
firewall-cmd --reload

In addition, I have also issued the following commands on Controller and Compute:

firewall-cmd --zone=public --add-service=dhcp --permanent
firewall-cmd --reload
edit retag flag offensive close merge delete

Comments

What's your network configuration? If you use tunneling for tenant networks (VXLAN, GRE), the packets between the servers are not DHCP, but VXLAN (UDP port 4786 or so) or GRE packets. You have to either open the firewalls entirely or selectively for that type of traffic.

Bernd Bausch gravatar imageBernd Bausch ( 2017-01-27 21:51:12 -0500 )edit

I have chosen Network Option 2, or self service network in the install guide:

http://docs.openstack.org/newton/install-guide-rdo/overview.html#network2

VXLAN is enabled. Is UDP 4786 the only port I need to open?

jbdkz100 gravatar imagejbdkz100 ( 2017-01-29 09:53:08 -0500 )edit

I have already opened up all ports on controller and compute in this Newton firewall guide: http://docs.openstack.org/newton/config-reference/firewalls-default-ports.html

jbdkz100 gravatar imagejbdkz100 ( 2017-01-29 09:53:56 -0500 )edit

UDP 4789 (corrected) is the VXLAN port. It doesn't appear on the page you reference, so I suppose if you didn't open this port, tenant network traffic is blocked. You could open it and see what happens. Or check by running tcpdump on the network node's physical interface, filtering for UDP 4789.

Bernd Bausch gravatar imageBernd Bausch ( 2017-01-30 03:26:08 -0500 )edit

1 answer

Sort by ยป oldest newest most voted
0

answered 2017-06-17 15:58:28 -0500

jbdkz100 gravatar image

Resolved, after activating firewalld logging, I found out that the VXLAN upd port 8472 was the problem, I opened the port on both the controller and the compute node, and instances are not getting DHCP leases.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Get to know Ask OpenStack

Resources for moderators

Question Tools

1 follower

Stats

Asked: 2017-01-27 15:23:39 -0500

Seen: 1,235 times

Last updated: Jun 17 '17