Ask Your Question

Cannot ping from external network to floating IP of tenant router gateway

asked 2014-09-12 03:44:12 -0500

jazzsir gravatar image

updated 2014-09-25 02:44:35 -0500

I have followed the Icehouse doc "OpenStack Installation Guide(three-node)". My environment is same as the doc except IP and nodes that are builded as VM using libvirt in CentOS 6.5

In accordance with the doc.

  • Neutron server is running on controller-node
  • NIC(eth1) for external network on network-node is configured without IP (PROMISC="yes" because the node is VM)

The problem

The strange things

  • The tap and qr ports are always DOWN (on network-node) - you can check it in "the detail info"
  • The port of the router_gateway is DOWN (on controller-node) - you can check it in "the detail info"
  • There are some errors(ConnectionError, HeartbeatTimeout) in log files. - you can check it at the bottom of writing please click (more) button at the bottom of this writing to show all info
  • I assigned external IP to br-ex on network-node for test and pinged, then I can capture incoming packets by using "tcpdump -i eth1" on network-node, but there are no 'IP' packets, only 'ARP' packet in captured packets and source host(external node) receives no response

The detail info of my environment:

image description

1) IP addresses and CIDR

-controller-node : (management network)
-network-node : (management network)
       (data network)
-compute-node : (management network)
       (data network)
-external network gateway :
-the floating IP of tenant router gateway :
-external network CIDR :
-demo network CIDR :

2) network node

[root@network-node ~]# ovs-vsctl show
    Bridge br-int
        fail_mode: secure
        Port br-int
            Interface br-int
                type: internal
        Port "qr-98c762ea-d7"
            tag: 1
            Interface "qr-98c762ea-d7"
                type: internal
        Port patch-tun
            Interface patch-tun
                type: patch
                options: {peer=patch-int}
        Port "tapf5eec840-e6"
            tag: 1
            Interface "tapf5eec840-e6"
                type: internal
    Bridge br-ex
        Port "eth1"
            Interface "eth1"
        Port br-ex
            Interface br-ex
                type: internal
        Port "qg-9810105a-ed"
            Interface "qg-9810105a-ed"
                type: internal
    Bridge br-tun
        Port patch-int
            Interface patch-int
                type: patch
                options: {peer=patch-tun}
        Port "gre-0a00011f"
            Interface "gre-0a00011f"
                type: gre
                options: {in_key=flow, local_ip="", out_key=flow, remote_ip=""}
        Port br-tun
            Interface br-tun
                type: internal
    ovs_version: "1.11.0"
[root@network-node ~]#
[root@network-node ~]# ip a
2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:f6:31:07 brd ff:ff:ff:ff:ff:ff
    inet brd scope global eth0
    inet6 fe80::5054:ff:fef6:3107/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:d3:92:e2 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::5054:ff:fed3:92e2/64 scope link 
       valid_lft forever preferred_lft forever
4 ...
edit retag flag offensive close merge delete


can you let us know that you have enabled security group rules?

SGPJ gravatar imageSGPJ ( 2014-09-15 19:28:06 -0500 )edit

Hi SGPJ. Thank you for your attention. I updated my security-group-rules. My problem is that I can not ping from external network to floating IP of virtual tenant router (Not VM).

jazzsir gravatar imagejazzsir ( 2014-09-16 02:12:07 -0500 )edit

I have the same problem as you.. :(

agtion gravatar imageagtion ( 2014-09-16 07:23:22 -0500 )edit

do you have neutron-l3-agent service running? Anything strange in its log (/var/log/neutron/l3-agent.log) ?

T u l gravatar imageT u l ( 2014-09-17 15:38:04 -0500 )edit

I really thank you for your attention. Now, I check some errors in log files. but, I don't understand, because I'm just getting my feet wet. I updated the logs in my writing, please check it

jazzsir gravatar imagejazzsir ( 2014-09-17 21:10:40 -0500 )edit

2 answers

Sort by ยป oldest newest most voted

answered 2014-10-01 19:59:53 -0500

jazzsir gravatar image

updated 2014-10-01 20:20:21 -0500

hi, T u I. I think the problem is that eth1 couldn't be set into promiscuous mode. I have just posted it on this board.. Thank you so much for your support.

edit flag offensive delete link more

answered 2014-09-22 14:18:38 -0500

T u l gravatar image

updated 2015-07-02 22:41:57 -0500

fifieldt gravatar image

a stupid suggestion: did you try to reboot your nodes? also did you try to create a new network to see if the issue persists for newly-created networks? Also, please take a look here and here and this (iptables -A INPUT -p gre -j ACCEPT; iptables -A OUTPUT -p gre -j ACCEPT) for possible reasons

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Get to know Ask OpenStack

Resources for moderators

Question Tools



Asked: 2014-09-12 03:44:12 -0500

Seen: 2,960 times

Last updated: Jul 02 '15