Hi there,

I am setting a relatively small OpenStack (Juno) deployment which I am trying to deploy to with the aim of moving the current deployment in a production state when I have ironed out all the bugs. (Possibly involving a redeploy with the assistance of Puppet, not sure yet).

However I have encountered a blocker I am unable to overcome. Any QRouters I create do not appear to pass traffic onto the virtual machines. I can ping either side of the router, but any traffic that should be DNATed isn't appearing on the qr side of the router.

Some background on the setup:

• 3x CentOS 7 Controller/Network Nodes running Neutron OpenVSwitch Agents, Neutron L3 Agents, Neutron DHCP Agents and Metadata Agents (control1 through control3)
• 7x CentOS 7 Compute Nodes running Neutron OpenVSwitch Agents (compute1 through compute7)

Routers are set to be non-distributed and HA. (I wanted to go distributed and HA unfortunately that isn't yet supported in Juno). We have one external VLAN (47 in this setup) which is our DMZ 10.47.0.0/20, and we have configured this with the goal of adding more VLANs with external allocations in future.

We also have the following networks for various functions:

10.47.16.0/24 Management (VLAN 48) 10.47.17.0/24 Mesh (For GRE Traffic, VLAN 49)

Here is some relevant output and configuration files:

ovs-vsctl show on management node with active router

[root@control3 ~]# ovs-vsctl show
7efc1761-efab-4caa-9932-654caf074936
    Bridge br-tun
        Port "gre-0a01e441"
            Interface "gre-0a01e441"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.65"}
        Port "gre-0a01e451"
            Interface "gre-0a01e451"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.81"}
        Port "gre-0a01e453"
            Interface "gre-0a01e453"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.83"}
        Port "gre-0a01e452"
            Interface "gre-0a01e452"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.82"}
        Port br-tun
            Interface br-tun
                type: internal
        Port "gre-0a01e456"
            Interface "gre-0a01e456"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.86"}
        Port patch-int
            Interface patch-int
                type: patch
                options: {peer=patch-tun}
        Port "gre-0a01e454"
            Interface "gre-0a01e454"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.84"}
        Port "gre-0a01e457"
            Interface "gre-0a01e457"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.87"}
        Port "gre-0a01e440"
            Interface "gre-0a01e440"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.64"}
        Port "gre-0a01e455"
            Interface "gre-0a01e455"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.85"}
    Bridge br-int
        fail_mode: secure
        Port "qr-8668140a-07"
            tag: 1
            Interface "qr-8668140a-07"
                type: internal
        Port patch-tun
            Interface patch-tun
                type: patch
                options: {peer=patch-int}
        Port "tap9e08a279-67"
            tag: 1
            Interface "tap9e08a279-67"
        Port br-int
            Interface ...