Bug 1651647 - [RHOSP 12][DVR] Neutron doesn't configure multiple external subnets for one network properly
Summary: [RHOSP 12][DVR] Neutron doesn't configure multiple external subnets for one n...
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-neutron
Version: 12.0 (Pike)
Hardware: x86_64
OS: Linux
Target Milestone: ---
: ---
Assignee: Slawek Kaplonski
QA Contact: Roee Agiman
Depends On:
Blocks: 1651936
TreeView+ depends on / blocked
Reported: 2018-11-20 13:42 UTC by Alex Stupnikov
Modified: 2020-10-26 11:59 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1651936 (view as bug list)
Last Closed: 2018-12-17 15:16:35 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Launchpad 1805456 0 None None None 2018-11-27 15:44:19 UTC

Description Alex Stupnikov 2018-11-20 13:42:08 UTC
Description of problem:

It is possible to create two subnets for single external network and it looks like we support such kind of setup. However, it doesn't work properly: every DVR will have a single on-link route for ONLY ONE external subnet and will not have on-link route for another one.

As a result, there are two scenarios when routing doesn't work as it should:

- two instances with FIPs from different external subnets will have asymmetric traffic flows: if there is an on-link route for DST packet, it will be routed directly to another DVR. If not, packet will be routed to external router. As a result, if there is a stateful firewall on external router, this communication will be blocked.
- two instances with FIPs from the same external subnet could have suboptimal traffic flows if there are no on-link routes for this subnet. As a result, traffic will always go through external router, which could cause issues if router has protection against such kind of flows.

Here is an example output of routing table in fip-* namespace on compute node where single external network has two subnets: and

default via dev fg-83ec5f16-be table 2852022899 dev fg-83ec5f16-be proto kernel scope link src via dev fpr-789f245b-1 via dev fpr-789f245b-1 via dev fpr-789f245b-1

As we can see, there are host routes for local FIPs, a single on-link route for subnet and default route.

Additional information:

An upstream bug for legacy routers [1] was solved long time ago.

[1] https://bugs.launchpad.net/neutron/+bug/1312467

Note You need to log in before you can comment on or make changes to this bug.