Bug 1945506 - OCP on OSP. ML2/OVN w DVR fails to build SDN infrastructure properly if detached ports with FIPs are used for communication
Summary: OCP on OSP. ML2/OVN w DVR fails to build SDN infrastructure properly if detac...
Keywords:
Status: CLOSED DUPLICATE of bug 1929901
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: python-networking-ovn
Version: 16.1 (Train)
Hardware: All
OS: All
urgent
urgent
Target Milestone: ---
: ---
Assignee: ffernand
QA Contact: Eran Kuris
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-04-01 07:44 UTC by Alex Stupnikov
Modified: 2024-10-01 17:49 UTC (History)
7 users (show)

Fixed In Version: ovn2.13-20.12.0-149.el8fdp
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-09-10 15:03:56 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker OSP-1707 0 None None None 2022-08-30 12:05:51 UTC

Description Alex Stupnikov 2021-04-01 07:44:09 UTC
Description of problem:

One of our customers is running RHOSP 16.1 ML2/OVN deployment with DVR and faces communication problems when two VMs from same tenant network are using Floatig IPs to communicate with each other. This case is a bit special for the following reasons:

- one of VMs (client) should have used floating IP attached to its port. But in reality we can see that server sees SNAT source IP from client side instead of VM's FIP
- second VM (server) is using Fixed IP and FIP addresses from detached port to server client's requests
- from VM's perspective we can see that TCP connection is established, client is able to trasfer initial request and get TCP ack from server, server is able to transfer some data in return, but client's TCP acks can't reach the server.

We have collected some tcpdumps to understand this issue better and it looks like this problem is caused by asymmetric traffic and inconsistent processing of affected TCP flow by stateful firewall.

I will provide more information about IP addresses and data we have privately.


Note You need to log in before you can comment on or make changes to this bug.