Installing, Configuring, and Verifying Neutron

1. Configure database access.

   1 2	[database] connection = mysql+pymysql://neutron:<PASSWORD>@controller/neutron

2. Modify the content in the [DEFAULT] section.

   1 2 3 4 5 6 7

   [DEFAULT] core_plugin = ml2 service_plugins = transport_url = rabbit://openstack:<PASSWORD>@controller auth_strategy = keystone notify_nova_on_port_status_changes = true notify_nova_on_port_data_changes = true

   

   Leave service_plugins blank and set <PASSWORD> to the password of the rabbit OpenStack user.

3. Configure Identity service access.

   1 2 3 4 5 6 7 8 9 10

   [keystone_authtoken] www_authenticate_uri = http://controller:5000 auth_url = http://controller:5000 memcached_servers = controller:11211 auth_type = password project_domain_name = default user_domain_name = default project_name = service username = neutron password = <PASSWORD>

4. Configure parameters in the [nova] section.
   

   By default, the configuration file does not contain this section. You need to add it.

   1 2 3 4 5 6 7 8 9

   [nova] auth_url = http://controller:5000 auth_type = password project_domain_name = default user_domain_name = default region_name = RegionOne project_name = service username = nova password = <PASSWORD>

5. Configure the lock path.

   1 2	[oslo_concurrency] lock_path = /var/lib/neutron/tmp

1. Enable the flat and VLAN networks.

   You need to add [ml2], [ml2_type_flat], and [securitygroup].

   1 2 3 4 5

   [ml2] type_drivers = flat,vlan tenant_network_types = mechanism_drivers = linuxbridge extension_drivers = port_security

   

   Leave tenant_network_types unspecified.

2. Set the flat network type to provider.

   1 2	[ml2_type_flat] flat_networks = provider

3. Configure the VLAN as a flat network.

   1 2	[ml2_type_vlan] network_vlan_ranges = provider

4. Enable ipset to improve security.

   1 2	[securitygroup] enable_ipset = true

1. Map the provider virtual network to the physical network.

   1 2	[linux_bridge] physical_interface_mappings = provider:enp3s0

   

   In this example, the provider network uses the enp3s0 network port. Set the network port based on actual requirements. The physical network adapter is configured for the service network, not for the management network. For details, see Networking.

2. Disable the VXLAN network.

   1 2	[vxlan] enable_vxlan = false

3. Enable the security group, configure the iptables firewall driver for the Linux bridge, save the configuration, and exit.

   1 2 3

   [securitygroup] enable_security_group = true firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

4. Check that the Linux operating system kernel supports bridge filters.

   Add the following to the /etc/sysctl.conf file, save the file, and exit:

   1 2	net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1

   

5. Add the network bridge filter.

   1 2 3

   modprobe br_netfilter sysctl -p sed -i '$amodprobe br_netfilter' /etc/rc.local

Add the following to the /etc/neutron/dhcp_agent.ini file, save the file, and exit:

1
2
3
4

[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true

1

vim /etc/neutron/metadata_agent.ini

Configure the metadata host and shared key.

1
2
3

[DEFAULT]
nova_metadata_host = controller
metadata_proxy_shared_secret = <PASSWORD>

1

vim /etc/nova/nova.conf

Set access parameters, enable the metadata agent, and set the password.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

[neutron]
# ...
url = http://controller:9696
auth_url = http://controller:5000
auth_type = password
project_domain_name = default
user_domain_name = default
region_name = RegionOne
project_name = service
username = neutron
password = <PASSWORD>
service_metadata_proxy = true
metadata_proxy_shared_secret = <PASSWORD>

Before performing this operation, ensure that Nova has been installed.

1. In the [database] section, comment out all connection options (commented by default), because the compute node does not directly access the database.
2. Configure RabbitMQ message queue access.

   1 2	[DEFAULT] transport_url = rabbit://openstack:<PASSWORD>@controller

3. Configure Identity service access.

   1 2 3 4 5 6 7 8 9 10 11 12

   [DEFAULT] auth_strategy = keystone [keystone_authtoken] www_authenticate_uri = http://controller:5000 auth_url = http://controller:5000 memcached_servers = controller:11211 auth_type = password project_domain_name = default user_domain_name = default project_name = service username = neutron password = <PASSWORD>

4. Configure the lock path.

   1 2	[oslo_concurrency] lock_path = /var/lib/neutron/tmp

1. Map the provider virtual network to the provider physical network port.

   1 2	[linux_bridge] physical_interface_mappings = provider:enp3s0

   

   In this example, the provider network uses the enp3s0 network port. Set the network port based on actual requirements. The physical network adapter is configured for the service network, not for the management network. For details, see Networking.

2. Disable the VXLAN network.

   1 2	[vxlan] enable_vxlan = false

3. Enable the security group and configure the iptables firewall driver for the Linux bridge.

   1 2 3

   [securitygroup] enable_security_group = true firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver

1. Add the following content to the file:

   1 2 3

   net.ipv4.ip_forward=1 net.ipv4.conf.all.rp_filter=0 net.ipv4.conf.default.rp_filter=0

2. Make the configuration take effect.

   1

   sysctl -p

1. Configure database access.

   1 2	[database] connection = mysql+pymysql://neutron:<PASSWORD>@controller/neutron

2. Enable the ML2 plugin and disable other plugins.

   1 2 3 4 5 6 7

   [DEFAULT] core_plugin = ml2 service_plugins = transport_url = rabbit://openstack:<PASSWORD>@controller auth_strategy = keystone notify_nova_on_port_status_changes = true notify_nova_on_port_data_changes = true

3. Configure Identity service access.

   1 2 3 4 5 6 7 8 9 10

   [keystone_authtoken] www_authenticate_uri = http://controller:5000 auth_url = http://controller:5000 memcached_servers = controller:11211 auth_type = password project_domain_name = default user_domain_name = default project_name = service username = neutron password = <PASSWORD>

4. Configure Nova parameters.

   You need to add [nova].

   1 2 3 4 5 6 7 8 9

   [nova] auth_url = http://controller:5000 auth_type = password project_domain_name = default user_domain_name = default region_name = RegionOne project_name = service username = nova password = <PASSWORD>

5. Configure the lock path.

   1 2	[oslo_concurrency] lock_path = /var/lib/neutron/tmp

1. Enable the flat and VLAN networks.

   You need to add [ml2], [ml2_type_flat], [ml2_type_vlan], and [securitygroup].

   1 2 3 4 5 6 7 8 9 10 11

   [ml2] type_drivers = flat,vlan tenant_network_types = mechanism_drivers = openvswitch extension_drivers = port_security [ml2_type_flat] flat_networks = provider [ml2_type_vlan] network_vlan_ranges = provider [securitygroup] enable_ipset = true

Edit the /etc/neutron/dhcp_agent.ini file.

1
2
3
4
5

[DEFAULT]
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true
interface_driver = openvswitch
force_metadata = true

Edit the /etc/neutron/metadata_agent.ini file.

Configure the metadata host and shared key.

1
2
3

[DEFAULT]
nova_metadata_host = controller
metadata_proxy_shared_secret = <PASSWORD>

PASSWORD is the password for accessing the Neutron database.

1. Add the following content to the file:

   1 2 3

   net.ipv4.ip_forward=1 net.ipv4.conf.all.rp_filter=0 net.ipv4.conf.default.rp_filter=0

2. Make the configuration take effect.

   1

   sysctl -p

1. Configure RabbitMQ message queue access.

   1 2	[DEFAULT] transport_url = rabbit://openstack:<PASSWORD>@controller

   

   PASSWORD indicates the password set by the RabbitMQ service for the openstack user.

2. Configure Identity service access.

   1 2 3 4 5 6 7 8 9 10 11 12

   [DEFAULT] auth_strategy = keystone [keystone_authtoken] www_authenticate_uri = http://controller:5000 auth_url = http://controller:5000 memcached_servers = controller:11211 auth_type = password project_domain_name = default user_domain_name = default project_name = service username = neutron password = <PASSWORD>

   

   PASSWORD is the password for accessing the Neutron database.

3. Configure the lock path.

   1 2	[oslo_concurrency] lock_path = /var/lib/neutron/tmp