36512433f9
As part of the installation guide improvement project, I performed the following operations on the Neutron initial networks section: 1) Added new diagram to help visualize network components and their locations within the environment. 2) Added explanation for each procedure. 3) Added use of 'openrc' files. 4) Clarified phrasing and wording. Change-Id: I69946a009807681115ebe23c011495ffb8b9467e Partial-Bug: #1291071 Implements: blueprint networking-install-guide-improvements
185 lines
9.4 KiB
XML
185 lines
9.4 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<section xml:id="neutron-initial-networks"
|
|
xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:svg="http://www.w3.org/2000/svg"
|
|
xmlns:html="http://www.w3.org/1999/xhtml" version="5.0">
|
|
<title>Create initial networks</title>
|
|
<para>Before launching your first instance, you must create the
|
|
necessary virtual network infrastructure to which the instance will
|
|
connect, including the
|
|
<link linkend="neutron_initial-external-network">external network</link>
|
|
and
|
|
<link linkend="neutron_initial-tenant-network">tenant network</link>.
|
|
See <xref linkend="neutron_figure-neutron-initial-networks"/>. After
|
|
creating this infrastructure, we recommend that you
|
|
<link linkend="neutron_initial-networks-verify">verify
|
|
connectivity</link> and resolve any issues before proceeding further.
|
|
</para>
|
|
<figure xml:id="neutron_figure-neutron-initial-networks">
|
|
<title>Initial networks</title>
|
|
<mediaobject>
|
|
<imageobject>
|
|
<imagedata contentwidth="6in"
|
|
fileref="figures/installguide_neutron-initial-networks.png"/>
|
|
</imageobject>
|
|
</mediaobject>
|
|
</figure>
|
|
<section xml:id="neutron_initial-external-network">
|
|
<title>External network</title>
|
|
<para>The external network typically provides internet access for
|
|
your instances. By default, this network only allows internet
|
|
access <emphasis>from</emphasis> instances using
|
|
<glossterm>Network Address Translation (NAT)</glossterm>. You can
|
|
enable internet access <emphasis>to</emphasis> individual instances
|
|
using a <glossterm>floating IP address</glossterm> and suitable
|
|
<glossterm>security group</glossterm> rules. The <literal>admin</literal>
|
|
tenant owns this network because it provides external network
|
|
access for multiple tenants. You must also enable sharing to allow
|
|
access by those tenants.</para>
|
|
<note>
|
|
<para>Perform these commands on the controller node.</para>
|
|
</note>
|
|
<procedure>
|
|
<title>To create the external network:</title>
|
|
<step>
|
|
<para>Source the <literal>admin</literal> tenant credentials:</para>
|
|
<screen><prompt>$</prompt> <userinput>source admin-openrc.sh</userinput></screen>
|
|
</step>
|
|
<step>
|
|
<para>Create the network:</para>
|
|
<screen><prompt>$</prompt> <userinput>neutron net-create ext-net --shared --router:external=True</userinput></screen>
|
|
</step>
|
|
</procedure>
|
|
<para>Like a physical network, a virtual network requires a
|
|
<glossterm>subnet</glossterm> assigned to it. The external network
|
|
shares the same subnet and <glossterm>gateway</glossterm> associated
|
|
with the physical network connected to the external interface on the
|
|
network node. You should specify an exclusive slice of this subnet
|
|
for <glossterm>router</glossterm> and floating IP addresses to prevent
|
|
interference with other devices on the external network.</para>
|
|
<para>Replace <replaceable>FLOATING_IP_START</replaceable> and
|
|
<replaceable>FLOATING_IP_END</replaceable> with the first and last
|
|
IP addresses of the range that you want to allocate for floating IP
|
|
addresses. Replace <replaceable>EXTERNAL_NETWORK_CIDR</replaceable>
|
|
with the subnet associated with the physical network. Replace
|
|
<replaceable>EXTERNAL_NETWORK_GATEWAY</replaceable> with the gateway
|
|
associated with the physical network, typically the ".1" IP address.
|
|
You should disable <glossterm>DHCP</glossterm> on this subnet because
|
|
instances do not connect directly to the external network and floating
|
|
IP addresses require manual assignment.</para>
|
|
<procedure>
|
|
<title>To create a subnet on the external network:</title>
|
|
<step>
|
|
<para>Create the subnet:</para>
|
|
<screen><prompt>$</prompt> <userinput>neutron subnet-create ext-net --name ext-subnet \
|
|
--allocation-pool start=<replaceable>FLOATING_IP_START</replaceable>,end=<replaceable>FLOATING_IP_END</replaceable> \
|
|
--disable-dhcp --gateway <replaceable>EXTERNAL_NETWORK_GATEWAY</replaceable> <replaceable>EXTERNAL_NETWORK_CIDR</replaceable></userinput></screen>
|
|
<para>For example, using <literal>203.0.113.0/24</literal> with
|
|
floating IP address range <literal>203.0.113.101</literal> to
|
|
<literal>203.0.113.200</literal>:</para>
|
|
<screen><prompt>$</prompt> <userinput>neutron subnet-create ext-net --name ext-subnet \
|
|
--allocation-pool start=203.0.113.101,end=203.0.113.200 \
|
|
--disable-dhcp --gateway 203.0.113.1 203.0.113.0/24</userinput></screen>
|
|
</step>
|
|
</procedure>
|
|
</section>
|
|
<section xml:id="neutron_initial-tenant-network">
|
|
<title>Tenant network</title>
|
|
<para>The tenant network provides internal network access for instances.
|
|
The architecture isolates this type of network from other tenants. The
|
|
<literal>demo</literal> tenant owns this network because it only
|
|
provides network access for instances within it.</para>
|
|
<note>
|
|
<para>Perform these commands on the controller node.</para>
|
|
</note>
|
|
<procedure>
|
|
<title>To create the tenant network:</title>
|
|
<step>
|
|
<para>Source the <literal>demo</literal> tenant credentials:</para>
|
|
<screen><prompt>$</prompt> <userinput>source demo-openrc.sh</userinput></screen>
|
|
</step>
|
|
<step>
|
|
<para>Create the network:</para>
|
|
<screen><prompt>$</prompt> <userinput>neutron net-create demo-net</userinput></screen>
|
|
</step>
|
|
</procedure>
|
|
<para>Like the external network, your tenant network also requires
|
|
a subnet attached to it. You can specify any valid subnet because the
|
|
architecture isolates tenant networks. Replace
|
|
<replaceable>TENANT_NETWORK_CIDR</replaceable> with the subnet
|
|
you want to associate with the tenant network. Replace
|
|
<replaceable>TENANT_NETWORK_GATEWAY</replaceable> with the gateway you
|
|
want to associate with this network, typically the ".1" IP address. By
|
|
default, this subnet will use DHCP so your instances can obtain IP
|
|
addresses.</para>
|
|
<procedure>
|
|
<title>To create a subnet on the tenant network:</title>
|
|
<step>
|
|
<para>Create the subnet:</para>
|
|
<screen><prompt>$</prompt> <userinput>neutron subnet-create demo-net --name demo-subnet \
|
|
--gateway <replaceable>TENANT_NETWORK_GATEWAY</replaceable> <replaceable>TENANT_NETWORK_CIDR</replaceable></userinput></screen>
|
|
<para>Example using <literal>192.168.1.0/24</literal>:</para>
|
|
<screen><prompt>$</prompt> <userinput>neutron subnet-create demo-net --name demo-subnet \
|
|
--gateway 192.168.1.1 192.168.1.0/24</userinput></screen>
|
|
</step>
|
|
</procedure>
|
|
<para>A virtual router passes network traffic between two or more virtual
|
|
networks. Each router requires one or more
|
|
<glossterm baseform="interface">interfaces</glossterm> and/or gateways
|
|
that provide access to specific networks. In this case, you will create
|
|
a router and attach your tenant and external networks to it.</para>
|
|
<procedure>
|
|
<title>To create a router on the tenant network and attach the external
|
|
and tenant networks to it:</title>
|
|
<step>
|
|
<para>Create the router:</para>
|
|
<screen><prompt>$</prompt> <userinput>neutron router-create demo-router</userinput></screen>
|
|
</step>
|
|
<step>
|
|
<para>Attach the router to the <literal>demo</literal> tenant
|
|
subnet:</para>
|
|
<screen><prompt>$</prompt> <userinput>neutron router-interface-add demo-router demo-subnet</userinput></screen>
|
|
</step>
|
|
<step>
|
|
<para>Attach the router to the external network by setting it as
|
|
the gateway:</para>
|
|
<screen><prompt>$</prompt> <userinput>neutron router-gateway-set demo-router ext-net</userinput></screen>
|
|
</step>
|
|
</procedure>
|
|
</section>
|
|
<section xml:id="neutron_initial-networks-verify">
|
|
<title>Verify connectivity</title>
|
|
<para>We recommend that you verify network connectivity and resolve any
|
|
issues before proceeding further. Following the external network
|
|
subnet example using <literal>203.0.113.0/24</literal>, the tenant
|
|
router gateway should occupy the lowest IP address in the floating
|
|
IP address range, <literal>203.0.113.101</literal>. If you configured
|
|
your external physical network and virtual networks correctly, you
|
|
you should be able to <command>ping</command> this IP address from any
|
|
host on your external physical network.</para>
|
|
<note>
|
|
<para>If you are building your OpenStack nodes as virtual machines,
|
|
you must configure the hypervisor to permit promiscuous mode on the
|
|
external network.</para>
|
|
</note>
|
|
<procedure>
|
|
<title>To verify network connectivity:</title>
|
|
<step>
|
|
<para>Ping the tenant router gateway:</para>
|
|
<screen><prompt>$</prompt> <userinput>ping -c 4 203.0.113.101</userinput>
|
|
<computeroutput>PING 203.0.113.101 (203.0.113.101) 56(84) bytes of data.
|
|
64 bytes from 203.0.113.101: icmp_req=1 ttl=64 time=0.619 ms
|
|
64 bytes from 203.0.113.101: icmp_req=2 ttl=64 time=0.189 ms
|
|
64 bytes from 203.0.113.101: icmp_req=3 ttl=64 time=0.165 ms
|
|
64 bytes from 203.0.113.101: icmp_req=4 ttl=64 time=0.216 ms
|
|
|
|
--- 203.0.113.101 ping statistics ---
|
|
4 packets transmitted, 4 received, 0% packet loss, time 2999ms
|
|
rtt min/avg/max/mdev = 0.165/0.297/0.619/0.187 ms</computeroutput></screen>
|
|
</step>
|
|
</procedure>
|
|
</section>
|
|
</section>
|