How to configure OVN router?

Overview

Based on the experimental environment in my previous article, I will now add the three-layer network infrastructure to OVN. The final result will be a pair of logical switches connected by a logical router. In addition, the router will be configured to provide IP addresses through the built-in DHCP service in OVN.

Refactoring logic components

As the setup starts to get more complex, we will restructure the network architecture. The new logical network topology is as follows:

• 2 logical switches: “dmz” and “inside”
• Logical router "tenant1" which connects two logical switches
• IP network “dmz”: 172.16.255.128/26
• IP network “inside”: 172.16.255.192/26
• Each logical switch has a pair of "virtual machines"

The new logical network is shown in the figure below

Understanding Routing

In this lab, we will create an OVN router, a "distributed logical router" (DLR). DLR is different from a traditional router because it is not a physical device, but a logical architecture (unlike a logical switch). DLR exists only as a function in OVS: in other words, each OVS instance can simulate a three-layer router locally before forwarding traffic on the overlay network.

Creating Logical Switches and Logical Routers

Define the logical switch on ubuntu1:

 ovn-nbctl ls- add inside
 ovn-nbctl ls- add dmz

Add the logical router and its associated router and switch ports:

 # Add router tenant1
 ovn-nbctl lr- add tenant1 
  
 # Create a port for the router tenant1 to connect to the DMZ switch
 ovn-nbctl lrp- add tenant1 tenant1-dmz 02:ac:10:ff:01:29 172.16.255.129/26 
  
 # Create port dmz-tenant1 for the dmz switch to connect to the router tenant1
 ovn-nbctl lsp- add dmz dmz-tenant1
 ovn-nbctl lsp- set -type dmz-tenant1 router
 ovn-nbctl lsp -set -addresses dmz-tenant1 02:ac:10:ff:01:29
 ovn-nbctl lsp- set -options dmz-tenant1 router-port=tenant1-dmz 
  
 #Create a port for the router tenant1 to connect to the inside switch
 ovn-nbctl lrp- add tenant1 tenant1-inside 02:ac:10:ff:01:93 172.16.255.193/26 
  
 #Create port inside-tenant1 for the inside switch to connect to the router tenant1
 ovn-nbctl lsp- add inside inside-tenant1
 ovn-nbctl lsp- set -type inside-tenant1 router
 ovn-nbctl lsp- set -addresses inside-tenant1 02:ac:10:ff:01:93
 ovn-nbctl lsp- set -options inside-tenant1 router-port=tenant1-inside 
  
 ovn-nbctl show

Add DHCP

DHCP in OVN is a bit different than most solutions. Most people assume that the administrator will:

1. Defines a set of DHCP options for a given subnet
2. Create a logical switch port and define the MAC address and IP address for the port
3. Assign DHCP options to this port.
4. Set port security to allow only assigned addresses

Next, we will configure logical ports for the four virtual machines.

On ubuntu1:

 ovn-nbctl lsp- add dmz dmz-vm1
 ovn-nbctl lsp- set -addresses dmz-vm1 "02:ac:10:ff:01:30 172.16.255.130"  
 ovn-nbctl lsp- set -port-security dmz-vm1 "02:ac:10:ff:01:30 172.16.255.130"   
  
 ovn-nbctl lsp- add dmz dmz-vm2
 ovn-nbctl lsp- set -addresses dmz-vm2 "02:ac:10:ff:01:31 172.16.255.131"  
 ovn-nbctl lsp- set -port-security dmz-vm2 "02:ac:10:ff:01:31 172.16.255.131"   
  
 ovn-nbctl lsp- add inside inside-vm3
 ovn-nbctl lsp- set -addresses inside-vm3 "02:ac:10:ff:01:94 172.16.255.194"  
 ovn-nbctl lsp- set -port-security inside-vm3 "02:ac:10:ff:01:94 172.16.255.194"   
  
 ovn-nbctl lsp- add inside inside-vm4
 ovn-nbctl lsp- set -addresses inside-vm4 "02:ac:10:ff:01:95 172.16.255.195"  
 ovn-nbctl lsp- set -port-security inside-vm4 "02:ac:10:ff:01:95 172.16.255.195"   
  
 ovn-nbctl show

You may have noticed that, unlike the previous experiment, now we can define the mac and IP address with one command. The IP address definition achieves our two goals:

1. It implements ARP suppression by having OVN locally answer ARP requests for IP/MACs it knows about.
2. The IP address will be assigned from the interface on which the DHCP request is received. This is how DHCP is implemented.

Next, we need to define the DHCP options and assign them to the logical ports. The process here will be a little different than what we have seen before, as we will be interacting directly with the OVN NB database. The reason for doing this is that we need to capture the UUIDs in the DHCP_Options so that we can assign UUIDs to switch ports. To do this, we will output the captured results of the ovn-nbctl command into a pair of bash variables.

 dmzDhcp="$(ovn-nbctl create DHCP_Options cidr=172.16.255.128/26 \
 options= "\"server_id\"=\"172.16.255.129\" \"server_mac\"=\"02:ac:10:ff:01:29\" \
 \ "lease_time\"=\"3600\" \"router\"=\"172.16.255.129\"" )"
 echo $dmzDhcp 
  
 insideDhcp="$(ovn-nbctl create DHCP_Options cidr=172.16.255.192/26 \
 options= "\"server_id\"=\"172.16.255.193\" \"server_mac\"=\"02:ac:10:ff:01:93\" \
 \ "lease_time\"=\"3600\" \"router\"=\"172.16.255.193\"" )"
 echo $insideDhcp 
  
 ovn-nbctl dhcp-options-list

If you want to learn more about the OVN NB database, see the ovn-nb manual.

Now, we will assign DHCP_Options to the logical switch port using the UUID stored in the variable.

 ovn-nbctl lsp- set -dhcpv4-options dmz-vm1 $dmzDhcp
 ovn-nbctl lsp-get-dhcpv4-options dmz-vm1 
  
 ovn-nbctl lsp- set -dhcpv4-options dmz-vm2 $dmzDhcp
 ovn-nbctl lsp-get-dhcpv4-options dmz-vm2 
  
 ovn-nbctl lsp- set -dhcpv4-options inside-vm3 $insideDhcp
 ovn-nbctl lsp-get-dhcpv4-options inside-vm3 
  
 ovn-nbctl lsp- set -dhcpv4-options inside-vm4 $insideDhcp
 ovn-nbctl lsp-get-dhcpv4-options inside-vm4

Configuring the virtual machine

As in the previous experiment, we will use the "pseudo virtual machine" built using the OVS internal ports and network namespace. The difference now is that we will use DHCP for address allocation.

Next we will set up the virtual machine.

On Ubuntu 2:

 ip netns add vm1
 ovs-vsctl add -port br- int vm1 -- set interface vm1 type=internal  
 ip link set vm1 address 02:ac:10:ff:01:30
 ip link set vm1 netns vm1
 ovs-vsctl set Interface vm1 external_ids:iface-id=dmz-vm1
 ip netns exec vm1 dhclient vm1
 ip netns exec vm1 ip addr show vm1
 ip netns exec vm1 ip route show 
  
 ip netns add vm3
 ovs-vsctl add -port br- int vm3 -- set interface vm3 type=internal  
 ip link set vm3 address 02:ac:10:ff:01:94
 ip link set vm3 netns vm3
 ovs-vsctl set Interface vm3 external_ids:iface-id=inside-vm3
 ip netns exec vm3 dhclient vm3
 ip netns exec vm3 ip addr show vm3
 ip netns exec vm3 ip route show

On Ubuntu 3:

 ip netns add vm2
 ovs-vsctl add -port br- int vm2 -- set interface vm2 type=internal  
 ip link set vm2 address 02:ac:10:ff:01:31
 ip link set vm2 netns vm2
 ovs-vsctl set Interface vm2 external_ids:iface-id=dmz-vm2
 ip netns exec vm2 dhclient vm2
 ip netns exec vm2 ip addr show vm2
 ip netns exec vm2 ip route show 
  
 ip netns add vm4
 ovs-vsctl add -port br- int vm4 -- set interface vm4 type=internal  
 ip link set vm4 address 02:ac:10:ff:01:95
 ip link set vm4 netns vm4
 ovs-vsctl set Interface vm4 external_ids:iface-id=inside-vm4
 ip netns exec vm4 dhclient vm4
 ip netns exec vm4 ip addr show vm4
 ip netns exec vm4 ip route show

Testing network connectivity

On ubuntu2, test network connectivity from vm1:

 # ping vm1's default gateway
 root@ubuntu2:~# ip netns exec vm1 ping 172.16.255.129
 PING 172.16.255.129 (172.16.255.129) 56(84) bytes of data.
 64 bytes from 172.16.255.129: icmp_seq=1 ttl=254 time =0.689 ms
 64 bytes from 172.16.255.129: icmp_seq=2 ttl=254 time =0.393 ms
 64 bytes from 172.16.255.129: icmp_seq=3 ttl=254 time =0.483 ms   
 # Ping vm2 from the overlay network (across tenant1)
 root@ubuntu2:~# ip netns exec vm1 ping 172.16.255.131
 PING 172.16.255.131 (172.16.255.131) 56(84) bytes of data.
 64 bytes from 172.16.255.131: icmp_seq=1 ttl=64 time =2.16 ms
 64 bytes from 172.16.255.131: icmp_seq=2 ttl=64 time =0.573 ms
 64 bytes from 172.16.255.131: icmp_seq=3 ttl=64 time =0.446 ms   
 # Ping vm3 through the router (across the entire overlay network)
 root@ubuntu2:~# ip netns exec vm1 ping 172.16.255.194
 PING 172.16.255.194 (172.16.255.194) 56(84) bytes of data.
 64 bytes from 172.16.255.194: icmp_seq=1 ttl=63 time =1.37 ms
 64 bytes from 172.16.255.194: icmp_seq=2 ttl=63 time =0.077 ms
 64 bytes from 172.16.255.194: icmp_seq=3 ttl=63 time =0.076 ms   
 # Ping vm4 through the router (across the entire overlay network)
 root@ubuntu2:~# ip netns exec vm1 ping 172.16.255.195
 PING 172.16.255.195 (172.16.255.195) 56(84) bytes of data.
 64 bytes from 172.16.255.195: icmp_seq=1 ttl=63 time =1.79 ms
 64 bytes from 172.16.255.195: icmp_seq=2 ttl=63 time =0.605 ms
 64 bytes from 172.16.255.195: icmp_seq=3 ttl=63 time =0.503 ms

Conclusion

OVN makes layer 3 overlay networks easy to deploy and manage. In addition, the way services like DHCP are built directly into the system helps reduce the number of external components required to build an effective SDN solution. In the next article, we will discuss how to connect our (currently isolated) overlay network to the outside world.

Translator profile: Zheng Minxian works for Nooyun Systems (Shanghai) Co., Ltd. He works at Nooyun R&D Center in Nanjing as a solution engineer.