Chapter 6. Configuring allowed address pairs In Red Hat OpenStack Services on OpenShift (RHOSO) networking environments, an allowed address pair is when you identify a specific MAC address, IP address, or both to allow network traffic to pass through a port regardless of the subnet. When you define allowed address pairs, you are able to use protocols like Virtual Router Redundancy Protocol (VRRP) that float an IP address between two VM instances to enable fast data plane failover. A port whose IP address is a member of an allowed address pair of another port is referred to as a virtual port (vport). You define allowed address pairs using the OpenStack command-line client openstack port command. This section contains the following topics: Section 6.1, "Usage rules for allowed address pairs" Section 6.2, "Adding an allowed address pair to a pre-existing port" Section 6.3, "Creating a port and allowing one address pair" 6.1. Usage rules for allowed address pairs When using allowed address pairs in Red Hat OpenStack Services on OpenShift (RHOSO) networking environments, you must follow these rules: When creating a VM instance, do not bind the instance to a virtual port (vport). Instead, use a port whose IP address is not a member of another port's allowed address pair. Binding a vport to an instance prevents the instance from spawning and produces an error message similar to the following: WARNING nova.virt.libvirt.driver [req-XXXX - - - default default] [instance: XXXXXXXXX] Timeout waiting for [('network-vif-plugged', 'XXXXXXXXXX')] for instance with vm_state building and task_state spawning.: eventlet.timeout.Timeout: 300 seconds It is possible to create VIPs. However, the IP address assigned to a bound port using allowed_address_pairs , should match the virtual port IP address (/32). If you use a CIDR format IP address for the bound port allowed_address_pairs instead, port forwarding is not configured in the back end, and traffic fails for any IP in the CIDR expecting to reach the bound IP port. Do not use the default security group with a wider IP address range in an allowed address pair. Doing so can allow a single port to bypass security groups for all other ports within the same network. For example, this command impacts all ports in the network and bypasses all security groups: USD openstack port set --allowed-address \ mac-address=3e:37:09:4b,ip-address=0.0.0.0/0 \ 9e67d44eab334f07bf82fa1b17d824b6 Additional resources Section 6.2, "Adding an allowed address pair to a pre-existing port" Section 6.3, "Creating a port and allowing one address pair" 6.2. Adding an allowed address pair to a pre-existing port In Red Hat OpenStack Services on OpenShift (RHOSO) networking environments, you can add an allowed address pair to a port to enable network traffic to flow through the port regardless of the subnet. Prerequisites The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud. The python-openstackclient package resides on your workstation. Ensure that you follow the rules when using allowed address pairs. For more information, see Section 6.1, "Usage rules for allowed address pairs" . Procedure Confirm that the system OS_CLOUD variable is set for your cloud: USD echo USDOS_CLOUD my_cloud Reset the variable if necessary: USD export OS_CLOUD=my_other_cloud As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command. Use the following command to add allowed address pairs: USD openstack port set --allowed-address mac-address=<mac_address>,ip-address=<ip_cidr> <port> Note You cannot set an allowed-address pair that matches the mac_address and ip_address of a port. This is because such a setting has no effect since traffic matching the mac_address and ip_address is already allowed to pass through the port. Additional resources port create in the Command line interface reference Section 6.1, "Usage rules for allowed address pairs" Section 6.3, "Creating a port and allowing one address pair" 6.3. Creating a port and allowing one address pair In Red Hat OpenStack Services on OpenShift (RHOSO) environments, you can create a port with an allowed address pair to enable network traffic to flow through the port regardless of the subnet. Prerequisites The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud. The python-openstackclient package resides on your workstation. Ensure that you follow the rules when using allowed address pairs. For more information, see Section 6.1, "Usage rules for allowed address pairs" . Procedure Confirm that the system OS_CLOUD variable is set for your cloud: USD echo USDOS_CLOUD my_cloud Reset the variable if necessary: USD export OS_CLOUD=my_other_cloud As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command. Use the following command to create a port and allow one address pair: USD openstack port create --network <network> --allowed-address \ mac-address=<mac_address>,ip-address=<ip_cidr> <port_name> Additional resources port create in the Command line interface reference Section 6.1, "Usage rules for allowed address pairs" Section 6.2, "Adding an allowed address pair to a pre-existing port"

Commands:
WARNING nova.virt.libvirt.driver [req-XXXX - - - default default] [instance: XXXXXXXXX] Timeout waiting for [('network-vif-plugged', 'XXXXXXXXXX')] for instance with vm_state building and task_state spawning.: eventlet.timeout.Timeout: 300 seconds
openstack port set --allowed-address mac-address=3e:37:09:4b,ip-address=0.0.0.0/0 9e67d44eab334f07bf82fa1b17d824b6
dnf list installed python-openstackclient
echo USDOS_CLOUD my_cloud
export OS_CLOUD=my_other_cloud
openstack port set --allowed-address mac-address=<mac_address>,ip-address=<ip_cidr> <port>
dnf list installed python-openstackclient
echo USDOS_CLOUD my_cloud
export OS_CLOUD=my_other_cloud
openstack port create --network <network> --allowed-address mac-address=<mac_address>,ip-address=<ip_cidr> <port_name>