Chapter 17. Networking (neutron) Parameters You can modify the neutron service with networking parameters. Parameter Description CertificateKeySize Specifies the private key size used when creating the certificate. The default value is 2048 . ContainerOvnCertificateKeySize Override the private key size used when creating the certificate for this service. DerivePciWhitelistEnabled Whether to enable or not the pci passthrough whitelist automation. The default value is true . DhcpAgentNotification Enables DHCP agent notifications. The default value is true . DockerAdditionalSockets Additional domain sockets for the docker daemon to bind to (useful for mounting into containers that launch other containers). The default value is ['/var/lib/openstack/docker.sock'] . DockerNeutronDHCPAgentUlimit Ulimit for OpenStack Networking (neutron) DHCP Agent Container. The default value is ['nofile=16384'] . DockerNeutronL3AgentUlimit Ulimit for OpenStack Networking (neutron) L3 Agent Container. The default value is ['nofile=16384'] . DockerOpenvswitchUlimit Ulimit for Openvswitch Container. The default value is ['nofile=16384'] . DockerPuppetMountHostPuppet Whether containerized puppet executions use modules from the baremetal host. Defaults to true. Can be set to false to consume puppet modules from containers directly. The default value is true . DockerSRIOVUlimit Ulimit for SR-IOV Container. The default value is ['nofile=16384'] . EnableSQLAlchemyCollectd Set to true to enable the SQLAlchemy-collectd server plugin. The default value is false . EnableVLANTransparency If True, then allow plugins that support it to create VLAN transparent networks. The default value is false . EnforceSecureRbac Setting this option to True will configure each OpenStack service to enforce Secure RBAC by setting [oslo_policy] enforce_new_defaults and [oslo_policy] enforce_scope to True. This introduces a consistent set of RBAC personas across OpenStack services that include support for system and project scope, as well as keystone's default roles, admin, member, and reader. Do not enable this functionality until all services in your deployment actually support secure RBAC. The default value is false . MemcacheUseAdvancedPool Use the advanced (eventlet safe) memcached client pool. The default value is true . NeutronAgentDownTime Seconds to regard the agent as down; should be at least twice NeutronGlobalReportInterval, to be sure the agent is down for good. The default value is 600 . NeutronAgentExtensions Comma-separated list of extensions enabled for the OpenStack Networking (neutron) agents. The default value is qos . NeutronAllowL3AgentFailover Allow automatic l3-agent failover. The default value is True . NeutronApiOptEnvVars Hash of optional environment variables. NeutronApiOptVolumes List of optional volumes to be mounted. NeutronBridgeMappings The logical to physical bridge mappings to use. The default ( datacentre:br-ex ) maps br-ex (the external bridge on hosts) to a physical name datacentre , which provider networks can use (for example, the default floating network). If changing this, either use different post-install network scripts or be sure to keep datacentre as a mapping network name. The default value is datacentre:br-ex . NeutronCertificateKeySize Override the private key size used when creating the certificate for this service. NeutronCorePlugin The core plugin for networking. The value should be the entrypoint to be loaded from neutron.core_plugins namespace. The default value is ml2 . NeutronDBSyncExtraParams String of extra command line parameters to append to the neutron-db-manage upgrade head command. NeutronDefaultAvailabilityZones Comma-separated list of default network availability zones to be used by OpenStack Networking (neutron) if its resource is created without availability zone hints. If not set, no AZs will be configured for OpenStack Networking (neutron) network services. NeutronDhcpAgentAvailabilityZone Availability zone for OpenStack Networking (neutron) DHCP agent. If not set, no AZs will be configured for OpenStack Networking (neutron) network services. NeutronDhcpAgentDnsmasqDnsServers List of servers to use as dnsmasq forwarders. NeutronDhcpAgentDnsmasqEnableAddr6List Enable dhcp-host entry with list of addresses when port has multiple IPv6 addresses in the same subnet. The default value is true . NeutronDhcpAgentsPerNetwork The number of DHCP agents to schedule per network. The default value is 0 . NeutronDhcpCertificateKeySize Override the private key size used when creating the certificate for this service. NeutronDhcpLoadType Additional to the availability zones aware network scheduler. The default value is networks . NeutronDhcpOvsIntegrationBridge Name of Open vSwitch bridge to use. NeutronDhcpServerBroadcastReply OpenStack Networking (neutron) DHCP agent to use broadcast in DHCP replies. The default value is false . NeutronDnsDomain Domain to use for building the hostnames. The default value is openstacklocal . NeutronEnableARPResponder Enable ARP responder feature in the OVS Agent. The default value is false . NeutronEnableDibblerDockerWrapper Generate a wrapper script so OpenStack Networking (neutron) launches the dibbler client in a separate container. The default value is true . NeutronEnableDnsmasqDockerWrapper Generate a dnsmasq wrapper script so that OpenStack Networking (neutron) launches dnsmasq in a separate container. The default value is true . NeutronEnableDVR Enable Distributed Virtual Router. NeutronEnableForceMetadata If True, DHCP always provides metadata route to VM. The default value is false . NeutronEnableHaproxyDockerWrapper Generate a wrapper script so OpenStack Networking (neutron) launches haproxy in a separate container. The default value is true . NeutronEnableIgmpSnooping Enable IGMP Snooping. The default value is false . NeutronEnableInternalDNS If True, enable the internal OpenStack Networking (neutron) DNS server that provides name resolution between VMs. This parameter has no effect if NeutronDhcpAgentDnsmasqDnsServers is set. The default value is false . NeutronEnableIsolatedMetadata If True, DHCP allows metadata support on isolated networks. The default value is false . NeutronEnableKeepalivedWrapper Generate a wrapper script so OpenStack Networking (neutron) launches keepalived processes in a separate container. The default value is true . NeutronEnableL2Pop Enable/disable the L2 population feature in the OpenStack Networking (neutron) agents. The default value is False . NeutronEnableMetadataNetwork If True, DHCP provides metadata network. Requires either NeutronEnableIsolatedMetadata or NeutronEnableForceMetadata parameters to also be True. The default value is false . NeutronExcludeDevices List of <network_device>:<excluded_devices> mapping network_device to the agent's node-specific list of virtual functions that should not be used for virtual networking. excluded_devices is a semicolon separated list of virtual functions to exclude from network_device. The network_device in the mapping should appear in the physical_device_mappings list. NeutronFirewallDriver Firewall driver for realizing OpenStack Networking (neutron) security group function. NeutronFlatNetworks Sets the flat network name to configure in plugins. The default value is datacentre . NeutronGeneveMaxHeaderSize Geneve encapsulation header size. The default value is 38 . NeutronGlobalPhysnetMtu MTU of the underlying physical network. OpenStack Networking (neutron) uses this value to calculate MTU for all virtual network components. For flat and VLAN networks, OpenStack Networking uses this value without modification. For overlay networks such as VXLAN, OpenStack Networking automatically subtracts the overlay protocol overhead from this value. The default value is 0 . NeutronGlobalReportInterval Seconds between nodes reporting state to server; should be less than NeutronAgentDownTime, best if it is half or less than NeutronAgentDownTime. The default value is 300 . NeutronInterfaceDriver OpenStack Networking (neutron) DHCP Agent interface driver. The default value is neutron.agent.linux.interface.OVSInterfaceDriver . NeutronL3AgentAvailabilityZone Availability zone for OpenStack Networking (neutron) L3 agent. If not set, no AZs will be configured for OpenStack Networking (neutron) network services. NeutronL3AgentExtensions Comma-separated list of extensions enabled for the OpenStack Networking (neutron) L3 agent. NeutronL3AgentLoggingBurstLimit Maximum number of packets per rate_limit. The default value is 25 . NeutronL3AgentLoggingLocalOutputLogBase Output logfile path on agent side, default syslog file. NeutronL3AgentLoggingRateLimit Maximum number of packets logging per second. The default value is 100 . NeutronL3AgentMode Agent mode for L3 agent. Must be legacy or dvr_snat . The default value is legacy . NeutronL3AgentRadvdUser The username passed to radvd, used to drop root privileges and change user ID to username and group ID to the primary group of username. If no user specified, the user executing the L3 agent will be passed. If "root" specified, because radvd is spawned as root, no "username" parameter will be passed. The default value is root . NeutronMechanismDrivers The mechanism drivers for the OpenStack Networking (neutron) tenant network. The default value is ovn . NeutronMetadataProxySharedSecret Shared secret to prevent spoofing. NeutronMetadataWorkers Sets the number of worker processes for the OpenStack Networking (neutron) OVN metadata agent. The default value results in the configuration being left unset and a system-dependent default will be chosen (usually the number of processors). Please note that this can result in a large number of processes and memory consumption on systems with a large core count. On such systems it is recommended that a non-default value be selected that matches the load requirements. NeutronML2PhysicalNetworkMtus A list of mappings of physical networks to MTU values. The format of the mapping is <physnet>:<mtu val> . This mapping allows you to specify a physical network MTU value that differs from the default segment_mtu value in ML2 plugin and overwrites values from global_physnet_mtu for the selected network. NeutronNetworkSchedulerDriver The network schedule driver to use for availability zones. The default value is neutron.scheduler.dhcp_agent_scheduler.AZAwareWeightScheduler . NeutronNetworkType The tenant network type for OpenStack Networking (neutron). The default value is geneve . NeutronNetworkVLANRanges The OpenStack Networking (neutron) ML2 and Open vSwitch VLAN mapping range to support. Defaults to permitting any VLAN on the datacentre physical network (See NeutronBridgeMappings ). The default value is datacentre:1:1000 . NeutronOverlayIPVersion IP version used for all overlay network endpoints. The default value is 4 . NeutronOVNLoggingBurstLimit Maximum number of packets per rate_limit. The default value is 25 . NeutronOVNLoggingLocalOutputLogBase Output logfile path on agent side, default syslog file. NeutronOVNLoggingRateLimit Maximum number of packets logging per second. The default value is 100 . NeutronOVSAgentLoggingBurstLimit Maximum number of packets per rate_limit. The default value is 25 . NeutronOVSAgentLoggingLocalOutputLogBase Output logfile path on agent side, default syslog file. NeutronOVSAgentLoggingRateLimit Maximum number of packets logging per second. The default value is 100 . NeutronOVSFirewallDriver Configure the classname of the firewall driver to use for implementing security groups. Possible values depend on system configuration. Some examples are: noop , openvswitch , iptables_hybrid . The default value of an empty string results in a default supported configuration. NeutronOvsIntegrationBridge Name of Open vSwitch bridge to use. NeutronOvsResourceProviderBandwidths Comma-separated list of <bridge>:<egress_bw>:<ingress_bw> tuples, showing the available bandwidth for the given bridge in the given direction. The direction is meant from VM perspective. Bandwidth is measured in kilobits per second (kbps). The bridge must appear in bridge_mappings as the value. NeutronOVSTunnelCsum Set or un-set the tunnel header checksum on outgoing IP packet carrying GRE/VXLAN tunnel. The default value is false . NeutronOvsVnicTypeBlacklist Comma-separated list of VNIC types for which support in OpenStack Networking (neutron) is administratively prohibited by the OVS mechanism driver. NeutronPassword The password for the OpenStack Networking (neutron) service and database account. NeutronPermittedEthertypes Set additional ethertypes to to be configured on OpenStack Networking (neutron) firewalls. NeutronPhysicalDevMappings List of <physical_network>:<physical device> All physical networks listed in network_vlan_ranges on the server should have mappings to appropriate interfaces on each agent. Example "tenant0:ens2f0,tenant1:ens2f1". NeutronPluginExtensions Comma-separated list of enabled extension plugins. The default value is qos,port_security,dns_domain_ports . NeutronPluginMl2PuppetTags Puppet resource tag names that are used to generate configuration files with puppet. The default value is neutron_plugin_ml2 . NeutronPortQuota Number of ports allowed per tenant, and minus means unlimited. The default value is 500 . NeutronRouterSchedulerDriver The router schedule driver to use for availability zones. The default value is neutron.scheduler.l3_agent_scheduler.AZLeastRoutersScheduler . NeutronRpcWorkers Sets the number of RPC workers for the OpenStack Networking (neutron) service. If not specified, it'll take the value of NeutronWorkers and if this is not specified either, the default value results in the configuration being left unset and a system-dependent default will be chosen (usually 1). NeutronSecurityGroupQuota Number of security groups allowed per tenant, and minus means unlimited. The default value is 10 . NeutronServicePlugins Comma-separated list of service plugin entrypoints. The default value is qos,ovn-router,trunk,segments,port_forwarding,log . NeutronSriovAgentExtensions Comma-separated list of extensions enabled for the OpenStack Networking (neutron) SR-IOV agents. NeutronSriovResourceProviderBandwidths Comma-separated list of <network_device>:<egress_bw>:<ingress_bw> tuples, showing the available bandwidth for the given device in the given direction. The direction is meant from VM perspective. Bandwidth is measured in kilobits per second (kbps). The device must appear in physical_device_mappings as the value. NeutronSriovVnicTypeBlacklist Comma-separated list of VNIC types for which support in OpenStack Networking (neutron) is administratively prohibited by the SR-IOV mechanism driver. NeutronTunnelIdRanges Comma-separated list of <tun_min>:<tun_max> tuples enumerating ranges of GRE tunnel IDs that are available for tenant network allocation. The default value is ['1:4094'] . NeutronTunnelTypes The tunnel types for the OpenStack Networking (neutron) tenant network. The default value is vxlan . NeutronTypeDrivers Comma-separated list of network type driver entrypoints to be loaded. The default value is geneve,vxlan,vlan,flat . NeutronVhostuserSocketDir The vhost-user socket directory for OVS. NeutronVniRanges Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges of VXLAN VNI IDs that are available for tenant network allocation. The default value is ['1:65536'] . NeutronWorkers Sets the number of API and RPC workers for the OpenStack Networking service. Note that more workers creates a larger number of processes on systems, which results in excess memory consumption. It is recommended to choose a suitable non-default value on systems with high CPU core counts. 0 sets to the OpenStack internal default, which is equal to the number of CPU cores on the node. NotificationDriver Driver or drivers to handle sending notifications. The default value is noop . OVNAvailabilityZone The az options to configure in ovs db. eg. [ az-0 , az-1 , az-2 ]. OVNCMSOptions The CMS options to configure in ovs db. OVNContainerCpusetCpus Limit the specific CPUs or cores a container can use. It can be specified as a single core (ex. 0), as a comma-separated list (ex. 0,1), as a range (ex. 0-3) or a combination if methods (ex 0-3,7,11-15). The selected cores should be isolated from guests and hypervisor in order to obtain best possible performance. OVNControllerImageUpdateTimeout During update, how long we wait for the container image to be updated, in seconds. The default value is 600 . OVNControllerUpdateTimeout During update, how long we wait for the container to be updated, in seconds. The default value is 600 . OVNDbConnectionTimeout Timeout in seconds for the OVSDB connection transaction. The default value is 180 . OvnDBSCertificateKeySize Override the private key size used when creating the certificate for this service. OVNDnsServers List of servers to use as as dns forwarders. OVNEmitNeedToFrag Configure OVN to emit "need to frag" packets in case of MTU mismatch. Before enabling this configuration make sure that it's supported by the host kernel (version >= 5.2) or by checking the output of the following command ovs-appctl -t ovs-vswitchd dpif/show-dp-features br-int | grep "Check pkt length action" . The default value is false . OVNEnableHaproxyDockerWrapper Generate a wrapper script so that haproxy is launched in a separate container. The default value is true . OVNEncapType Type of encapsulation used in OVN. It can be "geneve" or "vxlan". The default value is geneve . OVNIntegrationBridge Name of the OVS bridge to use as integration bridge by OVN Controller. The default value is br-int . OvnMetadataCertificateKeySize Override the private key size used when creating the certificate for this service. OVNMetadataEnabled Whether Metadata Service has to be enabled. The default value is true . OVNNeutronSyncMode The synchronization mode of OVN with OpenStack Networking (neutron) DB. The default value is log . OVNNorthboundClusterPort Cluster port of the OVN Northbound DB server. The default value is 6643 . OVNNorthboundServerPort Port of the OVN Northbound DB server. The default value is 6641 . OVNOpenflowProbeInterval The inactivity probe interval of the OpenFlow connection to the OpenvSwitch integration bridge, in seconds. The default value is 60 . OVNOvsdbProbeInterval Probe interval in ms for the OVSDB session. The default value is 60000 . OVNQosDriver OVN notification driver for OpenStack Networking (neutron) QOS service plugin. The default value is ovn-qos . OVNRemoteProbeInterval Probe interval in ms. The default value is 60000 . OVNSouthboundClusterPort Cluster port of the OVN Southbound DB server. The default value is 6644 . OVNSouthboundServerPort Port of the OVN Southbound DB server. The default value is 6642 . OVNStaticBridgeMacMappings Static OVN Bridge MAC address mappings. Unique OVN bridge mac addresses is dynamically allocated by creating OpenStack Networking (neutron) ports. When OpenStack Networking (neutron) isn't available, for instance in the standalone deployment, use this parameter to provide static OVN bridge mac addresses. For example: controller-0: datacenter: 00:00:5E:00:53:00 provider: 00:00:5E:00:53:01 compute-0: datacenter: 00:00:5E:00:54:00 provider: 00:00:5E:00:54:01. OvsDisableEMC Disable OVS Exact Match Cache. The default value is false . OvsHwOffload Enable OVS Hardware Offload. This feature supported from OVS 2.8.0. The default value is false . PythonInterpreter The python interpreter to use for python and ansible actions. The default value is `USD(command -v python3 command -v python)`. TenantNetPhysnetMtu MTU of the underlying physical network. OpenStack Networking (neutron) uses this value to calculate MTU for all virtual network components. For flat and VLAN networks, OpenStack Networking (neutron) uses this value without modification. For overlay networks such as VXLAN, OpenStack Networking (neutron) automatically subtracts the overlay protocol overhead from this value. (The mtu setting of the Tenant network in network_data.yaml control's this parameter.). The default value is 1500 .

Commands: