problem security_group in openstack kilo

asked 2015-08-04 09:43:52 +0300

JYH
1 ●5 ●6 ●7

I install nova(cloudbase kilo version) on windows 2012 (Hyper-V).

I using flat mode in neutron.

but i meet problem....configure security_group....

window compute node i setted

neutron-hyperv-agent.conf [SECURITYGROUP] firewalldriver=neutron.plugins.hyperv.agent.securitygroupsdriver.HyperVSecurityGroupsDriver enablesecurity_group=true
nova.conf [DEFAULT] securitygroupapi=neutron

but i think not suported.......

--------------------------------------------------------- Log --------------------------------------------------------- 2015-08-06 14:28:30.246 3696 ERROR oslomessaging.rpc.dispatcher [req-e74dfee6-8fc3-4a9e-97c0-38fe146baccf ] Exception during message handling: Endpoint does not support RPC method tunnelupdate

2015-08-06 14:28:30.246 3696 TRACE oslo_messaging.rpc.dispatcher Traceback (most recent call last):

2015-08-06 14:28:30.246 3696 TRACE oslomessaging.rpc.dispatcher File "C:\Program Files (x86)\Cloudbase Solutions\OpenStack\Nova\Python27\lib\site-packages\oslomessaging\rpc\dispatcher.py", line 142, in dispatchand_reply

2015-08-06 14:28:30.246 3696 TRACE oslomessaging.rpc.dispatcher executorcallback))

2015-08-06 14:28:30.246 3696 TRACE oslo_messaging.rpc.dispatcher raise NoSuchMethod(method)

2015-08-06 14:28:30.246 3696 TRACE oslomessaging.rpc.dispatcher NoSuchMethod: Endpoint does not support RPC method tunnelupdate

2015-08-06 14:28:30.246 3696 TRACE oslo_messaging.rpc.dispatcher

2015-08-06 14:30:04.082 3696 INFO neutron.agent.securitygroups_rpc [req-db75690b-5f7d-44d3-862d-4dbd3ee33314 ] Refresh firewall rules

2015-08-06 14:30:04.170 3696 INFO hyperv.neutron.securitygroupsdriver [req-db75690b-5f7d-44d3-862d-4dbd3ee33314 ] Updating port rules.

2015-08-06 14:30:04.170 3696 INFO hyperv.neutron.securitygroupsdriver [req-db75690b-5f7d-44d3-862d-4dbd3ee33314 ] Creating 0 new rules, removing 3 old rules.

2015-08-06 14:30:04.388 3696 ERROR hyperv.neutron.securitygroupsdriver [req-db75690b-5f7d-44d3-862d-4dbd3ee33314 ] Hyper-V Exception: list.remove(x): x not in list while removing rules for port: 8d0215ff-5d38-451b-9307-24031b12b421

2015-08-06 14:30:14.154 3696 INFO neutron.agent.securitygroups_rpc [req-e7a28f60-4e53-42a3-bac7-54c1e886476e ] Refresh firewall rules

2015-08-06 14:30:14.246 3696 INFO hyperv.neutron.securitygroupsdriver [req-e7a28f60-4e53-42a3-bac7-54c1e886476e ] Updating port rules.

2015-08-06 14:30:14.246 3696 INFO hyperv.neutron.securitygroupsdriver [req-e7a28f60-4e53-42a3-bac7-54c1e886476e ] Creating 0 new rules, removing 0 old rules.

2015-08-06 14:38:00.572 3696 INFO neutron.agent.securitygroups_rpc [req-5e0ac430-7233-4cbd-9776-014396f9f38b ] Security group rule updated [u'1f75292d-834f-4f4f-a435-c7dbe64764cd']

2015-08-06 14:38:00.572 3696 INFO neutron.agent.securitygroups_rpc [req-5e0ac430-7233-4cbd-9776-014396f9f38b ] Refresh firewall rules

2015-08-06 14:38:00.635 3696 INFO hyperv.neutron.securitygroupsdriver [req-5e0ac430-7233-4cbd-9776-014396f9f38b ] Updating port rules.

2015-08-06 14:38:00.635 3696 INFO hyperv.neutron.securitygroupsdriver [req-5e0ac430-7233-4cbd-9776-014396f9f38b ] Creating 1 new rules, removing 0 old rules.

2015-08-06 14:38:01.430 3696 ERROR hyperv.neutron.securitygroupsdriver [req-5e0ac430-7233-4cbd-9776-014396f9f38b ] Hyper-V Exception: Protocol while adding rules for port: 8d0215ff-5d38-451b-9307-24031b12b421

edit retag flag offensive close merge delete

add a comment

2 answers

Sort by » oldest newest most voted

answered 2015-08-05 04:26:25 +0300

JYH
1 ●5 ●6 ●7

Thank you for answer.

I have 3node.

controller node - ubuntu 14.04, network node - ubunut 14.04, compute node - window 2012 datacenter

1. neutron security-group-show sginwhichyourvmiscreated

root@controller:~# neutron security-group-show win_ter

Field | Value

description | allow terminal

id | 1f75292d-834f-4f4f-a435-c7dbe64764cd

name | win_ter

securitygrouprules | {"remotegroupid": null, "direction": "ingress", "remoteipprefix": "0.0.0.0/0", "protocol": "icmp", "tenantid": "edd4e17281e84808ac7edb17a9107469", "portrangemax": null, "securitygroupid": "1f75292d-834f-4f4f-a435-c7dbe64764cd", "portrange_min": null, "ethertype": "IPv4", "id": "bb0da8a8-3c41-40f4-9050-cf2535ccc26f"}

tenant_id | edd4e17281e84808ac7edb17a9107469

root@controller:~# nova secgroup-list-rules win_ter

IP Protocol | From Port | To Port | IP Range | Source Group

icmp | -1 | -1 | 0.0.0.0/0

2.nova show instance_name

root@controller:~# nova show server1 | grep securi

| securitygroups | winter

3. pip freeze | grep networking-hyperv

※ controller , netowrk node

root@controller:~# !pip

pip list| grep networking-hyperv

networking-hyperv (2015.1.0)

root@controller:~# pip freeze | grep networking-hyperv

networking-hyperv==2015.1.0

※ compute node

PS C:\Users\Administrator.WIN-EQDDAE5V39M> pip freeze | findstr networking-hyperv

networking-hyperv==2015.1.0.dev11

PS C:\Users\Administrator.WIN-EQDDAE5V39M> pip list | findstr networking-hyperv

networking-hyperv (2015.1.0.dev11)

## Exceptionally i can execute this commnad in window compute node

- Get-VMNetworkAdapterExtendedAcl

Is not it supports Windows 2012 datacenter?

edit flag offensive delete link

Comments

Windows 2012? Not Windows 2012 R2? If you are uncertain of which version you have, you can run ``gwmi -Class Win32_OperatingSystem`` and see the version. 6.2 is Windows Server 2012 and 6.3 is Windows Server 2012 R2. Unfortunately, Security groups works on 2012 or newer...

Claudiu Belu ( 2015-08-06 11:04:45 +0300 )edit

... since in Windows Server 2012 R2 it was introduced Extendeed ACLs, which are used to create the security groups.

Claudiu Belu ( 2015-08-06 11:06:12 +0300 )edit

Just after successfully setting is changed to 2012 r2 datacenter. But the problem is when the outbound port is set to neutron security-group-rule-create command. - commnad 1. neutron security-group-rule-create --ethertype ipv4 --direction egress --protocol udp --port-range-min 53 --port-range-max 53 --remote-ip-prefix 0.0.0.0/0 win_ter 2. neutron security-group-rule-create --ethertype ipv4 --direction egress --protocol tcp --port-range-min 53 --port-range-max 53 --remote-ip-prefix 0.0.0.0/0 win_ter - window compute node Get-VMNetworkAdapterExtendedAcl -VMName instance-00000034 ------------------------------------------------------------------------ I 'd be expected to enter port 53 RemotePort. But it was entered in the LocalPort. Anyway thank you so so so thankful answer . Claudiu Belu will be blessed in the future.

JYH ( 2015-08-07 11:06:46 +0300 )edit

add a comment

answered 2015-08-04 13:56:04 +0300

Claudiu Belu
319 ●4 ●5

Hello JYH,

The configuration options you have set seems to be in order.

The switch port is bound to the VM properly, otherwise security group rules would not be added to it.

In order to determine the issue, I would like to ask you for some information. I would like to know what rules are currently in your security group, so we can replicate the issue:

neutron security-group-show sg_in_which_your_vm_is_created

To see the VM's security group:

nova show instance_name

Also, it would be useful to know the version of networking-hyperv you have (run on Hyper-V):

pip freeze | grep networking-hyperv

I will be waiting for your reply!

Best regards,

Claudiu Belu

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

problem security_group in openstack kilo

2 answers

Comments

Your Answer

Question Tools

Stats

Related questions

problem security_group in openstack kilo edit

2 answers

Comments

Your Answer

Question Tools

Stats

Related questions

problem security_group in openstack kilo