Page History

...

• bridges connected to logical router with patch port
• bridges connected to VPC VR (hence no patch port)
• bridge corresponding to logical router

Flows rules for the bridges connected to VPC VR (e.g. bridge for tier 1 network on host 3): no new additional flow rules are added to such bridges apart from what is added by OVS tunnel manager currently.  Bridge will just act as a mac learning L2 switch with rules to handle broadcast/multicast traffic. To recap from [4] below are the flow rules. there is single table 0 for all the rows.

• priority:1200 :- allow all incoming broadcast (dl_dst=ff:ff:ff:ff:ff:ff) and multicast (nw_dst=224.0.0.0/24) traffic from the VIF's that are connected to the VM's
• priority:1100 :-permit broadcast (dl_dst=ff:ff:ff:ff:ff:ff) and multicast (nw_dst=224.0.0.0/24) traffic to be sent out ONLY on the VIF's that are connect to VM's (i.e excluding the tunnel interfaces)
• priority:1000 :- suppress all broadcast/multicast ingress traffic on GRE tunnels
• priority:0 :- do NORMAL processing on the rest of the flows. this rule will ensure (due to NORMAL processing) new mac address seen from a interface is learned

Flows rules for bridge connected to logical router with patch port port (e.g. bridge for tier 1 network on host 1): will need additional rules to deal with patch port and ensure:

...

Below diagram depicts the pipeline processing setup with flow rules.

Flows logical router: Flows rules for bridge acting as logical router:

...

Assuming a ingress ACL to permit traffic from tier2, and egress ACL to permit outbound traffic to tier 2 is applied on tier 1 network, below new rules will be added in to flow table of the logical router bridge.

table=2, priority=1000,nw_dst=10.1.2.0/24 actions=resubmit(,1)

table=5, priority=1000,nw_src=10.1.2.0/24 actions=output:1

Packet flows:

Lets considers few packet flows to understand how logical router and flow rules achieve distributed routing.

• Consider case where VM1 (assume with IP 10.1.1.20) in tier1 running on host 1, wants to communicate with  VM1 (10.1.2.30) in tier 2 running on host 2. sequence of flow would be:
  • 10.1.1.20 sends ARP request for 10.1.1.1 (gateway for tier1)
  • VPC VR sends ARP response with MAC address (say 3c:07:54:4a:07:8f) on which 10.1.1.1 can be reached
  • 10.1.1.20 sends packet to 10.1.2.30 with ethernet destination 3c:07:54:4a:07:8f
  • flow rule on tier 1 bridge on host 1, over rides the default flow (normal l2 switching) and sends the packet on patch port
  • logical router created for VPC on host 1 receives packet on patch port 1. logical router does route look up (flow table 1 action) and does ingress and egress ACL's and modifies source mac address with mac address of 10.1.2.1 and modifies destination mac address with mac address of 10.1.2.30 and sends packet on patch port2.
  • tier 2 bridge on host 1 receives packet on patch port, does a mac lookup.
  • if the destination mac address is found, then sends packet on the port else floods packets on all the ports
  • tier 2 bridge on host 2 receives packet and forward to VM1. 

Fall back approach:

Achieving distributed routing and network ACL, would need distributed configuration. Given the scale of changes that would involve  

...