Page History

...

• For OVS, flow table need following modifications:
  • 1. For each VM:
    Outgoing tag with pvlan:
    • • <a> Tagged isolated vlan and go through flow-table again(for DHCP server specify handling):
        • priority=50,dl_vlan=0xffff,dl_src=
    <VM MAC>
    • • • $vm_mac,actions=mod_vlan_vid:
    <secondary isolated vlan>,output:<trunk port>
    2. For each VM in the same host as DHCP server:
    <a> Allow communitcation with DHCP server(e.g. DNS): priority=100,dl_src=<VM MAC>,dl_dst=<DHCP MAC> actions=NORMAL
    <b> Allow DHCP request: priority=60,udp,dl_src=<VM MAC>,nw_dst=255.255.255.255,tp_dst=67 actions=NORMAL
    3
    • • • $sec_iso_vlan,resubmit:$trunk_port
      • <b> If there is no other process in the flow table, then output to trunk port:
        • priority=60,dl_vlan=$sec_iso_vlan,dl_src=$vm_mac,actions=output:$trunk_port
    • 2. For each host has DHCP server:
      • <a> ARP for DHCP server from
    outside
    • • other hosts:
        • priority=
    160
    • • • 200,arp,dl_vlan=
    <secondary isolated vlan>
    • • • $sec_iso_vlan,nw_dst=
    <DHCP IP>
    • • • $dhcp_ip,actions=
    mod
    • • • strip_vlan
    _vid:<primary vlan>,NORMAL
    <b> ARP for DHCP server: priority=150,arp,nw_dst=<DHCP IP> actions=NORMAL
    <c>
    • • • ,output:$dhcp_port
      • <b> Accept packets from outside(e.g. DNS):
        • priority=
    100
    • • • 150,dl_vlan=
    <secondary isolated vlan>
    • • • $sec_iso_vlan,dl_dst=
    <DHCP MAC>
    • • • $dhcp_mac,actions=
    mod
    • • • strip_vlan
    _vid:<primary vlan>,NORMAL
    <d>
    • • • ,output:$dhcp_port
      • <c> Accept DHCP request from
    outside
    • • other hosts:
        • priority=
    60
    • • • 100,udp,dl_vlan=
    <secondary isolated vlan>
    • • • $sec_iso_vlan,nw_dst=255.255.255.255,tp_dst=67,actions=
    mod
    • • • strip_vlan
    _vid:<primary vlan>,NORMAL
    • • • ,output:$dhcp_port
  • The VM migration and host restart would affect the rules, need to be reprogrammed.

  ...

  PVLAN can be enabled on shared networks. Shared networks are created by admin users, end user vms are allowed to have nics on shared networks.
  Modify createNetworkCmd (for shared networks)

  • Add a new parameter: secondary_isolated_vlanisolatedpvlan:
    • Not a required paramter. if the parameter is not null, then PVLAN would be enabled.
    • When the parameter is set, it must be advance shared network.

  DB changes

  The type of the VLAN (primary/isolated) may need to be tracked. The vlan table and the VlanVO class may need to be changed. An association between a primary and secondary VLAN IDs may need to be tracked in a separate table, or in some other way. The same isolated VLAN ID cannot be associated with different primary VLAN IDs. Multiple isolated VLAN IDs can be associated with a single primary VLAN ID.

  Cisco Nexus 1000v specific changes

  New functions to add primary and secondary VLANs to port groups, and to be called in HypervisorHostHelper.java, will need to be added to VsmCommand.java and NetconfHelper.java.

  Phased implementation for VMware

  For VMware, the project will be carried out in two phases. In phase 1, pvlan support will be implemented in cloudstack for VMware Distributed Virtual Switch configurations. In phase 2, pvlan support will be implemented for provisioning profiles on Cisco Nexus 1000v.

  UI flow

  • The admin creates a shared vlan. She is asked if it is a PVLAN. If yes, in addition to the primary vlan id, she is asked for the secondary vlan id.
    The pre-confirmation dialog asks her to make sure her physical infrastructure is configured in the same fashion.

  ...