[ovs-discuss] OVS drops all packets on ESX RHEL6.5 VM

[Chen Weiwen]

Dear Pro, I see OVS drops all packet on RHEL 6.5 VM booted from ESX. Here
is the configuration:1)
Created a port group (4095) on the vCenter,
where the ESX host was added to a cluster, and provided the NIC configured
above as an uplink.2)
Booted a VM(which is supposed to be setup as
Management host) with RHEL 6.5 and provided the port group created in Step 1 to
this VM3)
Run vconfig command and it can ping gateway:a.
# vconfig add eth0 1b.
# ifconfig eth0.1 10.1.216.57/18c.
# ping 10.1.192.1 --- This is gateway and worked4)
Run ovs command:a. ovs-vsctl
add-br mybrb. ovs-vsctl
add-port mybr eth0c. ovs-vsctl
add-port mybr test tag=1 ? set interface test type=internald. ifconfig
test 10.1.216.57/18e. ping
gateway will fail: 10.1.192.1f. Change mtu on test port and eth0 to 1504, compared to default 1500. No good5)
Remove eth0 from OVS and do following, ping
still fail:a.
# ovs-vsctl del-port mybr eth0b.
# vconfig add eth0 1c.
# ifconfig eth0.1 10.1.216.57/18d.
# ping 10.1.192.1 will fail6) Remove OVS,
ping will work:a.
# ovs-vsctl del-br mybrb.
# service openvswitch stopc.
# ping 10.1.192.1 --- it
works Here is the RHEL 6.5 Kernel version: 2.6.32-431.el6.x86_64I tried both OVS 1.11 and 2.3, exactly
same behavior.
BTW, I have no problem with RHEL6.5 on baremetal system at all to have OVS configured exactly like above.Help for thoughts?
























































-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://openvswitch.org/pipermail/discuss/attachments/20141013/25189024/attachment.html>

[Federico Iezzi]

Did you try to allow ?promiscuous mode? on vSwitch configuration?

--------------------------------------------
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

Il giorno 14/ott/2014, alle ore 00:59, Chen Weiwen <chenww at hotmail.com<mailto:chenww at hotmail.com>> ha scritto:

Dear Pro,

I see OVS drops all packet on RHEL 6.5 VM booted from ESX. Here is the configuration:
1) Created a port group (4095) on the vCenter, where the ESX host was added to a cluster, and provided the NIC configured above as an uplink.
2) Booted a VM(which is supposed to be setup as Management host) with RHEL 6.5 and provided the port group created in Step 1 to this VM
3) Run vconfig command and it can ping gateway:
a. # vconfig add eth0 1
b. # ifconfig eth0.1 10.1.216.57/18
c. # ping 10.1.192.1 --- This is gateway and worked
4) Run ovs command:
a. ovs-vsctl add-br mybr
b. ovs-vsctl add-port mybr eth0
c. ovs-vsctl add-port mybr test tag=1 ? set interface test type=internal
d. ifconfig test 10.1.216.57/18
e. ping gateway will fail: 10.1.192.1
f. Change mtu on test port and eth0 to 1504, compared to default 1500. No good
5) Remove eth0 from OVS and do following, ping still fail:
a. # ovs-vsctl del-port mybr eth0
b. # vconfig add eth0 1
c. # ifconfig eth0.1 10.1.216.57/18
d. # ping 10.1.192.1 will fail
6) Remove OVS, ping will work:
a. # ovs-vsctl del-br mybr
b. # service openvswitch stop
c. # ping 10.1.192.1 --- it works

Here is the RHEL 6.5 Kernel version: 2.6.32-431.el6.x86_64
I tried both OVS 1.11 and 2.3, exactly same behavior.

BTW, I have no problem with RHEL6.5 on baremetal system at all to have OVS configured exactly like above.
Help for thoughts?


_______________________________________________
discuss mailing list
discuss at openvswitch.org<mailto:discuss at openvswitch.org>
http://openvswitch.org/mailman/listinfo/discuss

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://openvswitch.org/pipermail/discuss/attachments/20141014/a2010cc3/attachment-0001.html>

[Ben Pfaff]

That might not help and might hurt; see the FAQ:

Q: Does Open vSwitch support configuring a port in promiscuous mode?

A: Yes. How you configure it depends on what you mean by "promiscuous
mode":

- Conventionally, "promiscuous mode" is a feature of a network
interface card. Ordinarily, a NIC passes to the CPU only the
packets actually destined to its host machine. It discards
the rest to avoid wasting memory and CPU cycles. When
promiscuous mode is enabled, however, it passes every packet
to the CPU. On an old-style shared-media or hub-based
network, this allows the host to spy on all packets on the
network. But in the switched networks that are almost
everywhere these days, promiscuous mode doesn't have much
effect, because few packets not destined to a host are
delivered to the host's NIC.

This form of promiscuous mode is configured in the guest OS of
the VMs on your bridge, e.g. with "ifconfig".

- The VMware vSwitch uses a different definition of "promiscuous
mode". When you configure promiscuous mode on a VMware vNIC,
the vSwitch sends a copy of every packet received by the
vSwitch to that vNIC. That has a much bigger effect than just
enabling promiscuous mode in a guest OS. Rather than getting
a few stray packets for which the switch does not yet know the
correct destination, the vNIC gets every packet. The effect
is similar to replacing the vSwitch by a virtual hub.

This "promiscuous mode" is what switches normally call "port
mirroring" or "SPAN". For information on how to configure
SPAN, see "How do I configure a port as a SPAN port, that is,
enable mirroring of all traffic to that port?"

On Tue, Oct 14, 2014 at 01:01:23PM +0000, Federico Iezzi wrote:
> Did you try to allow ?promiscuous mode? on vSwitch configuration?
>
> --------------------------------------------
> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.
>
> Il giorno 14/ott/2014, alle ore 00:59, Chen Weiwen <chenww at hotmail.com<mailto:chenww at hotmail.com>> ha scritto:
>
> Dear Pro,
>
> I see OVS drops all packet on RHEL 6.5 VM booted from ESX. Here is the configuration:
> 1) Created a port group (4095) on the vCenter, where the ESX host was added to a cluster, and provided the NIC configured above as an uplink.
> 2) Booted a VM(which is supposed to be setup as Management host) with RHEL 6.5 and provided the port group created in Step 1 to this VM
> 3) Run vconfig command and it can ping gateway:
> a. # vconfig add eth0 1
> b. # ifconfig eth0.1 10.1.216.57/18
> c. # ping 10.1.192.1 --- This is gateway and worked
> 4) Run ovs command:
> a. ovs-vsctl add-br mybr
> b. ovs-vsctl add-port mybr eth0
> c. ovs-vsctl add-port mybr test tag=1 ? set interface test type=internal
> d. ifconfig test 10.1.216.57/18
> e. ping gateway will fail: 10.1.192.1
> f. Change mtu on test port and eth0 to 1504, compared to default 1500. No good
> 5) Remove eth0 from OVS and do following, ping still fail:
> a. # ovs-vsctl del-port mybr eth0
> b. # vconfig add eth0 1
> c. # ifconfig eth0.1 10.1.216.57/18
> d. # ping 10.1.192.1 will fail
> 6) Remove OVS, ping will work:
> a. # ovs-vsctl del-br mybr
> b. # service openvswitch stop
> c. # ping 10.1.192.1 --- it works
>
> Here is the RHEL 6.5 Kernel version: 2.6.32-431.el6.x86_64
> I tried both OVS 1.11 and 2.3, exactly same behavior.
>
> BTW, I have no problem with RHEL6.5 on baremetal system at all to have OVS configured exactly like above.
> Help for thoughts?
>
>
> _______________________________________________
> discuss mailing list
> discuss at openvswitch.org<mailto:discuss at openvswitch.org>
> http://openvswitch.org/mailman/listinfo/discuss
>

> _______________________________________________
> discuss mailing list
> discuss at openvswitch.org
> http://openvswitch.org/mailman/listinfo/discuss

[Chen Weiwen]

Yes, the ESX vswitch is configured with promiscuous mode as well as on RHEL guest VM uplink eth0 for OVS using the command: ifconfig eth0 promisc. I thought this is not necessary as OVS will automatically set the uplink into promisc mode. Is this still true? tcpdump on eth0 can see all packets on the uplinks, but these packets failed to deliver to ovs port.

Good to know VMware vNIC on promiscuous mode will set it to be a hub.
Regards-weiwen
> Date: Tue, 14 Oct 2014 07:38:03 -0700
> From: blp at nicira.com
> To: fiezzi at enter.it
> CC: chenww at hotmail.com; discuss at openvswitch.org
> Subject: Re: [ovs-discuss] OVS drops all packets on ESX RHEL6.5 VM
>
> That might not help and might hurt; see the FAQ:
>
> Q: Does Open vSwitch support configuring a port in promiscuous mode?
>
> A: Yes. How you configure it depends on what you mean by "promiscuous
> mode":
>
> - Conventionally, "promiscuous mode" is a feature of a network
> interface card. Ordinarily, a NIC passes to the CPU only the
> packets actually destined to its host machine. It discards
> the rest to avoid wasting memory and CPU cycles. When
> promiscuous mode is enabled, however, it passes every packet
> to the CPU. On an old-style shared-media or hub-based
> network, this allows the host to spy on all packets on the
> network. But in the switched networks that are almost
> everywhere these days, promiscuous mode doesn't have much
> effect, because few packets not destined to a host are
> delivered to the host's NIC.
>
> This form of promiscuous mode is configured in the guest OS of
> the VMs on your bridge, e.g. with "ifconfig".
>
> - The VMware vSwitch uses a different definition of "promiscuous
> mode". When you configure promiscuous mode on a VMware vNIC,
> the vSwitch sends a copy of every packet received by the
> vSwitch to that vNIC. That has a much bigger effect than just
> enabling promiscuous mode in a guest OS. Rather than getting
> a few stray packets for which the switch does not yet know the
> correct destination, the vNIC gets every packet. The effect
> is similar to replacing the vSwitch by a virtual hub.
>
> This "promiscuous mode" is what switches normally call "port
> mirroring" or "SPAN". For information on how to configure
> SPAN, see "How do I configure a port as a SPAN port, that is,
> enable mirroring of all traffic to that port?"
>
> On Tue, Oct 14, 2014 at 01:01:23PM +0000, Federico Iezzi wrote:
> > Did you try to allow ?promiscuous mode? on vSwitch configuration?
> >
> > --------------------------------------------
> > This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.
> >
> > Il giorno 14/ott/2014, alle ore 00:59, Chen Weiwen <chenww at hotmail.com<mailto:chenww at hotmail.com>> ha scritto:
> >
> > Dear Pro,
> >
> > I see OVS drops all packet on RHEL 6.5 VM booted from ESX. Here is the configuration:
> > 1) Created a port group (4095) on the vCenter, where the ESX host was added to a cluster, and provided the NIC configured above as an uplink.
> > 2) Booted a VM(which is supposed to be setup as Management host) with RHEL 6.5 and provided the port group created in Step 1 to this VM
> > 3) Run vconfig command and it can ping gateway:
> > a. # vconfig add eth0 1
> > b. # ifconfig eth0.1 10.1.216.57/18
> > c. # ping 10.1.192.1 --- This is gateway and worked
> > 4) Run ovs command:
> > a. ovs-vsctl add-br mybr
> > b. ovs-vsctl add-port mybr eth0
> > c. ovs-vsctl add-port mybr test tag=1 ? set interface test type=internal
> > d. ifconfig test 10.1.216.57/18
> > e. ping gateway will fail: 10.1.192.1
> > f. Change mtu on test port and eth0 to 1504, compared to default 1500. No good
> > 5) Remove eth0 from OVS and do following, ping still fail:
> > a. # ovs-vsctl del-port mybr eth0
> > b. # vconfig add eth0 1
> > c. # ifconfig eth0.1 10.1.216.57/18
> > d. # ping 10.1.192.1 will fail
> > 6) Remove OVS, ping will work:
> > a. # ovs-vsctl del-br mybr
> > b. # service openvswitch stop
> > c. # ping 10.1.192.1 --- it works
> >
> > Here is the RHEL 6.5 Kernel version: 2.6.32-431.el6.x86_64
> > I tried both OVS 1.11 and 2.3, exactly same behavior.
> >
> > BTW, I have no problem with RHEL6.5 on baremetal system at all to have OVS configured exactly like above.
> > Help for thoughts?
> >
> >
> > _______________________________________________
> > discuss mailing list
> > discuss at openvswitch.org<mailto:discuss at openvswitch.org>
> > http://openvswitch.org/mailman/listinfo/discuss
> >
>
> > _______________________________________________
> > discuss mailing list
> > discuss at openvswitch.org
> > http://openvswitch.org/mailman/listinfo/discuss
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://openvswitch.org/pipermail/discuss/attachments/20141014/34d124f8/attachment-0001.html>