CentOS 7
Sponsored Link

OpenStack Stein : Neutron ネットワークを構成する (VXLAN)2019/05/16

 
OpenStack Network Service(Neutron)による仮想ネットワークの構成です。
例として、VXLAN タイプのネットワークを構成します。
事前に以下のように Control ノードNetwork ノードCompute ノードの 各 Neutron サービスノードを構築済みであることが前提です。
また、当例では Network ノードが二つのネットワークインターフェースを持っているものとします。
------------+---------------------------+---------------------------+------------
            |                           |                           |
        eth0|10.0.0.30              eth0|10.0.0.50              eth0|10.0.0.51
+-----------+-----------+   +-----------+-----------+   +-----------+-----------+
|    [ Control Node ]   |   |    [ Network Node ]   |   |    [ Compute Node ]   |
|                       |   |                       |   |                       |
|  MariaDB    RabbitMQ  |   |      Open vSwitch     |   |        Libvirt        |
|  Memcached  httpd     |   |        L2 Agent       |   |     Nova Compute      |
|  Keystone   Glance    |   |        L3 Agent       |   |      Open vSwitch     |
|  Nova API             |   |     Metadata Agent    |   |        L2 Agent       |
|  Neutron Server       |   |                       |   |                       |
|  Metadata Agent       |   |                       |   |                       |
+-----------------------+   +-----------+-----------+   +-----------------------+
                                    eth1|(UP with no IP)

[1] Control ノードで以下のように設定変更します。
[root@dlp ~(keystone)]#
vi /etc/neutron/plugins/ml2/ml2_conf.ini
# 最終行付近:tenant_network_types に値を追記

[ml2]
type_drivers = flat,vlan,gre,vxlan
tenant_network_types =
vxlan
# 最終行に追記

[ml2_type_flat]
flat_networks = physnet1

[ml2_type_vxlan]
vni_ranges = 1:1000

[root@dlp ~(keystone)]#
systemctl restart neutron-server

[2] Network ノードで以下のように設定変更します。
# ブリッジ追加

[root@network ~]#
ovs-vsctl add-br br-eth1

# 追加したブリッジのポートにeth1を追加

[root@network ~]#
ovs-vsctl add-port br-eth1 eth1

[root@network ~]#
vi /etc/neutron/plugins/ml2/ml2_conf.ini
# 最終行付近:tenant_network_types に値を追記

[ml2]
type_drivers = flat,vlan,gre,vxlan
tenant_network_types =
vxlan
# 最終行に追記

[ml2_type_flat]
flat_networks = physnet1

[ml2_type_vxlan]
vni_ranges = 1:1000

[root@network ~]#
vi /etc/neutron/plugins/ml2/openvswitch_agent.ini
# 最終行に追記

[agent]
tunnel_types = vxlan
prevent_arp_spoofing = True

[ovs]
# local_ip は当ノードのローカルIPを指定
local_ip = 10.0.0.50
bridge_mappings = physnet1:br-eth1

[root@network ~]#
for service in dhcp-agent l3-agent metadata-agent openvswitch-agent; do
systemctl restart neutron-$service
done
# Firewalld 稼働中の場合は停止

[root@network ~]#
systemctl stop firewalld

[root@network ~]#
systemctl disable firewalld

[3] Compute ノードで以下のように設定変更します。
[root@node01 ~]#
vi /etc/neutron/plugins/ml2/ml2_conf.ini
# 最終行付近:tenant_network_types に値を追記

[ml2]
type_drivers = flat,vlan,gre,vxlan
tenant_network_types =
vxlan
# 最終行に追記

[ml2_type_flat]
flat_networks = physnet1

[ml2_type_vxlan]
vni_ranges = 1:1000

[root@node01 ~]#
vi /etc/neutron/plugins/ml2/openvswitch_agent.ini
# 最終行に追記

[agent]
tunnel_types = vxlan
prevent_arp_spoofing = True

[ovs]
# local_ip は当ノードのローカルIPを指定
local_ip = 10.0.0.51

[root@node01 ~]#
systemctl restart neutron-openvswitch-agent
# Firewalld 稼働中の場合は停止

[root@node01 ~]#
systemctl stop firewalld

[root@node01 ~]#
systemctl disable firewalld

[4] 仮想ルータを作成します。作業場所はどこでもよいですが、当例では Control ノード上で作業します。
# 仮想ルーター作成

[root@dlp ~(keystone)]#
openstack router create router01

+-------------------------+--------------------------------------------------------------------------+
| Field                   | Value                                                                    |
+-------------------------+--------------------------------------------------------------------------+
| admin_state_up          | UP                                                                       |
| availability_zone_hints |                                                                          |
| availability_zones      |                                                                          |
| created_at              | 2019-05-16T05:41:10Z                                                     |
| description             |                                                                          |
| distributed             | False                                                                    |
| external_gateway_info   | None                                                                     |
| flavor_id               | None                                                                     |
| ha                      | False                                                                    |
| id                      | 456ca41b-e509-4ac6-8575-a1732ded9968                                     |
| location                | Munch({'project': Munch({'domain_name': 'default', 'domain_id': Non...}) |
| name                    | router01                                                                 |
| project_id              | 183a5ed32a77427986038c176b605d73                                         |
| revision_number         | 1                                                                        |
| routes                  |                                                                          |
| status                  | ACTIVE                                                                   |
| tags                    |                                                                          |
| updated_at              | 2019-05-16T05:41:10Z                                                     |
+-------------------------+--------------------------------------------------------------------------+

[5] 内部用のネットワークを作成し、仮想ルーターに関連付けます。
# 内部用ネットワーク作成

[root@dlp ~(keystone)]#
openstack network create int_net --provider-network-type vxlan

+---------------------------+------------------------------------------------------------------------+
| Field                     | Value                                                                  |
+---------------------------+------------------------------------------------------------------------+
| admin_state_up            | UP                                                                     |
| availability_zone_hints   |                                                                        |
| availability_zones        |                                                                        |
| created_at                | 2019-05-16T05:41:45Z                                                   |
| description               |                                                                        |
| dns_domain                | None                                                                   |
| id                        | c9377689-558e-4f2a-9334-17a3b9fa1b87                                   |
| ipv4_address_scope        | None                                                                   |
| ipv6_address_scope        | None                                                                   |
| is_default                | False                                                                  |
| is_vlan_transparent       | None                                                                   |
| location                  | Munch({'project': Munch({'domain_name': 'default', 'domain_id': N...}) |
| mtu                       | 1450                                                                   |
| name                      | int_net                                                                |
| port_security_enabled     | True                                                                   |
| project_id                | 183a5ed32a77427986038c176b605d73                                       |
| provider:network_type     | vxlan                                                                  |
| provider:physical_network | None                                                                   |
| provider:segmentation_id  | 36                                                                     |
| qos_policy_id             | None                                                                   |
| revision_number           | 1                                                                      |
| router:external           | Internal                                                               |
| segments                  | None                                                                   |
| shared                    | False                                                                  |
| status                    | ACTIVE                                                                 |
| subnets                   |                                                                        |
| tags                      |                                                                        |
| updated_at                | 2019-05-16T05:41:45Z                                                   |
+---------------------------+------------------------------------------------------------------------+

# 内部用ネットワークにサブネット作成

[root@dlp ~(keystone)]#
openstack subnet create subnet1 --network int_net \
--subnet-range 192.168.100.0/24 --gateway 192.168.100.1 \
--dns-nameserver 10.0.0.10

+-------------------+--------------------------------------------------------------------------------+
| Field             | Value                                                                          |
+-------------------+--------------------------------------------------------------------------------+
| allocation_pools  | 192.168.100.2-192.168.100.254                                                  |
| cidr              | 192.168.100.0/24                                                               |
| created_at        | 2019-05-16T05:42:34Z                                                           |
| description       |                                                                                |
| dns_nameservers   | 10.0.0.10                                                                      |
| enable_dhcp       | True                                                                           |
| gateway_ip        | 192.168.100.1                                                                  |
| host_routes       |                                                                                |
| id                | b4dda943-e57b-4455-88dd-c3308c2ac30c                                           |
| ip_version        | 4                                                                              |
| ipv6_address_mode | None                                                                           |
| ipv6_ra_mode      | None                                                                           |
| location          | Munch({'project': Munch({'domain_name': 'default', 'domain_id': None, 'na...}) |
| name              | subnet1                                                                        |
| network_id        | c9377689-558e-4f2a-9334-17a3b9fa1b87                                           |
| prefix_length     | None                                                                           |
| project_id        | 183a5ed32a77427986038c176b605d73                                               |
| revision_number   | 0                                                                              |
| segment_id        | None                                                                           |
| service_types     |                                                                                |
| subnetpool_id     | None                                                                           |
| tags              |                                                                                |
| updated_at        | 2019-05-16T05:42:34Z                                                           |
+-------------------+--------------------------------------------------------------------------------+

# 仮想ルーターに内部ネットワークを設定

[root@dlp ~(keystone)]#
openstack router add subnet router01 subnet1
[6] 外部接続用のネットワークを作成し、仮想ルーターに関連付けます。
# 外部用ネットワーク作成

[root@dlp ~(keystone)]#
openstack network create \
--provider-physical-network physnet1 \
--provider-network-type flat --external ext_net

+---------------------------+------------------------------------------------------------------------+
| Field                     | Value                                                                  |
+---------------------------+------------------------------------------------------------------------+
| admin_state_up            | UP                                                                     |
| availability_zone_hints   |                                                                        |
| availability_zones        |                                                                        |
| created_at                | 2019-05-16T05:43:33Z                                                   |
| description               |                                                                        |
| dns_domain                | None                                                                   |
| id                        | 85844309-e89a-49cb-8ec7-730a8e6d253c                                   |
| ipv4_address_scope        | None                                                                   |
| ipv6_address_scope        | None                                                                   |
| is_default                | False                                                                  |
| is_vlan_transparent       | None                                                                   |
| location                  | Munch({'project': Munch({'domain_name': 'default', 'domain_id': N...}) |
| mtu                       | 1500                                                                   |
| name                      | ext_net                                                                |
| port_security_enabled     | True                                                                   |
| project_id                | 183a5ed32a77427986038c176b605d73                                       |
| provider:network_type     | flat                                                                   |
| provider:physical_network | physnet1                                                               |
| provider:segmentation_id  | None                                                                   |
| qos_policy_id             | None                                                                   |
| revision_number           | 1                                                                      |
| router:external           | External                                                               |
| segments                  | None                                                                   |
| shared                    | False                                                                  |
| status                    | ACTIVE                                                                 |
| subnets                   |                                                                        |
| tags                      |                                                                        |
| updated_at                | 2019-05-16T05:43:33Z                                                   |
+---------------------------+------------------------------------------------------------------------+

# 外部用ネットワークにサブネット作成

[root@dlp ~(keystone)]#
openstack subnet create subnet2 \
--network ext_net --subnet-range 10.0.0.0/24 \
--allocation-pool start=10.0.0.200,end=10.0.0.254 \
--gateway 10.0.0.1 --dns-nameserver 10.0.0.10 --no-dhcp

+-------------------+--------------------------------------------------------------------------------+
| Field             | Value                                                                          |
+-------------------+--------------------------------------------------------------------------------+
| allocation_pools  | 10.0.0.200-10.0.0.254                                                          |
| cidr              | 10.0.0.0/24                                                                    |
| created_at        | 2019-05-16T05:44:13Z                                                           |
| description       |                                                                                |
| dns_nameservers   | 10.0.0.10                                                                      |
| enable_dhcp       | False                                                                          |
| gateway_ip        | 10.0.0.1                                                                       |
| host_routes       |                                                                                |
| id                | 7bcaa30a-261c-41bb-bcab-f88c711f98a8                                           |
| ip_version        | 4                                                                              |
| ipv6_address_mode | None                                                                           |
| ipv6_ra_mode      | None                                                                           |
| location          | Munch({'project': Munch({'domain_name': 'default', 'domain_id': None, 'na...}) |
| name              | subnet2                                                                        |
| network_id        | 85844309-e89a-49cb-8ec7-730a8e6d253c                                           |
| prefix_length     | None                                                                           |
| project_id        | 183a5ed32a77427986038c176b605d73                                               |
| revision_number   | 0                                                                              |
| segment_id        | None                                                                           |
| service_types     |                                                                                |
| subnetpool_id     | None                                                                           |
| tags              |                                                                                |
| updated_at        | 2019-05-16T05:44:13Z                                                           |
+-------------------+--------------------------------------------------------------------------------+

# 仮想ルーターにゲートウェイを設定

[root@dlp ~(keystone)]#
openstack router set router01 --external-gateway ext_net

[7] 作成したネットワークは、外部用はデフォルトで全プロジェクトがアクセス可能ですが、内部用はデフォルトでは admin プロジェクトのみがアクセス可能なため、内部ネットワークを利用させたいプロジェクトにアクセス権限を付与しておきます。
# ネットワーク RBAC リスト表示

[root@dlp ~(keystone)]#
openstack network rbac list

+--------------------------------------+-------------+--------------------------------------+
| ID                                   | Object Type | Object ID                            |
+--------------------------------------+-------------+--------------------------------------+
| ffa3887f-2ae7-499e-8224-6eaaa27d7d96 | network     | 85844309-e89a-49cb-8ec7-730a8e6d253c |
+--------------------------------------+-------------+--------------------------------------+

# RBAC の詳細 (access_as_external のみ全プロジェクトがアクセス可能)

[root@dlp ~(keystone)]#
openstack network rbac show ffa3887f-2ae7-499e-8224-6eaaa27d7d96

+-------------------+--------------------------------------------------------------------------------+
| Field             | Value                                                                          |
+-------------------+--------------------------------------------------------------------------------+
| action            | access_as_external                                                             |
| id                | ffa3887f-2ae7-499e-8224-6eaaa27d7d96                                           |
| location          | Munch({'project': Munch({'domain_name': 'default', 'domain_id': None, 'na...}) |
| name              | None                                                                           |
| object_id         | 85844309-e89a-49cb-8ec7-730a8e6d253c                                           |
| object_type       | network                                                                        |
| project_id        | 183a5ed32a77427986038c176b605d73                                               |
| target_project_id | *                                                                              |
+-------------------+--------------------------------------------------------------------------------+

# 作成済みネットワーク一覧

[root@dlp ~(keystone)]#
openstack network list

+--------------------------------------+---------+--------------------------------------+
| ID                                   | Name    | Subnets                              |
+--------------------------------------+---------+--------------------------------------+
| 85844309-e89a-49cb-8ec7-730a8e6d253c | ext_net | 7bcaa30a-261c-41bb-bcab-f88c711f98a8 |
| c9377689-558e-4f2a-9334-17a3b9fa1b87 | int_net | b4dda943-e57b-4455-88dd-c3308c2ac30c |
+--------------------------------------+---------+--------------------------------------+

# 作成済みプロジェクト一覧

[root@dlp ~(keystone)]#
openstack project list

+----------------------------------+-----------+
| ID                               | Name      |
+----------------------------------+-----------+
| 183a5ed32a77427986038c176b605d73 | admin     |
| c5e87c9b460e4f16801b4102019c97e6 | service   |
| caab6ec580994e6481cd104b9d210f3f | hiroshima |
+----------------------------------+-----------+

# [int_net] への [access_as_shared] アクセス権を [hiroshima] プロジェクトに付与

[root@dlp ~(keystone)]#
netID=$(openstack network list | grep int_net | awk '{ print $2 }')

[root@dlp ~(keystone)]#
prjID=$(openstack project list | grep hiroshima | awk '{ print $2 }')

[root@dlp ~(keystone)]#
openstack network rbac create --target-project $prjID --type network --action access_as_shared $netID

+-------------------+--------------------------------------------------------------------------------+
| Field             | Value                                                                          |
+-------------------+--------------------------------------------------------------------------------+
| action            | access_as_shared                                                               |
| id                | 78866ef8-bd56-4094-bf73-541bbf98dda7                                           |
| location          | Munch({'project': Munch({'domain_name': 'default', 'domain_id': None, 'na...}) |
| name              | None                                                                           |
| object_id         | c9377689-558e-4f2a-9334-17a3b9fa1b87                                           |
| object_type       | network                                                                        |
| project_id        | 183a5ed32a77427986038c176b605d73                                               |
| target_project_id | caab6ec580994e6481cd104b9d210f3f                                               |
+-------------------+--------------------------------------------------------------------------------+
[8] 内部ネットワークへのアクセス権を付与したプロジェクトに所属する任意のユーザーでログインし、 作成した内部ネットワークをインスタンスに紐付けてインスタンスを作成・起動します。
# 利用可能な flavor 確認

[cent@dlp ~(keystone)]$
openstack flavor list

+----+----------+------+------+-----------+-------+-----------+
| ID | Name     |  RAM | Disk | Ephemeral | VCPUs | Is Public |
+----+----------+------+------+-----------+-------+-----------+
| 0  | m1.small | 2048 |   10 |         0 |     1 | True      |
+----+----------+------+------+-----------+-------+-----------+

# 利用可能なイメージ確認

[cent@dlp ~(keystone)]$
openstack image list

+--------------------------------------+---------+--------+
| ID                                   | Name    | Status |
+--------------------------------------+---------+--------+
| 0d0bf9ae-9d4c-445f-b2e0-5b322dffa988 | CentOS7 | active |
+--------------------------------------+---------+--------+

# 利用可能なネットワーク確認

[cent@dlp ~(keystone)]$
openstack network list

+--------------------------------------+---------+--------------------------------------+
| ID                                   | Name    | Subnets                              |
+--------------------------------------+---------+--------------------------------------+
| 85844309-e89a-49cb-8ec7-730a8e6d253c | ext_net | 7bcaa30a-261c-41bb-bcab-f88c711f98a8 |
| c9377689-558e-4f2a-9334-17a3b9fa1b87 | int_net | b4dda943-e57b-4455-88dd-c3308c2ac30c |
+--------------------------------------+---------+--------------------------------------+

# インスタンス用のセキュリティグループを作成

[cent@dlp ~(keystone)]$
openstack security group create secgroup01

+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field           | Value                                                                                                                                                                                  |
+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| created_at      | 2019-05-16T05:49:09Z                                                                                                                                                                   |
| description     | secgroup01                                                                                                                                                                             |
| id              | 1a681f58-e630-403d-b8b3-d48144618814                                                                                                                                                   |
| location        | Munch({'project': Munch({'domain_name': 'default', 'domain_id': None, 'name': 'hiroshima', 'id': u'caab6ec580994e6481cd104b9d210f3f'}), 'cloud': '', 'region_name': '', 'zone': None}) |
| name            | secgroup01                                                                                                                                                                             |
| project_id      | caab6ec580994e6481cd104b9d210f3f                                                                                                                                                       |
| revision_number | 1                                                                                                                                                                                      |
| rules           | created_at='2019-05-16T05:49:09Z', direction='egress', ethertype='IPv4', id='85762c3f-0142-420b-b08d-e44d7c05c2b0', updated_at='2019-05-16T05:49:09Z'                                  |
|                 | created_at='2019-05-16T05:49:09Z', direction='egress', ethertype='IPv6', id='f87051ea-a54a-4388-8e6f-2985d0eb56ab', updated_at='2019-05-16T05:49:09Z'                                  |
| tags            | []                                                                                                                                                                                     |
| updated_at      | 2019-05-16T05:49:09Z                                                                                                                                                                   |
+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

# インスタンス接続用の SSH キーペア作成

[cent@dlp ~(keystone)]$
ssh-keygen -q -N ""

Enter file in which to save the key (/home/cent/.ssh/id_rsa):
# 公開鍵登録

[cent@dlp ~(keystone)]$
openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey

+-------------+-------------------------------------------------+
| Field       | Value                                           |
+-------------+-------------------------------------------------+
| fingerprint | ee:45:ff:cc:da:54:18:01:31:a1:98:79:f8:ef:f5:ff |
| name        | mykey                                           |
| user_id     | b5dd128c2fd744c892ad7d1fb39d21a0                |
+-------------+-------------------------------------------------+

[cent@dlp ~(keystone)]$
netID=$(openstack network list | grep int_net | awk '{ print $2 }')

[cent@dlp ~(keystone)]$
openstack server create --flavor m1.small --image CentOS7 --security-group secgroup01 --nic net-id=$netID --key-name mykey CentOS_7
[cent@dlp ~(keystone)]$
openstack server list

+--------------------------------------+----------+--------+------------------------+---------+----------+
| ID                                   | Name     | Status | Networks               | Image   | Flavor   |
+--------------------------------------+----------+--------+------------------------+---------+----------+
| aced428a-2d16-4679-9798-50e69c7aaf1d | CentOS_7 | ACTIVE | int_net=192.168.100.59 | CentOS7 | m1.small |
+--------------------------------------+----------+--------+------------------------+---------+----------+
[9] 作成した仮想マシンインスタンスにフローティングIP を割り当てます。
[cent@dlp ~(keystone)]$
openstack floating ip create ext_net

+---------------------+------------------------------------------------------------------------------+
| Field               | Value                                                                        |
+---------------------+------------------------------------------------------------------------------+
| created_at          | 2019-05-16T05:51:04Z                                                         |
| description         |                                                                              |
| dns_domain          | None                                                                         |
| dns_name            | None                                                                         |
| fixed_ip_address    | None                                                                         |
| floating_ip_address | 10.0.0.240                                                                   |
| floating_network_id | 85844309-e89a-49cb-8ec7-730a8e6d253c                                         |
| id                  | 390e25f5-e71e-44a2-a655-021f0e8d0e30                                         |
| location            | Munch({'project': Munch({'domain_name': 'default', 'domain_id': None, '...}) |
| name                | 10.0.0.240                                                                   |
| port_details        | None                                                                         |
| port_id             | None                                                                         |
| project_id          | caab6ec580994e6481cd104b9d210f3f                                             |
| qos_policy_id       | None                                                                         |
| revision_number     | 0                                                                            |
| router_id           | None                                                                         |
| status              | DOWN                                                                         |
| subnet_id           | None                                                                         |
| tags                | []                                                                           |
| updated_at          | 2019-05-16T05:51:04Z                                                         |
+---------------------+------------------------------------------------------------------------------+

[cent@dlp ~(keystone)]$
openstack server add floating ip CentOS_7 10.0.0.240

# 設定確認

[cent@dlp ~(keystone)]$
openstack floating ip show 10.0.0.240

+---------------------+-----------------------------------------------------------------------------+
| Field               | Value                                                                       |
+---------------------+-----------------------------------------------------------------------------+
| created_at          | 2019-05-16T05:51:04Z                                                        |
| description         |                                                                             |
| dns_domain          | None                                                                        |
| dns_name            | None                                                                        |
| fixed_ip_address    | 192.168.100.59                                                              |
| floating_ip_address | 10.0.0.240                                                                  |
| floating_network_id | 85844309-e89a-49cb-8ec7-730a8e6d253c                                        |
| id                  | 390e25f5-e71e-44a2-a655-021f0e8d0e30                                        |
| location            | Munch({'project': Munch({'domain_name': 'default', 'domain_id': None, '...  |
| name                | 10.0.0.240                                                                  |
| port_details        | admin_state_up='True', device_id='aced428a-2d16-4679-9798-50e69c7aaf1d'...' |
| port_id             | cc3d45ff-0ad1-419d-b1fb-cdd11e17b45b                                        |
| project_id          | caab6ec580994e6481cd104b9d210f3f                                            |
| qos_policy_id       | None                                                                        |
| revision_number     | 2                                                                           |
| router_id           | 456ca41b-e509-4ac6-8575-a1732ded9968                                        |
| status              | ACTIVE                                                                      |
| subnet_id           | None                                                                        |
| tags                | []                                                                          |
| updated_at          | 2019-05-16T05:51:45Z                                                        |
+---------------------+-----------------------------------------------------------------------------+

[cent@dlp ~(keystone)]$
openstack server list

+--------------------------------------+----------+--------+------------------------------------+---------+----------+
| ID                                   | Name     | Status | Networks                           | Image   | Flavor   |
+--------------------------------------+----------+--------+------------------------------------+---------+----------+
| aced428a-2d16-4679-9798-50e69c7aaf1d | CentOS_7 | ACTIVE | int_net=192.168.100.59, 10.0.0.240 | CentOS7 | m1.small |
+--------------------------------------+----------+--------+------------------------------------+---------+----------+
[10] 起動した仮想マシンインスタンスに SSH 接続できるように、先に作成したセキュリティグループにポート許可の設定を追加します。
# ICMP 許可

[cent@dlp ~(keystone)]$
openstack security group rule create --protocol icmp --ingress secgroup01

+-------------------+--------------------------------------------------------------------------------+
| Field             | Value                                                                          |
+-------------------+--------------------------------------------------------------------------------+
| created_at        | 2019-05-16T05:53:03Z                                                           |
| description       |                                                                                |
| direction         | ingress                                                                        |
| ether_type        | IPv4                                                                           |
| id                | dd0ae319-330e-4db1-baff-d4c335a4718f                                           |
| location          | Munch({'project': Munch({'domain_name': 'default', 'domain_id': None, 'na...}) |
| name              | None                                                                           |
| port_range_max    | None                                                                           |
| port_range_min    | None                                                                           |
| project_id        | caab6ec580994e6481cd104b9d210f3f                                               |
| protocol          | icmp                                                                           |
| remote_group_id   | None                                                                           |
| remote_ip_prefix  | 0.0.0.0/0                                                                      |
| revision_number   | 0                                                                              |
| security_group_id | 1a681f58-e630-403d-b8b3-d48144618814                                           |
| tags              | []                                                                             |
| updated_at        | 2019-05-16T05:53:03Z                                                           |
+-------------------+--------------------------------------------------------------------------------+

# SSH 許可

[cent@dlp ~(keystone)]$
openstack security group rule create --protocol tcp --dst-port 22:22 secgroup01

+-------------------+--------------------------------------------------------------------------------+
| Field             | Value                                                                          |
+-------------------+--------------------------------------------------------------------------------+
| created_at        | 2019-05-16T05:53:34Z                                                           |
| description       |                                                                                |
| direction         | ingress                                                                        |
| ether_type        | IPv4                                                                           |
| id                | 742ed2bd-e0c6-4faf-9e94-f7d8eef91174                                           |
| location          | Munch({'project': Munch({'domain_name': 'default', 'domain_id': None, 'na...}) |
| name              | None                                                                           |
| port_range_max    | 22                                                                             |
| port_range_min    | 22                                                                             |
| project_id        | caab6ec580994e6481cd104b9d210f3f                                               |
| protocol          | tcp                                                                            |
| remote_group_id   | None                                                                           |
| remote_ip_prefix  | 0.0.0.0/0                                                                      |
| revision_number   | 0                                                                              |
| security_group_id | 1a681f58-e630-403d-b8b3-d48144618814                                           |
| tags              | []                                                                             |
| updated_at        | 2019-05-16T05:53:34Z                                                           |
+-------------------+--------------------------------------------------------------------------------+

[cent@dlp ~(keystone)]$
openstack security group rule list

+--------------------------------------+-------------+-----------+------------+--------------------------------------+--------------------------------------+
| ID                                   | IP Protocol | IP Range  | Port Range | Remote Security Group                | Security Group                       |
+--------------------------------------+-------------+-----------+------------+--------------------------------------+--------------------------------------+
| 742ed2bd-e0c6-4faf-9e94-f7d8eef91174 | tcp         | 0.0.0.0/0 | 22:22      | None                                 | 1a681f58-e630-403d-b8b3-d48144618814 |
| 85762c3f-0142-420b-b08d-e44d7c05c2b0 | None        | None      |            | None                                 | 1a681f58-e630-403d-b8b3-d48144618814 |
| 99caf6eb-be96-4684-8813-ca399342c22a | None        | None      |            | None                                 | 5708b270-8443-459d-b344-239e968f0693 |
| a68de996-4a07-46a8-a2f3-94c1d11a43fa | None        | None      |            | None                                 | 5708b270-8443-459d-b344-239e968f0693 |
| c6faa22c-5396-4674-822f-f529ad506def | None        | None      |            | 5708b270-8443-459d-b344-239e968f0693 | 5708b270-8443-459d-b344-239e968f0693 |
| dd0ae319-330e-4db1-baff-d4c335a4718f | icmp        | 0.0.0.0/0 |            | None                                 | 1a681f58-e630-403d-b8b3-d48144618814 |
| e07d5f57-1c1c-42a3-a075-1354a6bd7fcf | None        | None      |            | 5708b270-8443-459d-b344-239e968f0693 | 5708b270-8443-459d-b344-239e968f0693 |
| f87051ea-a54a-4388-8e6f-2985d0eb56ab | None        | None      |            | None                                 | 1a681f58-e630-403d-b8b3-d48144618814 |
+--------------------------------------+-------------+-----------+------------+--------------------------------------+--------------------------------------+
[11] 仮想マシンインスタンスに割りあてられたフローティング IP 宛てに SSH 接続することで、インスタンスに SSH ログインできます。
[cent@dlp ~(keystone)]$
openstack server list

+--------------------------------------+----------+--------+------------------------------------+---------+----------+
| ID                                   | Name     | Status | Networks                           | Image   | Flavor   |
+--------------------------------------+----------+--------+------------------------------------+---------+----------+
| aced428a-2d16-4679-9798-50e69c7aaf1d | CentOS_7 | ACTIVE | int_net=192.168.100.59, 10.0.0.240 | CentOS7 | m1.small |
+--------------------------------------+----------+--------+------------------------------------+---------+----------+

[cent@dlp ~(keystone)]$
ssh centos@10.0.0.240

The authenticity of host '10.0.0.240 (10.0.0.240)' can't be established.
ECDSA key fingerprint is SHA256:8JIQDmNwua3M1autPC3YjFOpTuP525whYxaWojC9fbw.
ECDSA key fingerprint is MD5:8e:78:d9:bf:0f:25:e4:14:b2:a2:0a:d7:58:cc:f4:66.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.0.240' (ECDSA) to the list of known hosts.
Last login: Wed May 15 00:33:45 2019
[centos@centos-7 ~]$    
# ログインできた
関連コンテンツ