CentOS 7
Sponsored Link

OpenStack Train : Neutron ネットワークを構成する (VXLAN)
2019/10/25
 
OpenStack Network Service(Neutron)による仮想ネットワークの構成です。
例として、VXLAN タイプのネットワークを構成します。
事前に以下のように Control ノードNetwork ノードCompute ノードの 各 Neutron サービスノードを構築済みであることが前提です。
また、当例では Network ノードが二つのネットワークインターフェースを持っているものとします。
------------+---------------------------+---------------------------+------------
            |                           |                           |
        eth0|10.0.0.30              eth0|10.0.0.50              eth0|10.0.0.51
+-----------+-----------+   +-----------+-----------+   +-----------+-----------+
|    [ Control Node ]   |   |    [ Network Node ]   |   |    [ Compute Node ]   |
|                       |   |                       |   |                       |
|  MariaDB    RabbitMQ  |   |      Open vSwitch     |   |        Libvirt        |
|  Memcached  httpd     |   |        L2 Agent       |   |     Nova Compute      |
|  Keystone   Glance    |   |        L3 Agent       |   |      Open vSwitch     |
|  Nova API             |   |     Metadata Agent    |   |        L2 Agent       |
|  Neutron Server       |   |                       |   |                       |
|  Metadata Agent       |   |                       |   |                       |
+-----------------------+   +-----------+-----------+   +-----------------------+
                                    eth1|(UP with no IP)

[1] Control ノードで以下のように設定変更します。
[root@dlp ~(keystone)]#
vi /etc/neutron/plugins/ml2/ml2_conf.ini
# 最終行付近:tenant_network_types に値を追記

[ml2]
type_drivers = flat,vlan,gre,vxlan
tenant_network_types =
vxlan
# 最終行に追記

[ml2_type_flat]
flat_networks = physnet1

[ml2_type_vxlan]
vni_ranges = 1:1000

[root@dlp ~(keystone)]#
systemctl restart neutron-server

[2] Network ノードで以下のように設定変更します。
# ブリッジ追加

[root@network ~]#
ovs-vsctl add-br br-eth1

# 追加したブリッジのポートにeth1を追加

[root@network ~]#
ovs-vsctl add-port br-eth1 eth1

[root@network ~]#
vi /etc/neutron/plugins/ml2/ml2_conf.ini
# 最終行付近:tenant_network_types に値を追記

[ml2]
type_drivers = flat,vlan,gre,vxlan
tenant_network_types =
vxlan
# 最終行に追記

[ml2_type_flat]
flat_networks = physnet1

[ml2_type_vxlan]
vni_ranges = 1:1000

[root@network ~]#
vi /etc/neutron/plugins/ml2/openvswitch_agent.ini
# 最終行に追記

[agent]
tunnel_types = vxlan
prevent_arp_spoofing = True

[ovs]
# local_ip は当ノードのローカルIPを指定
local_ip = 10.0.0.50
bridge_mappings = physnet1:br-eth1

[root@network ~]#
for service in dhcp-agent l3-agent metadata-agent openvswitch-agent; do
systemctl restart neutron-$service
done
# Firewalld 稼働中の場合は停止

[root@network ~]#
systemctl stop firewalld

[root@network ~]#
systemctl disable firewalld

[3] Compute ノードで以下のように設定変更します。
[root@node01 ~]#
vi /etc/neutron/plugins/ml2/ml2_conf.ini
# 最終行付近:tenant_network_types に値を追記

[ml2]
type_drivers = flat,vlan,gre,vxlan
tenant_network_types =
vxlan
# 最終行に追記

[ml2_type_flat]
flat_networks = physnet1

[ml2_type_vxlan]
vni_ranges = 1:1000

[root@node01 ~]#
vi /etc/neutron/plugins/ml2/openvswitch_agent.ini
# 最終行に追記

[agent]
tunnel_types = vxlan
prevent_arp_spoofing = True

[ovs]
# local_ip は当ノードのローカルIPを指定
local_ip = 10.0.0.51

[root@node01 ~]#
systemctl restart neutron-openvswitch-agent
# Firewalld 稼働中の場合は停止

[root@node01 ~]#
systemctl stop firewalld

[root@node01 ~]#
systemctl disable firewalld

[4] 仮想ルータを作成します。作業場所はどこでもよいですが、当例では Control ノード上で作業します。
# 仮想ルーター作成

[root@dlp ~(keystone)]#
openstack router create router01

+-------------------------+------------------------------------------------------------------------+
| Field                   | Value                                                                  |
+-------------------------+------------------------------------------------------------------------+
| admin_state_up          | UP                                                                     |
| availability_zone_hints |                                                                        |
| availability_zones      |                                                                        |
| created_at              | 2019-10-25T07:00:32Z                                                   |
| description             |                                                                        |
| distributed             | False                                                                  |
| external_gateway_info   | null                                                                   |
| flavor_id               | None                                                                   |
| ha                      | False                                                                  |
| id                      | 4779ca6a-7779-4e3f-bdf3-6c85f94bacd1                                   |
| location                | cloud='', project.domain_id=, project.domain_name='default', project...|
| name                    | router01                                                               |
| project_id              | 4f93fd3e6e184c859641b017115016a4                                       |
| revision_number         | 1                                                                      |
| routes                  |                                                                        |
| status                  | ACTIVE                                                                 |
| tags                    |                                                                        |
| updated_at              | 2019-10-25T07:00:32Z                                                   |
+-------------------------+------------------------------------------------------------------------+

[5] 内部用のネットワークを作成し、仮想ルーターに関連付けます。
# 内部用ネットワーク作成

[root@dlp ~(keystone)]#
openstack network create int_net --provider-network-type vxlan

+---------------------------+----------------------------------------------------------------------+
| Field                     | Value                                                                |
+---------------------------+----------------------------------------------------------------------+
| admin_state_up            | UP                                                                   |
| availability_zone_hints   |                                                                      |
| availability_zones        |                                                                      |
| created_at                | 2019-10-25T07:01:12Z                                                 |
| description               |                                                                      |
| dns_domain                | None                                                                 |
| id                        | 08ba2a6b-a9e6-41cd-b530-ffecb146117e                                 |
| ipv4_address_scope        | None                                                                 |
| ipv6_address_scope        | None                                                                 |
| is_default                | False                                                                |
| is_vlan_transparent       | None                                                                 |
| location                  | cloud='', project.domain_id=, project.domain_name='default', proje...|
| mtu                       | 1450                                                                 |
| name                      | int_net                                                              |
| port_security_enabled     | True                                                                 |
| project_id                | 4f93fd3e6e184c859641b017115016a4                                     |
| provider:network_type     | vxlan                                                                |
| provider:physical_network | None                                                                 |
| provider:segmentation_id  | 90                                                                   |
| qos_policy_id             | None                                                                 |
| revision_number           | 1                                                                    |
| router:external           | Internal                                                             |
| segments                  | None                                                                 |
| shared                    | False                                                                |
| status                    | ACTIVE                                                               |
| subnets                   |                                                                      |
| tags                      |                                                                      |
| updated_at                | 2019-10-25T07:01:12Z                                                 |
+---------------------------+----------------------------------------------------------------------+

# 内部用ネットワークにサブネット作成

[root@dlp ~(keystone)]#
openstack subnet create subnet1 --network int_net \
--subnet-range 192.168.100.0/24 --gateway 192.168.100.1 \
--dns-nameserver 10.0.0.10

+-------------------+-----------------------------------------------------------------------------+
| Field             | Value                                                                       |
+-------------------+-----------------------------------------------------------------------------+
| allocation_pools  | 192.168.100.2-192.168.100.254                                               |
| cidr              | 192.168.100.0/24                                                            |
| created_at        | 2019-10-25T07:01:54Z                                                        |
| description       |                                                                             |
| dns_nameservers   | 10.0.0.10                                                                   |
| enable_dhcp       | True                                                                        |
| gateway_ip        | 192.168.100.1                                                               |
| host_routes       |                                                                             |
| id                | 7e35d8e7-4f75-4afd-ab9f-da5ccf6850fc                                        |
| ip_version        | 4                                                                           |
| ipv6_address_mode | None                                                                        |
| ipv6_ra_mode      | None                                                                        |
| location          | cloud='', project.domain_id=, project.domain_name='default', project.id='...|
| name              | subnet1                                                                     |
| network_id        | 08ba2a6b-a9e6-41cd-b530-ffecb146117e                                        |
| prefix_length     | None                                                                        |
| project_id        | 4f93fd3e6e184c859641b017115016a4                                            |
| revision_number   | 0                                                                           |
| segment_id        | None                                                                        |
| service_types     |                                                                             |
| subnetpool_id     | None                                                                        |
| tags              |                                                                             |
| updated_at        | 2019-10-25T07:01:54Z                                                        |
+-------------------+-----------------------------------------------------------------------------+

# 仮想ルーターに内部ネットワークを設定

[root@dlp ~(keystone)]#
openstack router add subnet router01 subnet1
[6] 外部接続用のネットワークを作成し、仮想ルーターに関連付けます。
# 外部用ネットワーク作成

[root@dlp ~(keystone)]#
openstack network create \
--provider-physical-network physnet1 \
--provider-network-type flat --external ext_net

+---------------------------+----------------------------------------------------------------------+
| Field                     | Value                                                                |
+---------------------------+----------------------------------------------------------------------+
| admin_state_up            | UP                                                                   |
| availability_zone_hints   |                                                                      |
| availability_zones        |                                                                      |
| created_at                | 2019-10-25T07:03:06Z                                                 |
| description               |                                                                      |
| dns_domain                | None                                                                 |
| id                        | f6440530-1b12-4748-a557-3596e36a42ec                                 |
| ipv4_address_scope        | None                                                                 |
| ipv6_address_scope        | None                                                                 |
| is_default                | False                                                                |
| is_vlan_transparent       | None                                                                 |
| location                  | cloud='', project.domain_id=, project.domain_name='default', proje...|
| mtu                       | 1500                                                                 |
| name                      | ext_net                                                              |
| port_security_enabled     | True                                                                 |
| project_id                | 4f93fd3e6e184c859641b017115016a4                                     |
| provider:network_type     | flat                                                                 |
| provider:physical_network | physnet1                                                             |
| provider:segmentation_id  | None                                                                 |
| qos_policy_id             | None                                                                 |
| revision_number           | 1                                                                    |
| router:external           | External                                                             |
| segments                  | None                                                                 |
| shared                    | False                                                                |
| status                    | ACTIVE                                                               |
| subnets                   |                                                                      |
| tags                      |                                                                      |
| updated_at                | 2019-10-25T07:03:06Z                                                 |
+---------------------------+----------------------------------------------------------------------+

# 外部用ネットワークにサブネット作成

[root@dlp ~(keystone)]#
openstack subnet create subnet2 \
--network ext_net --subnet-range 10.0.0.0/24 \
--allocation-pool start=10.0.0.200,end=10.0.0.254 \
--gateway 10.0.0.1 --dns-nameserver 10.0.0.10 --no-dhcp

+-------------------+-----------------------------------------------------------------------------+
| Field             | Value                                                                       |
+-------------------+-----------------------------------------------------------------------------+
| allocation_pools  | 10.0.0.200-10.0.0.254                                                       |
| cidr              | 10.0.0.0/24                                                                 |
| created_at        | 2019-10-25T07:03:44Z                                                        |
| description       |                                                                             |
| dns_nameservers   | 10.0.0.10                                                                   |
| enable_dhcp       | False                                                                       |
| gateway_ip        | 10.0.0.1                                                                    |
| host_routes       |                                                                             |
| id                | c2db3338-39cf-4529-8c7e-8680db716475                                        |
| ip_version        | 4                                                                           |
| ipv6_address_mode | None                                                                        |
| ipv6_ra_mode      | None                                                                        |
| location          | cloud='', project.domain_id=, project.domain_name='default', project.id='...|
| name              | subnet2                                                                     |
| network_id        | f6440530-1b12-4748-a557-3596e36a42ec                                        |
| prefix_length     | None                                                                        |
| project_id        | 4f93fd3e6e184c859641b017115016a4                                            |
| revision_number   | 0                                                                           |
| segment_id        | None                                                                        |
| service_types     |                                                                             |
| subnetpool_id     | None                                                                        |
| tags              |                                                                             |
| updated_at        | 2019-10-25T07:03:44Z                                                        |
+-------------------+-----------------------------------------------------------------------------+

# 仮想ルーターにゲートウェイを設定

[root@dlp ~(keystone)]#
openstack router set router01 --external-gateway ext_net

[7] 作成したネットワークは、外部用はデフォルトで全プロジェクトがアクセス可能ですが、内部用はデフォルトでは admin プロジェクトのみがアクセス可能なため、内部ネットワークを利用させたいプロジェクトにアクセス権限を付与しておきます。
# ネットワーク RBAC リスト表示

[root@dlp ~(keystone)]#
openstack network rbac list

+--------------------------------------+-------------+--------------------------------------+
| ID                                   | Object Type | Object ID                            |
+--------------------------------------+-------------+--------------------------------------+
| e6981eab-8f30-44a4-82fc-a69a4adfa572 | network     | f6440530-1b12-4748-a557-3596e36a42ec |
+--------------------------------------+-------------+--------------------------------------+

# RBAC の詳細 (access_as_external のみ全プロジェクトがアクセス可能)

[root@dlp ~(keystone)]#
openstack network rbac show e6981eab-8f30-44a4-82fc-a69a4adfa572

+-------------------+------------------------------------------------------------------------------+
| Field             | Value                                                                        |
+-------------------+------------------------------------------------------------------------------+
| action            | access_as_external                                                           |
| id                | e6981eab-8f30-44a4-82fc-a69a4adfa572                                         |
| location          | cloud='', project.domain_id=, project.domain_name='default', project.id='4...|
| name              | None                                                                         |
| object_id         | f6440530-1b12-4748-a557-3596e36a42ec                                         |
| object_type       | network                                                                      |
| project_id        | 4f93fd3e6e184c859641b017115016a4                                             |
| target_project_id | *                                                                            |
+-------------------+------------------------------------------------------------------------------+

# 作成済みネットワーク一覧

[root@dlp ~(keystone)]#
openstack network list

+--------------------------------------+---------+--------------------------------------+
| ID                                   | Name    | Subnets                              |
+--------------------------------------+---------+--------------------------------------+
| 08ba2a6b-a9e6-41cd-b530-ffecb146117e | int_net | 7e35d8e7-4f75-4afd-ab9f-da5ccf6850fc |
| f6440530-1b12-4748-a557-3596e36a42ec | ext_net | c2db3338-39cf-4529-8c7e-8680db716475 |
+--------------------------------------+---------+--------------------------------------+

# 作成済みプロジェクト一覧

[root@dlp ~(keystone)]#
openstack project list

+----------------------------------+-----------+
| ID                               | Name      |
+----------------------------------+-----------+
| 2b9c4eda462e40a4a3d03b0a38f12bf1 | service   |
| 4f93fd3e6e184c859641b017115016a4 | admin     |
| 67b2b71cee384d69939e6b3963e0b2db | hiroshima |
+----------------------------------+-----------+

# [int_net] への [access_as_shared] アクセス権を [hiroshima] プロジェクトに付与

[root@dlp ~(keystone)]#
netID=$(openstack network list | grep int_net | awk '{ print $2 }')

[root@dlp ~(keystone)]#
prjID=$(openstack project list | grep hiroshima | awk '{ print $2 }')

[root@dlp ~(keystone)]#
openstack network rbac create --target-project $prjID --type network --action access_as_shared $netID

+-------------------+------------------------------------------------------------------------------+
| Field             | Value                                                                        |
+-------------------+------------------------------------------------------------------------------+
| action            | access_as_shared                                                             |
| id                | 5a8a1b9e-14ac-4e21-adb9-cf9fa35b1491                                         |
| location          | cloud='', project.domain_id=, project.domain_name='default', project.id='4...|
| name              | None                                                                         |
| object_id         | 08ba2a6b-a9e6-41cd-b530-ffecb146117e                                         |
| object_type       | network                                                                      |
| project_id        | 4f93fd3e6e184c859641b017115016a4                                             |
| target_project_id | 67b2b71cee384d69939e6b3963e0b2db                                             |
+-------------------+------------------------------------------------------------------------------+
[8] 内部ネットワークへのアクセス権を付与したプロジェクトに所属する任意のユーザーでログインし、 作成した内部ネットワークをインスタンスに紐付けてインスタンスを作成・起動します。
# 利用可能な flavor 確認

[cent@dlp ~(keystone)]$
openstack flavor list

+----+----------+------+------+-----------+-------+-----------+
| ID | Name     |  RAM | Disk | Ephemeral | VCPUs | Is Public |
+----+----------+------+------+-----------+-------+-----------+
| 0  | m1.small | 2048 |   10 |         0 |     1 | True      |
+----+----------+------+------+-----------+-------+-----------+

# 利用可能なイメージ確認

[cent@dlp ~(keystone)]$
openstack image list

+--------------------------------------+---------+--------+
| ID                                   | Name    | Status |
+--------------------------------------+---------+--------+
| c742c8ed-9d0f-4555-9844-7f063a0b585f | CentOS7 | active |
+--------------------------------------+---------+--------+

# 利用可能なネットワーク確認

[cent@dlp ~(keystone)]$
openstack network list

+--------------------------------------+---------+--------------------------------------+
| ID                                   | Name    | Subnets                              |
+--------------------------------------+---------+--------------------------------------+
| 08ba2a6b-a9e6-41cd-b530-ffecb146117e | int_net | 7e35d8e7-4f75-4afd-ab9f-da5ccf6850fc |
| f6440530-1b12-4748-a557-3596e36a42ec | ext_net | c2db3338-39cf-4529-8c7e-8680db716475 |
+--------------------------------------+---------+--------------------------------------+

# インスタンス用のセキュリティグループを作成

[cent@dlp ~(keystone)]$
openstack security group create secgroup01

+-----------------+-------------------------------------------------------------------------------+
| Field           | Value                                                                         |
+-----------------+-------------------------------------------------------------------------------+
| created_at      | 2019-10-25T06:50:07Z                                                          |
| description     | secgroup01                                                                    |
| id              | d4563618-ed32-44e2-8753-904b2c88994c                                          |
| location        | cloud='', project.domain_id=, project.domain_name='default', project.id='67...|
| name            | secgroup01                                                                    |
| project_id      | 67b2b71cee384d69939e6b3963e0b2db                                              |
| revision_number | 1                                                                             |
| rules           | created_at='2019-10-25T06:50:07Z', direction='egress', ethertype='IPv4', id...|
|                 | created_at='2019-10-25T06:50:07Z', direction='egress', ethertype='IPv6', id...|
| tags            | []                                                                            |
| updated_at      | 2019-10-25T06:50:07Z                                                          |
+-----------------+-------------------------------------------------------------------------------+

# インスタンス接続用の SSH キーペア作成

[cent@dlp ~(keystone)]$
ssh-keygen -q -N ""

Enter file in which to save the key (/home/cent/.ssh/id_rsa):
# 公開鍵登録

[cent@dlp ~(keystone)]$
openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey

+-------------+-------------------------------------------------+
| Field       | Value                                           |
+-------------+-------------------------------------------------+
| fingerprint | 02:d5:c2:25:0e:06:34:a8:06:a2:2b:42:7e:eb:3d:d3 |
| name        | mykey                                           |
| user_id     | 14ad73cc98744e01a51886e13d541013                |
+-------------+-------------------------------------------------+

[cent@dlp ~(keystone)]$
netID=$(openstack network list | grep int_net | awk '{ print $2 }')

[cent@dlp ~(keystone)]$
openstack server create --flavor m1.small --image CentOS7 --security-group secgroup01 --nic net-id=$netID --key-name mykey CentOS_7
[cent@dlp ~(keystone)]$
openstack server list

+--------------------------------------+----------+--------+-------------------------+---------+----------+
| ID                                   | Name     | Status | Networks                | Image   | Flavor   |
+--------------------------------------+----------+--------+-------------------------+---------+----------+
| b3c21241-2800-4109-831b-6fd69d20ecf8 | CentOS_7 | ACTIVE | int_net=192.168.100.179 | CentOS7 | m1.small |
+--------------------------------------+----------+--------+-------------------------+---------+----------+
[9] 作成した仮想マシンインスタンスにフローティングIP を割り当てます。
[cent@dlp ~(keystone)]$
openstack floating ip create ext_net

+---------------------+----------------------------------------------------------------------------+
| Field               | Value                                                                      |
+---------------------+----------------------------------------------------------------------------+
| created_at          | 2019-10-25T07:09:16Z                                                       |
| description         |                                                                            |
| dns_domain          | None                                                                       |
| dns_name            | None                                                                       |
| fixed_ip_address    | None                                                                       |
| floating_ip_address | 10.0.0.233                                                                 |
| floating_network_id | f6440530-1b12-4748-a557-3596e36a42ec                                       |
| id                  | 64567c2e-8405-49a9-839a-055ab223e5cd                                       |
| location            | Munch({'project': Munch({'domain_name': 'default', 'domain_id': None, 'n...|
| name                | 10.0.0.233                                                                 |
| port_details        | None                                                                       |
| port_id             | None                                                                       |
| project_id          | 67b2b71cee384d69939e6b3963e0b2db                                           |
| qos_policy_id       | None                                                                       |
| revision_number     | 0                                                                          |
| router_id           | None                                                                       |
| status              | DOWN                                                                       |
| subnet_id           | None                                                                       |
| tags                | []                                                                         |
| updated_at          | 2019-10-25T07:09:16Z                                                       |
+---------------------+----------------------------------------------------------------------------+

[cent@dlp ~(keystone)]$
openstack server add floating ip CentOS_7 10.0.0.233

# 設定確認

[cent@dlp ~(keystone)]$
openstack floating ip show 10.0.0.233

+---------------------+----------------------------------------------------------------------------+
| Field               | Value                                                                      |
+---------------------+----------------------------------------------------------------------------+
| created_at          | 2019-10-25T07:09:16Z                                                       |
| description         |                                                                            |
| dns_domain          | None                                                                       |
| dns_name            | None                                                                       |
| fixed_ip_address    | 192.168.100.179                                                            |
| floating_ip_address | 10.0.0.233                                                                 |
| floating_network_id | f6440530-1b12-4748-a557-3596e36a42ec                                       |
| id                  | 64567c2e-8405-49a9-839a-055ab223e5cd                                       |
| location            | cloud='', project.domain_id=, project.domain_name='default', project.id=...|
| name                | 10.0.0.233                                                                 |
| port_details        | admin_state_up='True', device_id='b3c21241-2800-4109-831b-6fd69d20ecf8',...|
| port_id             | c3c41a4d-e87b-4a4c-b0ea-15d7aa49c211                                       |
| project_id          | 67b2b71cee384d69939e6b3963e0b2db                                           |
| qos_policy_id       | None                                                                       |
| revision_number     | 2                                                                          |
| router_id           | 4779ca6a-7779-4e3f-bdf3-6c85f94bacd1                                       |
| status              | ACTIVE                                                                     |
| subnet_id           | None                                                                       |
| tags                | []                                                                         |
| updated_at          | 2019-10-25T07:09:58Z                                                       |
+---------------------+----------------------------------------------------------------------------+

[cent@dlp ~(keystone)]$
openstack server list

+--------------------------------------+----------+--------+-------------------------------------+---------+----------+
| ID                                   | Name     | Status | Networks                            | Image   | Flavor   |
+--------------------------------------+----------+--------+-------------------------------------+---------+----------+
| b3c21241-2800-4109-831b-6fd69d20ecf8 | CentOS_7 | ACTIVE | int_net=192.168.100.179, 10.0.0.233 | CentOS7 | m1.small |
+--------------------------------------+----------+--------+-------------------------------------+---------+----------+
[10] 起動した仮想マシンインスタンスに SSH 接続できるように、先に作成したセキュリティグループにポート許可の設定を追加します。
# ICMP 許可

[cent@dlp ~(keystone)]$
openstack security group rule create --protocol icmp --ingress secgroup01

+-------------------+-----------------------------------------------------------------------------+
| Field             | Value                                                                       |
+-------------------+-----------------------------------------------------------------------------+
| created_at        | 2019-10-25T06:52:03Z                                                        |
| description       |                                                                             |
| direction         | ingress                                                                     |
| ether_type        | IPv4                                                                        |
| id                | c6b50434-bf8f-4270-841f-49994e38cfb6                                        |
| location          | cloud='', project.domain_id=, project.domain_name='default', project.id='...|
| name              | None                                                                        |
| port_range_max    | None                                                                        |
| port_range_min    | None                                                                        |
| project_id        | 67b2b71cee384d69939e6b3963e0b2db                                            |
| protocol          | icmp                                                                        |
| remote_group_id   | None                                                                        |
| remote_ip_prefix  | 0.0.0.0/0                                                                   |
| revision_number   | 0                                                                           |
| security_group_id | d4563618-ed32-44e2-8753-904b2c88994c                                        |
| tags              | []                                                                          |
| updated_at        | 2019-10-25T06:52:03Z                                                        |
+-------------------+-----------------------------------------------------------------------------+

# SSH 許可

[cent@dlp ~(keystone)]$
openstack security group rule create --protocol tcp --dst-port 22:22 secgroup01

+-------------------+-----------------------------------------------------------------------------+
| Field             | Value                                                                       |
+-------------------+-----------------------------------------------------------------------------+
| created_at        | 2019-10-25T06:52:29Z                                                        |
| description       |                                                                             |
| direction         | ingress                                                                     |
| ether_type        | IPv4                                                                        |
| id                | b2bb1067-7cca-49fc-916a-4bd6372fb639                                        |
| location          | cloud='', project.domain_id=, project.domain_name='default', project.id='...|
| name              | None                                                                        |
| port_range_max    | 22                                                                          |
| port_range_min    | 22                                                                          |
| project_id        | 67b2b71cee384d69939e6b3963e0b2db                                            |
| protocol          | tcp                                                                         |
| remote_group_id   | None                                                                        |
| remote_ip_prefix  | 0.0.0.0/0                                                                   |
| revision_number   | 0                                                                           |
| security_group_id | d4563618-ed32-44e2-8753-904b2c88994c                                        |
| tags              | []                                                                          |
| updated_at        | 2019-10-25T06:52:29Z                                                        |
+-------------------+-----------------------------------------------------------------------------+

[cent@dlp ~(keystone)]$
openstack security group rule list

+--------------------------------------+-------------+-----------+-----------+------------+--------------------------------------+--------------------------------------+
| ID                                   | IP Protocol | Ethertype | IP Range  | Port Range | Remote Security Group                | Security Group                       |
+--------------------------------------+-------------+-----------+-----------+------------+--------------------------------------+--------------------------------------+
| 3fd92ecf-86dd-48a5-9d64-2a0c75744fc0 | None        | IPv4      | 0.0.0.0/0 |            | None                                 | d4563618-ed32-44e2-8753-904b2c88994c |
| 46c65b08-09a9-44e0-904d-934a91220ded | None        | IPv6      | ::/0      |            | e771f702-01e1-4263-95d0-e5818ea24c2c | e771f702-01e1-4263-95d0-e5818ea24c2c |
| 5a4b12f0-f1c2-43bb-b0bc-88a5e3fabafd | None        | IPv6      | ::/0      |            | None                                 | e771f702-01e1-4263-95d0-e5818ea24c2c |
| 76dac696-89a0-44e0-8144-d53c740b9746 | None        | IPv4      | 0.0.0.0/0 |            | None                                 | e771f702-01e1-4263-95d0-e5818ea24c2c |
| b2bb1067-7cca-49fc-916a-4bd6372fb639 | tcp         | IPv4      | 0.0.0.0/0 | 22:22      | None                                 | d4563618-ed32-44e2-8753-904b2c88994c |
| c6b50434-bf8f-4270-841f-49994e38cfb6 | icmp        | IPv4      | 0.0.0.0/0 |            | None                                 | d4563618-ed32-44e2-8753-904b2c88994c |
| ead55e6f-e2dd-4b21-862c-c2bcb6a724e9 | None        | IPv4      | 0.0.0.0/0 |            | e771f702-01e1-4263-95d0-e5818ea24c2c | e771f702-01e1-4263-95d0-e5818ea24c2c |
| f8282ac9-cd7f-4947-bd58-c2bb50d36b2e | None        | IPv6      | ::/0      |            | None                                 | d4563618-ed32-44e2-8753-904b2c88994c |
+--------------------------------------+-------------+-----------+-----------+------------+--------------------------------------+--------------------------------------+
[11] 仮想マシンインスタンスに割りあてられたフローティング IP 宛てに SSH 接続することで、インスタンスに SSH ログインできます。
[cent@dlp ~(keystone)]$
openstack server list

+--------------------------------------+----------+--------+-------------------------------------+---------+----------+
| ID                                   | Name     | Status | Networks                            | Image   | Flavor   |
+--------------------------------------+----------+--------+-------------------------------------+---------+----------+
| b3c21241-2800-4109-831b-6fd69d20ecf8 | CentOS_7 | ACTIVE | int_net=192.168.100.179, 10.0.0.233 | CentOS7 | m1.small |
+--------------------------------------+----------+--------+-------------------------------------+---------+----------+

[cent@dlp ~(keystone)]$
ssh centos@10.0.0.233

The authenticity of host '10.0.0.233 (10.0.0.233)' can't be established.
ECDSA key fingerprint is SHA256:8Mxh+vSFka75QgGaBO/RGWYnFNAOtdgw9q3OQv+QaJw.
ECDSA key fingerprint is MD5:7c:f3:35:bf:ab:01:d7:d0:98:a3:2b:2d:04:11:74:56.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.0.233' (ECDSA) to the list of known hosts.
[centos@centos-7 ~]$    
# ログインできた
関連コンテンツ