Border Leaf Router - kratna888/Contrail_Command GitHub Wiki

## Last commit: 2018-06-22 22:46:36 UTC by root
version 17.3R2-S1.2;
groups {
    JUMBO_FRAMES {
        interfaces {
            <*-*> {
                mtu 9216;
            }
        }
    }
    /* Contrail Generated Group Config */
    __contrail__ {
        interfaces {
            /* Interfaces Configuration */
            lo0 {
                /* Router Loopback Interface */
                unit 0 {
                    family inet {
                        address 192.168.255.202/32 {
                            primary;
                            preferred;
                        }
                    }
                }
            }
        }
        routing-options {
            /* Global Routing Options */
            router-id 192.168.255.202;
            route-distinguisher-id 192.168.255.202;
            autonomous-system 64512;
            dynamic-tunnels {
                _contrail_asn-64512 {
                    source-address 192.168.255.202;
                    gre;
                    destination-networks {
                        /* IP Fabric Subnet */
                        10.1.0.0/16;
                        /* BGP Router : 5c10-qfx3-bgp */
                        192.168.255.102/32;
                        /* BGP Router : 5c10-mx80-2-bgp */
                        192.168.255.202/32;
                        /* BGP Router : 5c10-qfx2-bgp */
                        192.168.255.101/32;
                        /* BGP Router : 5c10-qfx7-bgp */
                        192.168.255.1/32;
                        /* BGP Router : 5c10-qfx4-bgp */
                        192.168.255.3/32;
                        /* BGP Router : 5c10-mx80-1-bgp */
                        192.168.255.201/32;
                        /* BGP Router : 5c10-qfx8-bgp */
                        192.168.255.2/32;
                        /* BGP Router : 5c10-qfx5-bgp */
                        192.168.255.4/32;
                        /* BGP Router : 5c10s9 */
                        10.1.0.2/32;
                    }
                }
            }
        }
        protocols {
            /* Protocols Configuration */
            bgp {
                /* BGP Router: 5c10-mx80-2-bgp, UUID: 185b6585-4623-46a5-9861-581c7dfb9750 */
                group _contrail_asn-64512 {
                    type internal;
                    local-address 192.168.255.202;
                    hold-time 90;
                    family inet-vpn {
                        unicast;
                    }
                    family inet6-vpn {
                        unicast;
                    }
                    family evpn {
                        signaling;
                    }
                    family route-target;
                    export _contrail_ibgp_export_policy;
                    /* BGP Router: 5c10-qfx7-bgp, UUID: 34526fe2-708b-4df9-81d0-a573a352c0ed */
                    neighbor 192.168.255.1 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx2-bgp, UUID: 8ac11161-adb1-4171-958d-b019a3192ae4 */
                    neighbor 192.168.255.101 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx4-bgp, UUID: 396bfba9-b931-4e34-8a96-9aaaa24a28b1 */
                    neighbor 192.168.255.3 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx5-bgp, UUID: bb1ab961-88a3-4db4-ac3e-718113547cea */
                    neighbor 192.168.255.4 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-mx80-1-bgp, UUID: 02e7925c-b2c6-45d4-b2ed-ca3ae35c378a */
                    neighbor 192.168.255.201 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx3-bgp, UUID: c01684d1-25f3-4726-b186-a23eecb8e10c */
                    neighbor 192.168.255.102 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx8-bgp, UUID: d98621da-4597-4594-8e50-1cb9a46004cf */
                    neighbor 192.168.255.2 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10s9, UUID: bd665f57-32b3-4823-b9e5-753139f2cd73 */
                    neighbor 10.1.0.2 {
                        peer-as 64512;
                    }
                }
            }
        }
        policy-options {
            /* iBGP Export Policy */
            policy-statement _contrail_ibgp_export_policy {
                term inet-vpn {
                    from family inet-vpn;
                    then {
                        next-hop self;
                    }
                }
                term inet6-vpn {
                    from family inet6-vpn;
                    then {
                        next-hop self;
                    }
                }
            }
        }
    }
}
apply-groups [ JUMBO_FRAMES __contrail__ ];
system {
    host-name 5c10-mx80-2;
    time-zone US/Pacific;
    root-authentication {
        encrypted-password "$6$oe7EQSxE$Kw4Pj/OmaqdBHyL0cW4ZG1zFm2UkP8EFKDnmqfU8XAnQFza0w.XQPF76WF1ggLa5L.gUcxjb36TLBJmgQZGg01"; ## SECRET-DATA
    }
    name-server {
        172.21.200.60;
    }
    login {
        user regress {
            uid 2000;
            class super-user;
            authentication {
                encrypted-password "$1$G3kmi02B$Se420FZv06UKorm4JRinV/"; ## SECRET-DATA
            }
        }
    }
    services {
        ftp;
        ssh {
            root-login allow;
        }
        telnet;
        netconf {
            ssh;
        }
    }
    syslog {
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization info;
        }
        file interactive-commands {
            interactive-commands any;
        }
    }
    archival {
        configuration {
            transfer-on-commit;
            archive-sites {
                "ftp://ftpuser:[email protected]";
            }
        }
    }
    ntp {
        # Boot Servers #
        boot-server 10.84.5.100;
        server 172.21.200.60;
        server 10.84.5.100;
        server 172.29.131.60;
        server 172.29.135.60;
    }
}
interfaces {
    xe-0/0/0 {
        unit 0 {
            family inet {
                address 192.168.30.2/31;
            }
            family iso;
        }
    }
    xe-0/0/1 {
        unit 0 {
            family inet {
                address 192.168.40.2/31;
            }
            family iso;
        }
    }
    fxp0 {
        unit 0 {
            family inet {
                address 10.84.159.128/19;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 192.168.255.202/32;
            }
            family iso {
                address 49.0002.0192.0168.2542.00;
            }
        }
    }
}
snmp {
    location "";
    contact "";
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop 10.84.159.254;
    }
    router-id 192.168.255.202;
    autonomous-system 64512;
}
protocols {
    bgp {
        export ADV-LOOPBACK;
        group IPFAB-UNDER {
            type external;
            mtu-discovery;
            local-as 65402;
            multipath multiple-as;
            neighbor 192.168.40.3 {
                description 5c10-qfx3;
                peer-as 65302;
            }
            neighbor 192.168.30.3 {
                description 5c10-qfx2;
                peer-as 65301;
            }
        }
    }
    inactive: isis {
        interface all {
            level 1 disable;
        }
    }
}
policy-options {
    policy-statement ADV-LOOPBACK {
        term 1 {
            from {
                protocol direct;
                interface lo0.0;
            }
            then accept;
        }
    }
}

Troubleshooting Notes

Issue 0: If you cannot log into the new UI - Contrail Command - https://:9091 then,

iptables -F

Compute Nodes

The compute nodes needs to have kernel version of = kernel-3.10.0-862.3.2.el7.x86_64

wget http://mirror.centos.org/centos/7/updates/x86_64/Packages/kernel-3.10.0-862.3.2.el7.x86_64.rpm

yum install kernel-3.10.0-862.3.2.el7.x86_64.rpm

Step b: Ping Test. From each nodes, ping every remote nodes via mgmt interface as well as data interface.

Issue 0+ : If you cannot launch the new UI after the cluster deployment is complete,

Check the NTP sync.

Issue 1: If you encounter - UNREACHABLE issues when you are provisioning the cluster

Step 1: Log into the Contrail Command Server

ssh  [email protected]
[email protected]'s password:

Step 2: List the dockers

docker ps

Step 3: Log into the docker - contrail-command

docker exec -it contrail-command bash

Step 4: goto directory /var/tmp/contrail_cluster

[root@localhost contrail_cluster]# ls -lrt
total 0
drwxr-xr-x 3 root root 50 Jun  7 05:41 config
drwxr-xr-x 4 root root 90 Jun  7 05:41 edadd8ac-c7d9-4f6c-9a04-564477a97227
[root@localhost contrail_cluster]#

Step 5: you will find a cluster directory - edadd8ac-c7d9-4f6c-9a04-564477a97227

cd edadd8ac-c7d9-4f6c-9a04-564477a97227

Step 6: find the instances.yml file

[root@localhost edadd8ac-c7d9-4f6c-9a04-564477a97227]# ls
contrail-ansible-deployer  contrail-kolla-ansible  instances.yml
[root@localhost edadd8ac-c7d9-4f6c-9a04-564477a97227]#

Step 7: vi instances.yml file

provider_config:
  bms:
    ssh_user: root
    ssh_pwd: c0ntrail123

Step 8 : Verify if the password you had provided here in this section - provider_config is correct for your target nodes.

Issue 3: If you loose connectivity to compute node or If the Ansible playbook fails due to network restart is failing ( service network restart )

Issue 4: if the cluster deployment completes however endpoints are not created , please follow the workaround.

It failed since the keystone token had expired since the cluster deployment took longer than expected.

Step 1: Set the provisioning_state = CREATED - send a curl request to set the provisioning_state to CREATED.

Sample curl request below. Please update cluster resource UUID and x-auth-token to yours

curl --insecure -X PUT
https://:9091/contrail-cluster/43f4388a-4d86-49fe-af0c-59e3c1bca451
-H 'Content-Type: application/json'
-H 'x-auth-token: 3191f984-9738-49d8-ab78-3dc89c4b8209'
-d '{ "contrail-cluster": { "provisioning_state": "CREATED", "uuid": "43f4388a-4d86-49fe-af0c-59e3c1bca451" } }' To get the auth-token from the local keystone, use the following sample curl request.

curl -i -k
-H "Content-Type: application/json"
-d ' { "auth": { "identity": { "methods": ["password"], "password": { "user": { "name": "admin", "domain": { "id": "default" }, "password": "contrail123" } } }, "scope": { "project": { "name": "admin", "domain": { "id": "default" } } } } }'
"https://localhost:9091/keystone/v3/auth/tokens" ; echo

Create the following endpoints:

add following endpoint from infrastructure/cluster Advanced Options -> Endpoints

name: keystone Public URL: http://:5000

name: compute Public URL: http://:8774

name: baremetal Public URL: http://:6385

name: glance Public URL: http://:9292

name: swift Public URL: http://:8080

name: config Public URL: http://:8082

name: telemetry Public URL: http://:8081

name: nodejs Public URL: https://:8143

Logging into sql

Step 1 : log into the contrail_mysql

Step 2:

root@demo-server-11:/# mysql -uroot -pcontrail123

delete from endpoint where name='keystone';

==============================================

BMS usecase

when the ens1f0 gets an IP, the default route is changes to default via 192.168.10.1 dev ens1f0

hence lost external connectivity -

====================================

⚠️ **GitHub.com Fallback** ⚠️