LEAF NODE3 CONFIG 5C10 QFX7 - kratna888/Contrail_Command GitHub Wiki

## Last changed: 2018-06-06 01:20:29 UTC
## Image name: jinstall-host-qfx-5e-flex-x86-64-17.3R2.9-secure-signed.tgz

version 17.3R1.10;
groups {
    JUMBO_FRAMES {
        interfaces {
            <*-*> {
                mtu 9216;
            }
        }
    }
    /* Contrail Generated Group Config */
    __contrail__ {
        interfaces {
            /* Interfaces Configuration */
            lo0 {
                /* Router Loopback Interface */
                unit 0 {
                    family inet {
                        address 192.168.255.1/32 {
                            primary;
                            preferred;
                        }
                    }
                }
            }
        }
        routing-options {
            /* Global Routing Options */
            router-id 192.168.255.1;
            route-distinguisher-id 192.168.255.1;
            autonomous-system 64512;
            resolution {
                rib bgp.rtarget.0 {
                    resolution-ribs inet.0;
                }
            }
        }
        protocols {
            /* Protocols Configuration */
            bgp {
                /* BGP Router: 5c10-qfx7-bgp, UUID: 163dd771-309f-4873-811a-9aecf6b2c89d */
                group _contrail_asn-64512 {
                    type internal;
                    local-address 192.168.255.1;
                    hold-time 90;
                    family evpn {
                        signaling;
                    }
                    family route-target;
                    /* BGP Router: 5c10-qfx3-bgp, UUID: c1bc3905-7c01-404c-979a-85913d88965b */
                    neighbor 192.168.255.102 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx8-bgp, UUID: fc9b5ec1-f27e-4a27-817e-45677578149a */
                    neighbor 192.168.255.2 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx4-bgp, UUID: 5f548a4e-ae1e-4753-9a44-f11b3816f81b */
                    neighbor 192.168.255.3 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx5-bgp, UUID: f9ed8dd2-c594-400a-a971-a7d0fef2eeb1 */
                    neighbor 192.168.255.4 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-mx80-1-bgp, UUID: e087ffb7-2e0f-4133-bd80-345ae4d016de */
                    neighbor 192.168.255.201 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx2-bgp, UUID: 812803b8-3a93-4ddd-806f-348f82907f37 */
                    neighbor 192.168.255.101 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10s9, UUID: bd665f57-32b3-4823-b9e5-753139f2cd73 */
                    neighbor 10.1.0.2 {
                        peer-as 64512;
                    }
                }
            }
        }
        policy-options {
            /* Policy Options */
            community _contrail_switch_policy_ members target:64512:1;
        }
        switch-options {
            vtep-source-interface lo0.0;
        }
    }
}
apply-groups [ JUMBO_FRAMES __contrail__ ];
system {
    host-name 5c10-qfx7;
    domain-search [ contrail.juniper.net juniper.net jnpr.net englab.juniper.net spglab.juniper.net ];
    time-zone US/Pacific;
    arp {
        aging-timer 5;
    }
    root-authentication {
        encrypted-password "$6$I7UjnsGq$vYzV8/zhhJCEV5qKOEEjll95AUABIgxHjWoEEUKoQENwW/Yh7EYTTXqAFRfutstFwy/bddjVJ4BUfxw5UFe4l/"; ## SECRET-DATA
    }
    name-server {
        172.21.200.60;
    }
    services {
        ftp;
        ssh {
            root-login allow;
        }
        telnet;
        netconf {
            ssh;
            traceoptions {
                file nc;
                flag all;
            }
        }
    }
    syslog {
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization info;
        }
        file interactive-commands {
            interactive-commands any;
        }
    }
    archival {
        configuration {
            transfer-on-commit;
            archive-sites {
                "ftp://ftpuser:[email protected]";
            }
        }
    }
    processes {
        dhcp-service {
            traceoptions {
                file dhcp_logfile size 10m;
                level all;
                flag all;
            }
        }
        app-engine-virtual-machine-management-service {
            traceoptions {
                level notice;
                flag all;
            }
        }
    }
    ntp {
        server 172.21.200.60;
    }
}
chassis {
    redundancy {
        graceful-switchover;
    }
    aggregated-devices {
        ethernet {
            device-count 440;
        }
    }
}
interfaces {
    xe-0/0/32 {
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members vlan10;
                }
            }
        }
    }
    xe-0/0/33 {
        disable;
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members vlan10;
                }
            }
        }
    }
    xe-0/0/34 {
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members vlan10;
                }
            }
        }
    }
    xe-0/0/35 {
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members vlan10;
                }
            }
        }
    }
    et-0/0/48 {
        unit 0 {
            family inet {
                address 192.168.10.1/31;
            }
            family iso;
        }
    }
    et-0/0/49 {
        unit 0 {
            family inet {
                address 192.168.20.1/31;
            }
            family iso;
        }
    }
    ae10 {
        mtu 9192;
        aggregated-ether-options {
            lacp {
                active;
                periodic fast;
            }
        }
        unit 0 {
            family ethernet-switching {
                interface-mode trunk;
                vlan {
                    members vlan10;
                }
            }
        }
    }
    em0 {
        unit 0 {
            family inet {
                address 10.84.130.42/19;
            }
        }
    }
    irb {
        unit 10 {
            family inet {
                address 10.1.0.1/26;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 192.168.255.1/32;
            }
            family iso {
                address 49.0002.0192.0168.2551.00;
            }
        }
    }
}
snmp {
    location "";
    contact "";
    community public {
        authorization read-only;
    }
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop 10.84.159.254;
    }
    router-id 192.168.255.1;
    autonomous-system 64512;
}
protocols {
    bgp {
        group IPFAB-UNDER {
            type external;
            mtu-discovery;
            export BGP-IPFAB-UNDER-EXP;
            local-as 65001;
            multipath multiple-as;
            neighbor 192.168.10.0 {
                description 5c10-qfx2;
                peer-as 65301;
            }
            neighbor 192.168.20.0 {
                description 5c10-qfx3;
                peer-as 65302;
            }
        }
        inactive: group Contrail {
            type internal;
            traceoptions {
                file bgp.contrail.log;
                flag all;
            }
            family inet-vpn {
                unicast;
            }
            family inet6-vpn {
                unicast;
            }
            family evpn {
                signaling;
            }
            family route-target;
            local-as 64512;
            neighbor 10.1.0.2 {
                peer-as 64512;
            }
        }
    }
    inactive: isis {
        interface all {
            level 1 disable;
        }
    }
    lldp {
        interface all;
    }
    lldp-med {
        interface all;
    }
}
policy-options {
    policy-statement BGP-IPFAB-UNDER-EXP {
        term LOOPBACK {
            from {
                protocol direct;
                interface lo0.0;
            }
            then {
                community set IPFAB-LEAF;
                accept;
            }
        }
        term SERVERS {
            from {
                protocol direct;
                interface irb.10;
            }
            then {
                community set IPFAB-LEAF;
                accept;
            }
        }
        then reject;
    }
    community IPFAB-LEAF members 64512:1001;
}
vlans {
    vlan10 {
        vlan-id 10;
        l3-interface irb.10;
    }
}

Troubleshooting Notes

Issue 0: If you cannot log into the new UI - Contrail Command - https://:9091 then,

iptables -F

Compute Nodes

The compute nodes needs to have kernel version of = kernel-3.10.0-862.3.2.el7.x86_64

wget http://mirror.centos.org/centos/7/updates/x86_64/Packages/kernel-3.10.0-862.3.2.el7.x86_64.rpm

yum install kernel-3.10.0-862.3.2.el7.x86_64.rpm

Step b: Ping Test. From each nodes, ping every remote nodes via mgmt interface as well as data interface.

Issue 0+ : If you cannot launch the new UI after the cluster deployment is complete,

Check the NTP sync.

Issue 1: If you encounter - UNREACHABLE issues when you are provisioning the cluster

Step 1: Log into the Contrail Command Server

ssh  [email protected]
[email protected]'s password:

Step 2: List the dockers

docker ps

Step 3: Log into the docker - contrail-command

docker exec -it contrail-command bash

Step 4: goto directory /var/tmp/contrail_cluster

[root@localhost contrail_cluster]# ls -lrt
total 0
drwxr-xr-x 3 root root 50 Jun  7 05:41 config
drwxr-xr-x 4 root root 90 Jun  7 05:41 edadd8ac-c7d9-4f6c-9a04-564477a97227
[root@localhost contrail_cluster]#

Step 5: you will find a cluster directory - edadd8ac-c7d9-4f6c-9a04-564477a97227

cd edadd8ac-c7d9-4f6c-9a04-564477a97227

Step 6: find the instances.yml file

[root@localhost edadd8ac-c7d9-4f6c-9a04-564477a97227]# ls
contrail-ansible-deployer  contrail-kolla-ansible  instances.yml
[root@localhost edadd8ac-c7d9-4f6c-9a04-564477a97227]#

Step 7: vi instances.yml file

provider_config:
  bms:
    ssh_user: root
    ssh_pwd: c0ntrail123

Step 8 : Verify if the password you had provided here in this section - provider_config is correct for your target nodes.

Issue 3: If you loose connectivity to compute node or If the Ansible playbook fails due to network restart is failing ( service network restart )

Issue 4: if the cluster deployment completes however endpoints are not created , please follow the workaround.

It failed since the keystone token had expired since the cluster deployment took longer than expected.

Step 1: Set the provisioning_state = CREATED - send a curl request to set the provisioning_state to CREATED.

Sample curl request below. Please update cluster resource UUID and x-auth-token to yours

curl --insecure -X PUT
https://:9091/contrail-cluster/43f4388a-4d86-49fe-af0c-59e3c1bca451
-H 'Content-Type: application/json'
-H 'x-auth-token: 3191f984-9738-49d8-ab78-3dc89c4b8209'
-d '{ "contrail-cluster": { "provisioning_state": "CREATED", "uuid": "43f4388a-4d86-49fe-af0c-59e3c1bca451" } }' To get the auth-token from the local keystone, use the following sample curl request.

curl -i -k
-H "Content-Type: application/json"
-d ' { "auth": { "identity": { "methods": ["password"], "password": { "user": { "name": "admin", "domain": { "id": "default" }, "password": "contrail123" } } }, "scope": { "project": { "name": "admin", "domain": { "id": "default" } } } } }'
"https://localhost:9091/keystone/v3/auth/tokens" ; echo

Create the following endpoints:

add following endpoint from infrastructure/cluster Advanced Options -> Endpoints

name: keystone Public URL: http://:5000

name: compute Public URL: http://:8774

name: baremetal Public URL: http://:6385

name: glance Public URL: http://:9292

name: swift Public URL: http://:8080

name: config Public URL: http://:8082

name: telemetry Public URL: http://:8081

name: nodejs Public URL: https://:8143

Logging into sql

Step 1 : log into the contrail_mysql

Step 2:

root@demo-server-11:/# mysql -uroot -pcontrail123

delete from endpoint where name='keystone';

==============================================

BMS usecase

when the ens1f0 gets an IP, the default route is changes to default via 192.168.10.1 dev ens1f0

hence lost external connectivity -

====================================

⚠️ **GitHub.com Fallback** ⚠️