Spine 5C10 QFX3 - kratna888/Contrail_Command GitHub Wiki

## Last commit: 2018-06-22 15:46:18 PDT by root
version "17.3-20180509_17.3T.0 [dc-builder]";
groups {
    JUMBO_FRAMES {
        interfaces {
            <*-*> {
                mtu 9216;
            }
        }
    }
    /* Contrail Generated Group Config */
    __contrail__ {
        interfaces {
            /* Interfaces Configuration */
            lo0 {
                /* Router Loopback Interface */
                unit 0 {
                    family inet {
                        address 192.168.255.102/32 {
                            primary;
                            preferred;
                        }
                    }
                }
            }
        }
        routing-options {
            /* Global Routing Options */
            router-id 192.168.255.102;
            route-distinguisher-id 192.168.255.102;
            autonomous-system 64512;
            resolution {
                rib bgp.rtarget.0 {
                    resolution-ribs inet.0;
                }
            }
        }
        protocols {
            /* Protocols Configuration */
            bgp {
                /* BGP Router: 5c10-qfx3-bgp, UUID: c01684d1-25f3-4726-b186-a23eecb8e10c */
                group _contrail_asn-64512 {
                    type internal;
                    local-address 192.168.255.102;
                    hold-time 90;
                    family evpn {
                        signaling;
                    }
                    family route-target;
                    export _contrail_ibgp_export_policy;
                    /* BGP Router: 5c10-qfx7-bgp, UUID: 34526fe2-708b-4df9-81d0-a573a352c0ed */
                    neighbor 192.168.255.1 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx2-bgp, UUID: 8ac11161-adb1-4171-958d-b019a3192ae4 */
                    neighbor 192.168.255.101 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx4-bgp, UUID: 396bfba9-b931-4e34-8a96-9aaaa24a28b1 */
                    neighbor 192.168.255.3 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx5-bgp, UUID: bb1ab961-88a3-4db4-ac3e-718113547cea */
                    neighbor 192.168.255.4 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-mx80-1-bgp, UUID: 02e7925c-b2c6-45d4-b2ed-ca3ae35c378a */
                    neighbor 192.168.255.201 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-mx80-2-bgp, UUID: 185b6585-4623-46a5-9861-581c7dfb9750 */
                    neighbor 192.168.255.202 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10-qfx8-bgp, UUID: d98621da-4597-4594-8e50-1cb9a46004cf */
                    neighbor 192.168.255.2 {
                        peer-as 64512;
                    }
                    /* BGP Router: 5c10s9, UUID: bd665f57-32b3-4823-b9e5-753139f2cd73 */
                    neighbor 10.1.0.2 {
                        peer-as 64512;
                    }
                }
            }
        }
        policy-options {
            /* Policy Options */
            /* iBGP Export Policy */
            policy-statement _contrail_ibgp_export_policy {
                term inet-vpn {
                    from family inet-vpn;
                    then {
                        next-hop self;
                    }
                }
                term inet6-vpn {
                    from family inet6-vpn;
                    then {
                        next-hop self;
                    }
                }
            }
            community _contrail_switch_policy_ members target:64512:1;
        }
        switch-options {
            vtep-source-interface lo0.0;
        }
    }
}
apply-groups [ JUMBO_FRAMES __contrail__ ];
system {
    host-name 5c10-qfx3;
    domain-search [ contrail.juniper.net juniper.net jnpr.net englab.juniper.net spglab.juniper.net ];
    time-zone US/Pacific;
    arp {
        aging-timer 5;
    }
    root-authentication {
        encrypted-password "$6$N8Y5Eneh$62h2tzfh2c7bYe3GdN2GTy0ea0CfdaJq2lVQMasVLwpf7JjGWOW6ZPBhrKWzPLiPp9kpF2OYVmi7jnWCL0evm/"; ## SECRET-DATA
    }
    name-server {
        10.84.5.100;
        172.21.200.60;
    }
    services {
        ftp;
        ssh {
            root-login allow;
        }
        telnet;
        netconf {
            ssh;
            traceoptions {
                file nc.log;
                flag all;
            }
        }
    }
    syslog {
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization info;
        }
        file interactive-commands {
            interactive-commands any;
        }
    }
    archival {
        configuration {
            transfer-on-commit;
            archive-sites {
                "ftp://ftpuser:[email protected]";
            }
        }
    }
    processes {
        dhcp-service {
            traceoptions {
                file dhcp_logfile size 10m;
                level all;
                flag all;
            }
        }
        app-engine-virtual-machine-management-service {
            traceoptions {
                level notice;
                flag all;
            }
        }
    }
    ntp {
        # Boot Servers #
        boot-server 10.84.5.100;
        server 172.21.200.60;
        server 10.84.5.100;
        server 172.29.131.60;
        server 172.29.135.60;
    }
}
chassis {
    fpc 0 {
        pic 0 {
            port 30 {
                channel-speed 10g;
            }
        }
    }
}
interfaces {
    et-0/0/0 {
        unit 0 {
            family inet {
                address 192.168.20.4/31;
            }
            family iso;
        }
    }
    xe-0/0/31:0 {
        unit 0 {
            family inet {
                address 192.168.40.1/31;
            }
            family iso;
        }
    }
    xe-0/0/31:1 {
        unit 0 {
            family inet {
                address 192.168.40.3/31;
            }
            family iso;
        }
    }
    et-0/0/33 {
        unit 0 {
            family inet {
                address 192.168.20.6/31;
            }
            family iso;
        }
    }
    et-0/0/34 {
        unit 0 {
            family inet {
                address 192.168.20.0/31;
            }
            family iso;
        }
    }
    et-0/0/35 {
        unit 0 {
            family inet {
                address 192.168.20.2/31;
            }
            family iso;
        }
    }
    em0 {
        unit 0 {
            family inet {
                address 10.84.130.36/19;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 192.168.255.102/32;
            }
            family iso {
                address 49.0002.0192.0168.0032.00;
            }
        }
    }
}
snmp {
    location "";
    contact "";
    community public {
        authorization read-only;
    }
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop 10.84.159.254;
    }
    router-id 192.168.255.102;
    autonomous-system 64512;
    forwarding-table {
        export pplb;
    }
}
protocols {
    ##
    ## Warning: requires 'bgp' license
    ##
    bgp {
        traceoptions {
            file bgp.log;
            flag all;
        }
        group IPFAB-UNDER {
            type external;
            mtu-discovery;
            export ADV-LOOPBACK;
            local-as 65302;
            multipath multiple-as;
            neighbor 192.168.20.1 {
                description 5c10-qfx7;
                peer-as 65001;
            }
            neighbor 192.168.20.3 {
                description 5c10-qfx8;
                peer-as 65002;
            }
            neighbor 192.168.20.5 {
                description 5c10-qfx4;
                peer-as 65003;
            }
            neighbor 192.168.20.7 {
                description 5c10-qfx5;
                peer-as 65004;
            }
            neighbor 192.168.40.2 {
                description 5c10-mx80-2;
                peer-as 65402;
            }
            neighbor 192.168.40.0 {
                description 5c10-mx80-1;
                peer-as 65401;
            }
        }
    }
    inactive: isis {
        interface all {
            level 1 disable;
        }
        interface lo0.0;
    }
    lldp {
        interface all;
    }
    lldp-med {
        interface all;
    }
    igmp-snooping {
        vlan default;
    }
}
policy-options {
    policy-statement ADV-LOOPBACK {
        term 1 {
            from {
                protocol direct;
                interface lo0.0;
            }
            then accept;
        }
    }
    policy-statement BGP-IPFAB-UNDER-EXP {
        term LOOPBACK {
            from {
                protocol direct;
                interface lo0.0;
            }
            then {
                community set IPFAB-LEAF;
                accept;
            }
        }
        term SERVERS {
            from {
                protocol direct;
                interface irb.10;
            }
            then {
                community set IPFAB-LEAF;
                accept;
            }
        }
        then reject;
    }
    policy-statement pplb {
        then {
            load-balance per-packet;
            accept;
        }
    }
    community IPFAB-LEAF members 64512:1001;
}

{master:0}

Troubleshooting Notes

Issue 0: If you cannot log into the new UI - Contrail Command - https://:9091 then,

iptables -F

Compute Nodes

The compute nodes needs to have kernel version of = kernel-3.10.0-862.3.2.el7.x86_64

wget http://mirror.centos.org/centos/7/updates/x86_64/Packages/kernel-3.10.0-862.3.2.el7.x86_64.rpm

yum install kernel-3.10.0-862.3.2.el7.x86_64.rpm

Step b: Ping Test. From each nodes, ping every remote nodes via mgmt interface as well as data interface.

Issue 0+ : If you cannot launch the new UI after the cluster deployment is complete,

Check the NTP sync.

Issue 1: If you encounter - UNREACHABLE issues when you are provisioning the cluster

Step 1: Log into the Contrail Command Server

ssh  [email protected]
[email protected]'s password:

Step 2: List the dockers

docker ps

Step 3: Log into the docker - contrail-command

docker exec -it contrail-command bash

Step 4: goto directory /var/tmp/contrail_cluster

[root@localhost contrail_cluster]# ls -lrt
total 0
drwxr-xr-x 3 root root 50 Jun  7 05:41 config
drwxr-xr-x 4 root root 90 Jun  7 05:41 edadd8ac-c7d9-4f6c-9a04-564477a97227
[root@localhost contrail_cluster]#

Step 5: you will find a cluster directory - edadd8ac-c7d9-4f6c-9a04-564477a97227

cd edadd8ac-c7d9-4f6c-9a04-564477a97227

Step 6: find the instances.yml file

[root@localhost edadd8ac-c7d9-4f6c-9a04-564477a97227]# ls
contrail-ansible-deployer  contrail-kolla-ansible  instances.yml
[root@localhost edadd8ac-c7d9-4f6c-9a04-564477a97227]#

Step 7: vi instances.yml file

provider_config:
  bms:
    ssh_user: root
    ssh_pwd: c0ntrail123

Step 8 : Verify if the password you had provided here in this section - provider_config is correct for your target nodes.

Issue 3: If you loose connectivity to compute node or If the Ansible playbook fails due to network restart is failing ( service network restart )

Issue 4: if the cluster deployment completes however endpoints are not created , please follow the workaround.

It failed since the keystone token had expired since the cluster deployment took longer than expected.

Step 1: Set the provisioning_state = CREATED - send a curl request to set the provisioning_state to CREATED.

Sample curl request below. Please update cluster resource UUID and x-auth-token to yours

curl --insecure -X PUT
https://:9091/contrail-cluster/43f4388a-4d86-49fe-af0c-59e3c1bca451
-H 'Content-Type: application/json'
-H 'x-auth-token: 3191f984-9738-49d8-ab78-3dc89c4b8209'
-d '{ "contrail-cluster": { "provisioning_state": "CREATED", "uuid": "43f4388a-4d86-49fe-af0c-59e3c1bca451" } }' To get the auth-token from the local keystone, use the following sample curl request.

curl -i -k
-H "Content-Type: application/json"
-d ' { "auth": { "identity": { "methods": ["password"], "password": { "user": { "name": "admin", "domain": { "id": "default" }, "password": "contrail123" } } }, "scope": { "project": { "name": "admin", "domain": { "id": "default" } } } } }'
"https://localhost:9091/keystone/v3/auth/tokens" ; echo

Create the following endpoints:

add following endpoint from infrastructure/cluster Advanced Options -> Endpoints

name: keystone Public URL: http://:5000

name: compute Public URL: http://:8774

name: baremetal Public URL: http://:6385

name: glance Public URL: http://:9292

name: swift Public URL: http://:8080

name: config Public URL: http://:8082

name: telemetry Public URL: http://:8081

name: nodejs Public URL: https://:8143

Logging into sql

Step 1 : log into the contrail_mysql

Step 2:

root@demo-server-11:/# mysql -uroot -pcontrail123

delete from endpoint where name='keystone';

==============================================

BMS usecase

when the ens1f0 gets an IP, the default route is changes to default via 192.168.10.1 dev ens1f0

hence lost external connectivity -

====================================

⚠️ **GitHub.com Fallback** ⚠️