![Page 1: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/1.jpg)
IPV6 + OPENSTACK NEUTRON
![Page 2: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/2.jpg)
About MeCTO at Akanda Inc
OpenStack Technical Committee
Core Reviewer for Neutron
Neutron PTL during Havana/Icehouse
@gtwmm
![Page 3: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/3.jpg)
IPV6
![Page 4: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/4.jpg)
GOOGLE IPV6 TRAFFICHTTPS://WWW.GOOGLE.COM/INTL/EN/IPV6/STATISTICS.HTML
![Page 5: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/5.jpg)
AKAMAIHTTP://WWW.STATEOFTHEINTERNET.COM/TRENDS-VISUALIZATIONS-IPV6-ADOPTION-IPV4-EXHAUSTION-GLOBAL-HEAT-MAP-NETWORK-COUNTRY-GROWTH-DATA.HTML#COUNTRIES
![Page 6: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/6.jpg)
DID YOU KNOW?
SCALE WIFI
![Page 7: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/7.jpg)
Differences from v4Huge Address Space —128-bit
340,282,366,920,938,463,463,374,607,431,768,211,456
End-to-end Connectivity
Configuration
Routing
ICMP + Multicast
![Page 8: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/8.jpg)
Auto Configuration
Link Local Addressing
SLAAC
Based on EUI-64 Address
Prefix Announced via RA
Requires a /64 available for each tenant
![Page 9: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/9.jpg)
Auto Configuration (con’t)
DHCPv6
Stateless
RA + DHCP for extra information
Stateful
Nearly the same as v4 DHCP today
![Page 10: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/10.jpg)
Changes for Routing
Fixed Header Size
No checksum
Lower/Upper layers provide
No packet fragmentation
Router Advertisements
![Page 11: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/11.jpg)
ICMPv6
Neighbor Discovery
Router Advertisements
Some messages require multicast
ie ff02::1
Path MTU Discovery
![Page 12: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/12.jpg)
ChallengesNew Hardware Deployment
Software Updates
Application Updates for
IP, DNS, etc
Addresses not really human friendly
2607:f295:6050::101:ca75
fe80::893:33f1:b5c7:67ee
fe80::feed:cafe
![Page 13: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/13.jpg)
IPV6 IS A MUST
![Page 14: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/14.jpg)
OPENSTACK NEUTRON
![Page 15: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/15.jpg)
OpenStack
Large ecosystem of projects
Common Projects:
Compute, Identity, Networking, Storage projects
Released every 6 months
![Page 16: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/16.jpg)
OpenStack
![Page 17: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/17.jpg)
OpenStack
Compute API
Network API
Storage APIGUI, CLI, API Libs
KVM
ML2 Plugin
Ceph
![Page 18: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/18.jpg)
What is Neutron?
Unified API
Small Core
Pluggable Architecture
Extensible
![Page 19: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/19.jpg)
Neutron
neutron-server
L2 AgentL2 AgentL2 AgentL2 AgentL2 AgentL2 Agent
L3 AgentL3 Agent
L3 AgentL3 Agent
Database
L3 Agent
DHCP Agent
L2 Agent
Message Queue
Adv Services
neutron-server
![Page 20: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/20.jpg)
IPv6 in Neutron
IPv6 IPAM
Security Groups, L2 Pre-Pop
Early support starting in Grizzly
Enhanced support in Juno
![Page 21: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/21.jpg)
IPv6 Tenant Benefits
No NAT
No Floating IP Required
$ ssh 2607:f298:6050:eb8f::a1f:ea75:ca75
![Page 22: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/22.jpg)
JUNORELEASED OCTOBER 2014
CC BY-ND 2.0
"Amicalola Falls" by Sean Morgan
https://www.flickr.com/photos/seanm1025/3646862123
![Page 23: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/23.jpg)
Configuration
SLAAC
via radvd
DHCPv6
stateless
stateful
via dnsmasq
![Page 24: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/24.jpg)
Routing
L3 Agent
Provider Support
RA within project
Static External Gateway
Provider Network
Network Node
Network Node
Core
Hypervisor Hypervisor Hypervisor
![Page 25: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/25.jpg)
IPv6 Security
End to end connectivity
NAT as a security blanket
DHCP Spoofing
RA Spoofing
![Page 26: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/26.jpg)
MANAGMENT LAYER
![Page 27: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/27.jpg)
IPv6 Readiness
API Layer
DB Layer
Client Libraries
Messaging
Overlay Tunnels*
![Page 28: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/28.jpg)
Linux Tunnels
Kernel 3.9+
iproute(2)
Works# ip link add vtep1 type vxlan id 2 local 2607:f298:6050::feed remote 2607:f298:6050::beef
![Page 29: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/29.jpg)
Open vSwitch Tunnels
This command will silently fail:
# ovs-vsctl add-port br1 tun1 -- set interface tun1 type=vxlan options:remote_ip=2607:f298:6050::face
However, in the logs you’ll get this error:
2015-02-21T05:44:38.213Z|00031|socket_util|ERR|”2607:f298:6050::face" is not a valid IP address
![Page 30: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/30.jpg)
KILOAPRIL 2015
![Page 31: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/31.jpg)
Kilo
v4 and v6 DHCP Options
Multiple Prefixes per Subnet
Support External Prefix Delegation
Link Local Default External Gateway
![Page 32: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/32.jpg)
Linux Routing RA+Forwarding
net.ipv6.conf.eth0.accept_ra=1
net.ipv6.conf.all.forwarding=1
![Page 33: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/33.jpg)
Linux Routing RA+Forwarding
net.ipv6.conf.eth0.accept_ra=2
net.ipv6.conf.all.forwarding=1
![Page 34: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/34.jpg)
CHALLENGES
![Page 35: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/35.jpg)
Metadata Service
Cloud Init
Default EC2 address is IPv4: 169.254.169.254
Config Drive is your friend
![Page 36: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/36.jpg)
IPv6 Privacy Extension
SLAAC address is identifiable
Generate and use temporary address for a limited time
Incompatible with Spoofing Prevention
Do we care? private network, shared network, public network
![Page 37: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/37.jpg)
Routing
Prefix Delegation
Your routers and Neutron need to know this information
Static Routing
Dynamic Routing
OSPFv3
BGP
![Page 38: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/38.jpg)
AKANDA
![Page 39: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/39.jpg)
What is Akanda?
Open Source (Apache 2)
Dynamic Routing via Service VMs
Drop in replacement for Neutron L3, DHCP, Metadata Agents
In Production Now
Created by DreamHost
![Page 40: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/40.jpg)
Neutron
neutron-server
L2 AgentL2 AgentL2 AgentL2 AgentL2 AgentL2 Agent
L3 AgentL3 Agent
L3 AgentL3 Agent
Database
L3 Agent
DHCP Agent
L2 Agent
Message Queue
Adv Services
neutron-server
![Page 41: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/41.jpg)
Neutron+Akanda
neutron-server
L2 AgentL2 AgentL2 AgentL2 AgentL2 AgentL2 Agent
Database
Akanda
L2 Agent
Message Queueneutron-server
![Page 43: IPv6 and Neutron - SCALE 16x | 16x · PDF file · 2015-02-22L3 Agent Provider Support RA within project Static External Gateway ... neutron-server L2 AgentL2 AgentL2 AgentL2 Agent](https://reader031.vdocuments.us/reader031/viewer/2022011723/5aa1278a7f8b9a1f6d8b77ff/html5/thumbnails/43.jpg)
QUESTIONS?