manuals/user-guide/src/main/asciidoc/vtn/VTN_Manager_How_To_Configure_Flowfilters.adoc

   1 ==== How To Configure Flowfilters
   2
   3 ===== Overview
   4
   5 * This page explains how to provision flowfilter using VTN Manager. This page targets Beryllium release, so the procedure described here does not work in other releases.
   6
   7 * The flow-filter function discards, permits, or redirects packets of the traffic within a VTN, according to specified flow conditions. The table below lists the actions to be applied when a packet matches the condition:
   8
   9 [options="header",cols="30%,70%"]
  10 |===
  11 | Action | Function
  12 | Pass | Permits the packet to pass along the determined path. +
  13 As options, packet transfer priority (set priority) and DSCP change (set ip-dscp) is specified.
  14 | Drop | Discards the packet.
  15 | Redirect | Redirects the packet to a desired virtual interface. +
  16 As an option, it is possible to change the MAC address when the packet is transferred.
  17 |===
  18
  19 .Flow Filter Example
  20 image::vtn/flow_filter_example.png["Flow filter example",width=500]
  21
  22 * Following steps explain flow-filter function:
  23
  24 ** when a packet is transferred to an interface within a virtual network, the flow-filter function evaluates whether the transferred packet matches the condition specifed in the flow-list.
  25
  26 ** If the packet matches the condition, the flow-filter applies the flow-list matching action specified in the flow-filter.
  27
  28 ===== Requirements
  29
  30 To apply the packet filter, configure the following:
  31
  32 * Create a flow condition.
  33 * Specify where to apply the flow-filter, for example VTN, vBridge, or interface of vBridge.
  34
  35 To provision OpenFlow switches, this page uses Mininet. Mininet details and set-up can be referred at the below page:
  36 https://wiki.opendaylight.org/view/OpenDaylight_Controller:Installation#Using_Mininet
  37
  38 Start Mininet, and create three switches (s1, s2, and s3) and four hosts (h1, h2, h3 and h4) in it.
  39
  40 ----
  41 sudo mn --controller=remote,ip=192.168.0.100 --topo tree,2
  42 ----
  43
  44 NOTE: Replace "192.168.0.100" with the IP address of OpenDaylight controller based on your environment.
  45
  46 You can check the topology that you have created by executing "net" command in the Mininet console.
  47
  48 ----
  49  mininet> net
  50  h1 h1-eth0:s2-eth1
  51  h2 h2-eth0:s2-eth2
  52  h3 h3-eth0:s3-eth1
  53  h4 h4-eth0:s3-eth2
  54  s1 lo:  s1-eth1:s2-eth3 s1-eth2:s3-eth3
  55  s2 lo:  s2-eth1:h1-eth0 s2-eth2:h2-eth0 s2-eth3:s1-eth1
  56  s3 lo:  s3-eth1:h3-eth0 s3-eth2:h4-eth0 s3-eth3:s1-eth2
  57 ----
  58
  59 In this guide, you will provision flowfilters to establish communication between h1 and h3.
  60
  61 NOTE: You need to manually add flow entries to OpenFlow switches in the Mininet. The flow entries are needed to forward packets to controller when there is a table-miss. This configuration is required only in case of OpenFlow 1.3 or using OVS versions (>2.1.1).
  62
  63 ----
  64 sudo ovs-ofctl add-flow s1 priority=0,actions=output:CONTROLLER
  65 sudo ovs-ofctl add-flow s2 priority=0,actions=output:CONTROLLER
  66 sudo ovs-ofctl add-flow s3 priority=0,actions=output:CONTROLLER
  67 ----
  68
  69 ===== Configuration
  70
  71 To provision the virtual L2 network for the two hosts (h1 and h3), execute REST API provided by VTN Manager as follows. It uses curl command to call the REST API.
  72
  73 * Create a virtual tenant named vtn1 by executing
  74   https://jenkins.opendaylight.org/releng/view/vtn/job/vtn-merge-beryllium/lastSuccessfulBuild/artifact/manager/model/target/site/models/vtn.html#update-vtn[the update-vtn RPC].
  75
  76 ----
  77 curl --user "admin":"admin" -H "Content-type: application/json" -X POST http://localhost:8181/restconf/operations/vtn:update-vtn -d '{"input":{"tenant-name":"vtn1"}}'
  78 ----
  79
  80 * Create a virtual bridge named vbr1 in the tenant vtn1 by executing
  81   https://jenkins.opendaylight.org/releng/view/vtn/job/vtn-merge-beryllium/lastSuccessfulBuild/artifact/manager/model/target/site/models/vtn-vbridge.html#update-vbridge[the update-vbridge RPC].
  82
  83 ----
  84 curl --user "admin":"admin" -H "Content-type: application/json" -X POST http://localhost:8181/restconf/operations/vtn-vbridge:update-vbridge -d '{"input":{"tenant-name":"vtn1","bridge-name":"vbr1"}}'
  85 ----
  86
  87 * Create two interfaces into the virtual bridge by executing
  88   https://jenkins.opendaylight.org/releng/view/vtn/job/vtn-merge-beryllium/lastSuccessfulBuild/artifact/manager/model/target/site/models/vtn-vinterface.html#update-vinterface[the update-vinterface RPC].
  89
  90 ----
  91 curl --user "admin":"admin" -H "Content-type: application/json" -X POST http://localhost:8181/restconf/operations/vtn-vinterface:update-vinterface -d '{"input":{"tenant-name":"vtn1","bridge-name":"vbr1","interface-name":"if1"}}'
  92 ----
  93
  94
  95 ----
  96 curl --user "admin":"admin" -H "Content-type: application/json" -X POST http://localhost:8181/restconf/operations/vtn-vinterface:update-vinterface -d '{"input":{"tenant-name":"vtn1","bridge-name":"vbr1","interface-name":"if2"}}'
  97 ----
  98
  99 * Configure two mappings on the interfaces by executing
 100   https://jenkins.opendaylight.org/releng/view/vtn/job/vtn-merge-beryllium/lastSuccessfulBuild/artifact/manager/model/target/site/models/vtn-port-map.html#set-port-map[the set-port-map RPC].
 101
 102 ** The interface if1 of the virtual bridge will be mapped to the port "s2-eth1" of the switch "openflow:2" of the Mininet.
 103
 104 *** The h1 is connected to the port "s2-eth1".
 105
 106 ** The interface if2 of the virtual bridge will be mapped to the port "s3-eth1" of the switch "openflow:3" of the Mininet.
 107
 108 *** The h3 is connected to the port "s3-eth1".
 109
 110 ----
 111 curl --user "admin":"admin" -H "Content-type: application/json" -X POST http://localhost:8181/restconf/operations/vtn-port-map:set-port-map -d '{"input":{"tenant-name":"vtn1", "bridge-name":"vbr1", "interface-name":"if1", "node":"openflow:2", "port-name":"s2-eth1"}}'
 112 ----
 113
 114
 115 ----
 116 curl --user "admin":"admin" -H "Content-type: application/json" -X POST http://localhost:8181/restconf/operations/vtn-port-map:set-port-map -d '{"input":{"tenant-name":"vtn1", "bridge-name":"vbr1", "interface-name":"if2", "node":"openflow:3", "port-name":"s3-eth1"}}'
 117 ----
 118
 119 * Create flowcondition named cond_1 by executing
 120   https://jenkins.opendaylight.org/releng/view/vtn/job/vtn-merge-beryllium/lastSuccessfulBuild/artifact/manager/model/target/site/models/vtn-flow-condition.html#set-flow-condition[the set-flow-condition RPC].
 121
 122 ** For option source and destination-network, get inet address of host h1 and h3 from mininet.
 123
 124 ----
 125 curl --user "admin":"admin" -H "Content-type: application/json" -X POST http://localhost:8181/restconf/operations/vtn-flow-condition:set-flow-condition -d '{"input":{"name":"cond_1", "vtn-flow-match":[{"vtn-ether-match":{},"vtn-inet-match":{"source-network":"10.0.0.1/32","protocol":1,"destination-network":"10.0.0.3/32"},"index":"1"}]}}'
 126 ----
 127
 128 * Flowfilter can be applied either in VTN, VBR or VBR Interfaces. Here in this page we provision flowfilter with VBR Interface and demonstrate with action type drop and then pass.
 129
 130 * Flow filter demonstration with DROP action-type. Create Flowfilter in VBR Interface if1 by executing
 131   https://jenkins.opendaylight.org/releng/view/vtn/job/vtn-merge-beryllium/lastSuccessfulBuild/artifact/manager/model/target/site/models/vtn-flow-filter.html#set-flow-filter[the set-flow-filter RPC].
 132
 133 ----
 134 curl --user "admin":"admin" -H "Content-type: application/json" -X POST http://localhost:8181/restconf/operations/vtn-flow-filter:set-flow-filter -d '{"input": {"tenant-name": "vtn1", "bridge-name": "vbr1","interface-name":"if1","vtn-flow-filter":[{"condition":"cond_1","vtn-drop-filter":{},"vtn-flow-action":[{"order": "1","vtn-set-inet-src-action":{"ipv4-address":"10.0.0.1/32"}},{"order": "2","vtn-set-inet-dst-action":{"ipv4-address":"10.0.0.3/32"}}],"index": "1"}]}}'
 135 ----
 136
 137 ===== Verification of the drop filter
 138
 139 * Please execute ping from h1 to h3. As we have applied the action type "drop" , ping should fail with no packet flows between hosts h1 and h3 as below,
 140
 141 ----
 142  mininet> h1 ping h3
 143 ----
 144
 145 ===== Configuration for pass filter
 146
 147 * Update the flow filter to pass the packets by executing
 148   https://jenkins.opendaylight.org/releng/view/vtn/job/vtn-merge-beryllium/lastSuccessfulBuild/artifact/manager/model/target/site/models/vtn-flow-filter.html#set-flow-filter[the set-flow-filter RPC].
 149
 150 ----
 151 curl --user "admin":"admin" -H "Content-type: application/json" -X POST http://localhost:8181/restconf/operations/vtn-flow-filter:set-flow-filter -d '{"input": {"tenant-name": "vtn1", "bridge-name": "vbr1","interface-name":"if1","vtn-flow-filter":[{"condition":"cond_1","vtn-pass-filter":{},"vtn-flow-action":[{"order": "1","vtn-set-inet-src-action":{"ipv4-address":"10.0.0.1/32"}},{"order": "2","vtn-set-inet-dst-action":{"ipv4-address":"10.0.0.3/32"}}],"index": "1"}]}}'
 152 ----
 153
 154 ===== Verification For Packets Success
 155
 156 * As we have applied action type PASS now ping should happen between hosts h1 and h3.
 157
 158 ----
 159  mininet> h1 ping h3
 160  PING 10.0.0.3 (10.0.0.3) 56(84) bytes of data.
 161  64 bytes from 10.0.0.3: icmp_req=1 ttl=64 time=0.984 ms
 162  64 bytes from 10.0.0.3: icmp_req=2 ttl=64 time=0.110 ms
 163  64 bytes from 10.0.0.3: icmp_req=3 ttl=64 time=0.098 ms
 164 ----
 165
 166 * You can also verify the configurations by executing the following REST API. It shows all configuration in VTN Manager.
 167
 168 ----
 169 curl --user "admin":"admin" -H "Content-type: application/json" -X GET http://localhost:8181/restconf/operational/vtn:vtns/vtn/vtn1
 170 ----
 171
 172 ----
 173 {
 174   "vtn": [
 175   {
 176     "name": "vtn1",
 177       "vtenant-config": {
 178         "hard-timeout": 0,
 179         "idle-timeout": 300,
 180         "description": "creating vtn"
 181       },
 182       "vbridge": [
 183       {
 184         "name": "vbr1",
 185         "vbridge-config": {
 186           "age-interval": 600,
 187           "description": "creating vBridge1"
 188         },
 189         "bridge-status": {
 190           "state": "UP",
 191           "path-faults": 0
 192         },
 193         "vinterface": [
 194         {
 195           "name": "if1",
 196           "vinterface-status": {
 197             "mapped-port": "openflow:2:1",
 198             "state": "UP",
 199             "entity-state": "UP"
 200           },
 201           "port-map-config": {
 202             "vlan-id": 0,
 203             "node": "openflow:2",
 204             "port-name": "s2-eth1"
 205           },
 206           "vinterface-config": {
 207             "description": "Creating if1 interface",
 208             "enabled": true
 209           },
 210           "vinterface-input-filter": {
 211             "vtn-flow-filter": [
 212             {
 213               "index": 1,
 214               "condition": "cond_1",
 215               "vtn-flow-action": [
 216               {
 217                 "order": 1,
 218                 "vtn-set-inet-src-action": {
 219                   "ipv4-address": "10.0.0.1/32"
 220                 }
 221               },
 222               {
 223                 "order": 2,
 224                 "vtn-set-inet-dst-action": {
 225                   "ipv4-address": "10.0.0.3/32"
 226                 }
 227               }
 228               ],
 229                 "vtn-pass-filter": {}
 230             },
 231             {
 232               "index": 10,
 233               "condition": "cond_1",
 234               "vtn-drop-filter": {}
 235             }
 236             ]
 237           }
 238         },
 239         {
 240           "name": "if2",
 241           "vinterface-status": {
 242             "mapped-port": "openflow:3:1",
 243             "state": "UP",
 244             "entity-state": "UP"
 245           },
 246           "port-map-config": {
 247             "vlan-id": 0,
 248             "node": "openflow:3",
 249             "port-name": "s3-eth1"
 250           },
 251           "vinterface-config": {
 252             "description": "Creating if2 interface",
 253             "enabled": true
 254           }
 255         }
 256         ]
 257       }
 258     ]
 259   }
 260   ]
 261 }
 262 ----
 263
 264 ===== Cleaning Up
 265
 266 * To clean up both VTN and flowcondition.
 267
 268 * You can delete the virtual tenant vtn1 by executing
 269   https://jenkins.opendaylight.org/releng/view/vtn/job/vtn-merge-beryllium/lastSuccessfulBuild/artifact/manager/model/target/site/models/vtn.html#remove-vtn[the remove-vtn RPC].
 270
 271 ----
 272 curl --user "admin":"admin" -H "Content-type: application/json" -X POST http://localhost:8181/restconf/operations/vtn:remove-vtn -d '{"input":{"tenant-name":"vtn1"}}'
 273 ----
 274
 275 * You can delete the flowcondition cond_1 by executing
 276   https://jenkins.opendaylight.org/releng/view/vtn/job/vtn-merge-beryllium/lastSuccessfulBuild/artifact/manager/model/target/site/models/vtn-flow-condition.html#remove-flow-condition[the remove-flow-condition RPC].
 277
 278 ----
 279 curl --user "admin":"admin" -H "Content-type: application/json" -X POST http://localhost:8181/restconf/operations/vtn-flow-condition:remove-flow-condition -d '{"input":{"name":"cond_1"}}'
 280 ----
 281