Troubleshooting Netvirt Datapath

Opendaylight Netvirt programs specific flows to OVS, for the various VM connectivity usecases to work. The purpose of this document is to give a detailed picture of the various flows that happen on OVS when a packet arrives.

Openflow Table Ownership

TABLE NUMBER

TABLE NAME

OWNERSHIP

0

INTERFACE INGRESS TABLE

GENIUS - INTERFACEMANAGER

17

INGRESS DISPATCHER TABLE

GENIUS - INTERFACEMANAGER

18

EXTERNAL TUNNEL DHCP TABLE

NETVIRT - L2GW SERVICE

19

GATEWAY MAC TABLE

NETVIRT - L3VPN

20

L3 LFIB TABLE

NETVIRT - L3VPN

21

L3 FIB TABLE

NETVIRT - L3VPN

22

L3 SUBNET ROUTE TABLE

NETVIRT - L3VPN

25

Floating IP to Internal IP Translation Table

NETVIRT - NAT

26

Internal IP to FIP/ External IP Translation Table

NETVIRT - NAT

27

Intermediate Pre-FIB Table after Reverse Translation

NETVIRT - NAT

28

Intermediate Pre-FIB Table after Forward Translation

NETVIRT - NAT

36

Internal Terminating Service Table

ALL SERVICES(which require communication over vxlan)

38

External Terminating Service Table

NETVIRT - L2GW SERVICE

43

ARP Check Table

NETVIRT - ELAN

44

Inbound Translation in NAPT vSwitch

NETVIRT - NAT

45

IPv6 Table

NETVIRT - IPV6

46

Outbound Translation in NAPT vSwitch

NETVIRT - NAT

47

NAPT vSwitch Pre-FIB Table

NETVIRT - NAT

48

ELAN DestIpToDMac Table

NETVIRT - ELAN

49

Temporary Source MAC Learned Table

NETVIRT - ELAN

50

ELAN SMAC Table

NETVIRT - ELAN

51

ELAN DMAC Table

NETVIRT - ELAN

52

ELAN Unknown DMAC Table

NETVIRT - ELAN

55

ELAN Filter Equals Table

NETVIRT - ELAN

60

DHCP Table

NETVIRT - DHCP

80

L3 Interface Table

NETVIRT - L3VPN

81

ARP Responder Table

NETVIRT - L3VPN

210

Ingress ACL Anti-spoofing table

NETVIRT - ACL

211

Ingress ACL Conntrack classifier table

NETVIRT - ACL

212

Ingress ACL Conntrack sender table

NETVIRT - ACL

213

Applying ACL for existing Ingress traffic table

NETVIRT - ACL

214

Ingress ACL Filter cum dispatcher table

NETVIRT - ACL

215

Ingress ACL filter table

NETVIRT - ACL

216

Ingress Remote ACL filter table

NETVIRT - ACL

217

Ingress ACL committer table

NETVIRT - ACL

220

Interface Egress Dispatcher Table

GENIUS - INTERFACEMANAGER

239

Clear Egress conntrack state table

NETVIRT - ACL

240

Egress ACL Anti-spoofing table

NETVIRT - ACL

241

Egress ACL Conntrack classifier table

NETVIRT - ACL

242

Egress ACL Conntrack sender table

NETVIRT - ACL

243

Applying ACL for existing Egress traffic table

NETVIRT - ACL

244

Egress ACL Filter cum dispatcher table

NETVIRT - ACL

245

Egress ACL filter table

NETVIRT - ACL

246

Egress Remote ACL filter table

NETVIRT - ACL

247

Egress ACL committer table

NETVIRT - ACL

Genius InterfaceManager Pipeline

Netvirt uses Genius interface-manager to program ingress and egress flows for VMs as well as Tunnel ports. interface-manager is also used for binding multiple services on the same interface. A high level overview of the pipeline for ingress/egress is shown below in the diagram. This will be applicable for all service traffic flows explained in the subsequent sections.

../_images/genius-interfacemanager-pipeline.PNG

ELAN Traffic Flow

Traffic Type

FLOW

Known unicast traffic flow(both direction)

Table 0 => Table 17 => Table 43 => Table 48 => Table 49 => Table 50 => Table 51 => Table 220 => Output Port

Unknown unicast/ multicast/broadcast traffic

Table 0 => Table 17 => Table 43 => Table 50 => Table 51 => Table 52 => Remote BC Group => Local BC Group => Table 55 => Table 220 => Output Port
../_images/elan-pipeline.PNG

L3VPN Traffic Flow

Traffic Type

FLOW

L3VPN Traffic Flow within same DPN

Table 0 => Table 17 => Table 19 => Table 21 => Local nexthop Group => Table 220 => output VM port

L3VPN Traffic Flow across DPNs within Data Center(source DPN)

Table 0 => Table 17 => Table 19 => Table 21 => Table 220 => Output tunnel port

L3VPN Traffic Flow across DPNs within DC(destination)

Table 0 => Table 36 => Table 220 => Output VM port

L3VPN Traffic Flow across DC(towards DC)

Table 0 => Table 17 => Table 19 => Table 21 => push MPLS, => Table 220 => output tunnel port

L3VPN Traffic Flow across DC(from DC)

Table 0 => Table 20 => Local nexthop group => Table 220 => output tunnel port

NAT Traffic Flow

DNAT Traffic Flow

Traffic Type

FLOW

DNAT Traffic Flow on source DPN

Table 0 => Table 20 => Table 25 => Table 27 => Table 21 => Local nexthop Group => Table 220 =>Output port

DNAT Traffic Flow on destination DPN

Table 0 => Table 17 => Table 21 => Table 26 => Table 28 => Table 21 => External Tunnel Groups

SNAT Traffic Flow

  • SNAT VM Residing on the NAPT vSwitch

Traffic Type

FLOW

DPN (source traffic)

Table 0 => Table 17 => Table 21 => Table 26 => Table 46 => Table 47 => Table 21 => External Tunnel Groups

DPN (reverse traffic)

Table 0 => Table 20 => Table 44 => Table 47 => Table 21 => Local nexthop Group => Table 220 => output port

  • SNAT VM Residing on non-NAPT vSwitch (Source Traffic)

Traffic Type

FLOW

DPN (source traffic)

Table 0 => Table 17 => Table 21 => Table 26 => Internal Tunnel Group => Table 220 => output tunnel port

NAPT DPN (reverse traffic)

Table 0 => Table 36 => Table 46 => Table 47 => Table 21 => External Tunnel Group => Table 220 => Output port

  • SNAT VM Residing on non-NAPT vSwitch (Reverse Traffic)

Traffic Type

FLOW

NAPT DPN (source traffic)

Table 0 => Table 20 => Table 44 => Table 47 => Table 21 => Internal Tunnel Group => Table 220 => output port

DPN (reverse traffic)

Table 0 => Table 36 => Local nexthop Group => Table 220 => output port

  • Conntrack Based SNAT Traffic Flow

<TBD>

Inputs given by

  • Akash Sahu

  • Chetan Arakere Gowdru

  • Faseela K

  • Kiran N Upadhyaya

  • Manu B

  • N Vivekanandan

  • Shashidhar Raja