在OpenStack中默认由于安全组策略限制，云主机只响应自己的iP地址请求，如果需要做HA，可以用以下两种方式实现

1、 增加allow_address_pairs属性

  1. # neutron port-list |grep 10.xxx.51.50
  2. # neutron port-show cff5866e-f288-4614-8778-665795207e0f
  3. +-----------------------+----------------------------------------------------------------------------------------------+
  4. | Field                 | Value                                                                                        |
  5. +-----------------------+----------------------------------------------------------------------------------------------+
  6. | admin_state_up        | True                                                                                         |
  7. | allowed_address_pairs |                                                                                              |
  8. | binding:host_id       | Com-B05A04-23-C49-yyy.domain.tld                                                             |
  9. | binding:profile       | {}                                                                                           |
  10. | binding:vif_details   | {"port_filter": true, "ovs_hybrid_plug": true}                                               |
  11. | binding:vif_type      | ovs                                                                                          |
  12. | binding:vnic_type     | normal                                                                                       |
  13. | device_id             | 965c8148-4b5f-42e1-8827-f793f873aa88                                                         |
  14. | device_owner          | compute:PRD                                                                                  |
  15. | dns_assignment        | {"hostname": "host-10-xxx-51-50", "ip_address": "10.xxx.51.50", "fqdn": "host-10-xxx-51-50"} |
  16. | dns_name              |                                                                                              |
  17. | extra_dhcp_opts       |                                                                                              |
  18. | fixed_ips             | {"subnet_id": "bcfbcc6d-3bc4-4317-8c67-e9fcdcea0711", "ip_address": "10.xxx.51.50"}          |
  19. | id                    | cff5866e-f288-4614-8778-665795207e0f                                                         |
  20. | mac_address           | fa:16:3e:cb:ec:74                                                                            |
  21. | name                  |                                                                                              |
  22. | network_id            | e097267e-82b7-421d-8c35-e3bd83c34467                                                         |
  23. | port_security_enabled | True                                                                                         |
  24. | security_groups       | 6860bcc3-3b94-4c90-a78d-92d7f7379164                                                         |
  25. | status                | ACTIVE                                                                                       |
  26. | tenant_id             | 089d02a7f5ca450ab27a65774dfe698c                                                             |
  27. +-----------------------+----------------------------------------------------------------------------------------------+
  28. # neutron port-update cff5866e-f288-4614-8778-665795207e0f --allowed_address_pairs list=true type=dict ip_address=10.xxx.51.210
  29. # neutron port-show cff5866e-f288-4614-8778-665795207e0f
  30. +-----------------------+----------------------------------------------------------------------------------------------+
  31. | Field                 | Value                                                                                        |
  32. +-----------------------+----------------------------------------------------------------------------------------------+
  33. | admin_state_up        | True                                                                                         |
  34. | allowed_address_pairs | {"ip_address": "10.xxx.51.210", "mac_address": "fa:16:3e:cb:ec:74"}                          |
  35. | binding:host_id       | Com-B05A04-23-C49-yyy.domain.tld                                                             |
  36. | binding:profile       | {}                                                                                           |
  37. | binding:vif_details   | {"port_filter": true, "ovs_hybrid_plug": true}                                               |
  38. | binding:vif_type      | ovs                                                                                          |
  39. | binding:vnic_type     | normal                                                                                       |
  40. | device_id             | 965c8148-4b5f-42e1-8827-f793f873aa88                                                         |
  41. | device_owner          | compute:PRD                                                                                  |
  42. | dns_assignment        | {"hostname": "host-10-xxx-51-50", "ip_address": "10.xxx.51.50", "fqdn": "host-10-xxx-51-50"} |
  43. | dns_name              |                                                                                              |
  44. | extra_dhcp_opts       |                                                                                              |
  45. | fixed_ips             | {"subnet_id": "bcfbcc6d-3bc4-4317-8c67-e9fcdcea0711", "ip_address": "10.xxx.51.50"}          |
  46. | id                    | cff5866e-f288-4614-8778-665795207e0f                                                         |
  47. | mac_address           | fa:16:3e:cb:ec:74                                                                            |
  48. | name                  |                                                                                              |
  49. | network_id            | e097267e-82b7-421d-8c35-e3bd83c34467                                                         |
  50. | port_security_enabled | True                                                                                         |
  51. | security_groups       | 6860bcc3-3b94-4c90-a78d-92d7f7379164                                                         |
  52. | status                | BUILD                                                                                        |
  53. | tenant_id             | 089d02a7f5ca450ab27a65774dfe698c                                                             |
  54. +-----------------------+----------------------------------------------------------------------------------------------+
  55. # neutron port-list |grep 10.xxx.51.51
  56. # neutron port-update c0dea309-89e8-46db-a800-119323adf805 --allowed_address_pairs list=true type=dict ip_address=10.xxx.51.210
  57. # neutron port-show c0dea309-89e8-46db-a800-119323adf805
  58. +-----------------------+----------------------------------------------------------------------------------------------+
  59. | Field                 | Value                                                                                        |
  60. +-----------------------+----------------------------------------------------------------------------------------------+
  61. | admin_state_up        | True                                                                                         |
  62. | allowed_address_pairs | {"ip_address": "10.xxx.51.210", "mac_address": "fa:16:3e:84:05:8e"}                          |
  63. | binding:host_id       | Com-B05A04-21-C58-zzz.domain.tld                                                             |
  64. | binding:profile       | {}                                                                                           |
  65. | binding:vif_details   | {"port_filter": true, "ovs_hybrid_plug": true}                                               |
  66. | binding:vif_type      | ovs                                                                                          |
  67. | binding:vnic_type     | normal                                                                                       |
  68. | device_id             | 55c78568-e8e1-447c-8fe1-777379cf2baf                                                         |
  69. | device_owner          | compute:PRD                                                                                  |
  70. | dns_assignment        | {"hostname": "host-10-xxx-51-51", "ip_address": "10.xxx.51.51", "fqdn": "host-10-xxx-51-51"} |
  71. | dns_name              |                                                                                              |
  72. | extra_dhcp_opts       |                                                                                              |
  73. | fixed_ips             | {"subnet_id": "bcfbcc6d-3bc4-4317-8c67-e9fcdcea0711", "ip_address": "10.xxx.51.51"}          |
  74. | id                    | c0dea309-89e8-46db-a800-119323adf805                                                         |
  75. | mac_address           | fa:16:3e:84:05:8e                                                                            |
  76. | name                  |                                                                                              |
  77. | network_id            | e097267e-82b7-421d-8c35-e3bd83c34467                                                         |
  78. | port_security_enabled | True                                                                                         |
  79. | security_groups       | 6860bcc3-3b94-4c90-a78d-92d7f7379164                                                         |
  80. | status                | ACTIVE                                                                                       |
  81. | tenant_id             | 089d02a7f5ca450ab27a65774dfe698c                                                             |
  82. +-----------------------+----------------------------------------------------------------------------------------------+

2、 关闭neutron port的安全组特性

  1.  # neutron port-update --no-security-groups $port_id
  2.  # neutron port-update $port_id --port-security-enabled=False