A current customer test desired to see how well the AVI Load Balancer scales and as such they used Ixia BreakingPoint to determine the behavior. The point was to see when exactly the AVI Controller tells Openstack to spawn a new Instance of an AVI SE (Avi Load Balancer VM that holds a VIP and pool members reachable behind it) and how this process goes.

Following setups were tested:

• AVI LB VMs doing BGP (BGPaaS) with the Contrail vRouter and announcing VIPs
• AVI Controller being configured to spawn AVI SEs / LB VMs but using the inbuilt ECMP/AAP features of Contrail (yes, if you are asking yourselves, the VIP does not have to be from the same subnet as the AVI LB directly connected one to the vRouter)
• AVI LB VMs doing BGP Multihop with the SDN GW inside a VRF (this means that the SDN GW learns the prefixes and reuses the same LSP/label for transport/VPN as it already has for the directly connected IP of the AVI LB VM that originated the prefix)

Continue reading

Have you ever found yourself in a strange situation where:

• you had a Juniper device with a factory default JunOS
• it came with no-export version -> just telnet available, no SSH
• you have the fxp0 or em0 interface configured for remote access
• you do not have the device next to you and need to upgrade its software so that you can finally have full functionality and SSH?

Let’s say that with a big of creativity you can always find a way in. Here we go:

Continue reading

Sometimes it may happen that when you look in Contrail at the interfaces on a vRouter (on a Compute host) that some of them appear down. This you can also see on the Compute Node itself with vif –list. There can be some leftovers and this is the way to clean them up:

Continue reading

Sometimes when playing in the Contrail GUI (eg. with EVPN-VXLAN settings via the Router object) you might trigger some problems with the objects in the internal contrail api database and then end up in an inconsistent state. This article aims at showing a simple way of cleaning that one up (in my case changing the VNI triggered a bug).

Continue reading

This article means to show a simple way to create custom Firewall Tags for the new Contrail Security concept, apply them to an element (Virtual Network or Virtual Machine Interface == Neutron Port), create a Firewall rule that uses them, attach that rule to a Firewall Policy.

A few theoretical steps:

• create custom tag + value
• attach custom tag + value to port (VMI/Neutron Port)
• read default policy management ID
• create firewall rule attached to parent = default policy management ID
• update firewall policy with the previously created firewall rule

This assumes that later we will map (not present in this article) the firewall policy to the Default Application Policy. To eliminate a bit the confusion, Juniper’s Contrail Security has the following structure:

• Application policy
  • Default Application Policy = applies everywhere -> we map here 1 or More Firewall Policies
  • Custom Application Policy = applies mentioned Firewall Policies just to the elements (VNs/VMIs/Project/etc) where we put the matching application tags
    
• Firewall policy List of firewall rules that apply.
• Firewall rules

Continue reading

Recently I had the chance to play in a lab with a Load Balancer manufacturer for the Cloud that I had no clue about before and which proved to be a challenging but also rewarding experience. I’m talking about AVI Load Balancer (www.avinetworks.com) and this article will walk you through the basic concepts of it, how to integrate it with Contrail, how to see what it does in Contrail and how it provisions the VIPs and also what potential tips&tricks and shortcomings might be.

Continue reading

Someone asked me a few days ago if it would be possible to trigger Contrail operations via ansible. After a bit of looking around I did not locate anything already made so wanted to see for myself how doable this is. While keeping in mind that I never played with Python more than modifying a few things in scripts that I already found from others (I’m way better at reverse engineering and improving/changing what is already in place), I decided this would be a good challenge for starting things off.

Continue reading