Lingkup alamat (address scopes)¶

Lingkup alamat membangun kolam subnet. Sementara kolam subnet menyediakan mekanisme untuk mengendalikan alokasi alamat untuk subnet, lingkup alamat menunjukkan dimana alamat dapat dialihkan antara jaringan, mencegah penggunaan tumpang tindih alamat dalam dua subnet. Karena semua alamat dialokasikan dalam lingkup alamat tidak tumpang tindih, router neutron tidak men-NAT (Network Address Translation) antara jaringan proyek Anda dan jaringan eksternal Anda. Selama alamat dalam suatu kecocokan lingkup alamat, layanan Networking melakukan routing sederhana antar jaringan.

Mengakses lingkup alamat¶

Siapapun dengan akses ke layanan Networking dapat membuat lingkup alamat mereka sendiri. Namun, administrator jaringan dapat membuat lingkup alamat bersama, yang memungkinkan proyek lain untuk membuat jaringan dalam lingkup alamat itu.

Akses ke alamat di lingkup dikelola melalui kolam subnet. Kolam subnet baik dapat dibuat dalam lingkup alamat, ataupun diperbarui milik lingkup alamat.

Dengan kolam subnet, semua alamat digunakan dalam lingkup alamat menjadi unik dari sudut pandang pemilik lingkup alamat. Oleh karena itu, tambahkan lebih dari satu subnet kolam untuk lingkup alamat jika kolam memiliki pemilik yang berbeda, yang memungkinkan untuk pendelegasian bagian dari lingkup alamat. Delegasi mencegah alamat tumpang tindih di seluruh lingkup. Jika tidak, Anda menerima pesan kesalahan jika dua kolam memiliki rentang alamat yang sama.

Setiap interface router dikaitkan dengan lingkup alamat dengan melihat subnet terhubung ke jaringan. Ketika router menghubungkan ke jaringan eksternal dengan pencocokan lingkup alamat, lalu lintas me-rute jaringan antar tanpa Network Address Translation (NAT). Router menandai semua koneksi lalu lintas yang berasal dari masing-masing antarmuka dengan lingkup alamat yang sesuai. Jika lalu lintas meninggalkan antarmuka dalam lingkup yang salah, router memblok lalu lintas.

Kompatibilitas mundur¶

Jaringan yang dibuat sebelum rilis Mitaka tidak mengandung secara eksplisit lingkup address bernama, kecuali jaringan berisi subnet dari kolam subnet milik lingkup alamat yang dibuat atau diperbarui. Layanan Networking mempertahankan kompatibilitas mundur dengan jaringan pra-Mitaka melalui sifat lingkup alamat khusus sehingga jaringan ini bisa melakukan routing canggih:

Tak terbatas tumpang tindih alamat diperbolehkan.
Router neutron, secara default, akan men-NAT (Network Address Translation) lalu lintas dari jaringan internal untuk jaringan eksternal.
Pre-Mitaka lingkup alamat tidak terlihat melalui API. Anda tidak bisa mendaftar lingkup alamat atau menunjukkan detail. Lingkup ada secara implisit sebagai catch-all untuk alamat yang tidak secara eksplisit terlingkup.

Buat lingkup alamat bersama sebagai pengguna administratif¶

Bagian ini menunjukkan cara mengatur lingkup alamat bersama untuk memungkinkan routing sederhana untuk jaringan proyek dengan kolam subnet yang sama.

Catatan

Field tidak relevan telah dipangkas dari output dari perintah ini supaya singkat.

Buat lingkup alamat IPv6 dan IPv4:

$ openstack address scope create --share --ip-version 6 address-scope-ip6

+------------+--------------------------------------+
| Field      | Value                                |
+------------+--------------------------------------+
| headers    |                                      |
| id         | 28424dfc-9abd-481b-afa3-1da97a8fead7 |
| ip_version | 6                                    |
| name       | address-scope-ip6                    |
| project_id | 098429d072d34d3596c88b7dbf7e91b6     |
| shared     | True                                 |
+------------+--------------------------------------+

$ openstack address scope create --share --ip-version 4 address-scope-ip4

+------------+--------------------------------------+
| Field      | Value                                |
+------------+--------------------------------------+
| headers    |                                      |
| id         | 3193bd62-11b5-44dc-acf8-53180f21e9f2 |
| ip_version | 4                                    |
| name       | address-scope-ip4                    |
| project_id | 098429d072d34d3596c88b7dbf7e91b6     |
| shared     | True                                 |
+------------+--------------------------------------+

Buat kolam subnet yang menetapkan nama (atau UUID) dari lingkup alamat (address scope) dimana kolam subnet memilikinya. Jika Anda telah ada kolam subnet, gunakan perintah openstack subnet pool set untuk menempatkan mereka dalam lingkup alamat baru:

$ openstack subnet pool create --address-scope address-scope-ip6 \
--share --pool-prefix 2001:db8:a583::/48 --default-prefix-length 64 \
subnet-pool-ip6
+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| address_scope_id  | 28424dfc-9abd-481b-afa3-1da97a8fead7 |
| created_at        | 2016-12-13T22:53:30Z                 |
| default_prefixlen | 64                                   |
| default_quota     | None                                 |
| description       |                                      |
| id                | a59ff52b-0367-41ff-9781-6318b927dd0e |
| ip_version        | 6                                    |
| is_default        | False                                |
| max_prefixlen     | 128                                  |
| min_prefixlen     | 64                                   |
| name              | subnet-pool-ip6                      |
| prefixes          | 2001:db8:a583::/48                   |
| project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
| revision_number   | 1                                    |
| shared            | True                                 |
| updated_at        | 2016-12-13T22:53:30Z                 |
+-------------------+--------------------------------------+

$ openstack subnet pool create --address-scope address-scope-ip4 \
--share --pool-prefix 203.0.113.0/24 --default-prefix-length 26 \
subnet-pool-ip4
+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| address_scope_id  | 3193bd62-11b5-44dc-acf8-53180f21e9f2 |
| created_at        | 2016-12-13T22:55:09Z                 |
| default_prefixlen | 26                                   |
| default_quota     | None                                 |
| description       |                                      |
| id                | d02af70b-d622-426f-8e60-ed9df2a8301f |
| ip_version        | 4                                    |
| is_default        | False                                |
| max_prefixlen     | 32                                   |
| min_prefixlen     | 8                                    |
| name              | subnet-pool-ip4                      |
| prefixes          | 203.0.113.0/24                       |
| project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
| revision_number   | 1                                    |
| shared            | True                                 |
| updated_at        | 2016-12-13T22:55:09Z                 |
+-------------------+--------------------------------------+

Pastikan bahwa subnet pada jaringan eksternal diciptakan dari kolam subnet yang dibuat di atas:

$ openstack subnet show ipv6-public-subnet
+-------------------+------------------------------------------+
| Field             | Value                                    |
+-------------------+------------------------------------------+
| allocation_pools  | 2001:db8:a583::2-2001:db8:a583:0:ffff:ff |
|                   | ff:ffff:ffff                             |
| cidr              | 2001:db8:a583::/64                       |
| created_at        | 2016-12-10T21:36:04Z                     |
| description       |                                          |
| dns_nameservers   |                                          |
| enable_dhcp       | False                                    |
| gateway_ip        | 2001:db8:a583::1                         |
| host_routes       |                                          |
| id                | b333bf5a-758c-4b3f-97ec-5f12d9bfceb7     |
| ip_version        | 6                                        |
| ipv6_address_mode | None                                     |
| ipv6_ra_mode      | None                                     |
| name              | ipv6-public-subnet                       |
| network_id        | 05a8d31e-330b-4d96-a3fa-884b04abfa4c     |
| project_id        | 098429d072d34d3596c88b7dbf7e91b6         |
| revision_number   | 2                                        |
| segment_id        | None                                     |
| service_types     |                                          |
| subnetpool_id     | a59ff52b-0367-41ff-9781-6318b927dd0e     |
| updated_at        | 2016-12-10T21:36:04Z                     |
+-------------------+------------------------------------------+

$ openstack subnet show public-subnet
+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| allocation_pools  | 203.0.113.2-203.0.113.62             |
| cidr              | 203.0.113.0/26                       |
| created_at        | 2016-12-10T21:35:52Z                 |
| description       |                                      |
| dns_nameservers   |                                      |
| enable_dhcp       | False                                |
| gateway_ip        | 203.0.113.1                          |
| host_routes       |                                      |
| id                | 7fd48240-3acc-4724-bc82-16c62857edec |
| ip_version        | 4                                    |
| ipv6_address_mode | None                                 |
| ipv6_ra_mode      | None                                 |
| name              | public-subnet                        |
| network_id        | 05a8d31e-330b-4d96-a3fa-884b04abfa4c |
| project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
| revision_number   | 2                                    |
| segment_id        | None                                 |
| service_types     |                                      |
| subnetpool_id     | d02af70b-d622-426f-8e60-ed9df2a8301f |
| updated_at        | 2016-12-10T21:35:52Z                 |
+-------------------+--------------------------------------+

Routing dengan lingkup alamat untuk pengguna non-istimewa¶

Bagian ini menunjukkan bagaimana pengguna non-hak istimewa dapat menggunakan lingkup alamat untuk rute langsung ke jaringan eksternal tanpa NAT (Network Address Translation).

Buat beberapa jaringan untuk subnet host:

$ openstack network create network1
+---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | UP                                   |
| availability_zone_hints   |                                      |
| availability_zones        |                                      |
| created_at                | 2016-12-13T23:21:01Z                 |
| description               |                                      |
| headers                   |                                      |
| id                        | 1bcf3fe9-a0cb-4d88-a067-a4d7f8e635f0 |
| ipv4_address_scope        | None                                 |
| ipv6_address_scope        | None                                 |
| mtu                       | 1450                                 |
| name                      | network1                             |
| port_security_enabled     | True                                 |
| project_id                | 098429d072d34d3596c88b7dbf7e91b6     |
| provider:network_type     | vxlan                                |
| provider:physical_network | None                                 |
| provider:segmentation_id  | 94                                   |
| revision_number           | 3                                    |
| router:external           | Internal                             |
| shared                    | False                                |
| status                    | ACTIVE                               |
| subnets                   |                                      |
| tags                      | []                                   |
| updated_at                | 2016-12-13T23:21:01Z                 |
+---------------------------+--------------------------------------+

$ openstack network create network2
+---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | UP                                   |
| availability_zone_hints   |                                      |
| availability_zones        |                                      |
| created_at                | 2016-12-13T23:21:45Z                 |
| description               |                                      |
| headers                   |                                      |
| id                        | 6c583603-c097-4141-9c5c-288b0e49c59f |
| ipv4_address_scope        | None                                 |
| ipv6_address_scope        | None                                 |
| mtu                       | 1450                                 |
| name                      | network2                             |
| port_security_enabled     | True                                 |
| project_id                | 098429d072d34d3596c88b7dbf7e91b6     |
| provider:network_type     | vxlan                                |
| provider:physical_network | None                                 |
| provider:segmentation_id  | 81                                   |
| revision_number           | 3                                    |
| router:external           | Internal                             |
| shared                    | False                                |
| status                    | ACTIVE                               |
| subnets                   |                                      |
| tags                      | []                                   |
| updated_at                | 2016-12-13T23:21:45Z                 |
+---------------------------+--------------------------------------+

Buat subnet yang tidak terkait dengan kolam subnet atau lingkup alamat:

$ openstack subnet create --network network1 --subnet-range \
198.51.100.0/26 subnet-ip4-1
+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| allocation_pools  | 198.51.100.2-198.51.100.62           |
| cidr              | 198.51.100.0/26                      |
| created_at        | 2016-12-13T23:24:16Z                 |
| description       |                                      |
| dns_nameservers   |                                      |
| enable_dhcp       | True                                 |
| gateway_ip        | 198.51.100.1                         |
| headers           |                                      |
| host_routes       |                                      |
| id                | 66874039-d31b-4a27-85d7-14c89341bbb7 |
| ip_version        | 4                                    |
| ipv6_address_mode | None                                 |
| ipv6_ra_mode      | None                                 |
| name              | subnet-ip4-1                         |
| network_id        | 1bcf3fe9-a0cb-4d88-a067-a4d7f8e635f0 |
| project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
| revision_number   | 2                                    |
| service_types     |                                      |
| subnetpool_id     | None                                 |
| updated_at        | 2016-12-13T23:24:16Z                 |
+-------------------+--------------------------------------+

$ openstack subnet create --network network1 --ipv6-ra-mode slaac \
--ipv6-address-mode slaac --ip-version 6 --subnet-range \
2001:db8:80d2:c4d3::/64 subnet-ip6-1
+-------------------+-----------------------------------------+
| Field             | Value                                   |
+-------------------+-----------------------------------------+
| allocation_pools  | 2001:db8:80d2:c4d3::2-2001:db8:80d2:c4d |
|                   | 3:ffff:ffff:ffff:ffff                   |
| cidr              | 2001:db8:80d2:c4d3::/64                 |
| created_at        | 2016-12-13T23:28:28Z                    |
| description       |                                         |
| dns_nameservers   |                                         |
| enable_dhcp       | True                                    |
| gateway_ip        | 2001:db8:80d2:c4d3::1                   |
| headers           |                                         |
| host_routes       |                                         |
| id                | a7551b23-2271-4a88-9c41-c84b048e0722    |
| ip_version        | 6                                       |
| ipv6_address_mode | slaac                                   |
| ipv6_ra_mode      | slaac                                   |
| name              | subnet-ip6-1                            |
| network_id        | 1bcf3fe9-a0cb-4d88-a067-a4d7f8e635f0    |
| project_id        | 098429d072d34d3596c88b7dbf7e91b6        |
| revision_number   | 2                                       |
| service_types     |                                         |
| subnetpool_id     | None                                    |
| updated_at        | 2016-12-13T23:28:28Z                    |
+-------------------+-----------------------------------------+

Create a subnet using a subnet pool associated with an address scope from an external network:

$ openstack subnet create --subnet-pool subnet-pool-ip4 \
--network network2 subnet-ip4-2
+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| allocation_pools  | 203.0.113.2-203.0.113.62             |
| cidr              | 203.0.113.0/26                       |
| created_at        | 2016-12-13T23:32:12Z                 |
| description       |                                      |
| dns_nameservers   |                                      |
| enable_dhcp       | True                                 |
| gateway_ip        | 203.0.113.1                          |
| headers           |                                      |
| host_routes       |                                      |
| id                | 12be8e8f-5871-4091-9e9e-4e0651b9677e |
| ip_version        | 4                                    |
| ipv6_address_mode | None                                 |
| ipv6_ra_mode      | None                                 |
| name              | subnet-ip4-2                         |
| network_id        | 6c583603-c097-4141-9c5c-288b0e49c59f |
| project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
| revision_number   | 2                                    |
| service_types     |                                      |
| subnetpool_id     | d02af70b-d622-426f-8e60-ed9df2a8301f |
| updated_at        | 2016-12-13T23:32:12Z                 |
+-------------------+--------------------------------------+

$ openstack subnet create --ip-version 6 --ipv6-ra-mode slaac \
--ipv6-address-mode slaac --subnet-pool subnet-pool-ip6 \
--network network2 subnet-ip6-2
+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| allocation_pools  | 2001:db8:a583::2-2001:db8:a583:0:fff |
|                   | f:ffff:ffff:ffff                     |
| cidr              | 2001:db8:a583::/64                   |
| created_at        | 2016-12-13T23:31:17Z                 |
| description       |                                      |
| dns_nameservers   |                                      |
| enable_dhcp       | True                                 |
| gateway_ip        | 2001:db8:a583::1                     |
| headers           |                                      |
| host_routes       |                                      |
| id                | b599c2be-e3cd-449c-ba39-3cfcc744c4be |
| ip_version        | 6                                    |
| ipv6_address_mode | slaac                                |
| ipv6_ra_mode      | slaac                                |
| name              | subnet-ip6-2                         |
| network_id        | 6c583603-c097-4141-9c5c-288b0e49c59f |
| project_id        | 098429d072d34d3596c88b7dbf7e91b6     |
| revision_number   | 2                                    |
| service_types     |                                      |
| subnetpool_id     | a59ff52b-0367-41ff-9781-6318b927dd0e |
| updated_at        | 2016-12-13T23:31:17Z                 |
+-------------------+--------------------------------------+

Dengan pembuatan subnet dari kolam subnet terlingkup (scoped), jaringan dikaitkan dengan lingkup alamat.

$ openstack network show network2
+---------------------------+------------------------------+
| Field                     | Value                        |
+---------------------------+------------------------------+
| admin_state_up            | UP                           |
| availability_zone_hints   |                              |
| availability_zones        | nova                         |
| created_at                | 2016-12-13T23:21:45Z         |
| description               |                              |
| id                        | 6c583603-c097-4141-9c5c-     |
|                           | 288b0e49c59f                 |
| ipv4_address_scope        | 3193bd62-11b5-44dc-          |
|                           | acf8-53180f21e9f2            |
| ipv6_address_scope        | 28424dfc-9abd-481b-          |
|                           | afa3-1da97a8fead7            |
| mtu                       | 1450                         |
| name                      | network2                     |
| port_security_enabled     | True                         |
| project_id                | 098429d072d34d3596c88b7dbf7e |
|                           | 91b6                         |
| provider:network_type     | vxlan                        |
| provider:physical_network | None                         |
| provider:segmentation_id  | 81                           |
| revision_number           | 10                           |
| router:external           | Internal                     |
| shared                    | False                        |
| status                    | ACTIVE                       |
| subnets                   | 12be8e8f-5871-4091-9e9e-     |
|                           | 4e0651b9677e, b599c2be-e3cd- |
|                           | 449c-ba39-3cfcc744c4be       |
| tags                      | []                           |
| updated_at                | 2016-12-13T23:32:12Z         |
+---------------------------+------------------------------+

Menghubungkan router untuk masing-masing subnet proyek yang telah dibuat, misalnya, menggunakan router disebut router1:

$ openstack router add subnet router1 subnet-ip4-1
$ openstack router add subnet router1 subnet-ip4-2
$ openstack router add subnet router1 subnet-ip6-1
$ openstack router add subnet router1 subnet-ip6-2

Pemeriksaan konektivitas¶

Contoh ini menunjukkan bagaimana untuk memeriksa konektivitas antara jaringan dengan lingkup alamat.

Meluncurkan dua instance, instance1 pada network1 and instance2 pada network2. Mengasosiasikan alamat IP mengambang dengan kedua instance.

Atur kelompok keamanan untuk mengizinkan ping dan SSH (IPv4 dan IPv6):

$ openstack server list
+--------------+-----------+---------------------------------------------------------------------------+------------+
| ID           | Name      | Networks                                                                  | Image Name |
+--------------+-----------+---------------------------------------------------------------------------+------------+
| 97e49c8e-... | instance1 | network1=2001:db8:80d2:c4d3:f816:3eff:fe52:b69f, 198.51.100.3, 203.0.113.3| cirros     |
| ceba9638-... | instance2 | network2=203.0.113.3, 2001:db8:a583:0:f816:3eff:fe42:1eeb, 203.0.113.4    | centos     |
+--------------+-----------+---------------------------------------------------------------------------+------------+

Terlepas dari lingkup alamat, IP mengambang dapat ping dari jaringan eksternal:

$ ping -c 1 203.0.113.3
1 packets transmitted, 1 received, 0% packet loss, time 0ms
$ ping -c 1 203.0.113.4
1 packets transmitted, 1 received, 0% packet loss, time 0ms

Anda sekarang dapat ping instance2 langsung karena share instance2 lingkup alamat sama dengan jaringan eksternal:

Catatan

Border Gateway Protocol (BGP) routing dapat digunakan untuk secara otomatis mengatur rute statis untuk instance Anda.

# ip route add 203.0.113.0/26 via 203.0.113.2
$ ping -c 1 203.0.113.3
1 packets transmitted, 1 received, 0% packet loss, time 0ms

# ip route add 2001:db8:a583::/64 via 2001:db8::1
$ ping6 -c 1 2001:db8:a583:0:f816:3eff:fe42:1eeb
1 packets transmitted, 1 received, 0% packet loss, time 0ms

Anda tidak bisa ping langsung instance1 karena lingkup alamat tidak cocok:

# ip route add 198.51.100.0/26 via 203.0.113.2
$ ping -c 1 198.51.100.3
1 packets transmitted, 0 received, 100% packet loss, time 0ms

# ip route add 2001:db8:80d2:c4d3::/64 via 2001:db8::1
$ ping6 -c 1 2001:db8:80d2:c4d3:f816:3eff:fe52:b69f
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Jika lingkup alamat ada kesesuaian antar jaringan maka ping dan rute lalu lintas lainnya akan melalui langsung. Jika lingkup tidak cocok antar jaringan, router menjatuhkan lalu lintas ataupun menerapkan NAT untuk melintasi batas ruang lingkup.