summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorIhar Hrachyshka <ihrachys@redhat.com>2017-05-23 18:13:28 -0700
committerIhar Hrachyshka <ihrachys@redhat.com>2017-05-25 13:24:51 -0700
commit804fd3427eeb31a2846ee096dbdac924ec39bcbc (patch)
tree555ea1b05435776f0d9cfc3d754236eb9249a3ef
parentaeb11f384fe8e221c9bd62b8b86ecb1da4003777 (diff)
Enable arp_accept for all interfaces
OpenStack heavily relies on gratuitous ARP updates when moving floating IP addresses between devices. When a floating IP moves, Neutron L3 agent issues a burst of gratuitous ARP packets that should update any existing ARP table entries on all nodes that belong to the same network segment. Due to locktime kernel behavior, some gratuitous ARP packets may be ignored [1], rendering ARP table entries broken for some time. Due to a kernel bug [2], the time may be as long as hours, depending on other traffic flowing to the node. With the current EL7 kernel, the only way to make sure that nodes honor all sent gratuitous ARP updates is to set arp_accept to 1; this will disable locktime mechanism for the packets sent by Neutron L3 agent, and will make sure ARP tables are always updated. [1] https://patchwork.ozlabs.org/patch/762732/ [2] https://bugzilla.redhat.com/show_bug.cgi?id=1450203 Related-Bug: #1690165 Change-Id: I863b240e0ab4c4d5bb844f91b607fd0937d5cedf
-rw-r--r--puppet/services/kernel.yaml2
-rw-r--r--releasenotes/notes/enable-arp_accept-6296b0113bc56b10.yaml9
2 files changed, 11 insertions, 0 deletions
diff --git a/puppet/services/kernel.yaml b/puppet/services/kernel.yaml
index 3f9b0b7e..c142b475 100644
--- a/puppet/services/kernel.yaml
+++ b/puppet/services/kernel.yaml
@@ -77,6 +77,8 @@ outputs:
value: 0
net.ipv4.conf.all.send_redirects:
value: 0
+ net.ipv4.conf.all.arp_accept:
+ value: 1
net.ipv4.conf.default.accept_redirects:
value: 0
net.ipv4.conf.default.secure_redirects:
diff --git a/releasenotes/notes/enable-arp_accept-6296b0113bc56b10.yaml b/releasenotes/notes/enable-arp_accept-6296b0113bc56b10.yaml
new file mode 100644
index 00000000..4025477b
--- /dev/null
+++ b/releasenotes/notes/enable-arp_accept-6296b0113bc56b10.yaml
@@ -0,0 +1,9 @@
+---
+other:
+ - |
+ All nodes now enable ``arp_accept`` sysctl setting to help with honoring
+ gratuitous ARP packets in their ARP tables. While sources of gratuitous ARP
+ packets are diverse, this comes especially useful for Neutron floating IP
+ addresses that roam between devices, and for which Neutron L3 agent sends
+ gratuitous ARP packets to update all network nodes about IP address new
+ locations.