Prevent traffic flooding with FDB learning

Configure forwarding database learning to prevent traffic flooding on ports that have security disabled and belong to a provider network (network has an ML2/OVN localnet port).

Before you begin

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.

Procedure

  1. Open your OpenStackControlPlane custom resource (CR) file, openstack_control_plane.yaml, on your workstation.
  2. Add the following configuration to the neutron service configuration: 
    spec:
    neutron:
        template:
            customServiceConfig: |
               [ovn]
               localnet_learn_fdb = true
               fdb_age_threshold = 300
               [ovn_nb_global]
               fdb_removal_limit = 50
    • localnet_learn_fdb - Enables FDB learning by allowing the localnet ports that are created for each provider network to learn the MAC addresses and store them in the FDB SB table.
    • fdb_age_threshold - Sets the maximum time (seconds) that the learned MACs stay in the FDB table, and prevents this table from growing indefinitely.
    • fdb_removal_limit - Limits the number of FDB table entries that can be removed in a single transaction by the aging function. Important

      If you disable port security on a provider network in an environment, you must set related forwarding database (FDB) learning and aging parameters.

  3. Update the control plane: 
    $ oc apply -f openstack_control_plane.yaml -n openstack
  4. Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status: 
    $ oc get openstackcontrolplane -n openstack

    The OpenStackControlPlane resources are created when the status is "Setup complete".

    Tip
    Append the -w option to the end of the get command to track deployment progress.