We create a blank database after logging in to the MySQL server:

mysql –u root –p

Enter the password: dbr00tpassword

Once in the database, execute the following command:

create database neutron;

This will create an empty database called neutron. Let us now set up the Nova database user credentials as we did earlier:

GRANT ALL PRIVILEGES ON nova.* TO 'neutron'@'localhost' IDENTIFIED BY 'n3utron';
GRANT ALL PRIVILEGES ON nova.* TO 'neutron'@'%' IDENTIFIED BY 'n3utron';

This allows the username neutron, using our password, to access the database called neutron.

The Neutron control components are installed using the aptitude package manager by using the following command:

sudo apt-get install neutron-server neutron-plugin-ml2 python-neutronclient

Ensure that these are installed successfully.

Now, let's look at some of the initial configuration tasks on the controller node.

Creating the Neutron user in Keystone

Create the user in Keystone; by now, you will be familiar with exporting the credentials in order to use the different OpenStack command line utilities:

keystone user-create --name neutron --pass n3utronpwd

You should see something like the following screenshot:

Then assign the admin role to the user by running the following command:

keystone user-role-add --user neutron --tenant service --role admin

Creating the Neutron service in Keystone

The Neutron service is created using the following command:

keystone service-create --name neutron --type network --description "OpenStack Networking"

The service will look as follows:

We will have to note the id of the service, which we will use in the next section. In our case the id is 73376c096f154179a293a83a22cce643.

Creating the Neutron endpoint in Keystone

The endpoint is created using the following command, where you replace the ID with the ID you received during service creation:

keystone endpoint-create 
  --service-id 73376c096f154179a293a83a22cce643
  --publicurl http://OSControllerNode:9696 
  --internalurl http://OSControllerNode:9696 
  --adminurl http://OSControllerNode:9696 
  --region dataCenterOne

The following is the output:

Modifying the configuration files

On the controller node, we have a few files to modify:

• /etc/neutron/neutron.conf: This file is used to configure Neutron
• /etc/neutron/plugins/ml2/ml2_conf.ini: This file helps configure the ML2 plugin
• /etc/nova/nova.conf: This allows Nova to use Neutron rather than the default Nova networking

Let's view one file at a time. However before we proceed, we will need the ID of the service tenant that we created. We can obtain it by using the Keystone command keystone tenant-list and picking the ID of the service tenant.

We will have to export the variables (or source the file, as we have done in the past) as shown in the following screenshot:

So, the service tenant ID is 8067841bed8547b0a21459ff4c8d58f7. This will be different for you, so substitute this in the following configuration.

In the etc/neutron/neutron.conf file, make the following changes:

• Under the [database] section:

  connection = mysql://neutron:n3utron@OSControllerNode/neutron
  

• Under the [default] section:

  rpc_backend = rabbit
  rabbit_host = OSControllerNode
  rabbit_password = rabb1tmqpass
  auth_strategy = keystone
  core_plugin = ml2
  service_plugins = router
  allow_overlapping_ips = True
  notify_nova_on_port_status_changes = True
  notify_nova_on_port_data_changes = True
  nova_url = http://OSControllerNode:8774/v2
  nova_admin_auth_url = http://OSControllerNode:35357/v2.0
  nova_region_name = dataCenterOne
  nova_admin_username = nova
  nova_admin_tenant_id = 8067841bed8547b0a21459ff4c8d58f7
  nova_admin_password = n0vakeypwd
  verbose = True
  

• Under the [keystone_authtoken] section:

  auth_uri = http://OSControllerNode:5000/v2.0
  identity_uri = http://OSControllerNode:35357
  admin_tenant_name = service
  admin_user = neutron
  admin_password = n3utronpwd
  

These changes need to be done in the Neutron configuration.

Now, in the /etc/neutron/plugins/ml2/ml2_conf.ini file, make the following changes:

• In the [ml2] section, enable the GRE and flat networking as follows:

  type_drivers = flat,gre
  tenant_network_types = gre
  mechanism_drivers = openvswitch
  

• In the [ml2_type_gre] section, enable the tunnel ID ranges—these don't need to be in the physical network, as they will only be between the compute and network node:

  tunnel_id_ranges = 1:1000
  

• In the [securitygroup] section, make the following changes:

  enable_security_group = True
  enable_ipset = True
  firewall_driver= neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
  

  Tip

  The next set of changes is to be made in the /etc/nova/nova.conf file.

• In the [default] section, set the following:

  network_api_class = nova.network.neutronv2.api.API
  security_group_api = neutron
  linuxnet_interface_driver = nova.network.linux_net.LinuxOVSInterfaceDriver
  firewall_driver = nova.virt.firewall.NoopFirewallDriver
  

• In the [neutron] section, enable the metadata-related configuration, which will be enabled on the network node:

  url = http://OSControllerNode:9696
  auth_strategy = keystone
  admin_auth_url = http://OSControllerNode:35357/v2.0
  admin_tenant_name = service
  admin_username = neutron
  admin_password = n3utronpwd
  service_metadata_proxy = True
  metadata_proxy_shared_secret = m3tadatapwd
  

This will enable Neutron for Nova in line with the configuration.

The Neutron database can now be populated by running the following command as root user:

/bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf  --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade juno" neutron

To finalize the installation, delete the SQLite database that comes along with the Ubuntu packages:

rm –rf /var/lib/neutron/neutron.sqlite

Restart all the services, including Nova and Neutron, by running the following commands:

service nova-api restart
service nova-scheduler restart
service nova-conductor restart
service neutron-server restart

At this point, the installation is complete on the controller node.

In order to validate the installation, let's execute some Neutron commands:

neutron ext-list
neutron agent-list

On the network node, we will need to make some changes, which will help us set up network forwarding before we go into the actual installation.

We start by editing the /etc/sysctl.conf file to ensure the following parameters are set:

These lines are needed on the network node in order for it to be able to forward packets from one interface to the other, essentially behaving like a router. We also disable the Reverse Path (rp) filter so that the kernel doesn't do the source validation; this is required so that we can use the elastic IPs. In order to ensure that the changes take effect, reload the system control as follows:

sudo sysctl –p

This command reloads the sysctl.conf file that we modified.

We will install the Neutron packages for the ML2 plugin and the OVS agents along with Layer 3 and DHCP agents:

sudo apt-get install neutron-plugin-ml2 neutron-plugin-openvswitch-agent neutron-l3-agent neutron-dhcp-agent

Once the packages are installed, we will configure them. The Neutron configuration is similar to that on the controller node; the ML2 Plugin, DHCP agent, and the L3 agents are additional. We will also configure the metadata agent, which will be used to push the metadata on all the compute nodes when they come up.

Now, let us look at some of the initial configuration tasks on the network node.

dnsmasq_config_file = /etc/neutron/dnsmasq-neutron.conf

dhcp-option-force = 26,1454

The entire Neutron configuration is based on the OVS. We need to create a bridge (br-ex) that will point to the external network.

service openvswitch-switch restart
ovs-vsctl add-br br-ex

We now need to add the interface to the external bridge. This interface should be the one pointing to the external physical network world. In my case, it is eth2. Modify it to reflect the right interface name in your environment:

ovs-vsctl add-port br-ex eth2

This adds the external network to the bridge that OpenStack knows as br-ex.

Verify that the interface is added by executing the following command:

ovs-vsctl show

You will receive confirmation as shown in the following screenshot:

We now need to restart all the services we have installed by running the following commands:

sudo service neutron-plugin-openvswitch-agent restart
sudo service neutron-l3-agent restart
sudo service neutron-dhcp-agent restart
sudo service neutron-metadata-agent restart

On the controller node, after exploring the environment variables for authentication, execute the following command:

neutron agent-list

You will see the four agents we configured on the network node, as in the following screenshot:

We start by editing the /etc/sysctl.conf file to ensure the following parameters are set:

net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0

This disables the Reverse Path (rp) filter so that the kernel doesn't perform the source validation. The kernel will start dropping the packets if we don't set this, as sometimes the packets may actually be destined to another IP address. In order to ensure that the changes take effect, reload the system control:

sysctl –p

This command reloads the sysctl.conf file that we modified.

Install the ML2 plugin and OVS agent by running the following command:

sudo apt-get install neutron-plugin-ml2 neutron-plugin-openvswitch-agent

After this, start OVS by running the following command:

sudo service openvswitch-switch restart

Now, let us look at some of the initial configuration tasks on the compute node.

Finally, restart all the components that we installed on the compute node:

sudo service nova-compute restart
sudo service neutron-plugin-openvswitch-agent restart

This concludes the installation of Neutron in our OpenStack environment.

Validate the installation in the same way as we did for the Network node. On the controller, after exporting the credentials, execute the following command:

neutron agent-list

We already had four entries from our installation on the network node, but now you can see an entry has been created for the compute node as well: