title: openstack floating ip cannot be accessed
body: <h1>description</h1>
  
  <p>After the dvr is enabled, the two virtual machines of vip are configured with keealived. When the VIP of the private network drifts, the openstack floating ip cannot be accessed.</p>
  
  <h2>more detail as follows:</h2>
  
  <p>Two nodes, private network configuration keepalived
  Host1 192.168.1.2
  Host2 192.168.1.3 vip192.168.1.4
  Private network vip drift no problem, private network internal access vip is no problem
  The problem is that after the drift of the internal network's vip, the external floating ip corresponding to this vip cannot be accessed, and can be accessed before drifting.
  Phenomenon: Update the port of the private network that vip drifts to. The floating network can be used. What causes this problem?</p>
  
  <h2>Configuration reference</h2>
  
  <blockquote>
    <p><a href="https://hk.saowen.com/a/4d7a3dcd044eb53ae0fc81e4d1445ba76bbb02423ff6c7b4a53a8ad59945883d" rel="nofollow noreferrer">https://hk.saowen.com/a/4d7a3dcd044eb53ae0fc81e4d1445ba76bbb02423ff6c7b4a53a8ad59945883d</a></p>
  </blockquote>
  
  <h2>Configuration process</h2>
  
  <p>premise:
  Suppose there are already two virtual machines 10.10.10.6, 10.10.10.7, configured with keepalived, vip is 10.10.10.201
   
  Configure the steps to support VIP and floating IP access in OpenStack:</p>
  
  <ol>
  <li><p>Security group plus vrrp protocol 112</p>
  
  <blockquote>
    <p>neutron security-group-rule-create --protocol 112 default</p>
  </blockquote></li>
  <li><p>Create vip</p>
  
  <blockquote>
    <p>neutron port-create --fixed_ip ip_address=10.10.10.201 --security-group default vrrp_net</p>
  </blockquote></li>
  <li><p>Bind vip to floating ip</p>
  
  <blockquote>
    <p>neutron floatingip-create --port-id=3d7e70e9-cfcb-4aa9-95cc-60b5b6b67ec3 admin_floating_net</p>
  </blockquote></li>
  <li><p>Add allowed_address_pairs to the virtual machine port to support multiple NICs for multiple NICs.</p></li>
  </ol>
  
  <p>Query the port of virtual machine 1</p>
  
  <blockquote>
    <p>neutron port-list | grep 10.10.10.6</p>
  </blockquote>
  
  <p>Update the port of virtual machine 1</p>
  
  <blockquote>
    <p>neutron port-update df22ba59-9c58-41a5-9fa3-98b09e644fe5 --
    allowed_address_pairs list=true type=dict ip_address=10.10.10.201</p>
  </blockquote>
  
  <p>Query the port of virtual machine 2</p>
  
  <blockquote>
    <p>neutron port-list | grep 10.10.10.7</p>
  </blockquote>
  
  <p>Update the port of virtual machine 2</p>
  
  <blockquote>
    <p>neutron port-update 4c93d5b7-f26f-4136-a785-4db1479dbd81 -->allowed_address_pairs list=true type=dict ip_address=10.10.10.201</p>
  </blockquote>