OpenStack Ansible Pike版本：外部网络网关无法ping通求助

Let's walk through systematic checks to diagnose why you can't ping your external network gateway in your Pike setup:

1. Verify Physical Layer & VLAN Subinterface Configuration #

First, rule out underlying network issues:

• Check if your physical interface and VLAN subinterface are active and healthy:

  ip link show eno1
  ip link show eno1.139
  

  Both interfaces should show an UP state with no excessive error counters.
• Confirm your upstream switch port connected to eno1 is set to trunk mode and explicitly permits VLAN 139. Also double-check that your physical gateway device is actually present and operational within VLAN 139.

2. Validate the VLAN Bridge (br-vlan) #

Your bridge acts as the bridge between OpenStack and the physical VLAN—ensure it's working as expected:

• Check the bridge's port association and forwarding state:

  brctl show br-vlan
  

  You should see eno1.139 listed as an attached port, and the bridge should be in forwarding state.
• Confirm the bridge interface itself is up:

  ip link show br-vlan
  

3. Check OpenStack External Network/Subnet Configuration #

Make sure your OpenStack setup aligns with your physical network:

• Verify the external network uses the correct VLAN ID and bridge:

  openstack network show <your-external-network-name>
  

  Look for provider:physical_network matching your VLAN setup, provider:network_type set to vlan, and provider:segmentation_id = 139.
• Check that the subnet's gateway matches your physical gateway and has no conflicts:

  openstack subnet show <your-external-subnet-name>
  

  Ensure gateway_ip is the correct IP of your physical gateway, and no other device in the subnet is using the same IP.

4. Test Connectivity Directly from the Network Node #

Isolate whether the issue is with OpenStack or the underlying network:

• Temporarily assign a valid IP from the external subnet to br-vlan on your network controller:

  ip addr add <valid-subnet-ip>/<subnet-mask> dev br-vlan
  

  Try pinging the gateway. If this fails, the problem lies in your physical network (switch config, trunking, or gateway availability)—not OpenStack. If it works, the issue is within OpenStack's network configuration.

5. Check Security Groups & Firewall Rules #

Traffic might be blocked at the security group or node firewall level:

• Ensure the security group associated with your external network (or attached instances) allows ICMP traffic (ping):

  openstack security group rule list <your-security-group-name>
  openstack security group rule create --proto icmp <your-security-group-name>
  

• Check the network node's iptables rules to confirm br-vlan traffic isn't being blocked:

  iptables-save | grep br-vlan
  

  Look for any DROP rules targeting the bridge interface.

6. Inspect OpenStack Logs #

If all previous checks pass, dig into Neutron logs for specific errors:

• Check the Neutron server log for configuration issues:

  tail -f /var/log/neutron/server.log
  

• Check the Linuxbridge agent log for bridge/VLAN binding problems:

  tail -f /var/log/neutron/linuxbridge-agent.log
  

  Look for errors related to br-vlan, eno1.139, or VLAN 139.

内容的提问来源于stack exchange，提问作者Dusan Dordevic