一、查看基础信息
#查看VIP地址段信息
root@controller01:~# neutron subnet-list | grep 192.168.32
| 4bcfab12-2153-4780-94e4-290d66a3053c | Land | 192.168.32.0/24 | {"start": "192.168.32.46", "end": "192.168.32.46"} |
| | | | {"start": "192.168.32.151", "end": "192.168.32.254"} |
| | | | {"start": "192.168.32.43", "end": "192.168.32.43"} |
root@controller01:~# neutron port-list | grep -i vip
root@controller01:~# neutron subnet-show 4bcfab12-2153-4780-94e4-290d66a3053c
+-------------------+------------------------------------------------------+
| Field | Value |
+-------------------+------------------------------------------------------+
| allocation_pools | {"start": "192.168.32.46", "end": "192.168.32.46"} |
| | {"start": "192.168.32.43", "end": "192.168.32.43"} |
| | {"start": "192.168.32.151", "end": "192.168.32.254"} |
| cidr | 192.168.32.0/24 |
| created_at | 2019-12-05T00:51:28Z |
| description | |
| dns_nameservers | 10.32.5.11 |
| | 223.5.5.5 |
| enable_dhcp | True |
| gateway_ip | 192.168.32.1 |
| host_routes | |
| id | 4bcfab12-2153-4780-94e4-290d66a3053c |
| ip_version | 4 |
| ipv6_address_mode | |
| ipv6_ra_mode | |
| name | Land |
| network_id | fec40933-531f-4b11-bbd6-8cdba6d845d5 |
| project_id | a6ffbd0ac94a4416b63ffb21d00918f0 |
| revision_number | 3 |
| service_types | |
| subnetpool_id | |
| tags | |
| tenant_id | a6ffbd0ac94a4416b63ffb21d00918f0 |
| updated_at | 2025-11-21T08:24:26Z |
+-------------------+------------------------------------------------------+#查看要绑定的IP的port信息，确认allowed_address_pairs是否有绑定字段
root@controller01:~# neutron port-list --all | grep 192.168.32.197
| b1de8d84-af74-46ad-86b2-3ad8dd801683 | test-port | fa:16:3e:16:b3:9e | {"subnet_id": "4bcfab12-2153-4780-94e4-290d66a3053c", "ip_address": "192.168.32.197"} |
root@controller01:~# neutron port-show b1de8d84-af74-46ad-86b2-3ad8dd801683
+-----------------------+---------------------------------------------------------------------------------------+
| Field | Value |
+-----------------------+---------------------------------------------------------------------------------------+
| admin_state_up | True |
| allowed_address_pairs | |
| binding:host_id | compute15 |
| binding:profile | {} |
| binding:vif_details | {"port_filter": true} |
| binding:vif_type | bridge |
| binding:vnic_type | normal |
| created_at | 2020-04-07T18:02:08Z |
| description | |
| device_id | e8ae72a6-c30a-4c82-8e23-045dabd0b192 |
| device_owner | compute:nova |
| extra_dhcp_opts | |
| fixed_ips | {"subnet_id": "4bcfab12-2153-4780-94e4-290d66a3053c", "ip_address": "192.168.32.197"} |
| id | b1de8d84-af74-46ad-86b2-3ad8dd801683 |
| mac_address | fa:16:3e:16:b3:9e |
| name | test-port |
| network_id | fec40933-531f-4b11-bbd6-8cdba6d845d5 |
| port_security_enabled | True |
| project_id | 98ed819352ce481fb0c028e3d328ef5d |
| revision_number | 579 |
| security_groups | 1236a8c7-68a9-45f6-82e7-8b9b7da84368 |
| | 963803ee-93bc-44ae-9013-20239737de97 |
| | f97ff2eb-7d90-440e-b07f-1161190d608e |
| status | ACTIVE |
| tags | |
| tenant_id | 98ed819352ce481fb0c028e3d328ef5d |
| updated_at | 2026-08-19T08:46:41Z |
+-----------------------+---------------------------------------------------------------------------------------二、创建VIP，并绑定到实例IP的port
#创建VIP的prot
root@controller01:~# neutron port-create --name vip-197-236 fec40933-531f-4b11-bbd6-8cdba6d845d5
Created a new port:
+-----------------------+---------------------------------------------------------------------------------------+
| Field | Value |
+-----------------------+---------------------------------------------------------------------------------------+
| admin_state_up | True |
| allowed_address_pairs | |
| binding:host_id | |
| binding:profile | {} |
| binding:vif_details | {} |
| binding:vif_type | unbound |
| binding:vnic_type | normal |
| created_at | 2026-08-20T02:08:33Z |
| description | |
| device_id | |
| device_owner | |
| extra_dhcp_opts | |
| fixed_ips | {"subnet_id": "4bcfab12-2153-4780-94e4-290d66a3053c", "ip_address": "192.168.32.234"} |
| id | 1cba45cf-aff2-4410-890f-4ecbf39810f2 |
| mac_address | fa:16:3e:7e:d1:a8 |
| name | vip-197-236 |
| network_id | fec40933-531f-4b11-bbd6-8cdba6d845d5 |
| port_security_enabled | True |
| project_id | a6ffbd0ac94a4416b63ffb21d00918f0 |
| revision_number | 6 |
| security_groups | b9ace1bc-2a2c-4b70-86ad-a47a578aaeaf |
| status | DOWN |
| tags | |
| tenant_id | a6ffbd0ac94a4416b63ffb21d00918f0 |
| updated_at | 2026-08-20T02:08:34Z |
+-----------------------+---------------------------------------------------------------------------------------#将自动分配的 VIP 绑定到机器
root@controller01:~# neutron port-update b1de8d84-af74-46ad-86b2-3ad8dd801683 --allowed-address-pairs type=dict list=true ip_address=192.168.32.234
Updated port: b1de8d84-af74-46ad-86b2-3ad8dd801683
root@controller01:~# neutron port-show b1de8d84-af74-46ad-86b2-3ad8dd801683
+-----------------------+---------------------------------------------------------------------------------------+
| Field | Value |
+-----------------------+---------------------------------------------------------------------------------------+
| admin_state_up | True |
| allowed_address_pairs | {"ip_address": "192.168.32.234", "mac_address": "fa:16:3e:16:b3:9e"} |
| binding:host_id | compute15 |
| binding:profile | {} |
| binding:vif_details | {"port_filter": true} |
| binding:vif_type | bridge |
| binding:vnic_type | normal |
| created_at | 2020-04-07T18:02:08Z |
| description | |
| device_id | e8ae72a6-c30a-4c82-8e23-045dabd0b192 |
| device_owner | compute:nova |
| extra_dhcp_opts | |
| fixed_ips | {"subnet_id": "4bcfab12-2153-4780-94e4-290d66a3053c", "ip_address": "192.168.32.197"} |
| id | b1de8d84-af74-46ad-86b2-3ad8dd801683 |
| mac_address | fa:16:3e:16:b3:9e |
| name | test-port |
| network_id | fec40933-531f-4b11-bbd6-8cdba6d845d5 |
| port_security_enabled | True |
| project_id | 98ed819352ce481fb0c028e3d328ef5d |
| revision_number | 583 |
| security_groups | 1236a8c7-68a9-45f6-82e7-8b9b7da84368 |
| | 963803ee-93bc-44ae-9013-20239737de97 |
| | f97ff2eb-7d90-440e-b07f-1161190d608e |
| status | ACTIVE |
| tags | |
| tenant_id | 98ed819352ce481fb0c028e3d328ef5d |
| updated_at | 2026-08-20T02:11:10Z |
+-----------------------+---------------------------------------------------------------------------------------三、创建VIP安全组将安全组绑定到实例上。
root@controller01:~# neutron security-group-show f97ff2eb-7d90-440e-b07f-1161190d608e
+----------------------+--------------------------------------------------------------------+
| Field | Value |
+----------------------+--------------------------------------------------------------------+
| created_at | 2026-08-19T08:46:03Z |
| description | ECS |
| id | f97ff2eb-7d90-440e-b07f-1161190d608e |
| name | VIP_192_168_32_234 |
| project_id | 98ed819352ce481fb0c028e3d328ef5d |
| revision_number | 7 |
| security_group_rules | { |
| | "remote_group_id": null, |
| | "direction": "ingress", |
| | "protocol": "tcp", |
| | "description": "", |
| | "tags": [], |
| | "ethertype": "IPv4", |
| | "remote_ip_prefix": "192.168.32.0/24", |
| | "port_range_max": 65535, |
| | "updated_at": "2026-08-19T08:46:52Z", |
| | "security_group_id": "f97ff2eb-7d90-440e-b07f-1161190d608e", |
| | "port_range_min": 1, |
| | "revision_number": 0, |
| | "tenant_id": "98ed819352ce481fb0c028e3d328ef5d", |
| | "created_at": "2026-08-19T08:46:52Z", |
| | "project_id": "98ed819352ce481fb0c028e3d328ef5d", |
| | "id": "7a2d7b83-bf2b-4e5e-ad5a-e275ab368cca" |
| | } |
| | { |
| | "remote_group_id": null, |
| | "direction": "ingress", |
| | "protocol": "icmp", |
| | "description": "", |
| | "tags": [], |
| | "ethertype": "IPv4", |
| | "remote_ip_prefix": "192.168.32.0/24", |
| | "port_range_max": null, |
| | "updated_at": "2026-08-19T08:47:24Z", |
| | "security_group_id": "f97ff2eb-7d90-440e-b07f-1161190d608e", |
| | "port_range_min": null, |
| | "revision_number": 0, |
| | "tenant_id": "98ed819352ce481fb0c028e3d328ef5d", |
| | "created_at": "2026-08-19T08:47:24Z", |
| | "project_id": "98ed819352ce481fb0c028e3d328ef5d", |
| | "id": "eb363905-14cc-40fc-bf33-0d90e1e2c6e1" |
| | } |
| | { |
| | "remote_group_id": null, |
| | "direction": "ingress", |
| | "protocol": "udp", |
| | "description": "", |
| | "tags": [], |
| | "ethertype": "IPv4", |
| | "remote_ip_prefix": "192.168.32.0/24", |
| | "port_range_max": 65535, |
| | "updated_at": "2026-08-19T08:47:07Z", |
| | "security_group_id": "f97ff2eb-7d90-440e-b07f-1161190d608e", |
| | "port_range_min": 1, |
| | "revision_number": 0, |
| | "tenant_id": "98ed819352ce481fb0c028e3d328ef5d", |
| | "created_at": "2026-08-19T08:47:07Z", |
| | "project_id": "98ed819352ce481fb0c028e3d328ef5d", |
| | "id": "eeaa8ae1-b083-45c7-b7e7-4c7948eea72b" |
| | } |
| | { |
| | "remote_group_id": null, |
| | "direction": "egress", |
| | "protocol": null, |
| | "description": null, |
| | "tags": [], |
| | "ethertype": "IPv6", |
| | "remote_ip_prefix": null, |
| | "port_range_max": null, |
| | "updated_at": "2026-08-19T08:46:03Z", |
| | "security_group_id": "f97ff2eb-7d90-440e-b07f-1161190d608e", |
| | "port_range_min": null, |
| | "revision_number": 0, |
| | "tenant_id": "98ed819352ce481fb0c028e3d328ef5d", |
| | "created_at": "2026-08-19T08:46:03Z", |
| | "project_id": "98ed819352ce481fb0c028e3d328ef5d", |
| | "id": "fc0295dd-5919-4ba2-afe7-a56943a905ef" |
| | } |
| | { |
| | "remote_group_id": null, |
| | "direction": "egress", |
| | "protocol": null, |
| | "description": null, |
| | "tags": [], |
| | "ethertype": "IPv4", |
| | "remote_ip_prefix": null, |
| | "port_range_max": null, |
| | "updated_at": "2026-08-19T08:46:03Z", |
| | "security_group_id": "f97ff2eb-7d90-440e-b07f-1161190d608e", |
| | "port_range_min": null, |
| | "revision_number": 0, |
| | "tenant_id": "98ed819352ce481fb0c028e3d328ef5d", |
| | "created_at": "2026-08-19T08:46:03Z", |
| | "project_id": "98ed819352ce481fb0c028e3d328ef5d", |
| | "id": "fdddf360-65df-4106-946a-89be685e52aa" |
| | } |
| tags | |
| tenant_id | 98ed819352ce481fb0c028e3d328ef5d |
| updated_at | 2026-08-20T02:17:05Z |
+----------------------+--------------------------------------------------------------------+#放行高可用软件的心跳流量
neutron security-group-rule-create \
--protocol 112 \
--ethertype IPv4 \
--direction ingress \
--remote-group-id f97ff2eb-7d90-440e-b07f-1161190d608e \
f97ff2eb-7d90-440e-b07f-1161190d608e参数说明：
--protocol 112：指定放行 VRRP 协议。--ethertype IPv4：限定为 IPv4。--direction ingress：限定为入站方向（通常是默认值，写上更严谨）。--remote-group-id f97...：对应openstack命令里的--remote-group，表示只允许来自该安全组的流量。最后的
f97...：表示将这条规则添加到这个目标安全组中。
评论