Integration of OpenDaylight (ODL) with OpenStack to manage OpenVSwitch (OVS)

neutron-openvswitch-agent

OpenStack basically uses its own neutron layer-2 agent plugin to manage network in clouds. "neutron-openvswitch-agent" is the most common L2 agent which creates an OpenVSwitch (OpenFlow-compatible software switch provided in Linux) on each compute node. When a new instance is created, nova communicates with neutron for network configuration, such as assigning IP address, adding a bridge, creating network tunnel, etc. Neutron-server on the controller node then communicates with neutron-openvswitch-agent on the compute node where the VM will be hosted to actually create a new port and tunnel for the VM.

In order to set up openvswitch-agent as L2 driver, the following configuration should be done in neutron.

1. Controller/Network node

Install:

# yum install openstack-neutron openstack-neutron-openvswitch

/etc/neutron/neutron.conf:

...
[DEFAULT]
core_plugin=neutron.plugins.ml2.plugin.Ml2Plugin

/etc/neutron/plugins/ml2/ml2_conf.ini:

...
[ml2]
mechanism_drivers =openvswitch

/etc/neutron/plugins/ml2/openvswitch.ini

tunnel_bridge = br-tun
local_ip = [LOCAL_IP]
bridge_mappings =extnet:br-ex  #br-ex interface should set up manually for external connection

Of course, there are much more configuration in addition to the above settings. In this article, we only care of the difference between OVS and ODL. For more details on how to setup neutron-openvswitch, check out OpenStack guides.

2. Compute node

Install openvswitch-agent:

# yum install openstack-neutron-openvswitch

/etc/neutron/plugins/ml2/openvswitch.ini

tunnel_bridge = br-tun
local_ip = [LOCAL_IP]

After all, both controller and compute nodes should have openvswitch-agent which communicates with the controller's neutron server.

OpenDaylight + OpenStack

Although OpenStack's default openvswitch plugin provides extensive functionality, it does not provide the full SDN functionality that can be brought by OpenFlow switches that connects physical hosts. As this L2 driver can only communicate with OVS in hypervisors, not with switches, it's not possible to manage the network. Also, those OVS in each compute node actually communicates only with its own local SDN controller (neutron-openvswitch-agent running on each node), OVS's are not managed globally by a central controller. Instead, neutron-server in the controller is in charge of managing every neutron-openvswitch-agent in each node which controls the local OVS.

If you want to empower your cloud with full SDN functionality, it's good idea to consider using a separate SDN controller to manage the whole network. OpenDaylight (ODL) is one of popular SDN controller and working closely with OpenStack for integration of ODL with OpenStack.

ODL can be running with OpenStack side by side. In contrast to openvswitch-agent where OVS in compute nodes is connected to the local agent, OVS are all connected to the ODL remotely. In this mode, ODL is functioning as L2 agent, thus the central ODL controller manages all OVS in every compute node. Since OVS is directly connected to ODL, neutron-openvswitch-agent is not necessary any more on all nodes.

In order to use ODL along with OpenStack, a specific L2 driver is necessary to allow OpenStack to communicate with ODL's NorthBound API. ODL and OpenStack team has made 'networking-odl' module in this purpose.

More detailed install instruction can be found in ODL site and OpenStack site.

1. Controller/network node

Uninstall:
   # yum uninstall openstack-neutron-openvswitch

Install:
   # yum install python-networking-odl

/etc/neutron/neutron.conf
   service_plugins = odl-router

/etc/neutron/plugins/ml2/ml2_conf.ini
   tenant_network_types=vxlan
   mechanism_drivers = opendaylight
   port_binding_controller = network-topology

Running agents:

• neutron-dhcp-agent
• neutron-metadata-agent
• neutron-metering-agent

<Note 1>
opendaylight_v2 and odl-route_v2 can be used alternatively, which are for experimental development. For experimental usage, v2 is a good option as all new features are included. For stable usage, v1 is more recommended as you won't find more errors. Remind that these versions should be in pair, e.g. opendaylight_v2 cannot be used with odl-router.

<Note 2>
port_binding_controller setting is to determine how to get host configuration for binding a port. "network-topology" or "pseudo-agentdb-binding" can be used. The former is to use network topology which does not need an extra configuration. The latter is using OVS that contains 'hostconfigs', but it should be set up with "neutron-odl-ovs-hostconfig" command. It's by default "pseudo-agentdb-binding", but you will get error messages like these:

No valid hostconfigs in agentsdb for host
ERROR networking_odl.ml2.pseudo_agentdb_binding KeyError: 'hostconfig'
WARNING networking_odl.ml2.pseudo_agentdb_binding [-] ODL hostconfigs REST/GET failed, will retry on next poll

If so, set up a proper hostconfigs using 'neutron-odl-ovs-hostconfig' or change the 'port_binding_controller' setting.

<Note 3>
Neutron's L3-agent can be replaced by ODL. In such case, disable neutron-l3-agent and enable ODL's L3Fwd feature by changing "ovsdb.l3.fwd.enabled=yes" in ...karaf/etc/custom.properties file.

<Note 4>
In order to install networking-odl, I recommend to use yum instead of pip, as pip can mess up all Python dependencies that creates conflicts with OpenStack. Although the instruction guide recommends pip, it's good to consider yum especially if your other OpenStack components are installed by yum or PackStack. As PackStack uses yum, there will not be any dependency issue.


2. Compute node

Uninstall:

# yum uninstall openstack-neutron-openvswitch

Configuration:

# ovs-vsctl set-manager tcp:${CONTROL_HOST}:6640

Useful commands:

systemctl stop neutron-server
systemctl stop neutron-openvswitch-agent
systemctl stop openvswitch

Some tips...

1. ODL(karaf) and networking-odl module is necessary only on controller node. On compute nodes, just change the management server of OVS to indicate ODL.2. 
2. Don't confuse between openvswitch (OVS) and neutron-openvswitch-agent. OVS is a virtual switch provided by Linux kernel that mimics OpenFlow switch. 'neutron'-openvswitch-agent is the agent software used by OpenStack neutron in order to manage OVS in compute nodes.
3. ODL karaf can be run as daemon. Search 'karaf daemon' for instructions.
4. As mentioned above, those configurations explained above is a partial instruction missing a lot of information. Please refer to the full instruction guides to install ODL, setting up networking-odl,

L2TP / IPSec setup guide for CentOS 7

Reference: http://blog.earth-works.com/2013/02/22/how-to-set-up-openswan-l2tp-vpn-server-on-centos-6/

OpenVPN is easy to set up, but needs an extra program installation on client side. On the other hand, L2TP /IPSec is implemented in most operating systems such as Windows 7/8/10, MacOS, several Linux distributions, Android, iOS, and so on, so that we can connect to L2TP/IPSec VPN out-of-the-box with most operating systems.

In this article, we explained how to install L2TP/IPSec server on CentOS 7 Linux distribution.

1. Install epel repository for extra features in CentOS. This is necessary for l2tpd installation.

# sudo yum -y install epel-release

2. Install necessary packages.

# yum install lsof man openswan xl2tpd

3. Design the network and think of the range of IP addresses. In this article, we use the following IP address ranges. Please note that we configure the VPN as the part of the current LAN network of the VPN server, thus VPN-connected clients will join the LAN network.

[Physical settings that already configured]

• 192.168.0.0 / 24 : Physical network of LAN that resides VPN server
• 192.168.0.1 : Physical IP address of VPN server. (Already set up)

[VPN networks using for VPN setting]

• 192.168.0.201 : Local IP used by VPN server for L2TP tunnel. You can choose IP in the LAN network range.
• 192.168.0.202-250 : Local IP range for VPN-connected clients.

4. Allow IP forwarding for NAT in /etc/sysctl.conf

# Controls IP packet forwarding
net.ipv4.ip_forward = 1

5. Reload sysctl to make the config effective

sysctl -p

7. /etc/rc.local

for each in /proc/sys/net/ipv4/conf/*; do
        echo 0 &gt; $each/accept_redirects
        echo 0 &gt; $each/send_redirects
        echo 0 &gt; $each/rp_filter
done

8. /etc/ipsec.conf

# /etc/ipsec.conf - Openswan IPsec configuration file
#
# Manual:     ipsec.conf.5
#
# Please place your own config files in /etc/ipsec.d/ ending in .conf
version       2.0    # conforms to second version of ipsec.conf specification
# basic configuration
config setup
       protostack=netkey
       plutostderrlog=/var/log/pluto.log
       interfaces="%defaultroute"
       plutodebug=none
       virtual_private=%v4:192.168.0.0/24
       nat_traversal=yes
conn L2TP-PSK
       authby=secret
       pfs=no
       auto=add
       keyingtries=3
       type=transport
       left="%defaultroute"
       leftprotoport=17/1701
       right=%any
       rightprotoport=17/0
       # Apple iOS doesn't send delete notify so we need dead peer detection
       # to detect vanishing clients
       dpddelay=10
       dpdtimeout=90
       dpdaction=clear
#You may put your configuration (.conf) file in the "/etc/ipsec.d/" and uncomment this.
#include /etc/ipsec.d/*.conf

9. Generate a key file to /etc/ipsec.secrets

ipsec newhostkey --output /etc/ipsec.secrets --verbose --configdir /etc/pki/nssdb/

10. Add the PSK key (shared between clients/server) at the end of /etc/ipsec.secrets

192.168.0.1      %any:     PSK     "yourPSKHere"

11. /etc/xl2tpd/xl2tpd.conf

[global]
listen-addr = 192.168.0.1
;
; requires openswan-2.5.18 or higher - Also does not yet work in combination
; with kernel mode l2tp as present in linux 2.6.23+
; ipsec saref = yes
; Use refinfo of 22 if using an SAref kernel patch based on openswan 2.6.35 or
;  when using any of the SAref kernel patches for kernels up to 2.6.35.
; ipsec refinfo = 30
;
; works around bug: http://bugs.centos.org/view.php?id=5832
force userspace = yes

;
[lns default]
ip range = 192.168.0.202-192.168.0.250
local ip = 192.168.0.201
; leave chap unspecified for maximum compatibility with windows, iOS, etc
; require chap = yes
refuse pap = yes
require authentication = yes
name = CentOSVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

12. Update DNS server (ms-dns) on /etc/ppp/options.xl2tpd

ms-dns 8.8.8.8

13. Add ID/PW of users at /etc/ppp/chap-secrets

# client        server  secret                  IP addresses
user1           *       sgrongPassword1         *
user2           *       strongPassword2         *

13-1. Alternatively, use Linux's ID/PW for login. Follow the instructions on this article:
https://raymii.org/s/tutorials/IPSEC_L2TP_vpn_on_CentOS_-_Red_Hat_Enterprise_Linux_or_Scientific_-_Linux_6.html#Local_user_(PAM//etc/passwd)_authentication

14. Setup iptables

#Allow ipsec traffic
iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT
iptables -A FORWARD -m policy --dir in --pol ipsec -j ACCEPT
#Do not NAT VPN traffic
iptables -t nat -A POSTROUTING -m policy --dir out --pol none -j MASQUERADE
#Forwarding rules for VPN
iptables -A FORWARD -i ppp+ -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#Ports for Openswan / xl2tpd
iptables -A INPUT -m policy --dir in --pol ipsec -p udp --dport 1701 -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
#Save your configuration
iptables save

15. Enable and start services

systemctl enable ipsec
systemctl start ipsed
systemctl enable xl2tpd
systemctl start xl2tpd

16. Configure clients (Windows/Mac/Linux/etc..)

• Type of VPN: L2TP/IPSec
• L2TP Security: choose pre-shared key for authentication. Put the PSK ("yourPSKHere") configured in Step 10.
• ID/PW: ones set up in Step 13

Samsung Galaxy S7 Duos (SM-G930FD) dual sim 4g + 3g mode

Galaxy S7 and S7 Edge have their dual sim models, so called S7 (Edge) Duos, selling in a few countries. If you got one of them with the model number SM-G930FD / SM-G935FD, your S7 is capable to connect to two separate networks at the same time. There are two card slots in the sim tray where two different nano sized sim cards can be placed.

However, for some S7 Duos models (especially selling in India or Middle East), 4g+3g dual mode is not working and forced to change to 4g+2g mode only. While the main sim card can connect to 4g or 3g network with data enabled, the sub sim card can connect to 2g only and not allowed to switch to 3g.

This is because Samsung banned the 2nd sim to connect to 3g network, as 3g was regarded as a data network which would conflict with the main sim's 4g (or 3g) data network connection. However, in these days many countries use 3g network as their main connection carrying not only data but also voice and SMS text messages. For those countries and carriers where 2g network (GSM, GPRS or EDGE) is not available, this can be troublesome as the 2nd sim card can connect to 3g network, which makes the dual sim functionality useless.

If your S7 Duos is not able to turn the 2nd sim to 3g mode and only working in 4g+2g mode, it can be fixed by updating the firmware to different country. As far as I tested, the recent G930FD firmware for Thailand works perfectly without any issue on 4g+3g dual mode. You might want to update your firmware to the latest version and test 4g+3g mode again before changing the firmware, because the issue is sometimes fixed on the latest version.

Be aware that this method needs factory reset and changing CSC code (country and carrier code) of the firmware. If your current CSC code is in multi-CSC and not a default CSC code in the multi-CSC, it will be difficult to return the CSC code back to your original one after changing CSC.

Changing S7's firmware to one of Samsung's official one using ODIN is simple and not tripping Knox. If you want to change the firmware back to the original, it is always possible to return like as it was, except for the case that your original CSC is in multi-CSC.

You can use ODIN to wipe your firmware to another version. Follow the simple steps.
1) Download the latest ODIN program and Samsung USB driver package, and install them on your Windows computer.
2) Download the latest Thailand firmware of S7 Duos (SM-G930FD / G935FD) from SamMobile.com or SamFirm application.
3) Back up all the data in your mobile
4) Turn off the mobile, and turn on again by pushing VolDown + Home + Power key simultaneously.
5) Phone is booted in Downloading mode, press VolUp key to enter the downloading ready mode.
6) Open ODIN, put the downloaded firmware into the ODIN (BL+AP+CP+CSC). Make sure the CSC selection is the CSC file without HOME_ prefix. FYI, HOME_CSC is used only for updating from the same firmware variant which will not need delete all the data.
7) Connect S7 to the computer with USB cable. Connection is detected in ODIN.
8) Start download. Do not change any options in ODIN (only Auto Reboot, F.Reset Time checked, all others unchecked).
9) Once the firmware is downloaded, the phone will be reset and takes a while to boot up.
10) (IMPOTANT!!) An extra factory reset is necessary to make sure your CSC is changed to THL (Thailand version) before using your mobile. Once the phone is booted up and showing the welcome message, just turn it off again, and turn on by pressing VolUP + Home + Power key for a while booting in Recovery Mode. On the Recovery menu, select 'wipe data/factory reset' and 'wipe cache partition', then reboot again.
11) Now, your S7 is entirely in Thailand firmware, which means 4g+3g dual mode is working perfectly.

More details can be found on internet. There are so many guides online explaining how to update S7 firmware using ODIN. Search for S7 ODIN .

Note that 4g+3g dual mode is working only on Thailand firmware with THL CSC, even after 7.0 update. If your CSC is not THL, 4g+3g is not working correctly no matter what your firmware is. This is confirmed as of February 2017, and I wish Samsung will notice and patch it across all regions soon.

On Linux, difference between network commands, like "ip route show" vs "route"

Apparently, Linux tool "route" performs very similar role with the "ip route" command. They both can show and manipulate a routing table of Linux. So, what is difference?

Simple answer is; "ip" command replaces the old "route" command. "ip" is a command line tool in "iproute2" suite which substitutes "net-tools" package. "iproute2" suit integrates more functionality and a single interface through "ip" command.

Thus, if you can do something with route command, you can do exactly same thing with ip command.

More details of one-to-one match between old and new command can be found on this article: https://dougvitale.wordpress.com/2011/12/21/deprecated-linux-networking-commands-and-their-replacements/

WiFi 802.11ac/n/g speed in theory and practice

When you are looking for a new fancy WiFi router, you can see a lot of bloated numbers in their model name. There are several technologies specified in IEEE 802.11, such as a, g, b, n, ac (the latter, the newer).

WiFi manufacturer put those alphabets to the model name to make customer easy to recognize up to which technology it supports, and most times put a number after that, such as N600, AC1300, AC1600, etc., to indicate what their maximum speed is.

Customers, like me, easily believe that N600, for example, would support 600 Mbps max speed for a connection between one device and the router theoretically. You probably have heard that this 600 Mbps is not a realistic, but still theoretically possible.

Wrong.

This number does not provide much information about the speed of 'a single connection'. It rather gives theoretical maximum speed that the router can support for 'all connections'.

For example, the maximum speed of a single connection in WD MyNet N600 is 300Mbps, not 600Mbps. They used N600 in the model name because the device can support up to 300 Mbps for 2.4Ghz and 5Ghz respectively. The maximum speed (more like throughput) of the router, 600Mbps, can be achieved when two devices are connected at 300Mbps on 2.4Ghz and 5Ghz respectively.

This is tricky and hard to be aware for a non-professionals, as many people would just believe that AC1900 would perform much better than N300 with their MacBook Air or Nexus 5.

In addition to the WiFi technology, like AC or N, there is another crucial part that determines the maximum WiFi speed of a device: the number of radios.

For the older 802.11 technologies, such as a/b/g, a device can only use a single radio. Therefore, the maximum speed was fixed to 54Mbps in 802.11g for example.

On the other hand, newer technologies including n and ac employ MIMO concept which can utilize multiple radios to achieve higher speed. (Note that this is a different concept from dual-band support like 2.4Ghz and 5Ghz). Only when both of your mobile device and WiFi router are equipped with multiple radios, you can get a higher speed. It totally depends on how many radios your mobile device is equipped with.

For example, if you connect your Nexus 5X (2x2 MIMO support) to a N600 (300 for 2.4GHz plus 300 for 5GHz, 2x2 antenna) router with 802.11n 5Ghz, the maximum speed can be up to 300 Mbps. However, if you connect the old Nexus 5 (no MIMO) to the same router, the maximum speed is only 150 Mbps, because 150 Mbps is the max speed at 1x1 radio of the Nexus 5. Nexus 5 supports 802.11ac though. If the Nexus 5 is connected to AC1300 router, for example, it can have at most 433 Mbps (Max speed of 802.11ac with 1x1 radio).

The table below shows the maximum speed of 802.11 standards at different radio settings.

Radio configuration	1x1	2x2	3x3
802.11ac 5GHz	433	866	1300
802.11n 5GHz	150	300	450
802.11n 2.4GHz	72	144

Also, the radio configuration of a few well-known devices are presented.

Device	Support mode	Radio conf	Max speed (ac)
Nexus 5	n, ac	1x1	433
iPad Air, iPhone 6	n, ac	2x2	866
Macbook Air	n, ac	2x2	866
Nexus 5X	n, ac	2x2	866

At last, I should emphasize again that all these speeds are theoretical. In practice, it's not rare that 144Mbps speed at Macbook Air (connected with 802.11n, 2.4Ghz) is far quicker than 300Mbps-connected Nexus 5X. This is because laptops usually embed a big antenna compared to the smaller mobile devices. Also, laptops can have higher power range at WiFi chip-set which performs better.

For your information, this is a bench-marked network speed in reality. All devices are connected to N600 router which supports only 802.11n up to 300Mbps (2x2 config).

Band	2.4 (144/72)	5 (300/150)
Macbook Air (2x2)	103	113
iPad (2x2)	78	110
Nexus5 (1x1)	45	99

Although theoretical max-speed of Macbook and iPad, 300Mbps, is twice as the Nexus 5's max speed (150Mbps), the actual speed is almost same across all the three devices.

Battery capacity comparison from MacBook to Xiaomi Powerbank to Eneloop.

All portable devices need a battery for their power source. We learned basic electric units such as Watts, Ampere, Voltage, Watts-Hour, etc. However, when the device specification listed 2700mAh, or 54Wh battery, we get somewhat confused what it literally means. Here I want to compare those different units and the actual capacity of the batteries.

First of all, there are two different units the manufacturers use to describe the battery capacity: Watts and Amperes. You remember the equation to calculate Watts from Ampere.

Watts (W) = Ampere (A) * Voltage (V)

Apple uses Watts, instead of Ampere, to describe their charger capacity instead of Ampere. For example, Apple's 12W iPad charger is equivalent to 2.4A adapter, as the output of this charger is 5V (standard USB voltage). Similarly 5W iPhone charger outputs 1A at maximum. This is why you can't use iPhone charger for iPad as the output currents is too low for iPad, while you can use iPad charger to charge iPhones.

Similarly Watts-hours can be calculated with Ampere-hours because the voltage is constant regardless of time for the device.

Watt-hours (Wh) = Ampere-hours (Ah) * Voltage (V)

Most mobile devices nowadays use lithium-ion battery. A single cell of the lithium-ion battery has around 3.7 Volts, which is applicable to the most mobile phones and tablets. Therefore, iPhone 6s' 1715 mAh battery is equivalent to 6.35 Wh. We can use Wh or mAh interchangeably for the most case if the device is equipped with 3.7V single cell (or multi-cell with parallel connectivity) battery.

However, laptops needs more power than other portable devices to run the many integrated functions, which is the reason why MacBook Air's battery has higher voltage: 7.4V. This is actually equivalent to the dual cell lithium ion battery in serial connection. Therefore, 54 Wh MacBook Air battery's Ampere-hour is 7300 mAh, not 14,600 mAh.

The attached 'hours' in these unit mean that it can constantly provide such amount of Watts or Amperes for one hour. For example, 54 Wh means the battery can provide 54 Watts power for an hour. If the device consumes only 5.4 Watts, this device can survive for 10 hours with the 54 Wh battery. Power adapter does not use these 'hours' units, as they can supply unlimited power, whereas batteries can provide only for a certain amount of hours.

MacBook Air 13": 54 Wh = 7.4 V * 7,300 mAh
MacBook Pro 13": 74.9 Wh = 7.4 V * 10,120 mAh

iPhone 6s: 1,715 mAh * 3.7V = 6.35 Wh
iPhone 6s Plus: 2,750 mAh * 3.7V = 10.18 Wh
Nexus 5X: 2,700 mAh * 3.7V = 9.99 Wh
Nexus 6P: 3,450 mAh * 3.7V = 12,77 Wh
iPad Air 2: 7,340 mAh * 3.7V = 27.16 Wh
Xiaomi Powerbank 16000mAh: 16,000mAh * 3.7V = 59.2 Wh

Eneloop AA (NiMH): 2000mAh * 1.2V = 2.4 Wh

Note that Xiaomi's 16000 mAh powerbank specifies 16000 mAh capacity based on the battery cell, not the output level. Its output Volt is 5V, not 3.7V, thus it has 11840 mAh output capacity.

CAUTION! Think twice before joining GreenShareCar!

If you are looking for a car share membership, you have to consider again before joining GreenShareCar membership.

On their homepage they advertise that there is no joining fee. That is "literally" true, but not really. When you join the membership, you do not have to pay any fee for joining. Thus there is no joining fee. However, they will charge you "Termination of Membership / Plan" fee no matter how often or how long you have used their cars.

Be aware that you will be charged $55 when you quit the membership, no exceptions. Everyone should pay $55 to terminate this membership!

This crucially important information, however, cannot be found anywhere on their website. You can find it only in their Membership User Agreement PDF file, on the last page, as the last element in the fee/charge table.

If you do not want to pay for $55 termination fee, do not go for this company!