Operating System: All
Platform: All

I also added the br-ex bridge and added a port to it, while creating the networks the patch port was created as shown below :

[stack@localhost devstack]$ sudo ovs-vsctl show
e07e8ce9-4bf6-489b-8859-424d52981406
Manager "tcp:10.106.138.151:6640"
is_connected: true
Manager "ptcp:6641:127.0.0.1"
is_connected: true
Bridge br-int
Controller "tcp:10.106.138.151:6653"
is_connected: true
Controller "tcp:172.16.3.25:6653"
is_connected: true
fail_mode: secure
Port "tap4168d878-d1"
Interface "tap4168d878-d1"
Port br-int
Interface br-int
type: internal
Port "tap2e801cfe-b0"
Interface "tap2e801cfe-b0"
Port "tap22b9df7b-81"
Interface "tap22b9df7b-81"
Port br-ex-patch
Interface br-ex-patch
type: patch
options:

Bridge br-ex
Port br-ex-int-patch
Interface br-ex-int-patch
type: patch
options:

Port "ens35"
Interface "ens35"
Port br-ex
Interface br-ex
type: internal
ovs_version: "2.6.1"

Please find the attachment for the dump flows and the odl log details

Attachment 8557_Bug logs.zip has been added with description: log info

attached the dump flows

Attachment dump for snat and dnat.zip has been added with description: adding the dump flows

Hi Lakshmi,

Request to collect below required log/dump outputs for further analyze the issue.

(1)
The following logs needs to be set as TRACE before configuring NAT topology.

NAT TRACE Enable:
--------------------
log:set TRACE org.opendaylight.netvirt.neutronvpn
log:set TRACE org.opendaylight.netvirt.natservice.internal
log:set TRACE org.opendaylight.netvirt.fibmanager

(2)

Please capture the following outputs before and after NAT traffic.

OVS Dump flows and Groups:
-----------------------------
sudo ovs-ofctl dump-flows -O Openflow13 br-int
sudo ovs-ofctl dump-groups -O Openflow13 br-int
sudo ovs-ofctl dump-group-stats -O Openflow13 br-int
sudo ovs-vsctl list Open_vSwitch

(3)

Please collect the following REST API call output

http://localhost:8181/restconf/config/odl-nat:external-networks/
http://localhost:8080/restconf/config/odl-nat:ext-routers/
http://localhost:8181/restconf/config/odl-nat:floating-ip-port-info
http://localhost:8181/restconf/config/odl-nat:floating-ip-info/
http://localhost:8181/restconf/operational/odl-nat:floating-ip-info/
http://localhost:8181/restconf/config/odl-fib:fibEntries/
http://localhost:8181/restconf/operational/odl-l3vpn:vpn-instance-op-data/
http://localhost:8181/restconf/operational/odl-l3vpn:learnt-vpn-vip-to-port-data/

Thanks & Regards,
Karthikeyan.

attached the trace enabled logs and the dump flows

Attachment NAT_logs.zip has been added with description: adding the dump flows

Working on this issue.

Please refer the below code review for having fix for DNAT failure in Stable/Ocata

https://git.opendaylight.org/gerrit/#/c/58176/

Hi Swetha,

DNAT:
DNAT- FIP issue has been fixed in ODL-Master for Stable/Ocata. Please download the latest ODL-Master (Nitrogen) distribution build and try to validate the SNAT/DNAT traffic for “flat” network.

SNAT:
Without any code changes it was working fine for our local development setup. Once your external server connectivity is proper you can able to get the below REST API output for external “flat” network. As of now ODL CSIT with Stable/Ocata has some problem in the setup. Hence we are unable to run the CSIT job for SNAT/DNAT traffic.

Sample Output:
---------------
http://localhost:8181/restconf/operational/odl-l3vpn:learnt-vpn-vip-to-port-data

{
"learnt-vpn-vip-to-port-data": {
"learnt-vpn-vip-to-port": [

]
}
}

Latest ODL-Master Distribution:
----------------------------------
https://nexus.opendaylight.org/content/repositories/opendaylight.snapshot/org/opendaylight/integration/distribution-karaf/0.7.0-SNAPSHOT/distribution-karaf-0.7.0-20170606.040008-788.zip

Hi Swetha,

Still we are seeing problem with external-gateway IP (11.12.13.250) is not learnt by ARP. As a result in L3_FIB_TABLE (21) flow is missing to reach external gateway.

Example flow: (100.100.100.1 IP is external gateway in our tested topology)
cookie=0x8000003, duration=10.170s, table=21, n_packets=0, n_bytes=0, priority=42,ip,metadata=0x30d50/0xfffffe,nw_dst=100.100.100.1 actions=set_feld:0a:00:27:00:00:10->eth_dst,load:0x500->NXM_NX_REG6[],resubmit(,220)

We are not seeing any issue with SNAT flows as it was programming properly as expected (as per the shared logs)

cookie=0x8000004, duration=486.053s, table=21, n_packets=7, n_bytes=518, priority=10,ip,metadata=0x30d52/0xfffffe actions=goto_table:26
cookie=0x8000006, duration=485.881s, table=26, n_packets=7, n_bytes=518, priority=5,ip,metadata=0x30d52/0xfffffe actions=goto_table:46
cookie=0x81296a9, duration=48.438s, table=46, n_packets=6, n_bytes=444, idle_timeout=300, send_flow_rem priority=10,tcp,metadata=0x30d52/0xfffffe,nw_src=10.0.0.10,tp_src=39712 actions=set_field:11.12.13.9->ip_src,set_field:49152->tcp_src,set_field:fa:16:3e:34:b4:ac->eth_src,write_metadata:0x30d4e/0xffffff,goto_table:47
cookie=0x8000006, duration=485.968s, table=47, n_packets=6, n_bytes=444, priority=5,ip,metadata=0x30d4e/0xfffffe actions=load:0->NXM_OF_IN_PORT[],resubmit(,21)
(Since L3_FIB_TABLE(21) for external gateway flow is missing packets are getting dropped here)

To debug further, please do packet capture on interface “ens35” while performing external router-gw set (neutron router-gateway-set <ROUTER_NAME> <EXT_NET_NAME> --enable-snat) you should able to see ARP broadcast request and response from the external gateway. Please refer the below example snapshot for your reference.

Example Packet-Captured (100.100.100.106 is the external fixed IP used for SNAT and 100.100.100.1 is external gateway IP for tested our topology)

Also request to set the below few more modules log level as “TRACE” before doing SNAT configuration.

log:set TRACE org.opendaylight.netvirt.natservice.internal
log:set TRACE org.opendaylight.netvirt.neutronvpn
log:set TRACE org.opendaylight.netvirt.fibmanager
log:set TRACE org.opendaylight.netvirt.vpnmanager
log:set TRACE org.opendaylight.netvirt.elan

Kindly share the log information as you shared earlier after re-testing SNAT.

Attachment Example_ARP_Request_Response.jpg has been added with description: Example Packet-Captured for ARP Request and Response

Hi Swetha,

We do have CSIT job for SNAT/DNAT UC's running with openstack-Ocata in Carbon distribution.we are not seeing any issue in SNAT/DNAT traffic (TCP/UDP) is getting failed. Please refer the below link for your reference.

https://jenkins.opendaylight.org/releng/job/netvirt-csit-1node-openstack-ocata-upstream-learn-carbon/30/robot/report/log.html#s1-s1-s3

Thanks,
Karthikeyan.

We tested again, SNAT and DNAT is working, due to some network issues the external flows were not learnt by ARP.