vtep (5) Linux Manual Page

vtep – hardware_vtep database schema

This schema specifies relations that a VTEP can use to integrate physical ports into logical switches maintained by a network virtualization controller such as NSX46

Glossary:

VTEP

VXLAN Tunnel End Point, an entity which originates and/or terminates VXLAN tunnels46

HSC

Hardware Switch Controller46

NVC

Network Virtualization Controller, e46g46 NSX46

VRF

Virtual Routing and Forwarding instance46

Table Summary

The following list summarizes the purpose of each of the tables in the hardware_vtep database. Each table is described in more detail on a later page.

Table

Purpose

Global

Top-level configuration46

Manager

OVSDB management connection46

Physical_Switch

A physical switch46

Tunnel

A tunnel created by a physical switch46

Physical_Port

A port within a physical switch46

Logical_Binding_Stats

Statistics for a VLAN on a physical port bound to a logical network46

Logical_Switch

A layer-2 domain46

Ucast_Macs_Local

Unicast MACs (local)

Ucast_Macs_Remote

Unicast MACs (remote)

Mcast_Macs_Local

Multicast MACs (local)

Mcast_Macs_Remote

Multicast MACs (remote)

Logical_Router

A logical L3 router46

Arp_Sources_Local

ARP source addresses for logical routers

Arp_Sources_Remote

ARP source addresses for logical routers

Physical_Locator_Set

Physical_Locator_Set configuration46

Physical_Locator

Physical_Locator configuration46

ACL_entry

ACL_entry configuration46

ACL

ACL configuration46

Global TABLE

Top-level configuration for a hardware VTEP46 There must be exactly one record in the Global table46

Summary:

switches

set of Physical_Switchs

Database Configuration:

managers

set of Managers

Details:

switches: set of Physical_Switchs

The physical switch or switches managed by the VTEP46

When a physical switch integrates support for this VTEP schema, which is expected to be the most common case, this column should point to one Physical_Switch record that represents the switch itself46 In another possible implementation, a server or a VM presents a VTEP schema front-end interface to one or more physical switches, presumably communicating with those physical switches over a proprietary protocol46 In that case, this column would point to one Physical_Switch for each physical switch, and the set might change over time as the front-end server comes to represent a differing set of switches46

Database Configuration: These columns primarily configure the database server (ovsdb-server), not the hardware VTEP itself46

managers: set of Managers

Database clients to which the database server should connect or to which it should listen, along with options for how these connection should be configured46 See the Manager table for more information46

Manager TABLE

Configuration for a database connection to an Open vSwitch Database (OVSDB) client46

The database server can initiate and maintain active connections to remote clients46 It can also listen for database connections46

Summary:

Core Features:

target

string (must be unique within table)

Client Failure Detection and Handling:

max_backoff

optional integer, at least 1,000

inactivity_probe

optional integer

Status:

is_connected

boolean

status : last_error

optional string

status : state

optional string, one of ACTIVE, VOID, CONNECTING, IDLE, or BACKOFF

status : sec_since_connect

optional string, containing an integer, at least 0

status : sec_since_disconnect

optional string, containing an integer, at least 0

status : locks_held

optional string

status : locks_waiting

optional string

status : locks_lost

optional string

status : n_connections

optional string, containing an integer, at least 2

Connection Parameters:

other_config : dscp

optional string, containing an integer

Details:

Core Features:

target: string (must be unique within table)

Connection method for managers46

The following connection methods are currently supported:

ssl:ip[:port]

The specified SSL port (default: 6640) on the host at the given ip, which must be expressed as an IP address (not a DNS name)46

SSL key and certificate configuration happens outside the database46

tcp:ip[:port]

The specified TCP port (default: 6640) on the host at the given ip, which must be expressed as an IP address (not a DNS name)46

pssl:[port][:ip]

Listens for SSL connections on the specified TCP port (default: 6640)46 If ip, which must be expressed as an IP address (not a DNS name), is specified, then connections are restricted to the specified local IP address46

ptcp:[port][:ip]

Listens for connections on the specified TCP port (default: 6640)46 If ip, which must be expressed as an IP address (not a DNS name), is specified, then connections are restricted to the specified local IP address46

Client Failure Detection and Handling:

max_backoff: optional integer, at least 1,000

Maximum number of milliseconds to wait between connection attempts46 Default is implementation-specific46

inactivity_probe: optional integer

Maximum number of milliseconds of idle time on connection to the client before sending an inactivity probe message46 If the Open vSwitch database does not communicate with the client for the specified number of seconds, it will send a probe46 If a response is not received for the same additional amount of time, the database server assumes the connection has been broken and attempts to reconnect46 Default is implementation-specific46 A value of 0 disables inactivity probes46

Status:

is_connected: boolean

true if currently connected to this manager, false otherwise46

status : last_error: optional string

A human-readable description of the last error on the connection to the manager; i46e46 strerror(errno)46 This key will exist only if an error has occurred46

status : state: optional string, one of ACTIVE, VOID, CONNECTING, IDLE, or BACKOFF

The state of the connection to the manager:

VOID

Connection is disabled46

BACKOFF

Attempting to reconnect at an increasing period46

CONNECTING

Attempting to connect46

ACTIVE

Connected, remote host responsive46

IDLE

Connection is idle46 Waiting for response to keep-alive46

These values may change in the future46 They are provided only for human consumption46

status : sec_since_connect: optional string, containing an integer, at least 0

The amount of time since this manager last successfully connected to the database (in seconds)46 Value is empty if manager has never successfully connected46

status : sec_since_disconnect: optional string, containing an integer, at least 0

The amount of time since this manager last disconnected from the database (in seconds)46 Value is empty if manager has never disconnected46

status : locks_held: optional string

Space-separated list of the names of OVSDB locks that the connection holds46 Omitted if the connection does not hold any locks46

status : locks_waiting: optional string

Space-separated list of the names of OVSDB locks that the connection is currently waiting to acquire46 Omitted if the connection is not waiting for any locks46

status : locks_lost: optional string

Space-separated list of the names of OVSDB locks that the connection has had stolen by another OVSDB client46 Omitted if no locks have been stolen from this connection46

status : n_connections: optional string, containing an integer, at least 2

When target specifies a connection method that listens for inbound connections (e46g46 ptcp: or pssl:) and more than one connection is actually active, the value is the number of active connections46 Otherwise, this key-value pair is omitted46

When multiple connections are active, status columns and key-value pairs (other than this one) report the status of one arbitrarily chosen connection46

Connection Parameters: Additional configuration for a connection between the manager and the database server46

other_config : dscp: optional string, containing an integer

The Differentiated Service Code Point (DSCP) is specified using 6 bits in the Type of Service (TOS) field in the IP header46 DSCP provides a mechanism to classify the network traffic and provide Quality of Service (QoS) on IP networks46 The DSCP value specified here is used when establishing the connection between the manager and the database server46 If no value is specified, a default value of 48 is chosen46 Valid DSCP values must be in the range 0 to 6346

Physical_Switch TABLE

A physical switch that implements a VTEP46

Summary:

ports

set of Physical_Ports

tunnels

set of Tunnels

Network Status:

management_ips

set of strings

tunnel_ips

set of strings

Identification:

name

string (must be unique within table)

description

string

Error Notification:

switch_fault_status : mac_table_exhaustion

none

switch_fault_status : tunnel_exhaustion

none

switch_fault_status : unspecified_fault

none

Details:

ports: set of Physical_Ports

The physical ports within the switch46

tunnels: set of Tunnels

Tunnels created by this switch as instructed by the NVC46

Network Status:

management_ips: set of strings

IPv4 or IPv6 addresses at which the switch may be contacted for management purposes46

tunnel_ips: set of strings

IPv4 or IPv6 addresses on which the switch may originate or terminate tunnels46

This column is intended to allow a Manager to determine the Physical_Switch that terminates the tunnel represented by a Physical_Locator46

Identification:

name: string (must be unique within table)

Symbolic name for the switch, such as its hostname46

description: string

An extended description for the switch, such as its switch login banner46

Error Notification: An entry in this column indicates to the NVC that this switch has encountered a fault46 The switch must clear this column when the fault has been cleared46

switch_fault_status : mac_table_exhaustion: none

Indicates that the switch has been unable to process MAC entries requested by the NVC due to lack of table resources46

switch_fault_status : tunnel_exhaustion: none

Indicates that the switch has been unable to create tunnels requested by the NVC due to lack of resources46

switch_fault_status : unspecified_fault: none

Indicates that an error has occurred in the switch but that no more specific information is available46

Tunnel TABLE

A tunnel created by a Physical_Switch46

Summary:

local Physical_Locator

remote Physical_Locator

Bidirectional Forwarding Detection (BFD):

BFD Local Configuration:

bfd_config_local : bfd_dst_mac

optional string

bfd_config_local : bfd_dst_ip

optional string

BFD Remote Configuration:

bfd_config_remote : bfd_dst_mac

optional string

bfd_config_remote : bfd_dst_ip

optional string

BFD Parameters:

bfd_params : enable

optional string, either true or false

bfd_params : min_rx

optional string, containing an integer, at least 1

bfd_params : min_tx

optional string, containing an integer, at least 1

bfd_params : decay_min_rx

optional string, containing an integer

bfd_params : forwarding_if_rx

optional string, either true or false

bfd_params : cpath_down

optional string, either true or false

bfd_params : check_tnl_key

optional string, either true or false

BFD Status:

bfd_status : enabled

optional string, either true or false

bfd_status : state

optional string, one of down, init, up, or admin_down

bfd_status : forwarding

optional string, either true or false

bfd_status : diagnostic

optional string

bfd_status : remote_state

optional string, one of down, init, up, or admin_down

bfd_status : remote_diagnostic

optional string

bfd_status : info

optional string

Details:

local: Physical_Locator

Tunnel end-point local to the physical switch46

remote: Physical_Locator

Tunnel end-point remote to the physical switch46

Bidirectional Forwarding Detection (BFD): BFD, defined in RFC 5880, allows point to point detection of connectivity failures by occasional transmission of BFD control messages46 VTEPs are expected to implement BFD46

BFD operates by regularly transmitting BFD control messages at a rate negotiated independently in each direction46 Each endpoint specifies the rate at which it expects to receive control messages, and the rate at which it’s willing to transmit them46 An endpoint which fails to receive BFD control messages for a period of three times the expected reception rate will signal a connectivity fault46 In the case of a unidirectional connectivity issue, the system not receiving BFD control messages will signal the problem to its peer in the messages it transmits46

A hardware VTEP is expected to use BFD to determine reachability of devices at the end of the tunnels with which it exchanges data46 This can enable the VTEP to choose a functioning service node among a set of service nodes providing high availability46 It also enables the NVC to report the health status of tunnels46

In many cases the BFD peer of a hardware VTEP will be an Open vSwitch instance46 The Open vSwitch implementation of BFD aims to comply faithfully with the requirements put forth in RFC 588046 Open vSwitch does not implement the optional Authentication or “Echo Mode” features46

BFD Local Configuration: The HSC writes the key-value pairs in the bfd_config_local column to specify the local configurations to be used for BFD sessions on this tunnel46

bfd_config_local : bfd_dst_mac: optional string

Set to an Ethernet address in the form xx:xx:xx:xx:xx:xx to set the MAC expected as destination for received BFD packets46 The default is 00:23:20:00:00:0146

bfd_config_local : bfd_dst_ip: optional string

Set to an IPv4 address to set the IP address that is expected as destination for received BFD packets46 The default is 1694625446146046

BFD Remote Configuration: The bfd_config_remote column is the remote counterpart of the bfd_config_local column46 The NVC writes the key-value pairs in this column46

bfd_config_remote : bfd_dst_mac: optional string

Set to an Ethernet address in the form xx:xx:xx:xx:xx:xx to set the destination MAC to be used for transmitted BFD packets46 The default is 00:23:20:00:00:0146

bfd_config_remote : bfd_dst_ip: optional string

Set to an IPv4 address to set the IP address used as destination for transmitted BFD packets46 The default is 1694625446146146

BFD Parameters: The NVC sets up key-value pairs in the bfd_params column to enable and configure BFD46

bfd_params : enable: optional string, either true or false

True to enable BFD on this Tunnel46 If not specified, BFD will not be enabled by default46

bfd_params : min_rx: optional string, containing an integer, at least 1

The shortest interval, in milliseconds, at which this BFD session offers to receive BFD control messages46 The remote endpoint may choose to send messages at a slower rate46 Defaults to 100046

bfd_params : min_tx: optional string, containing an integer, at least 1

The shortest interval, in milliseconds, at which this BFD session is willing to transmit BFD control messages46 Messages will actually be transmitted at a slower rate if the remote endpoint is not willing to receive as quickly as specified46 Defaults to 10046

bfd_params : decay_min_rx: optional string, containing an integer

An alternate receive interval, in milliseconds, that must be greater than or equal to bfd_params:min_rx46 The implementation should switch from bfd_params:min_rx to bfd_params:decay_min_rx when there is no obvious incoming data traffic at the tunnel, to reduce the CPU and bandwidth cost of monitoring an idle tunnel46 This feature may be disabled by setting a value of 046 This feature is reset whenever bfd_params:decay_min_rx or bfd_params:min_rx changes46

bfd_params : forwarding_if_rx: optional string, either true or false

When true, traffic received on the Tunnel is used to indicate the capability of packet I/O46 BFD control packets are still transmitted and received46 At least one BFD control packet must be received every 100 * bfd_params:min_rx amount of time46 Otherwise, even if traffic is received, the bfd_params:forwarding will be false46

bfd_params : cpath_down: optional string, either true or false

Set to true to notify the remote endpoint that traffic should not be forwarded to this system for some reason other than a connectivity failure on the interface being monitored46 The typical underlying reason is “concatenated path down,” that is, that connectivity beyond the local system is down46 Defaults to false46

bfd_params : check_tnl_key: optional string, either true or false

Set to true to make BFD accept only control messages with a tunnel key of zero46 By default, BFD accepts control messages with any tunnel key46

BFD Status: The VTEP sets key-value pairs in the bfd_status column to report the status of BFD on this tunnel46 When BFD is not enabled, with bfd_params:enable, the HSC clears all key-value pairs from bfd_status46

bfd_status : enabled: optional string, either true or false

Set to true if the BFD session has been successfully enabled46 Set to false if the VTEP cannot support BFD or has insufficient resources to enable BFD on this tunnel46 The NVC will disable the BFD monitoring on the other side of the tunnel once this value is set to false46

bfd_status : state: optional string, one of down, init, up, or admin_down

Reports the state of the BFD session46 The BFD session is fully healthy and negotiated if UP46

bfd_status : forwarding: optional string, either true or false

Reports whether the BFD session believes this Tunnel may be used to forward traffic46 Typically this means the local session is signaling UP, and the remote system isn’t signaling a problem such as concatenated path down46

bfd_status : diagnostic: optional string

A diagnostic code specifying the local system’s reason for the last change in session state46 The error messages are defined in section 4461 of [RFC 5880]46

bfd_status : remote_state: optional string, one of down, init, up, or admin_down

Reports the state of the remote endpoint’s BFD session46

bfd_status : remote_diagnostic: optional string

A diagnostic code specifying the remote system’s reason for the last change in session state46 The error messages are defined in section 4461 of [RFC 5880]46

bfd_status : info: optional string

A short message providing further information about the BFD status (possibly including reasons why BFD could not be enabled)46

Physical_Port TABLE

A port within a Physical_Switch46

Summary:

vlan_bindings

map of integer-Logical_Switch pairs, key in range 0 to 4,095

acl_bindings

map of integer-ACL pairs, key in range 0 to 4,095

vlan_stats

map of integer-Logical_Binding_Stats pairs, key in range 0 to 4,095

Identification:

name

string

description

string

Error Notification:

port_fault_status : invalid_vlan_map

none

port_fault_status : invalid_ACL_binding

none

port_fault_status : unspecified_fault

none

Details:

vlan_bindings: map of integer-Logical_Switch pairs, key in range 0 to 4,095

Identifies how VLANs on the physical port are bound to logical switches46 If, for example, the map contains a (VLAN, logical switch) pair, a packet that arrives on the port in the VLAN is considered to belong to the paired logical switch46 A value of zero in the VLAN field means that untagged traffic on the physical port is mapped to the logical switch46

acl_bindings: map of integer-ACL pairs, key in range 0 to 4,095

Attach Access Control Lists (ACLs) to the physical port46 The column consists of a map of VLAN tags to ACLs46 If the value of the VLAN tag in the map is 0, this means that the ACL is associated with the entire physical port46 Non-zero values mean that the ACL is to be applied only on packets carrying that VLAN tag value46 Switches will not necessarily support matching on the VLAN tag for all ACLs, and unsupported ACL bindings will cause errors to be reported46 The binding of an ACL to a specific VLAN and the binding of an ACL to the entire physical port should not be combined on a single physical port46 That is, a mix of zero and non-zero keys in the map is not recommended46

vlan_stats: map of integer-Logical_Binding_Stats pairs, key in range 0 to 4,095

Statistics for VLANs bound to logical switches on the physical port46 An implementation that fully supports such statistics would populate this column with a mapping for every VLAN that is bound in vlan_bindings46 An implementation that does not support such statistics or only partially supports them would not populate this column or partially populate it, respectively46 A value of zero in the VLAN field refers to untagged traffic on the physical port46

Identification:

name: string

Symbolic name for the port46 The name ought to be unique within a given Physical_Switch, but the database is not capable of enforcing this46

description: string

An extended description for the port46

Error Notification: An entry in this column indicates to the NVC that the physical port has encountered a fault46 The switch must clear this column when the error has been cleared46

port_fault_status : invalid_vlan_map: none

Indicates that a VLAN-to-logical-switch mapping requested by the controller could not be instantiated by the switch because of a conflict with local configuration46

port_fault_status : invalid_ACL_binding: none

Indicates that an error has occurred in associating an ACL with a port46

port_fault_status : unspecified_fault: none

Indicates that an error has occurred on the port but that no more specific information is available46

Logical_Binding_Stats TABLE

Reports statistics for the Logical_Switch with which a VLAN on a Physical_Port is associated46

Summary:

Statistics:

packets_from_local

integer

bytes_from_local

integer

packets_to_local

integer

bytes_to_local

integer

Details:

Statistics: These statistics count only packets to which the binding applies46

packets_from_local: integer

Number of packets sent by the Physical_Switch46

bytes_from_local: integer

Number of bytes in packets sent by the Physical_Switch46

packets_to_local: integer

Number of packets received by the Physical_Switch46

bytes_to_local: integer

Number of bytes in packets received by the Physical_Switch46

Logical_Switch TABLE

A logical Ethernet switch, whose implementation may span physical and virtual media, possibly crossing L3 domains via tunnels; a logical layer-2 domain; an Ethernet broadcast domain46

Summary:

Per Logical-Switch Tunnel Key:

tunnel_key

optional integer

Identification:

name

string (must be unique within table)

description

string

Details:

Per Logical-Switch Tunnel Key: Tunnel protocols tend to have a field that allows the tunnel to be partitioned into sub-tunnels: VXLAN has a VNI, GRE and STT have a key, CAPWAP has a WSI, and so on46 We call these generically “tunnel keys46” Given that one needs to use a tunnel key at all, there are at least two reasonable ways to assign their values:

•

Per Logical_Switch+Physical_Locator pair46 That is, each logical switch may be assigned a different tunnel key on every Physical_Locator46 This model is especially flexible46

In this model, Physical_Locator carries the tunnel key46 Therefore, one Physical_Locator record will exist for each logical switch carried at a given IP destination46

•

Per Logical_Switch46 That is, every tunnel associated with a particular logical switch carries the same tunnel key, regardless of the Physical_Locator to which the tunnel is addressed46 This model may ease switch implementation because it imposes fewer requirements on the hardware datapath46

In this model, Logical_Switch carries the tunnel key46 Therefore, one Physical_Locator record will exist for each IP destination46

tunnel_key: optional integer

This column is used only in the tunnel key per Logical_Switch model (see above), because only in that model is there a tunnel key associated with a logical switch46

For vxlan_over_ipv4 encapsulation, this column is the VXLAN VNI that identifies a logical switch46 It must be in the range 0 to 16,777,21546

Identification:

name: string (must be unique within table)

Symbolic name for the logical switch46

description: string

An extended description for the logical switch, such as its switch login banner46

Ucast_Macs_Local TABLE

Mapping of unicast MAC addresses to tunnels (physical locators)46 This table is written by the HSC, so it contains the MAC addresses that have been learned on physical ports by a VTEP46

Summary:

MAC

string

logical_switch Logical_Switch

locator Physical_Locator

ipaddr

string

Details:

MAC: string

A MAC address that has been learned by the VTEP46

logical_switch: Logical_Switch

The Logical switch to which this mapping applies46

locator: Physical_Locator

The physical locator to be used to reach this MAC address46 In this table, the physical locator will be one of the tunnel IP addresses of the appropriate VTEP46

ipaddr: string

The IP address to which this MAC corresponds46 Optional field for the purpose of ARP supression46

Ucast_Macs_Remote TABLE

Mapping of unicast MAC addresses to tunnels (physical locators)46 This table is written by the NVC, so it contains the MAC addresses that the NVC has learned46 These include VM MAC addresses, in which case the physical locators will be hypervisor IP addresses46 The NVC will also report MACs that it has learned from other HSCs in the network, in which case the physical locators will be tunnel IP addresses of the corresponding VTEPs46

Summary:

MAC

string

logical_switch Logical_Switch

locator Physical_Locator

ipaddr

string

Details:

MAC: string

A MAC address that has been learned by the NVC46

logical_switch: Logical_Switch

The Logical switch to which this mapping applies46

locator: Physical_Locator

The physical locator to be used to reach this MAC address46 In this table, the physical locator will be either a hypervisor IP address or a tunnel IP addresses of another VTEP46

ipaddr: string

The IP address to which this MAC corresponds46 Optional field for the purpose of ARP supression46

Mcast_Macs_Local TABLE

Mapping of multicast MAC addresses to tunnels (physical locators)46 This table is written by the HSC, so it contains the MAC addresses that have been learned on physical ports by a VTEP46 These may be learned by IGMP snooping, for example46 This table also specifies how to handle unknown unicast and broadcast packets46

Summary:

MAC

string

logical_switch Logical_Switch

locator_set Physical_Locator_Set

ipaddr

string

Details:

MAC: string

A MAC address that has been learned by the VTEP46

The keyword unknown-dst is used as a special “Ethernet address” that indicates the locations to which packets in a logical switch whose destination addresses do not otherwise appear in Ucast_Macs_Local (for unicast addresses) or Mcast_Macs_Local (for multicast addresses) should be sent46

logical_switch: Logical_Switch

The Logical switch to which this mapping applies46

locator_set: Physical_Locator_Set

The physical locator set to be used to reach this MAC address46 In this table, the physical locator set will be contain one or more tunnel IP addresses of the appropriate VTEP(s)46

ipaddr: string

The IP address to which this MAC corresponds46 Optional field for the purpose of ARP supression46

Mcast_Macs_Remote TABLE

Mapping of multicast MAC addresses to tunnels (physical locators)46 This table is written by the NVC, so it contains the MAC addresses that the NVC has learned46 This table also specifies how to handle unknown unicast and broadcast packets46

Multicast packet replication may be handled by a service node, in which case the physical locators will be IP addresses of service nodes46 If the VTEP supports replication onto multiple tunnels, then this may be used to replicate directly onto VTEP-hypervisor tunnels46

Summary:

MAC

string

logical_switch Logical_Switch

locator_set Physical_Locator_Set

ipaddr

string

Details:

MAC: string

A MAC address that has been learned by the NVC46

The keyword unknown-dst is used as a special “Ethernet address” that indicates the locations to which packets in a logical switch whose destination addresses do not otherwise appear in Ucast_Macs_Remote (for unicast addresses) or Mcast_Macs_Remote (for multicast addresses) should be sent46

logical_switch: Logical_Switch

The Logical switch to which this mapping applies46

locator_set: Physical_Locator_Set

The physical locator set to be used to reach this MAC address46 In this table, the physical locator set will be either a service node IP address or a set of tunnel IP addresses of hypervisors (and potentially other VTEPs)46

ipaddr: string

The IP address to which this MAC corresponds46 Optional field for the purpose of ARP supression46

Logical_Router TABLE

A logical router, or VRF46 A logical router may be connected to one or more logical switches46 Subnet addresses and interface addresses may be configured on the interfaces46

Summary:

switch_binding

map of string-Logical_Switch pairs

static_routes

map of string-string pairs

acl_binding

map of string-ACL pairs

Identification:

name

string (must be unique within table)

description

string

Error Notification:

LR_fault_status : invalid_ACL_binding

none

LR_fault_status : unspecified_fault

none

Details:

switch_binding: map of string-Logical_Switch pairs

Maps from an IPv4 or IPv6 address prefix in CIDR notation to a logical switch46 Multiple prefixes may map to the same switch46 By writing a 32-bit (or 128-bit for v6) address with a /N prefix length, both the router’s interface address and the subnet prefix can be configured46 For example, 1924668461461/24 creates a /24 subnet for the logical switch attached to the interface and assigns the address 1924668461461 to the router interface46

static_routes: map of string-string pairs

One or more static routes, mapping IP prefixes to next hop IP addresses46

acl_binding: map of string-ACL pairs

Maps ACLs to logical router interfaces46 The router interfaces are indicated using IP address notation, and must be the same interfaces created in the switch_binding column46 For example, an ACL could be associated with the logical router interface with an address of 1924668461461 as defined in the example above46

Identification:

name: string (must be unique within table)

Symbolic name for the logical router46

description: string

An extended description for the logical router46

Error Notification: An entry in this column indicates to the NVC that the HSC has encountered a fault in configuring state related to the logical router46

LR_fault_status : invalid_ACL_binding: none

Indicates that an error has occurred in associating an ACL with a logical router port46

LR_fault_status : unspecified_fault: none

Indicates that an error has occurred in configuring the logical router but that no more specific information is available46

Arp_Sources_Local TABLE

MAC address to be used when a VTEP issues ARP requests on behalf of a logical router46

A distributed logical router is implemented by a set of VTEPs (both hardware VTEPs and vswitches)46 In order for a given VTEP to populate the local ARP cache for a logical router, it issues ARP requests with a source MAC address that is unique to the VTEP46 A single per-VTEP MAC can be re-used across all logical networks46 This table contains the MACs that are used by the VTEPs of a given HSC46 The table provides the mapping from MAC to physical locator for each VTEP so that replies to the ARP requests can be sent back to the correct VTEP using the appropriate physical locator46

Summary:

src_mac

string

locator Physical_Locator

Details:

src_mac: string

The source MAC to be used by a given VTEP46

locator: Physical_Locator

The Physical_Locator to use for replies to ARP requests from this MAC address46

Arp_Sources_Remote TABLE

MAC address to be used when a remote VTEP issues ARP requests on behalf of a logical router46

This table is the remote counterpart of Arp_sources_local46 The NVC writes this table to notify the HSC of the MACs that will be used by remote VTEPs when they issue ARP requests on behalf of a distributed logical router46

Summary:

src_mac

string

locator Physical_Locator

Details:

src_mac: string

The source MAC to be used by a given VTEP46

locator: Physical_Locator

The Physical_Locator to use for replies to ARP requests from this MAC address46

Physical_Locator_Set TABLE

A set of one or more Physical_Locators46

This table exists only because OVSDB does not have a way to express the type “map from string to one or more Physical_Locator records46”

Summary:

locators

immutable set of 1 or more Physical_Locators

Details:

locators: immutable set of 1 or more Physical_Locators

Physical_Locator TABLE

Identifies an endpoint to which logical switch traffic may be encapsulated and forwarded46

For the vxlan_over_ipv4 encapsulation, the only encapsulation defined so far, all endpoints associated with a given Logical_Switch must use a common tunnel key, which is carried in the tunnel_key column of Logical_Switch46

For some encapsulations yet to be defined, we expect Physical_Locator to identify both an endpoint and a tunnel key46 When the first such encapsulation is defined, we expect to add a “tunnel_key” column to Physical_Locator to allow the tunnel key to be defined46

See the “Per Logical-Switch Tunnel Key” section in the Logical_Switch table for further discussion of the model46

Summary:

encapsulation_type

immutable string, must be vxlan_over_ipv4

dst_ip

immutable string

Details:

encapsulation_type: immutable string, must be vxlan_over_ipv4

The type of tunneling encapsulation46

dst_ip: immutable string

For vxlan_over_ipv4 encapsulation, the IPv4 address of the VXLAN tunnel endpoint46

We expect that this column could be used for IPv4 or IPv6 addresses in encapsulations to be introduced later46

ACL_entry TABLE

Describes the individual entries that comprise an Access Control List46

Each entry in the table is a single rule to match on certain header fields46 While there are a large number of fields that can be matched on, most hardware cannot match on arbitrary combinations of fields46 It is common to match on either L2 fields (described below in the L2 group of columns) or L3/L4 fields (the L3/L4 group of columns) but not both46 The hardware switch controller may log an error if an ACL entry requires it to match on an incompatible mixture of fields46

Summary:

sequence

integer

L2 fields:

source_mac

optional string

dest_mac

optional string

ethertype

optional string

L3/L4 fields:

source_ip

optional string

source_mask

optional string

dest_ip

optional string

dest_mask

optional string

protocol

optional integer

source_port_min

optional integer

source_port_max

optional integer

dest_port_min

optional integer

dest_port_max

optional integer

tcp_flags

optional integer

tcp_flags_mask

optional integer

icmp_type

optional integer

icmp_code

optional integer

direction

string, either ingress or egress

action

string, either deny or permit

Error Notification:

acle_fault_status : invalid_acl_entry

none

acle_fault_status : unspecified_fault

none

Details:

sequence: integer

The sequence number for the ACL entry for the purpose of ordering entries in an ACL46 Lower numbered entries are matched before higher numbered entries46

L2 fields:

source_mac: optional string

Source MAC address, in the form xx:xx:xx:xx:xx:xx

dest_mac: optional string

Destination MAC address, in the form xx:xx:xx:xx:xx:xx

ethertype: optional string

Ethertype in hexadecimal, in the form 0xAAAA

L3/L4 fields:

source_ip: optional string

Source IP address, in the form xx46xx46xx46xx for IPv4 or appropriate colon-separated hexadecimal notation for IPv646

source_mask: optional string

Mask that determines which bits of source_ip to match on, in the form xx46xx46xx46xx for IPv4 or appropriate colon-separated hexadecimal notation for IPv646

dest_ip: optional string

Destination IP address, in the form xx46xx46xx46xx for IPv4 or appropriate colon-separated hexadecimal notation for IPv646

dest_mask: optional string

Mask that determines which bits of dest_ip to match on, in the form xx46xx46xx46xx for IPv4 or appropriate colon-separated hexadecimal notation for IPv646

protocol: optional integer

Protocol number in the IPv4 header, or value of the "next header" field in the IPv6 header46

source_port_min: optional integer

Lower end of the range of source port values46 The value specified is included in the range46

source_port_max: optional integer

Upper end of the range of source port values46 The value specified is included in the range46

dest_port_min: optional integer

Lower end of the range of destination port values46 The value specified is included in the range46

dest_port_max: optional integer

Upper end of the range of destination port values46 The value specified is included in the range46

tcp_flags: optional integer

Integer representing the value of TCP flags to match46 For example, the SYN flag is the second least significant bit in the TCP flags46 Hence a value of 2 would indicate that the "SYN" flag should be set (assuming an appropriate mask)46

tcp_flags_mask: optional integer

Integer representing the mask to apply when matching TCP flags46 For example, a value of 2 would imply that the "SYN" flag should be matched and all other flags ignored46

icmp_type: optional integer

ICMP type to be matched46

icmp_code: optional integer

ICMP code to be matched46

direction: string, either ingress or egress

Direction of traffic to match on the specified port, either "ingress" (toward the logical switch or router) or "egress" (leaving the logical switch or router)46

action: string, either deny or permit

Action to take for this rule, either "permit" or "deny"46

Error Notification: An entry in this column indicates to the NVC that the ACL could not be configured as requested46 The switch must clear this column when the error has been cleared46

acle_fault_status : invalid_acl_entry: none

Indicates that an ACL entry requested by the controller could not be instantiated by the switch, e46g46 because it requires an unsupported combination of fields to be matched46

acle_fault_status : unspecified_fault: none

Indicates that an error has occurred in configuring the ACL entry but no more specific information is available46

Acl Table

Access Control List table46 Each ACL is constructed as a set of entries from the ACL_entry table46 Packets that are not matched by any entry in the ACL are allowed by default46

Summary:

acl_entries

set of 1 or more ACL_entrys

acl_name

string (must be unique within table)

Error Notification:

acl_fault_status : invalid_acl

none

acl_fault_status : resource_shortage

none

acl_fault_status : unspecified_fault

none

Details:

acl_entries: set of 1 or more ACL_entrys

A set of references to entries in the ACL_entry table46

acl_name: string (must be unique within table)

A human readable name for the ACL, which may (for example) be displayed on the switch CLI46

Error Notification: An entry in this column indicates to the NVC that the ACL could not be configured as requested46 The switch must clear this column when the error has been cleared46

acl_fault_status : invalid_acl: none

Indicates that an ACL requested by the controller could not be instantiated by the switch, e46g46, because it requires an unsupported combination of fields to be matched46

acl_fault_status : resource_shortage: none

Indicates that an ACL requested by the controller could not be instantiated by the switch due to a shortage of resources (e46g46 TCAM space)46

acl_fault_status : unspecified_fault: none

Indicates that an error has occurred in configuring the ACL but no more specific information is available46