•

ct.trk : Always set to true by ct_next to indicate that connection tracking has taken place. All other ct subfields have ct.trk as a prerequisite.

•

ct.new : True for a new flow

•

ct.est : True for an established flow

•

ct.rel : True for a related flow

•

ct.rpl : True for a reply flow

•

ct.inv : True for a connection entry in a bad state

•

ct.dnat : True for a packet whose destination IP address has been changed.

•

ct.snat : True for a packet whose source IP address has been changed.

•

eth.bcast expands to eth.dst == ff:ff:ff:ff:ff:ff

•

eth.mcast expands to eth.dst[40]

•

eth.mcastv6 expands to eth.dst[32..47] == 0x3333

•

vlan.present expands to vlan.tci[12]

•

ip4 expands to eth.type == 0x800

•

ip4.src_mcast expands to ip4.src[28..31] == 0xe

•

ip4.mcast expands to ip4.dst[28..31] == 0xe

•

ip6 expands to eth.type == 0x86dd

•

ip expands to ip4 || ip6

•

icmp4 expands to ip4 && ip.proto == 1

•

icmp6 expands to ip6 && ip.proto == 58

•

icmp expands to icmp4 || icmp6

•

ip.is_frag expands to ip.frag[0]

•

ip.later_frag expands to ip.frag[1]

•

ip.first_frag expands to ip.is_frag && !ip.later_frag

•

arp expands to eth.type == 0x806

•

rarp expands to eth.type == 0x8035

•

ip6.mcast expands to eth.mcastv6 && ip6.dst[120..127] == 0xff

•

nd expands to icmp6.type == {135, 136} && icmp6.code == 0 && ip.ttl == 255

•

nd_ns expands to icmp6.type == 135 && icmp6.code == 0 && ip.ttl == 255

•

nd_ns_mcast expands to ip6.mcast && icmp6.type == 135 && icmp6.code == 0 && ip.ttl == 255

•

nd_na expands to icmp6.type == 136 && icmp6.code == 0 && ip.ttl == 255

•

nd_rs expands to icmp6.type == 133 && icmp6.code == 0 && ip.ttl == 255

•

nd_ra expands to icmp6.type == 134 && icmp6.code == 0 && ip.ttl == 255

•

tcp expands to ip.proto == 6

•

udp expands to ip.proto == 17

•

sctp expands to ip.proto == 132

next;

•

icmp4.frag_mtu icmp6.frag_mtu

•

eth.src unchanged

•

eth.dst unchanged

•

eth.type = 0x0806

•

arp.op = 1 (ARP request)

•

arp.sha copied from eth.src

•

arp.spa copied from ip4.src

•

arp.tha = 00:00:00:00:00:00

•

arp.tpa copied from ip4.dst

•

eth.src unchanged

•

eth.dst set to IPv6 multicast MAC address

•

eth.type = 0x86dd

•

ip6.src copied from ip6.src

•

ip6.dst set to IPv6 Solicited-Node multicast address

•

icmp6.type = 135 (Neighbor Solicitation)

•

nd.target copied from ip6.dst

•

eth.dst exchanged with eth.src

•

eth.type = 0x86dd

•

ip6.dst copied from ip6.src

•

ip6.src copied from nd.target

•

icmp6.type = 136 (Neighbor Advertisement)

•

nd.target unchanged

•

nd.sll = 00:00:00:00:00:00

•

nd.tll copied from eth.dst

•

eth.dst exchanged with eth.src

•

eth.type = 0x86dd

•

ip6.dst copied from ip6.src

•

ip6.src copied from nd.target

•

icmp6.type = 136 (Neighbor Advertisement)

•

nd.target unchanged

•

nd.sll = 00:00:00:00:00:00

•

nd.tll copied from eth.dst

•

addr_mode

•

slla

•

mtu

•

prefix

•

ip.proto = 1 (ICMPv4)

•

ip.frag = 0 (not a fragment)

•

ip.ttl = 255

•

icmp4.type = 3 (destination unreachable)

•

icmp4.code = 1 (host unreachable)

•

ip.proto = 58 (ICMPv6)

•

ip.ttl = 255

•

icmp6.type = 1 (destination unreachable)

•

icmp6.code = 1 (administratively prohibited)

•

empty_lb_backends . This event is raised if a received packet is destined for a load balancer VIP that has no configured backend destinations. For this event, the event info includes the load balancer VIP, the load balancer UUID, and the transport protocol. Associated meter: event-elb

•

Match on the the 5-tuple and the expected next-hop mac address in table 76: nw_src=ip0 , nw_dst=ip1 , ip_proto , tp_src=l4_port0 , tp_dst=l4_port1 , dl_src=ethaddr and set reg9[5] .

•

Match on the 5-tuple in table 77: nw_src=ip1 , nw_dst=ip0 , ip_proto , tp_src=l4_port1 , tp_dst=l4_port0 and set reg9[5] to 1

commit_lb_aff( vip , backend , proto , timeout ); Parameters : load-balancer virtual ip:port vip , load-balancer backend ip:port backend , load-balancer protocol proto , affinity timeout timeout .

This action translates to an openflow "learn" action that inserts a new flow in table 78.

This action is applied for new connections received by a specific load-balacer with affinity timeout configured.

R = chk_lb_aff();

This action checks if the packet under consideration matches any flow in table 78. If it is so, then the 1-bit destination register R is set to 1.

R = ct_nw_dst();

This action checks if the packet is tracked and stores the conntrack original destination IPv4 address in the register R of 32-bit size.

R = ct_ip6_dst();

This action checks if the packet is tracked and stores the conntrack original destination IPv6 address in the register R of 128-bit size.

R = ct_tp_dst();

This action checks if the packet is tracked and stores the conntrack original L4 destination port in the register R of 16-bit size.

sample(probability= packets , ...)

This action causes the matched traffic to be sampled using IPFIX protocol. More information about how per-flow IPFIX sampling works in OVS can be found in ovs-actions (7) and ovs-vswitchd.conf.db (5).

In order to reliably identify each sampled packet when it is received by the IPFIX collector, this action sets the content of the ObservationDomainID and ObservationPointID IPFIX fields (see argument description below).

The following key-value arguments are supported:
probability= packets

The number of sampled packets out of 65535. It must be greater or equal to 1.

collector_set= id

The unsigned 32-bit integer identifier of the sample collector to send sampled packets to. It must match the value configured in the Flow_Sample_Collector_Set Table in OVS. Defaults to 0.

obs_domain= id

An unsigned 8-bit integer that identifies the sampling application. It will be placed in the 8 most significant bits of the ObservationDomainID field of IPFIX samples. The 24 less significant bits will be automatically filled in with the datapath key. Defaults to 0.

obs_point= id

An unsigned 32-bit integer to be used as ObsservationPointID or the string @cookie to indicate that the first 32 bits of the Logical_Flow ’s UUID shall be used instead.

mac_cache_use;

This action resubmits to corresponding table which updates the use statistics of MAC cache.

R = dhcp_relay_req_chk( relay-ip ,

server-ip ); Parameters : Logical Router Port IP relay-ip , DHCP Server IP server-ip .

Result : stored to a 1-bit subfield R .

This action executes on the source node on which the DHCP request (DHCPDISCOVER or DHCPREQUEST) originated.

When this action applied successfully on the DHCP request packet, it updates GIADDR in the DHCP packet with relay-ip and stores 1 in R.

When this action failed to apply on the packet, it leaves the packet unchanged and stores 0 in R.

R = dhcp_relay_resp_chk( relay-ip ,

server-ip ); Parameters : Logical Router Port IP relay-ip , DHCP Server IP server-ip .

Result : stored to a 1-bit subfield R .

This action executes on the first node (Redirect Chassis node) which processes the DHCP response(DHCPOFFER, DHCPACK) from the DHCP server.

When this action applied successfully on the DHCP response packet, it updates the destination MAC and destination IP in the packet and stores 1 in R. relay-ip and server-ip are used to validate GIADDR and SERVER-ID in the DHCP response packet.

When this action failed to apply on the packet, it leaves the packet unchanged and stores 0 in R.

tags : map of string-string pairs

Key-value pairs that provide additional information to help ovn-controller processing the logical flow. Below are the tags used by ovn-controller.
in_out_port

In the logical flow’s "match" column, if a logical port P is compared with "inport" and the logical flow is on a logical switch ingress pipeline, or if P is compared with "outport" and the logical flow is on a logical switch egress pipeline, and the expression is combined with other expressions (if any) using the operator &&, then the port P should be added as the value in this tag. If there are multiple logical ports meeting this criteria, one of them can be added. ovn-controller uses this information to skip parsing flows that are not needed on the chassis. Failing to add the tag will affect efficiency, while adding wrong value will affect correctness.

controller_meter : optional string

The name of the meter in table Meter to be used for all packets that the logical flow might send to ovn-controller .

flow_desc : optional string

Human-readable explanation of the flow, this is optional and used to provide context for the given flow.

external_ids : stage-name : optional string

Human-readable name for this flow’s stage in the pipeline.

external_ids : stage-hint : optional string, containing an uuid

UUID of a OVN_Northbound record that caused this logical flow to be created. Currently used only for attribute of logical flows to northbound ACL records.

external_ids : source : optional string

Source file and line number of the code that added this flow to the pipeline.

Common Columns:

The overall purpose of these columns is described under Common Columns at the beginning of this document.
external_ids : map of string-string pairs

Logical_DP_Group TABLE

Each row in this table represents a group of logical datapaths referenced by the logical_dp_group column in the Logical_Flow table.

Summary:

Details:

datapaths : set of weak reference to Datapath_Binding s

List of Datapath_Binding entries.

Multicast_Group TABLE

The rows in this table define multicast groups of logical ports. Multicast groups allow a single packet transmitted over a tunnel to a

hypervisor to be delivered to multiple VMs on that hypervisor, which uses bandwidth more efficiently.

Each row in this table defines a logical multicast group numbered

tunnel_key within datapath , whose logical ports are listed in the ports column.

Summary:

Details:

datapath : Datapath_Binding

The logical datapath in which the multicast group resides.

tunnel_key : integer, in range 32,768 to 65,535

The value used to designate this logical egress port in tunnel encapsulations. An index forces the key to be unique within the datapath . The unusual range ensures that multicast group IDs do not overlap with logical port IDs.

name : string

The logical multicast group’s name. An index forces the name to be unique within the datapath . Logical flows in the ingress pipeline may output to the group just as for individual logical ports, by assigning the group’s name to outport and executing an output action.

Multicast group names and logical port names share a single namespace and thus should not overlap (but the database schema cannot enforce this). To try to avoid conflicts, ovn-northd uses names that begin with _MC_ .

ports : set of weak reference to Port_Binding s

The logical ports included in the multicast group. All of these ports must be in the datapath logical datapath (but the database schema cannot enforce this).

Mirror TABLE

Each row in this table represents a mirror that can be used for port mirroring. These mirrors are referenced by the mirror_rules column in the Port_Binding table.

Summary:

Details:

name : string (must be unique within table)

Represents the name of the mirror.

filter : string, one of both , from-lport , or to-lport

The value of this field represents selection criteria of the mirror. to-lport mirrors the packets coming into logical port. from-lport mirrors the packets going out of logical port. both mirrors for both directions.

sink : string

The value of this field represents the destination/sink of the mirror. If the type is gre or erspan , the value indicates the tunnel remote IP (either IPv4 or IPv6). For a type of local , this field defines a local interface on the OVS integration bridge to be used as the mirror destination. The interface must possess external-ids:mirror-id that matches this string.

type : string, one of erspan , gre , or local

The value of this field specifies the mirror type - gre , erspan or local .

index : integer

The value of this field represents the tunnel ID. If the configured tunnel type is gre , this field represents the GRE key

value and if the configured tunnel type is erspan it represents the erspan_idx value. It is ignored if the type is local .

external_ids : map of string-string pairs

See External IDs at the beginning of this document.

Meter TABLE

Each row in this table represents a meter that can be used for QoS or rate-limiting.

Summary:

Details:

name : string (must be unique within table)

A name for this meter.

Names that begin with "__" (two underscores) are reserved for OVN internal use and should not be added manually.

unit : string, either kbps or pktps

The unit for rate and burst_rate parameters in the bands entry. kbps specifies kilobits per second, and pktps specifies packets per second.

bands : set of 1 or more Meter_Band s

The bands associated with this meter. Each band specifies a rate above which the band is to take the action action . If multiple

bands’ rates are exceeded, then the band with the highest rate among the exceeded bands is selected.

Meter_Band TABLE

Each row in this table represents a meter band which specifies the rate above which the configured action should be applied. These bands are

referenced by the bands column in the Meter table.

Summary:

Details:

action : string, must be drop

The action to execute when this band matches. The only supported action is drop .

rate : integer, in range 1 to 4,294,967,295

The rate limit for this band, in kilobits per second or bits per second, depending on whether the parent Meter entry’s unit column specified kbps or pktps .

burst_size : integer, in range 0 to 4,294,967,295

The maximum burst allowed for the band in kilobits or packets, depending on whether kbps or pktps was selected in the parent Meter entry’s unit column. If the size is zero, the switch is free to select some reasonable value depending on its

configuration.

Datapath_Binding TABLE

Each row in this table represents a logical datapath, which implements a logical pipeline among the ports in the Port_Binding table associated

with it. In practice, the pipeline in a given logical datapath implements either a logical switch or a logical router.

The main purpose of a row in this table is provide a physical binding for a logical datapath. A logical datapath does not have a physical location, so its physical binding information is limited: just

tunnel_key . The rest of the data in this table does not affect packet forwarding.

Summary:

OVN_Northbound Relationship:

external_ids : logical-switch

optional string, containing an uuid

external_ids : logical-router

optional string, containing an uuid

external_ids : interconn-ts

optional string

Naming:

Common Columns:

Details:

tunnel_key : integer, in range 1 to 16,777,215 (must be unique within
table)

The tunnel key value to which the logical datapath is bound. The

Tunnel Encapsulation section in ovn-architecture (7) describes how tunnel keys are constructed for each supported encapsulation.

load_balancers : set of uuids

Not used anymore; kept for backwards compatibility of the schema.

OVN_Northbound Relationship:

Each row in Datapath_Binding is associated with some logical datapath. ovn-northd uses these keys to track the association of a logical datapath with concepts in the OVN_Northbound database.
external_ids : logical-switch : optional string, containing an uuid

For a logical datapath that represents a logical switch, ovn-northd stores in this key the UUID of the corresponding Logical_Switch row in the OVN_Northbound database.

external_ids : logical-router : optional string, containing an uuid

For a logical datapath that represents a logical router, ovn-northd stores in this key the UUID of the corresponding

Logical_Router row in the OVN_Northbound database.

external_ids : interconn-ts : optional string

For a logical datapath that represents a logical switch that represents a transit switch for interconnection, ovn-northd stores in this key the value of the same interconn-ts key of the external_ids column of the corresponding Logical_Switch row in the OVN_Northbound database.

Naming:

ovn-northd copies these from the name fields in the OVN_Northbound database, either from name and external_ids:neutron:router_name in the Logical_Router table or from name and external_ids:neutron:network_name in the Logical_Switch table.
external_ids : name : optional string

A name for the logical datapath.

external_ids : name2 : optional string

Another name for the logical datapath.

Common Columns:

The overall purpose of these columns is described under Common Columns at the beginning of this document.
external_ids : map of string-string pairs

Port_Binding TABLE

Each row in this table binds a logical port to a realization. For most logical ports, this means binding to some physical location, for example by binding a logical port to a VIF that belongs to a VM running on a particular hypervisor. Other logical ports, such as logical patch ports, can be realized without a specific physical location, but their

bindings are still expressed through rows in this table.

For every Logical_Switch_Port record in OVN_Northbound database, ovn-northd creates a record in this table. ovn-northd populates and maintains every column except the chassis and virtual_parent columns, which it leaves empty in new records.

ovn-controller / ovn-controller-vtep populates the chassis column for the records that identify the logical ports that are located on its hypervisor/gateway, which ovn-controller / ovn-controller-vtep in turn finds out by monitoring the local hypervisor’s Open_vSwitch database, which identifies logical ports via the conventions described in

IntegrationGuide.rst . (The exceptions are for Port_Binding records with type of l3gateway , whose locations are identified by ovn-northd via the options:l3gateway-chassis column in this table. ovn-controller is still responsible to populate the chassis column.)

ovn-controller also populates the virtual_parent column of records

whose type is virtual .

When a chassis shuts down gracefully, it should clean up the chassis column that it previously had populated. (This is not critical because resources hosted on the chassis are equally unreachable regardless of whether their rows are present.) To handle the case where a VM is shut

down abruptly on one chassis, then brought up again on a different one, ovn-controller / ovn-controller-vtep must overwrite the chassis column with new information.

Summary:

Core Features:

requested_additional_chassis

set of weak reference to Chassis

Patch Options:

L3 Gateway Options:

options : l3gateway-chassis

optional string

Localnet Options:

L2 Gateway Options:

options : l2gateway-chassis

optional string

VTEP Options:

options : vtep-physical-switch

optional string

options : vtep-logical-switch

optional string

VMI (or VIF) Options:

options : requested-chassis

optional string

options : activation-strategy

optional string

options : additional-chassis-activated

optional string

options : qos_physical_network

optional string

Distributed Gateway Port Options:

options : chassis-redirect-port

optional string

Chassis Redirect Options:

Nested Containers:

Virtual ports:

Naming:

Common Columns:

Details:

Core Features:

datapath : Datapath_Binding

The logical datapath to which the logical port belongs.

logical_port : string (must be unique within table)

A logical port. For a logical switch port, this is taken from name in the OVN_Northbound database’s Logical_Switch_Port table. For a logical router port, this is taken from name in the OVN_Northbound database’s Logical_Router_port table. (This means that logical switch ports and router port names must not share names in an OVN deployment.) OVN does not prescribe a particular format for the logical port ID.

encap : optional weak reference to Encap

Points to preferred encapsulation configuration to transmit logical dataplane packets to this chassis. The entry is reference to a Encap record.

additional_encap : set of weak reference to Encap s

Points to preferred encapsulation configuration to transmit logical dataplane packets to this additional chassis. The entry is reference to a Encap record. See also additional_chassis .

chassis : optional weak reference to Chassis

The meaning of this column depends on the value of the type column. This is the meaning for each type
(empty string)

The physical location of the logical port. To successfully identify a chassis, this column must be a Chassis record. This is populated by ovn-controller .

localnet

Always empty. A localnet port is realized on every chassis that has connectivity to the corresponding physical network.

localport

Always empty. A localport port is present on every chassis.

l3gateway

The physical location of the L3 gateway. To successfully identify a chassis, this column must be a Chassis record. This is populated by ovn-controller based on the value of the options:l3gateway-chassis column in this table.

l2gateway

The physical location of this L2 gateway. To successfully identify a chassis, this column must be a Chassis record. This is populated by ovn-controller based on the value of the options:l2gateway-chassis column in this table.

additional_chassis : set of weak reference to Chassis

The meaning of this column is the same as for the chassis . The column is used to track an additional physical location of the logical port. Used with regular (empty type ) port bindings.

gateway_chassis : set of Gateway_Chassis es

A list of Gateway_Chassis .

This should only be populated for ports with type set to chassisredirect . This column defines the list of chassis used as gateways where traffic will be redirected through.

ha_chassis_group : optional HA_Chassis_Group

This should only be populated for ports with type set to chassisredirect . This column defines the HA chassis group with a list of HA chassis used as gateways where traffic will be redirected through.

up : optional boolean

This is set to true whenever all OVS flows required by this Port_Binding have been installed. This is populated by ovn-controller .

tunnel_key : integer, in range 1 to 32,767

A number that represents the logical port in the key (e.g. STT key or Geneve TLV) field carried within tunnel protocol packets.

The tunnel ID must be unique within the scope of a logical datapath.

mac : set of strings

This column is a misnomer as it may contain MAC addresses and IP addresses. It is copied from the addresses column in the Logical_Switch_Port table in the Northbound database. It follows the same format as that column.

port_security : set of strings

This column controls the addresses from which the host attached to the logical port (‘‘the host’’) is allowed to send packets and to which it is allowed to receive packets. If this column is empty, all addresses are permitted.

It is copied from the port_security column in the Logical_Switch_Port table in the Northbound database. It follows the same format as that column.

type : string

A type for this logical port. Logical ports can be used to model other types of connectivity into an OVN logical switch. The following types are defined:
(empty string)

VM (or VIF) interface.

l3gateway

One of a pair of logical ports that act as if connected by a patch cable across multiple chassis. Useful for connecting a logical switch with a Gateway router (which is only resident on a particular chassis).

localnet

A connection to a locally accessible network from ovn-controller instances that have a corresponding bridge mapping. A logical switch can have multiple localnet ports attached. This type is used to model direct connectivity to existing networks. In this case, each chassis should have a mapping for one of the physical networks only. Note: nothing said above implies that a chassis cannot be plugged to multiple physical networks as long as they belong to different switches.

localport

A connection to a local VIF. Traffic that arrives on a localport is never forwarded over a tunnel to another chassis. These ports are present on every chassis and have the same address in all of them. This is used to model connectivity to local services that run on every hypervisor.

l2gateway

An L2 connection to a physical network. The chassis this Port_Binding is bound to will serve as an L2 gateway to the network named by options : network_name .

chassisredirect

A logical port that represents a particular instance, bound to a specific chassis, of an otherwise distributed parent port (e.g. of type patch ). A chassisredirect port should never be used as an inport . When an ingress pipeline sets the outport , it may set the value to a logical port of type chassisredirect . This will cause the packet to be directed to a specific chassis to carry out

the egress pipeline. At the beginning of the egress pipeline, the outport will be reset to the value of the distributed port.

virtual

Represents a logical port with an virtual ip . This virtual ip can be configured on a logical port (which is referred as virtual parent).

requested_chassis : optional weak reference to Chassis

This column exists so that the ovn-controller can effectively monitor all Port_Binding records destined for it, and is a supplement to the options:requested-chassis option. The option is still required so that the ovn-controller can check the CMS intent when the chassis pointed to does not currently exist, which for example occurs when the ovn-controller is stopped without passing the -restart argument. This column must be a Chassis record. This is populated by ovn-northd when the options:requested-chassis is defined and contains a string matching the name or hostname of an existing chassis. See also requested_additional_chassis .

requested_additional_chassis : set of weak reference to Chassis

This column exists so that the ovn-controller can effectively monitor all Port_Binding records destined for it, and is a supplement to the options:requested-chassis option when multiple chassis are listed. This column must be a list of Chassis records. This is populated by ovn-northd when the options:requested-chassis is defined as a list of chassis names or hostnames. See also requested_chassis .

mirror_rules : set of weak reference to Mirror s

Mirror rules that apply to the port binding. Please see the Mirror table.

Patch Options:

These options apply to logical ports with type of patch .
options : peer : optional string

The logical_port in the Port_Binding record for the other side of the patch. The named logical_port must specify this logical_port in its own peer option. That is, the two patch logical ports must have reversed logical_port and peer values.

nat_addresses : set of strings

MAC address followed by a list of SNAT and DNAT external IP addresses, followed by is_chassis_resident(" lport ") , where lport is the name of a logical port on the same chassis where the corresponding NAT rules are applied. This is used to send gratuitous ARPs for SNAT and DNAT external IP addresses via localnet , from the chassis where lport resides. Example: 80:fa:5b:06:72:b7 158.36.44.22 158.36.44.24 is_chassis_resident("foo1") . This would result in generation of gratuitous ARPs for IP addresses 158.36.44.22 and 158.36.44.24 with a MAC address of 80:fa:5b:06:72:b7 from the chassis where the logical port "foo1" resides.

L3 Gateway Options:

These options apply to logical ports with type of l3gateway .
options : peer : optional string

The logical_port in the Port_Binding record for the other side of the ’l3gateway’ port. The named logical_port must specify this logical_port in its own peer option. That is, the two ’l3gateway’ logical ports must have reversed logical_port and peer values.

options : l3gateway-chassis : optional string

The chassis in which the port resides.

nat_addresses : set of strings

MAC address of the l3gateway port followed by a list of SNAT and DNAT external IP addresses. This is used to send gratuitous ARPs for SNAT and DNAT external IP addresses via localnet . Example: 80:fa:5b:06:72:b7 158.36.44.22 158.36.44.24 . This would result in generation of gratuitous ARPs for IP addresses 158.36.44.22 and 158.36.44.24 with a MAC address of 80:fa:5b:06:72:b7. This

is used in OVS version 2.8 and later versions.

Localnet Options:

These options apply to logical ports with type of localnet .
options : network_name : optional string

Required. ovn-controller uses the configuration entry ovn-bridge-mappings to determine how to connect to this network. ovn-bridge-mappings is a list of network names mapped to a local OVS bridge that provides access to that network. An example of configuring ovn-bridge-mappings would be: .IP
$ ovs-vsctl set open . external-ids:ovn-bridge-mappings=physnet1:br-eth0,physnet2:br-eth1

When a logical switch has a localnet port attached, every chassis that may have a local vif attached to that logical switch must have a bridge mapping configured to reach that localnet . Traffic that arrives on a localnet port is never forwarded over a tunnel to another chassis. If there are multiple localnet ports in a logical switch, each chassis should only have a single bridge mapping for one of the physical networks. Note: In case of multiple localnet ports, to provide interconnectivity between all VIFs located on different chassis with different fabric connectivity, the fabric should implement some form of routing between the segments.

tag : optional integer, in range 1 to 4,095

If set, indicates that the port represents a connection to a specific VLAN on a locally accessible network. The VLAN ID is used to match incoming traffic and is also added to outgoing traffic.

L2 Gateway Options:

These options apply to logical ports with type of l2gateway .
options : network_name : optional string

Required. ovn-controller uses the configuration entry ovn-bridge-mappings to determine how to connect to this network. ovn-bridge-mappings is a list of network names mapped to a local OVS bridge that provides access to that network. An example of configuring ovn-bridge-mappings would be: .IP
$ ovs-vsctl set open . external-ids:ovn-bridge-mappings=physnet1:br-eth0,physnet2:br-eth1

When a logical switch has a l2gateway port attached, the chassis that the l2gateway port is bound to must have a bridge mapping configured to reach the network identified by network_name .

options : l2gateway-chassis : optional string

Required. The chassis in which the port resides.

tag : optional integer, in range 1 to 4,095

If set, indicates that the gateway is connected to a specific VLAN on the physical network. The VLAN ID is used to match incoming traffic and is also added to outgoing traffic.

VTEP Options:

These options apply to logical ports with type of vtep .
options : vtep-physical-switch : optional string

Required. The name of the VTEP gateway.

options : vtep-logical-switch : optional string

Required. A logical switch name connected by the VTEP gateway. Must be set when type is vtep .

VMI (or VIF) Options:

These options apply to logical ports with type having (empty string)
options : requested-chassis : optional string

If set, identifies a specific chassis (by name or hostname) that is allowed to bind this port. Using this option will prevent thrashing between two chassis trying to bind the same port during a live migration. It can also prevent similar thrashing due to a mis-configuration, if a port is accidentally created on more than one chassis.

If set to a comma separated list, the first entry identifies the main chassis and the rest are one or more additional chassis that are allowed to bind the same port.

When multiple chassis are set for the port, and the logical switch is connected to an external network through a localnet port, tunneling is enforced for the port to guarantee delivery of packets directed to the port to all its locations. This has MTU implications because the network used for tunneling must have MTU larger than localnet for stable connectivity.

options : activation-strategy : optional string

If used with multiple chassis set in requested-chassis , specifies an activation strategy for all additional chassis. By default, no activation strategy is used, meaning additional port locations are immediately available for use. When set to "rarp", the port is blocked for ingress and egress communication until a RARP packet is sent from a new location. The "rarp" strategy is useful in live migration scenarios for virtual machines.

options : additional-chassis-activated : optional string

When activation-strategy is set, this option indicates that the port was activated using the strategy specified.

options : iface-id-ver : optional string

If set, this port will be bound by ovn-controller only if this same key and value is configured in the external_ids column in the Open_vSwitch database’s Interface table.

options : qos_min_rate : optional string

If set, indicates the minimum guaranteed rate available for data sent from this interface, in bit/s.

options : qos_max_rate : optional string

If set, indicates the maximum rate for data sent from this interface, in bit/s. The traffic will be shaped according to this limit.

options : qos_burst : optional string

If set, indicates the maximum burst size for data sent from this interface, in bits.

options : qos_physical_network : optional string

If set, indicates the name of the egress network name where traffic shaping will be applied.

options : qdisc_queue_id : optional string, containing an integer, in
range 1 to 61,440

Indicates the queue number on the physical device. This is same as the queue_id used in OpenFlow in struct ofp_action_enqueue .

Distributed Gateway Port Options:

These options apply to the distributed parent ports of logical ports with type of chasssisredirect .
options : chassis-redirect-port : optional string

The name of the chassis redirect port derived from this port if this port is a distributed parent of a chassis redirect port.

Chassis Redirect Options:

These options apply to logical ports with type of chassisredirect .
options : distributed-port : optional string

The name of the distributed port for which this chassisredirect port represents a particular instance.

options : redirect-type : optional string

The value is copied from the column options in the OVN_Northbound database’s Logical_Router_Port table for the distributed parent of this port.

options : always-redirect : optional string

A boolean option that is set to true if the distributed parent of this chassis redirect port does not need distributed processing.

Nested Containers:

These columns support containers nested within a VM. Specifically, they are used when type is empty and logical_port identifies the interface of a container spawned inside a VM. They are empty for containers or VMs that run directly on a hypervisor.
parent_port : optional string

This is taken from parent_name in the OVN_Northbound database’s Logical_Switch_Port table.

tag : optional integer, in range 1 to 4,095

Identifies the VLAN tag in the network traffic associated with that container’s network interface.

This column is used for a different purpose when type is localnet (see Localnet Options , above) or l2gateway (see L2 Gateway Options , above).

Virtual ports:

virtual_parent : optional string

This column is set by ovn-controller with one of the value from the options:virtual-parents in the OVN_Northbound database’s Logical_Switch_Port table when the OVN action bind_vport is executed. ovn-controller also sets the chassis column when it executes this action with its chassis id.

ovn-controller sets this column only if the type is "virtual".

Naming:

external_ids : name : optional string

For a logical switch port, ovn-northd copies this from external_ids:neutron:port_name in the Logical_Switch_Port table in the OVN_Northbound database, if it is a nonempty string.

For a logical switch port, ovn-northd does not currently set this key.

Common Columns:

external_ids : map of string-string pairs

See External IDs at the beginning of this document.

The ovn-northd program populates this column with all entries into the external_ids column of the Logical_Switch_Port and Logical_Router_Port tables of the OVN_Northbound database.

MAC_Binding TABLE

Each row in this table specifies a binding from an IP address to an Ethernet address that has been discovered through ARP (for IPv4) or neighbor discovery (for IPv6). This table is primarily used to discover bindings on physical networks, because IP-to-MAC bindings for virtual machines are usually populated statically into the Port_Binding table.

This table expresses a functional relationship: MAC_Binding ( logical_port , ip ) = mac .

In outline, the lifetime of a logical router’s MAC binding looks like this:

Summary:

Details:

logical_port : string

The logical port on which the binding was discovered.

ip : string

The bound IP address.

mac : string

The Ethernet address to which the IP is bound.

timestamp : integer

The timestamp in msec when the MAC binding was added or updated. Records that existed before this column will have 0.

datapath : Datapath_Binding

The logical datapath to which the logical port belongs.

DHCP_Options TABLE

Each row in this table stores the DHCP Options supported by native OVN DHCP. ovn-northd populates this table with the supported DHCP options. ovn-controller looks up this table to get the DHCP codes of the DHCP options defined in the "put_dhcp_opts" action. Please refer to the RFC 2132 "https://tools.ietf.org/html/rfc2132" for the possible list of DHCP options that can be defined here.

Summary:

Details:

name : string

Name of the DHCP option.

Example. name="router"

code : integer, in range 0 to 254

DHCP option code for the DHCP option as defined in the RFC 2132.

Example. code=3

type : string, one of bool , domains , host_id , ipv4 , static_routes , str ,
uint16 , uint32 , or uint8

Data type of the DHCP option code.
value: bool

This indicates that the value of the DHCP option is a bool.

Example. "name=ip_forward_enable", "code=19", "type=bool".

put_dhcp_opts(..., ip_forward_enable = 1,...)

value: uint8

This indicates that the value of the DHCP option is an unsigned int8 (8 bits)

Example. "name=default_ttl", "code=23", "type=uint8".

put_dhcp_opts(..., default_ttl = 50,...)

value: uint16

This indicates that the value of the DHCP option is an unsigned int16 (16 bits).

Example. "name=mtu", "code=26", "type=uint16".

put_dhcp_opts(..., mtu = 1450,...)

value: uint32

This indicates that the value of the DHCP option is an unsigned int32 (32 bits).

Example. "name=lease_time", "code=51", "type=uint32".

put_dhcp_opts(..., lease_time = 86400,...)

value: ipv4

This indicates that the value of the DHCP option is an IPv4 address or addresses.

Example. "name=router", "code=3", "type=ipv4".

put_dhcp_opts(..., router = 10.0.0.1,...)

Example. "name=dns_server", "code=6", "type=ipv4".

put_dhcp_opts(..., dns_server = {8.8.8.8 7.7.7.7},...)

value: static_routes

This indicates that the value of the DHCP option contains a pair of IPv4 route and next hop addresses.

Example. "name=classless_static_route", "code=121", "type=static_routes".

put_dhcp_opts(..., classless_static_route = {30.0.0.0/24,10.0.0.4,0.0.0.0/0,10.0.0.1}...)

value: str

This indicates that the value of the DHCP option is a string.

Example. "name=host_name", "code=12", "type=str".

value: host_id

This indicates that the value of the DHCP option is a host_id. It can either be a host_name or an IP address.

Example. "name=tftp_server", "code=66", "type=host_id".

value: domains

This indicates that the value of the DHCP option is a domain name or a comma separated list of domain names.

Example. "name=domain_search_list", "code=119", "type=domains".

DHCPv6_Options TABLE

Each row in this table stores the DHCPv6 Options supported by native OVN DHCPv6. ovn-northd populates this table with the supported DHCPv6 options. ovn-controller looks up this table to get the DHCPv6 codes of the DHCPv6 options defined in the put_dhcpv6_opts action. Please refer to RFC 3315 and RFC 3646 for the list of DHCPv6 options that can be defined here.

Summary:

Details:

name : string

Name of the DHCPv6 option.

Example. name="ia_addr"

code : integer, in range 0 to 254

DHCPv6 option code for the DHCPv6 option as defined in the appropriate RFC.

Example. code=3

type : string, one of domain , ipv6 , mac , or str

Data type of the DHCPv6 option code.
value: ipv6

This indicates that the value of the DHCPv6 option is an IPv6 address(es).

Example. "name=ia_addr", "code=5", "type=ipv6".

put_dhcpv6_opts(..., ia_addr = ae70::4,...)

value: str

This indicates that the value of the DHCPv6 option is a string.

Example. "name=domain_search", "code=24", "type=str".

put_dhcpv6_opts(..., domain_search = ovn.domain,...)

value: mac

This indicates that the value of the DHCPv6 option is a MAC address.

Example. "name=server_id", "code=2", "type=mac".

put_dhcpv6_opts(..., server_id = 01:02:03:04L05:06,...)

Connection TABLE

Configuration for a database connection to an Open vSwitch database (OVSDB) client.

This table primarily configures the Open vSwitch database server ( ovsdb-server ).

The Open vSwitch database server can initiate and maintain active connections to remote clients. It can also listen for database connections.

Summary:

Core Features:

Client Failure Detection and Handling:

Status:

status : sec_since_disconnect

optional string, containing an integer, at least 0

Common Columns:

Details:

Core Features:

target : string (must be unique within table)

Connection methods for clients.

The following connection methods are currently supported:
ssl: host [ : port ]

The specified SSL/TLS port on the given host , which can either be a DNS name (if built with unbound library) or an IP address. A valid SSL configuration must be provided when this form is used, this configuration can be specified via command-line options or the SSL table.

If port is not specified, it defaults to 6640.

SSL/TLS support is an optional feature that is not always built as part of OVN or Open vSwitch.

tcp: host [ : port ]

The specified TCP port on the given host , which can either be a DNS name (if built with unbound library) or an IP address (IPv4 or IPv6). If host is an IPv6 address, wrap it in square brackets, e.g. tcp:[::1]:6640 .

If port is not specified, it defaults to 6640.

pssl: [ port ][ : host ]

Listens for SSL/TLS connections on the specified TCP port . Specify 0 for port to have the kernel automatically choose an available port. If host , which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address (either IPv4 or IPv6 address). If host is an IPv6 address, wrap in square brackets, e.g. pssl:6640:[::1] . If host is not specified then it listens only on IPv4 (but not IPv6) addresses. A valid SSL/TLS configuration must be provided when this form is used, this can be specified either via command-line options or the SSL table.

If port is not specified, it defaults to 6640.

SSL/TLS support is an optional feature that is not always built as part of OVN or Open vSwitch.

ptcp: [ port ][ : host ]

Listens for connections on the specified TCP port . Specify 0 for port to have the kernel automatically

choose an available port. If host , which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address (either IPv4 or IPv6 address). If host is an IPv6 address, wrap it in square brackets, e.g. ptcp:6640:[::1] . If host is not specified then it listens only on IPv4 addresses.

If port is not specified, it defaults to 6640.

When multiple clients are configured, the target values must be unique. Duplicate target values yield unspecified results.

read_only : boolean

true to restrict these connections to read-only transactions, false to allow them to modify the database.

role : string

String containing role name for this connection entry.

Client Failure Detection and Handling:

max_backoff : optional integer, at least 1,000

Maximum number of milliseconds to wait between connection attempts. Default is implementation-specific.

inactivity_probe : optional integer

Maximum number of milliseconds of idle time on connection to the client before sending an inactivity probe message. If Open vSwitch does not communicate with the client for the specified number of seconds, it will send a probe. If a response is not

received for the same additional amount of time, Open vSwitch assumes the connection has been broken and attempts to reconnect. Default is implementation-specific. A value of 0 disables inactivity probes.

Status:

Key-value pair of is_connected is always updated. Other key-value pairs in the status columns may be updated depends on the target type.

When target specifies a connection method that listens for inbound connections (e.g. ptcp: or punix: ), both n_connections and is_connected may also be updated while the remaining key-value pairs are omitted.

On the other hand, when target specifies an outbound connection, all key-value pairs may be updated, except the above-mentioned two key-value pairs associated with inbound connection targets. They are omitted.
is_connected : boolean

true if currently connected to this client, false otherwise.

status : last_error : optional string

A human-readable description of the last error on the connection to the manager; i.e. strerror(errno) . This key will exist only if an error has occurred.

status : state : optional string, one of ACTIVE , BACKOFF , CONNECTING ,
IDLE , or VOID

The state of the connection to the manager:

BACKOFF

Attempting to reconnect at an increasing period.

CONNECTING

Attempting to connect.

These values may change in the future. They are provided only for human consumption.

status : sec_since_connect : optional string, containing an integer, at
least 0

The amount of time since this client last successfully connected to the database (in seconds). Value is empty if client has never successfully been connected.

status : sec_since_disconnect : optional string, containing an integer,
at least 0

The amount of time since this client last disconnected from the database (in seconds). Value is empty if client has never disconnected.

status : locks_held : optional string

Space-separated list of the names of OVSDB locks that the connection holds. Omitted if the connection does not hold any locks.

status : locks_waiting : optional string

Space-separated list of the names of OVSDB locks that the connection is currently waiting to acquire. Omitted if the connection is not waiting for any locks.

status : locks_lost : optional string

Space-separated list of the names of OVSDB locks that the connection has had stolen by another OVSDB client. Omitted if no locks have been stolen from this connection.

status : n_connections : optional string, containing an integer, at
least 2

When target specifies a connection method that listens for inbound connections (e.g. ptcp: or pssl: ) and more than one connection is actually active, the value is the number of active connections. Otherwise, this key-value pair is omitted.

status : bound_port : optional string, containing an integer

When target is ptcp: or pssl: , this is the TCP port on which the OVSDB server is listening. (This is particularly useful when target specifies a port of 0, allowing the kernel to choose any available port.)

Common Columns:

The overall purpose of these columns is described under Common Columns at the beginning of this document.
external_ids : map of string-string pairs
other_config : map of string-string pairs

SSL TABLE

SSL/TLS configuration for ovn-sb database access.

Summary:

Common Columns:

Details:

private_key : string

Name of a PEM file containing the private key used as the switch’s identity for SSL/TLS connections to the controller.

certificate : string

Name of a PEM file containing a certificate, signed by the certificate authority (CA) used by the controller and manager, that certifies the switch’s private key, identifying a trustworthy switch.

ca_cert : string

Name of a PEM file containing the CA certificate used to verify that the switch is connected to a trustworthy controller.

bootstrap_ca_cert : boolean

If set to true , then Open vSwitch will attempt to obtain the CA certificate from the controller on its first SSL/TLS connection

and save it to the named PEM file. If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL/TLS connections must be authenticated by a certificate signed by the CA certificate thus obtained. This option exposes the SSL/TLS connection to a man-in-the-middle attack obtaining the initial CA certificate. It may still be useful for bootstrapping.

ssl_protocols : string

Range or a comma- or space-delimited list of the SSL/TLS protocols to enable for SSL/TLS connections.

Supported protocols include TLSv1 (deprecated), TLSv1.1 (deprecated), TLSv1.2 and TLSv1.3 . Ranges can be provided in a form of two protocol names separated with a dash ( TLSv1.1-TLSv1.2 ), or as a single protocol name with a plus sign ( TLSv1.2+ ). The value can be a list of protocols or exactly one range. The range is a preferred way of specifying protocols and the configuration always behaves as if the range between the minimum and the maximum specified version is provided, i.e., if the value is set to TLSv1.1,TLSv1.3 , the TLSv1.2 will also be enabled as if it was a range. Regardless of order, the highest protocol supported by both sides will be chosen when making the connection.

The default when this option is omitted is TLSv1.2+ .

ssl_ciphers : string

List of ciphers (in OpenSSL cipher string format) to be supported for SSL/TLS connections with TLSv1.2 and earlier. The default when this option is omitted is DEFAULT:@SECLEVEL=2 .

ssl_ciphersuites : string

List of ciphersuites (in OpenSSL ciphersuites string format) to be supported for SSL/TLS connections with TLSv1.3 and later. Default value from OpenSSL will be used when this option is omitted.

Common Columns:

The overall purpose of these columns is described under Common Columns at the beginning of this document.
external_ids : map of string-string pairs

DNS TABLE

Each row in this table stores the DNS records. The OVN action dns_lookup uses this table for DNS resolution.

Summary:

Common Columns:

Details:

records : map of string-string pairs

Key-value pair of DNS records with DNS query name as the key and a string of IP address(es) separated by comma or space as the

value. ovn-northd stores the DNS query name in all lowercase in order to facilitate case-insensitive lookups.

Example: "vm1.ovn.org" = "10.0.0.4 aef0::4"

datapaths : set of 1 or more Datapath_Binding s

The DNS records defined in the column records will be applied only to the DNS queries originating from the datapaths defined in this column.

options : ovn-owned : optional string

This column indicates that all the Domains in this table are owned by OVN, and all DNS queries for those domains will be answered locally by either an IP address or DNS rejection .

Common Columns:

external_ids : map of string-string pairs

See External IDs at the beginning of this document.

RBAC_Role TABLE

Role table for role-based access controls.

Summary:

Details:

name : string

The role name, corresponding to the role column in the Connection table.

permissions : map of string-weak reference to RBAC_Permission pairs

A mapping of table names to rows in the RBAC_Permission table.

RBAC_Permission TABLE

Permissions table for role-based access controls.

Summary:

Details:

table : string

Name of table to which this row applies.

authorization : set of strings

Set of strings identifying columns and column:key pairs to be compared with client ID. At least one match is required in order to be authorized. A zero-length string is treated as a special value indicating all clients should be considered authorized.

insert_delete : boolean

When "true", row insertions and authorized row deletions are permitted.

update : set of strings

Set of strings identifying columns and column:key pairs that authorized clients are allowed to modify.

Gateway_Chassis TABLE

Association of Port_Binding rows of type chassisredirect to a Chassis . The traffic going out through a specific chassisredirect port will be

redirected to a chassis, or a set of them in high availability configurations.

Summary:

Common Columns:

Details:

name : string (must be unique within table)

Name of the Gateway_Chassis .

A suggested, but not required naming convention is ${port_name}_${chassis_name} .

chassis : optional weak reference to Chassis

The Chassis to which we send the traffic.

priority : integer, in range 0 to 32,767

This is the priority the specific Chassis among all Gateway_Chassis belonging to the same Port_Binding .

options : map of string-string pairs

Reserved for future use.

Common Columns:

The overall purpose of these columns is described under Common Columns at the beginning of this document.
external_ids : map of string-string pairs

HA_Chassis TABLE

Summary:

Common Columns:

Details:

chassis : optional weak reference to Chassis

The Chassis which provides the HA functionality.

priority : integer, in range 0 to 32,767

Priority of the HA chassis. Chassis with highest priority will be the active chassis in the HA chassis group.

Common Columns:

external_ids : map of string-string pairs

See External IDs at the beginning of this document.

HA_Chassis_Group TABLE

Table representing a group of chassis which can provide High availability services. Each chassis in the group is represented by the table HA_Chassis . The HA chassis with highest priority will be the active chassis of this group. If the active chassis failover is detected, the HA chassis with the next higher priority takes over the

responsibility of providing the HA. If ha_chassis_group column of the table Port_Binding references this table, then this HA chassis group provides the gateway functionality and redirects the gateway traffic to the active chassis of this group.

Summary:

Common Columns:

Details:

name : string (must be unique within table)

Name of the HA_Chassis_Group . Name should be unique.

ha_chassis : set of HA_Chassis es

A list of HA_Chassis which belongs to this group.

ref_chassis : set of weak reference to Chassis

The set of Chassis that reference this HA chassis group. To determine the correct Chassis , find the chassisredirect type Port_Binding that references this HA_Chassis_Group . This Port_Binding is derived from some particular logical router. Starting from that LR, find the set of all logical switches and routers connected to it, directly or indirectly, across router ports that link one LRP to another or to a LSP. For each LSP in these logical switches, find the corresponding Port_Binding and add its bound Chassis (if any) to ref_chassis .

Common Columns:

external_ids : map of string-string pairs

See External IDs at the beginning of this document.

Controller_Event TABLE

Database table used by ovn-controller to report CMS related events. Please note there is no guarantee a given event is written exactly once

in the db. It is CMS responsibility to squash duplicated lines or to filter out duplicated events

Summary:

Details:

event_type : string, must be empty_lb_backends

Event type occurred

event_info : map of string-string pairs

Key-value pairs used to specify event info to the CMS. Possible values are:

chassis : optional weak reference to Chassis

This column is a Chassis record to identify the chassis that has managed a given event.

seq_num : integer

Event sequence number. Global counter for controller generated events. It can be used by the CMS to detect possible duplication of the same event.

IP_Multicast TABLE

IP Multicast configuration options. For now only applicable to IGMP.

Summary:

Querier configuration options:

Details:

datapath : weak reference to Datapath_Binding (must be unique within
table)

Datapath_Binding entry for which these configuration options are

defined.

enabled : optional boolean

Enables/disables multicast snooping. Default: disabled.

querier : optional boolean

Enables/disables multicast querying. If enabled then multicast querying is enabled by default.

table_size : optional integer

Limits the number of multicast groups that can be learned. Default: 2048 groups per datapath.

idle_timeout : optional integer

Configures the idle timeout (in seconds) for IP multicast groups if multicast snooping is enabled. Default: 300 seconds.

query_interval : optional integer

Configures the interval (in seconds) for sending multicast queries if snooping and querier are enabled. Default: idle_timeout /2 seconds.

seq_no : integer

ovn-controller reads this value and flushes all learned multicast groups when it detects that seq_no was changed.

Querier configuration options:

The ovn-controller process that runs on OVN hypervisor nodes uses the following columns to determine field values in IGMP/MLD queries that it originates:
eth_src : string

Source Ethernet address.

ip4_src : string

Source IPv4 address.

ip6_src : string

Source IPv6 address.

query_max_resp : optional integer

Value (in seconds) to be used as "max-response" field in multicast queries. Default: 1 second.

IGMP_Group TABLE

Contains learned IGMP groups indexed by address/datapath/chassis.

Summary:

Details:

address : string

Destination IPv4 address for the IGMP group.

protocol : string

Group protocol version either IGMPv1,v2,v3 or MLDv1,v2.

datapath : optional weak reference to Datapath_Binding

Datapath to which this IGMP group belongs.

chassis : optional weak reference to Chassis

Chassis to which this IGMP group belongs.

ports : set of weak reference to Port_Binding s

The destination port bindings for this IGMP group.

chassis_name : string

The chassis that inserted this record. This column is used for RBAC purposes only.

Service_Monitor TABLE

Each row in this table configures monitoring a service for its liveness. The service can be an IPv4 TCP or UDP service. ovn-controller periodically sends out service monitor packets and updates the status of the service.

ovn-northd uses this feature to implement the load balancer health check feature offered to the CMS through the northbound database.

Summary:

Configuration:

Status Reporting:

Common Columns:

Details:

Configuration:

ovn-northd sets these columns and values to configure the service monitor.
ip : string

IP of the service to be monitored. Only IPv4 is supported.

protocol : optional string, either tcp or udp

The protocol of the service.

port : integer, in range 0 to 65,535

The TCP or UDP port of the service.

logical_port : string

The VIF of the logical port on which the service is running. The ovn-controller that binds this logical_port monitors the service by sending periodic monitor packets.

src_mac : string

Source Ethernet address to use in the service monitor packet.

src_ip : string

Source IPv4 or IPv6 address to use in the service monitor packet.

chassis_name : string

The name of the chassis where the logical port is bound.

options : interval : optional string, containing an integer

The interval, in seconds, between service monitor checks.

options : timeout : optional string, containing an integer

The time, in seconds, after which the service monitor check times out.

options : success_count : optional string, containing an integer

The number of successful checks after which the service is considered online .

options : failure_count : optional string, containing an integer

The number of failure checks after which the service is considered offline .

Status Reporting:

The ovn-controller on the chassis that hosts the logical_port updates this column to report the service’s status.
status : optional string, one of error , offline , or online

For TCP service, ovn-controller sends a SYN to the service and expects an ACK response to consider the service to be online .

For UDP service, ovn-controller sends a UDP packet to the service and doesn’t expect any reply. If it receives an ICMP reply, then it considers the service to be offline .

Common Columns:

external_ids : map of string-string pairs

See External IDs at the beginning of this document.

Load_Balancer TABLE

Each row represents a load balancer.

Summary:

Load_Balancer options:

options : hairpin_orig_tuple

optional string, either true or false

Common Columns:

Details:

name : string

A name for the load balancer. This name has no special meaning or purpose other than to provide convenience for human interaction with the ovn-nb database.

vips : map of string-string pairs

A map of virtual IP addresses (and an optional port number with : as a separator) associated with this load balancer and their corresponding endpoint IP addresses (and optional port numbers with : as separators) separated by commas.

protocol : optional string, one of sctp , tcp , or udp

Valid protocols are tcp , udp , or sctp . This column is useful when a port number is provided as part of the vips column. If this column is empty and a port number is provided as part of vips column, OVN assumes the protocol to be tcp .

datapaths : set of Datapath_Binding s

Datapaths to which this load balancer applies to.

datapath_group : optional Logical_DP_Group

Deprecated. The group of datapaths to which this load balancer applies to. This means that the same load balancer applies to all datapaths in a group.

ls_datapath_group : optional Logical_DP_Group

The group of datapaths to which this load balancer applies to. This means that the same load balancer applies to all datapaths in a group.

lr_datapath_group : optional Logical_DP_Group

The group of logical router datapaths to which this load balancer applies to. This means that the same load balancer applies to all datapaths in a group.

Load_Balancer options:

options : hairpin_snat_ip : optional string

IP to be used as source IP for packets that have been hair-pinned after load balancing. This value is automatically populated by ovn-northd .

options : hairpin_orig_tuple : optional string, either true or false

This value is automatically set to true by ovn-northd when original destination IP and transport port of the load balanced packets are stored in registers reg1, reg2, xxreg1 .

Common Columns:

external_ids : map of string-string pairs

See External IDs at the beginning of this document.

BFD TABLE

Contains BFD parameter for ovn-controller bfd configuration.

Summary:

Configuration:

Status Reporting:

Details:

Configuration:

src_port : integer, in range 49,152 to 65,535

udp source port used in bfd control packets. The source port MUST be in the range 49152 through 65535 (RFC5881 section 4).

disc : integer

A unique, nonzero discriminator value generated by the transmitting system, used to demultiplex multiple BFD sessions between the same pair of systems.

logical_port : string

OVN logical port when BFD engine is running.

dst_ip : string

BFD peer IP address.

min_tx : integer

This is the minimum interval, in milliseconds, that the local system would like to use when transmitting BFD Control packets,

less any jitter applied. The value zero is reserved.

min_rx : integer

This is the minimum interval, in milliseconds, between received BFD Control packets that this system is capable of supporting, less any jitter applied by the sender. If this value is zero, the transmitting system does not want the remote system to send any periodic BFD Control packets.

detect_mult : integer

Detection time multiplier. The negotiated transmit interval, multiplied by this value, provides the Detection Time for the receiving system in Asynchronous mode.

chassis_name : string

The name of the chassis where the logical port is bound.

options : map of string-string pairs

Reserved for future use.

external_ids : map of string-string pairs

See External IDs at the beginning of this document.

Status Reporting:

status : string, one of admin_down , down , init , or up

BFD port logical states. Possible values are:

FDB TABLE

This table is primarily used to learn the MACs observed on a VIF (or a localnet port with ’localnet_learn_fdb’ enabled) which belongs to a Logical_Switch_Port record in OVN_Northbound whose port security is disabled and ’unknown’ address set. If port security is disabled on a Logical_Switch_Port record, OVN should allow traffic with any source mac from the VIF. This table will be used to deliver a packet to the VIF, If a packet’s eth.dst is learnt.

Summary:

Details:

mac : string

The learnt mac address.

dp_key : integer, in range 1 to 16,777,215

The key of the datapath on which this FDB was learnt.

port_key : integer, in range 1 to 16,777,215

The key of the port binding on which this FDB was learnt.

timestamp : integer

The timestamp in msec when the FDB was added or updated. Records that existed before this column will have 0.

Static_MAC_Binding TABLE

Each record represents a Static_MAC_Binding entry for a logical router.

Summary:

Details:

logical_port : string

The logical router port for the binding.

ip : string

The bound IP address.

mac : string

The Ethernet address to which the IP is bound.

override_dynamic_mac : boolean

Override dynamically learnt MACs.

datapath : Datapath_Binding

The logical datapath to which the logical router port belongs.

Chassis_Template_Var TABLE

Each record represents the set of template variable instantiations for a given chassis and is populated by ovn-northd from the contents of the OVN_Northbound.Chassis_Template_Var table.

Summary:

Details:

chassis : string (must be unique within table)

The chassis this set of variable values applies to.

variables : map of string-string pairs

The set of variable values for a given chassis.

Advertised_Route TABLE

Each record represents a route that should be exported from ovn to the outside network fabric. It is populated by ovn-northd based on the

addresses, routes and NAT Entries of a OVN_Northbound.Logical_Router_Port .

Summary:

Details:

datapath : Datapath_Binding

The datapath belonging to the OVN_Northbound.Logical_Router that this route is valid for.

logical_port : Port_Binding

This is the Port_Binding that the router will send packets out that are received for the below prefix.

ip_prefix : string

IP prefix of this route (e.g. 192.168.100.0/24).

tracked_port : optional Port_Binding

In combination with a host ip_prefix this tracks the port OVN will forward the packets for this destination to. If set the

ip_prefix will always contain a /32 (for ipv4) or /128 (for ipv6) prefix. An announcing chassis can use this information to check if this destination is local and adjust the route priorities based on that.

external_ids : map of string-string pairs

See External IDs at the beginning of this document.

Learned_Route TABLE

Each record represents a route that learned by ovn using some dynamic routing logic outside of ovn. It is populated by ovn-controller with routes it learns locally.

Summary:

Details:

datapath : Datapath_Binding

The datapath belonging to the OVN_Northbound.Logical_Router that this route is valid for.

logical_port : Port_Binding

This is the Port_Binding that the route was learned on.

ip_prefix : string

IP prefix of this route (e.g. 192.168.100.0/24).

nexthop : string

This is the nexthop ip we learned from outside of OVN.

external_ids : map of string-string pairs

See External IDs at the beginning of this document.

ECMP_Nexthop TABLE

Each record in this table represents an active next-hop for ECMP routes created with --ecmp-symmetric-reply option that are committed by ovn-northd to ovs connection tracker. The ECMP_Nexthop table is used by ovn-controller to track active ct entries and to flush stale ones.

Summary:

Details:

nexthop : string

Nexthop IP address for this ECMP route. Nexthop IP address should be the IP address of a connected router port or the IP

address of an external device used as nexthop for the given destination.

port : Port_Binding

The reference to Port_Binding table for the port used to connect to the configured next-hop.

datapath : Datapath_Binding

The reference to Datapath_Binding table for the datapath where the port used to connect to the configured next-hop is running.

mac : string

Nexthop mac address.

external_ids : map of string-string pairs

See External IDs at the beginning of this document.

ACL_ID TABLE

Each record represents an identifier that ovn-northd needs to synchronize with instances of ovn-controller . The UUID of each record corresponds directly with an ACL record in the northbound database.

Summary:

Details:

id : integer, in range 0 to 32,767

An identifier corresponding to a northbound allow-established ACL.