This howto focusses on the steps that you have to take to switch from the regular bridge to Open vSwitch.

 My SETUP

My server runs Debian 6.0.6 Squeeze. It has only 1 external IP address. That IP address is bound to eth0.

It currenlty has a br0 configured with an internal (RFC1918) ip address. All virtual machines are connected to that bridge. I’m using iptables and natting to make sure that all traffic on port 80 is forwarded to my webserver, port 25 to the mailserver etc.

Bridge configuration in /etc/network/interfaces

auto br0
iface br0 inet static
  address 172.16.11.1
  network 172.16.11.0
  netmask 255.255.255.0 
  broadcast 172.16.11.255
  bridge_stp on
  bridgefd 0 
  bridge_maxwait 0 
  pre-up brctl addbr br0
  post-down brctl delbr br0
  post-up /etc/network/firewallscript.sh

Building the packages

Since Debian doesn’t provide any packages for Open-vSwitch on Squeeze, I decided to create that package myself.

I’m going to use the latest version since I’m interested in the latest features as well. Let’s start by cloning the source tree.

 git clone git://openvswitch.org/openvswitch

Building the package itself. I’ve omitted the output.

cd openvswitch
./boot.sh
./configure
dpkg-buildpackage -b

This resulted in the following list of packages being created.

rivy@shell:~/src/openvswitch/src/openvswitch$ ls -l ../
total 13736
drwxr-xr-x 19 rivy rivy 4096 Nov 20 15:07 openvswitch
-rw-r--r-- 1 rivy rivy 272814 Nov 20 15:07 openvswitch-brcompat_1.9.90-1_amd64.deb
-rw-r--r-- 1 rivy rivy 664470 Nov 20 15:07 openvswitch-common_1.9.90-1_amd64.deb
-rw-r--r-- 1 rivy rivy 297856 Nov 20 15:07 openvswitch-controller_1.9.90-1_amd64.deb
-rw-r--r-- 1 rivy rivy 2328744 Nov 20 15:07 openvswitch-datapath-dkms_1.9.90-1_all.deb
-rw-r--r-- 1 rivy rivy 2395538 Nov 20 15:07 openvswitch-datapath-source_1.9.90-1_all.deb
-rw-r--r-- 1 rivy rivy 6181626 Nov 20 15:07 openvswitch-dbg_1.9.90-1_amd64.deb
-rw-r--r-- 1 rivy rivy 32656 Nov 20 15:07 openvswitch-ipsec_1.9.90-1_amd64.deb
-rw-r--r-- 1 rivy rivy 26310 Nov 20 15:07 openvswitch-pki_1.9.90-1_all.deb
-rw-r--r-- 1 rivy rivy 1610624 Nov 20 15:07 openvswitch-switch_1.9.90-1_amd64.deb
-rw-r--r-- 1 rivy rivy 45264 Nov 20 15:07 openvswitch-test_1.9.90-1_all.deb
-rw-r--r-- 1 rivy rivy 4902 Nov 20 15:07 openvswitch_1.9.90-1_amd64.changes
-rw-r--r-- 1 rivy rivy 48778 Nov 20 15:07 ovsdbmonitor_1.9.90-1_all.deb
-rw-r--r-- 1 rivy rivy 84260 Nov 20 15:07 python-openvswitch_1.9.90-1_all.deb
rivy@shell:~/src/openvswitch/src/openvswitch$

In case you don’t want to build the package. openvswitch_1.9.90-1_amd64.tgz.

Installing and configuring

Now install those packages on the server that has KVM running.

dpkg -i openvswitch-*

Make sure all dependencies are met. If not, run ‘apt-get -f install’ and rerun the installation.

Now, make sure we provide compatibility with the Linux bridge. Uncomment and change ‘no’ to ‘yes’ in /etc/default/openvswitch-switch

BRCOMPAT=yes

Make sure the module is built and will be loadable at boot time.

module-assistant auto-install openvswitch-datapath

Adapt the bridge settings in /etc/network/interfaces

#auto br0
iface br0 inet static
  address 172.16.11.1
  network 172.16.11.0
  netmask 255.255.255.0 
  broadcast 172.16.11.255
  bridge_stp on
  bridgefd 0 
  bridge_maxwait 0 
#  pre-up ovs-vsctl add-br br0 ( not needed as the switch config is kept in DB)
#  post-down ovs-vsctl del-br br0
  post-up /etc/network/firewallscript.sh

Replace the existing ifup scripts with scripts that make use of the new Open vSwitch. Therefor we keep a copy of the old files and create 2 new files.

cd /etc/kvm
mv kvm-ifdown kvm-ifdown-original
mv kvm-ifup kvm-ifup-original

Contents of new  /etc/kvm/kvm-ifup

#!/bin/sh
switch='br0'
/sbin/ifconfig $1 0.0.0.0 up
ovs-vsctl --if-exists del-port ${switch} $1
ovs-vsctl add-port ${switch} $1

Contents of new /etc/kvm/kvm-ifdown

#!/bin/sh
switch='br0'
/sbin/ifconfig $1 0.0.0.0 up
ovs-vsctl del-port ${switch} $1

Make sure that the new module is loaded before ‘bridge’. I did this by adding ‘openvswitch’ to ‘/etc/modules’.

echo 'openvswitch' >> /etc/modules

Next step shutdown all guests and remove the old bridge. When the bridge is removed, you can unload the old ‘bridge’ module and load the new ‘openvswitch’ module.

virsh list
virsh shutdown <all your guests>
ifconfig br0 down
rmmod bridge
modprobe openvswitch
service openvswitch-controller start
service openvswitch-switch start
service networking restart
service libvirt-bin restart

If all goes well, you guests should be using the new Open vSwitch.

To check if this is correct, issue the following command. You should have a vnetX interface for each guest.

# ovs-vsctl show
c9900989-6f68-4da6-b739-23b106efcab5
 Bridge "br0"
   Port "vnet6"
     Interface "vnet6"
   Port "vnet5"
     Interface "vnet5"
   Port "vnet4"
     Interface "vnet4"
   Port "vnet3"
     Interface "vnet3"
   Port "vnet0"
     Interface "vnet0"
   Port "vnet1"
     Interface "vnet1"
   Port "br0"
     Interface "br0"
       type: internal
   Port "vnet2"
     Interface "vnet2"
 ovs_version: "1.9.90"