G.5 Before a VM Instance has been Booted: Allowed Address Pairs

If you want to associate additional allowed IP addresses with a port before it is associated with a VM instance then you need to first create the port and then associate one or more ports with a VM instance when it is booted. The command to create a new port with defined allowed address pairs is of the following form:

# neutron port-create –-name <Port Name> --fixed-ip subnet-id=$(neutron subnet-show –f value –F id <Subnet name>),ip_address=<Target IP address>
$(neutron net-show –f value –F id <Network name>) --allowed_address_pairs list=true type=dict ip_address=<VIP address to be added>

Where the bolded items have the following meaning:

• <Port Name>

  This is effectively a string alias for the port that is useful when trying to locate the ID for the port but the –-name <Port Name> portion of the command is completely optional.

• <Subnet name>

  The name of the subnet to which the port should be added.

• <Target IP address>

  The unique IP address to be associated with the port.

• <Network Name>

  The name of the network with which the port should be associated.

• <VIP address to be added>

  This parameter value has the same meaning as described in the previous section.

For example, if you wanted to indicate to Neutron that a new port should have an IP address of 10.133.97.133 on the ext-subnet subnet with a single allowed address pair, 10.133.97.134, then you would type a command similar to the following:

# neutron port-create –name foo --fixed-ip subnet-id=$(neutron subnet-show –f value –F id ext-subnet),ip_address=10.133.97.133 $(neutron net-show –f value –F id ext-net) --allowed_address_pairs list=true type=dict ip_address=10.133.97.134/32

Once the port or ports with the additional allowed addresses have been created, when you boot the VM instance use a nova boot command similar to the following:

# nova boot --flavor m1.xlarge --image testVMimage --nic port-id=$(neutron port-show –f value –F id <Port Name>) testvm3

where the flavor, image, and VM instance name values need to be replaced by values appropriate for your VM. If the port to be associated with the VM instance is not named, then you need to obtain the port’s ID using the neutron port-list command and replace the $(neutron port-show –f value –F id <Port Name>) sequence in the above command with the port’s ID value.