Environment

• Product: ZStack Cloud
• Version: All versions that deploy a VPC vRouter image as a customized VM.
• Component: VPC vRouter, VPC management network, ZStack management node on port 8080, and the security policy or firewall between the management networks.
• Trigger/Condition: VPC vRouter creation consistently times out, and zvr.log reports that the VPC vRouter cannot reach the management node on port 8080.

Symptoms

• VPC vRouter creation in the UI times out.
• TCP ports 22 and 7272 between the management node and the VPC vRouter management IP are reachable.
• zvr.log on the VPC vRouter reports that the VPC vRouter cannot connect to the management node on port 8080.

Diagnosis

1. From the management node, verify that ports 22 and 7272 on the VPC vRouter management IP are reachable:

   # telnet <vpc-router-management-ip> 22
   # telnet <vpc-router-management-ip> 7272

2. Log in to the VPC vRouter and inspect zvr.log. Confirm that the log states that the connection to the management node on port 8080 fails.
3. Confirm a firewall or security policy between the cloud platform management network and the VPC management network is blocking port 8080.

Cause

The VPC vRouter must communicate with the ZStack management node on TCP port 8080 to register and pull configuration. A network firewall or security policy between the VPC management network and the cloud platform management network blocks that port, so the vRouter cannot complete its handshake with the management node and creation times out.

Resolution

1. Prerequisites

• Identify the IP ranges of the cloud platform management network and the VPC management network.
• Identify the firewall or security policy device between the networks.
• Confirm the operator who owns the security policy and request a change window.

2. Procedure

Step 1. Allow port 8080 between the VPC management network and the cloud platform management network

Adjust the firewall or security policy to allow TCP port 8080 traffic from the VPC management network to the cloud platform management network. The platform management network and the VPC management network must be able to reach each other.

Step 2. Plan the VPC management network to avoid future conflicts

The VPC management network must be routable to the cloud platform management network. Do not reuse the public network as the VPC management network. The following two network topologies are recommended:

• Scenario 1 — Same L2 subnet as the host management network. The host management IP is configured on br_bond0. In the platform, create an L2NoVlanNetwork based on bond0, and then create the VPC management network on that L2 network.
• Scenario 2 — Different subnet from the host management network with L3 connectivity. The host management IP is configured on br_bond0. In the platform, create an L2VlanNetwork based on bond0, and then create the VPC management network on that L2 network. The platform automatically sends specific routes for the host management network to the VPC vRouter.

Step 3. Retry the VPC vRouter creation

Retry the VPC vRouter creation task in the UI and confirm it completes within the timeout window.

Verification

• VPC vRouter creation completes successfully in the UI.
• zvr.log no longer reports connection failures on port 8080.
• A Telnet connection from the management node to the VPC vRouter management IP on port 8080 succeeds.
• The VPC vRouter can register with the management node and serve VPC traffic.

Risks and rollback

• TCP port 8080 must remain open between the VPC management network and the cloud platform management network for the VPC vRouter to operate. Removing the rule makes VPC functionality unavailable.
• Plan VPC management network changes in advance to avoid affecting the host management network.