Security groups and security group rules allows administrators and tenants the ability to specify the type of traffic and direction (ingress/egress) that is allowed to pass through a port. A security group is a container for security group rules.
When a port is created in quantum it is associated with a security group. If a security group is not specified the port will be associated with a default security group. By default this group will drop all ingress traffic and allow all egress. Rules can be added to this group in order to change the behaviour.
In order to use nova security groups in quantum,
configure the following files. In
/etc/quantum/quantum.conf
, set
proxy_mode True within the SECURITYGROUP section. Ensure
that the quantum-server
/etc/quantum/quantum.conf
file
has proxy_mode=False so that the quantum API service does
not work as a proxy for nova API calls. Then in
/etc/nova/nova.conf
set
security_group_handler to be
nova.network.sg.SecurityGroupHandlerQuantumProxy and
quantum_port_security=True in the DEFAULT section. Once
the files are changed, restart quantum-server, nova-api,
and the nova-compute services in order to pick up the
changes.
![]() | Note |
---|---|
If quantum-server is set to proxy_mode=True then you will not be able to use security groups through the quantum api and you will have to control security groups through nova configuration and commands. |