<div dir="ltr">Sumit, <div><br></div><div style>It would be good in the blueprint document to describe or atleast outline how the security groups feature and the FWaaS interact. </div><div style>To me there is a notion of a perimeter firewall that enforces the rules between tenant resources and outside world. This would be typically be enforced in an (virtual) appliance. </div>
<div style>Then there is the notion of security groups that (at least in my mind) would have to be distributed in nature and needs centralized entity validating and ensuring the security groups across all the tenants as the entities get created, destroyed or moved around. </div>
<div style><br></div><div style>I have some thoughts on this and I will try to elaborate in the FWaaS document. </div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Apr 6, 2013 at 12:06 PM, Sumit Naiksatam <span dir="ltr"><<a href="mailto:sumitnaiksatam@gmail.com" target="_blank">sumitnaiksatam@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">We are trying to frame a model for the logical Quantum resources that will be required to provide a Firewall service interface. In general, the Quantum logical resource model is always independent of any particular backend implementation, and it does not prescribe support via physical devices or virtual appliances; that is left to the backend implementation. Same assumptions are true in this case as well.<div>
<br></div><div>This is a DC use case.</div><div><br></div><div>Thanks,</div><div>~Sumit.</div><div class="HOEnZb"><div class="h5"><div><br><div class="gmail_quote">On Sat, Apr 6, 2013 at 10:16 AM, balaji patnala <span dir="ltr"><<a href="mailto:patnala003@gmail.com" target="_blank">patnala003@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>Hi Sumit,</div>
<div> </div>
<div>Do you mean that the vendor plugin-agent must be capable of mapping this quantum firewall instance and support both physical firewall and virtual firewall deployments.?</div>
<div> </div>
<div>I know that tenant will not have any visibility on physical/virtual firewall. I think we need to have more robust architecture for firewall so that it can be adapted to the DC networks.</div>
<div> </div>
<div>Regards,</div>
<div>Balaji.P<br><br></div>
<div class="gmail_quote">On Fri, Apr 5, 2013 at 11:15 AM, Sumit Naiksatam <span dir="ltr"><<a href="mailto:sumitnaiksatam@gmail.com" target="_blank">sumitnaiksatam@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">Inline...<br><br>
<div class="gmail_quote">
<div>On Thu, Apr 4, 2013 at 10:37 PM, balaji patnala <span dir="ltr"><<a href="mailto:patnala003@gmail.com" target="_blank">patnala003@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">
<div>Hi Sumit,</div>
<div> </div>
<div>"* The firewall resource as expressed in the model is a logical instance in the Quantum model. It's mapping to a physical/virtual appliance is left to the backend."</div>
<div> </div>
<div>Is it like we are trying to create a "firewall instance" in Quantum for a Tenant and then we want to map this Quantum Instance to "Physical" or "Virtual" Firewall Appliance.?</div></blockquote>
<div><br></div></div>
<div>Sumit: Yes, the backend/plugin implementation would do this but may not be necessarily visible to the tenant. </div>
<div>
<div>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">
<div> </div>
<div>Can you through some light on this?</div>
<div> </div>
<div>Regards,</div>
<div>Balaji.P<br><br></div>
<div class="gmail_quote">On Fri, Apr 5, 2013 at 6:03 AM, Sumit Naiksatam <span dir="ltr"><<a href="mailto:sumitnaiksatam@gmail.com" target="_blank">sumitnaiksatam@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">
<p>Just wanted to give an update on the call today - we had a fairly large number of people attending from PayPal, VMware, Cisco, Big Switch (to name a few that I noted).</p>
<p>Discussion notes:</p>
<p>* Decided to focus in the firewall_rule attributes - current definition of attributes is not clear. Although the intent is to capture these as flexible placeholder objects, the document is not very indicative. Needs to be articulated better (e.g. source_ip_address should just be a "source" string).</p>
<p>* Need a little more deliberation on which attributes in the firewall_rules need to form the core set of attributes; other lesser used/vendor-centric attributes can be modeled as "extended attributes".</p>
<p>* The zone attribute/resource definition needs to be expanded.</p>
<p>* It might be more practical to model a firewall_rule to firewall_policy relationship as 1:1. If we take that approach, it might be helpful to have a sequence number attribute in the firewall_rule.</p>
<p>* It might be helpful to model firewall instance to firewall_policy relationship as 1:many</p>
<p>* The firewall resource as expressed in the model is a logical instance in the Quantum model. It's mapping to a physical/virtual appliance is left to the backend.</p>
<p>* Details on use cases are required. Will help to validate against the model.</p>
<p>In general, we seem to have a decent start to the base model. No major objections on the workflow.</p>
<p>We will continue to have discussions over emails, and have another call next week.</p>
<p>Please feel free to add anything I might have missed.</p>
<p>Thanks,</p>
<p>~Sumit.</p><br>
<div class="gmail_quote">
<div>On Wed, Apr 3, 2013 at 10:47 AM, Sumit Naiksatam <span dir="ltr"><<a href="mailto:sumitnaiksatam@gmail.com" target="_blank">sumitnaiksatam@gmail.com</a>></span> wrote:<br></div>
<div>
<div>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">
<div dir="ltr">We have set up a conference call scheduled for Thursday April 4th to discuss this topic as a preparation for the upcoming summit.
<div><br></div>
<div>Agenda:</div>
<div>Current draft: <a href="https://wiki.openstack.org/wiki/Quantum/FWaaS/API" target="_blank">https://wiki.openstack.org/wiki/Quantum/FWaaS/API</a></div>
<div><br></div>
<div>Logistics (thanks to Vinay/Anand, PayPal):</div>
<div><br></div>
<div><pre style="WHITE-SPACE:pre-wrap;FONT-SIZE:14px">Where: Conference Bridge - <a href="tel:%28855%29%20227%201767%20x%207152259" value="+18552271767" target="_blank">(855) 227 1767 x 7152259</a></pre><pre style="WHITE-SPACE:pre-wrap;FONT-SIZE:14px">
<span style="FONT-FAMILY:Calibri,sans-serif;WHITE-SPACE:normal">When: Thursday, April 04, 2013 2:00 PM-3:00 PM. (UTC-08:00) Pacific Time (US & Canada)</span><br style="FONT-FAMILY:arial,sans-serif;WHITE-SPACE:normal;FONT-SIZE:13px">
<div style="FONT-FAMILY:arial,sans-serif;WHITE-SPACE:normal;FONT-SIZE:13px" class="gmail_quote"><div style="FONT-FAMILY:Calibri,sans-serif;WORD-WRAP:break-word;FONT-SIZE:14px"><tt><pre style="WHITE-SPACE:pre-wrap">Where: Conference Bridge - <a href="tel:%28855%29%20227%201767%20x%207152259" value="+18552271767" target="_blank">(855) 227 1767 x 7152259</a></pre>
<pre style="WHITE-SPACE:pre-wrap"><div style="FONT-FAMILY:Calibri,sans-serif;WHITE-SPACE:normal">Conf. Code 7152259</div><div style="FONT-FAMILY:Calibri,sans-serif;WHITE-SPACE:normal">Phones Numbers:</div><div style="FONT-FAMILY:Calibri,sans-serif;WHITE-SPACE:normal">
<ul><li style="MARGIN-LEFT:15px"><a href="tel:%28855%29%20227-1767" value="+18552271767" target="_blank">(855) 227-1767</a>(USA) - 08003765931(UK) </li><li style="MARGIN-LEFT:15px">0008006103229 (India – Toll Free)</li><li style="MARGIN-LEFT:15px">
81080024322044 (Moscow), 4992701688(Moscow)</li></ul><p>Web Conf: <a href="https://myroom-na.adobeconnect.com/anandpalanisamy/" rel="nofollow" target="_blank">https://myroom-na.adobeconnect.com/anandpalanisamy/</a> </p>
<p>
More Numbers: <a href="https://www.intercallonline.com/portlets/scheduling/viewNumbers/listNumbersByCode.do?confCode=7152259&name=&email=&selectedProduct=joinMeeting" rel="nofollow" target="_blank">https://www.intercallonline.com/portlets/scheduling/viewNumbers/listNumbersByCode.do?confCode=7152259&name=&email=&selectedProduct=joinMeeting</a></p>
<p>Thanks,</p><p>~Sumit.</p></div></pre></tt></div></div></pre></div></div></blockquote></div></div></div><br><br>_______________________________________________<br>OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br><br></blockquote></div><br><br>_______________________________________________<br>
OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div></div></div><br><br>_______________________________________________<br>OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>Vinay Bannai<br>Email: <a href="mailto:vbannai@gmail.com">vbannai@gmail.com</a><br>Google Voice: 415 938 7576<br>
</div>