<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Bump in wire service can be within network (intra network) as you suggest OR between network ( inter network ). </div>
<div>Advantage of bump in wire is one does not need networking config inside the service. </div><div>Inter network bump in wire service is analogous to having service inserted on link between two routers without the routers knowing about it. <br>
<br>Regards<div>-Harshad</div><div><br></div></div><div><br>On Oct 24, 2013, at 10:22 PM, Sumit Naiksatam <<a href="mailto:sumitnaiksatam@gmail.com">sumitnaiksatam@gmail.com</a>> wrote:<br><br></div><blockquote type="cite">
<div><div dir="ltr">The bump-in-the-wire mode we were referring to here is the one where the firewall has both legs on the same subnet/network. The point that was trying to be made was that applying zones in that case would not make as much sense. At this point there is no proposal though to validate and restrict this particular case, or for that matter any combination of ports for the zone. If anyone has suggestions on what criteria to use to restrict the port membership for zones, we can definitely discuss it, but there is none on the table at the moment.<div>
<br></div><div>Thanks,</div><div>~Sumit.</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Oct 24, 2013 at 2:48 PM, Rajesh Mohan <span dir="ltr"><<a href="mailto:rajesh.mlists@gmail.com" target="_blank">rajesh.mlists@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">This is good discussion.<div><br></div><div>+1 for using Neutron ports for defining zones. I see Kaiwei's point but for DELL, neutron ports makes more sense.</div>
<div><br></div><div>I am not sure if I completely understood the bump-in-the-wire/zone discussion. DELL security appliance allows using different zones with bump-in-the-wire. If the firewall is inserted in bump-in-the-wire mode between router and LAN hosts, then it does makes sense to apply different zones on ports connected to LAN and Router. The there are cases where the end-users apply same zones on both sides but this is a decision we should leave to end customers. We should allow configuring zones in bump-in-the-wire mode as well.</div>
<div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Oct 23, 2013 at 12:08 PM, Sumit Naiksatam <span dir="ltr"><<a href="mailto:sumitnaiksatam@gmail.com" target="_blank">sumitnaiksatam@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Log from today's meeting:<div>
<p><span><a href="http://eavesdrop.openstack.org/meetings/networking_fwaas/2013/networking_fwaas.2013-10-23-18.02.log.html" target="_blank">http://eavesdrop.openstack.org/meetings/networking_fwaas/2013/networking_fwaas.2013-10-23-18.02.log.html</a></span></p>
</div><div><br></div><div>Action items for some of the folks included.</div><div><br></div><div>Please join us for the meeting next week.</div><div><div class="gmail_extra"><br>Thanks,</div><div class="gmail_extra">~Sumit.</div>
<div class="gmail_extra"><br><div class="gmail_quote">On Tue, Oct 22, 2013 at 2:00 PM, Sumit Naiksatam <span dir="ltr"><<a href="mailto:sumitnaiksatam@gmail.com" target="_blank">sumitnaiksatam@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Reminder - we will have the Neutron FWaaS IRC meeting tomorrow <span style="font-family:arial,sans-serif;font-size:13px">Wednesday 18:00 UTC (11 AM PDT).</span><div>
<span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div><div><span style="font-family:arial,sans-serif;font-size:13px">Agenda:</span></div><div><span style="font-family:arial,sans-serif;font-size:13px">* Tempest tests</span></div><div><span style="font-family:arial,sans-serif;font-size:13px">* Definition and use of zones</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">* Address Objects</span></div><div><span style="font-family:arial,sans-serif;font-size:13px">* Counts API</span></div><div><span style="font-family:arial,sans-serif;font-size:13px">* Service Objects</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">* Integration with service type framework</span></div><div><span style="font-family:arial,sans-serif;font-size:13px">* Open discussion - any other topics you would like to bring up for discussion during the summit.</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><font face="arial, sans-serif"><a href="https://wiki.openstack.org/wiki/Meetings/FWaaS" target="_blank">https://wiki.openstack.org/wiki/Meetings/FWaaS</a></font><br>
</div><div><font face="arial, sans-serif"><br></font></div><div><span style="font-family:arial,sans-serif;font-size:13px">Thanks,</span></div><div><span style="font-family:arial,sans-serif;font-size:13px">~Sumit.</span></div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sun, Oct 13, 2013 at 1:56 PM, Sumit Naiksatam <span dir="ltr"><<a href="mailto:sumitnaiksatam@gmail.com" target="_blank">sumitnaiksatam@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Hi All,<div><br></div><div>For the next of phase of FWaaS development we will be considering a number of features. I am proposing an IRC meeting on Oct 16th Wednesday 18:00 UTC (11 AM PDT) to discuss this.</div>
<div><br></div><div>The etherpad for the summit session proposal is here:</div><div><a href="https://etherpad.openstack.org/p/icehouse-neutron-fwaas" target="_blank">https://etherpad.openstack.org/p/icehouse-neutron-fwaas</a><br>
</div><div>
<br></div><div>and has a high level list of features under consideration.</div><div><br>Thanks,</div><div>~Sumit.</div><div><br></div><div> </div></div>
</blockquote></div><br></div>
</blockquote></div><br></div></div></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>OpenStack-dev mailing list</span><br><span><a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a></span><br>
<span><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a></span><br></div></blockquote></body></html>