<html><body>
<p><font size="2" face="sans-serif">Hi Mike. I think we still owe you a response to your earlier email as we recover from the summit but let me address your current questions below. <br>
</font><font size="2" face="sans-serif"><br>
</font><font size="2" face="sans-serif">> On May 22, 2014, at 6:55 PM, "Mike Grima" <mike.r.grima@gmail.com> wrote:<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> Hello,<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> Just to make sure I understand:<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> 1.) I’m assuming that you can dilettante which policies apply to specific VM’s within a group (Is this correct?). With regards to DENY permissions, they are handled specially. In such a case, all other VM’s are provided with ALLOW permissions for that rule, while the destined VM for the DENY policy is provided with a DENY.<br>
</font><font size="2" face="sans-serif">Let's start from the question about Deny. There are no Deny actions. By default there is no connectivity. If you want to establish that you do it with Allow or other actions; otherwise no connectivity. Hence no need to have Deny. <br>
</font><font size="2" face="sans-serif"><br>
</font><font size="2" face="sans-serif">The policies generally apply to the whole group. The idea is to simplify the use of contract and policy rules by applying them to a group of like minded :) endpoints. <br>
</font><font size="2" face="sans-serif">> — Would you necessarily want to automatically provide all other VM’s with an ALLOW privilege? Not all VM’s in that group may need access to that port...<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">So you may reconsider how you group your endpoints into groups so you can apply policies to groups of endpoints with similar characteristics/roles. <br>
</font><font size="2" face="sans-serif"><br>
</font><font size="2" face="sans-serif">> 2.) Group Policy does support a Hierarchy. (Is this correct?)<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif"><br>
</font><font size="2" face="sans-serif">Yes. A contract can have another as a child contract. <br>
</font><font size="2" face="sans-serif">> 3.) On a separate note: Is the Group Policy feature exposed via a RESTful API akin to FWaaS?<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">Yes, That's the plan for the group policy extension similar to other extensions. <br>
</font><font size="2" face="sans-serif"><br>
</font><font size="2" face="sans-serif"><br>
</font><font size="2" face="sans-serif">> Thank you,<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> Mike Grima, RHCE<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> On May 22, 2014, at 2:08 AM, A, Keshava <keshava.a@hp.com> wrote:<br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> > Hi,<br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> > 1. When the group policy is applied ( across to all the VMs ) say deny for specific TCP port = 80, however because some special reason one of that VM needs to 'ALLOW TCP port' how to handle this ?<br>
</font><font size="2" face="sans-serif">> > When deny is applied to any one of VM in that group , this framework takes care of<br>
</font><font size="2" face="sans-serif">> > individually breaking that and apply ALLOW for other VM automatically ?<br>
</font><font size="2" face="sans-serif">> > and apply Deny for that specific VM ?<br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> > 2. Can there be 'Hierarchy of Group Policy " ?<br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> > Thanks & regards,<br>
</font><font size="2" face="sans-serif">> > Keshava.A<br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> > -----Original Message-----<br>
</font><font size="2" face="sans-serif">> > From: Michael Grima [<a href="mailto:mike.r.grima@gmail.com">mailto:mike.r.grima@gmail.com</a>]<br>
</font><font size="2" face="sans-serif">> > Sent: Wednesday, May 21, 2014 5:00 PM<br>
</font><font size="2" face="sans-serif">> > To: openstack-dev@lists.openstack.org<br>
</font><font size="2" face="sans-serif">> > Subject: Re: [openstack-dev] [Neutron][FWaaS]Firewall Web Services Research Thesis Applicability to the OpenStack Project<br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> > Sumit,<br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> > Unfortunately, I missed the IRC meeting on FWaaS (got the timezones screwed up...).<br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> > However, in the meantime, please review this section of my thesis on the OpenStack project:<br>
</font><font size="2" face="sans-serif">> > <a href="https://docs.google.com/document/d/1DGhgtTY4FxYxOqhKvMSV20cIw5WWR-gXbaBoMMMA-f0/edit?usp=sharing">https://docs.google.com/document/d/1DGhgtTY4FxYxOqhKvMSV20cIw5WWR-gXbaBoMMMA-f0/edit?usp=sharing</a><br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> > Please let me know if it is missing anything, or contains any wrong information. Also, if you have some time, please review the questions I have asked in the previous messages.<br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> > Thank you,<br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> > --<br>
</font><font size="2" face="sans-serif">> > Mike Grima, RHCE<br>
</font><font size="2" face="sans-serif">> ><br>
</font><font size="2" face="sans-serif">> > _______________________________________________<br>
</font><font size="2" face="sans-serif">> > OpenStack-dev mailing list<br>
</font><font size="2" face="sans-serif">> > OpenStack-dev@lists.openstack.org<br>
</font><font size="2" face="sans-serif">> > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> <br>
</font><font size="2" face="sans-serif">> _______________________________________________<br>
</font><font size="2" face="sans-serif">> OpenStack-dev mailing list<br>
</font><font size="2" face="sans-serif">> OpenStack-dev@lists.openstack.org<br>
</font><font size="2" face="sans-serif">> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</font><font size="2" face="sans-serif">> <br>
</font></body></html>