<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap:break-word; color:rgb(0,0,0); font-size:14px; font-family:Calibri,sans-serif" fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<div>Hi Sridar,</div>
<div><br>
</div>
<div>Yes I know this is only for phase 1, while I'm also thinking about how it should be in next phase. At least, zone concept should be introduced, we may use it to replace SG, to eliminate potential conflicts of defining ACL in two different places.</div>
<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF264113" style="direction: ltr;"><font face="Tahoma" size="2" color="#000000"><b>From:</b> Sridar Kandaswamy (skandasw) [skandasw@cisco.com]<br>
<b>Sent:</b> Thursday, August 14, 2014 10:12 PM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> Re: [openstack-dev] [Neutron] Simple proposal for stabilizing new features in-tree<br>
</font><br>
</div>
<div></div>
<div>
<div>Hi Wuhongning:</div>
<div><br>
</div>
<div>Yes u are correct – this is phase 1 to at least get basic perimeter firewall support working with DVR before looking for an optimal way to address E – W traffic. </div>
<div><br>
</div>
<div>Thanks</div>
<div><br>
</div>
<div>Sridar</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; border-bottom:medium none; border-left:medium none; padding-bottom:0in; padding-left:0in; padding-right:0in; border-top:#b5c4df 1pt solid; border-right:medium none; padding-top:3pt">
<span style="font-weight:bold">From: </span>Wuhongning <<a href="mailto:wuhongning@huawei.com" target="_blank">wuhongning@huawei.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>OpenStack List <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, August 14, 2014 at 1:05 AM<br>
<span style="font-weight:bold">To: </span>OpenStack List <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [openstack-dev] [Neutron] Simple proposal for stabilizing new features in-tree<br>
</div>
<div><br>
</div>
<div dir="ltr"><style type="text/css" id="owaParaStyle">
<!--
-->
</style>
<div style="word-wrap:break-word">
<div style="direction:ltr; font-family:Tahoma; color:#000000; font-size:10pt">
<div><span style="color:rgb(34,34,34); font-family:arial; font-size:small; background-color:rgb(255,255,255)">FWaas can't seamlessly work with DVR yet. A BP [1] has been submitted, but it can only handle NS traffic, leaving W-E untouched. If we implement the
WE firewall in DVR, the iptable might be applied at a per port basis, so there are some overlapping with SG (Can we image a packet run into iptable hook twice between VM and the wire, for both ingress and egress directions?). </span></div>
<div><span style="color:rgb(34,34,34); font-family:arial; font-size:small; background-color:rgb(255,255,255)"><br>
</span></div>
<div><span style="background-color:rgb(255,255,255)"><font color="#222222" face="arial" size="2">Maybe the overall service plugins (including service extension in ML2) needs some cleaning up, It seems that Neutron is just built from separate single blocks.</font></span></div>
<font face="Calibri,sans-serif"><span style="font-size:14px">
<div><font face="Calibri,sans-serif"><span style="font-size:14px"><br>
</span></font></div>
<div><font face="Calibri,sans-serif" style="font-size:10pt"><span style="font-size:14px">[1] </span></font><a href="http://git.openstack.org/cgit/openstack/neutron-specs/tree/specs/juno/neutron-dvr-fwaas.rst" style="font-family:Tahoma; font-size:10pt" target="_blank">http://git.openstack.org/cgit/openstack/neutron-specs/tree/specs/juno/neutron-dvr-fwaas.rst</a></div>
</span></font>
<div>
<div style="color:rgb(0,0,0); font-family:'Times New Roman'; font-size:16px">
<div><span id="OLK_SRC_BODY_SECTION">
<div>
<div>
<div class="gmail_extra"><br>
</div>
</div>
</div>
</span></div>
</div>
</div>
</div>
</div>
</div>
</span></div>
</div>
</div>
</body>
</html>