<html><head></head><body style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div><div><div>Hi folks.</div><div><br></div><div>We're currently on the way to deploy an openstack (grizzly) cloud environment </div><div>and suffering in problems implementing the security groups like described in [1].</div><div><br></div><div>The (hopefully) relevant configuration settings are:</div><div><br></div><div>/etc/nova/nova.conf</div><div>[…]</div><div>security_group_api=quantum</div><div><div>network_api_class=nova.network.quantumv2.api.API</div></div><div><div>libvirt_vif_driver=nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver</div><div>firewall_driver=nova.virt.firewall.NoopFirewallDriver</div></div><div>[…]</div><div><br></div><div>/etc/quantum/plugins/openvswitch/ovs_quantum_plugin.ini</div><div><div>[…]</div></div><div><div>firewall_driver = quantum.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver</div></div><div>[…]</div><div><br></div><div>The Networks for the vm's are attached to the compute-nodes via VLAN </div><div>encapsulation and correctly mapped to the vm's.</div><div><br></div><div>From our point of view - we're understanding the need of the </div><div>"ovs-bridge <> veth glue <> linux-bridge (for filtering) <> vm"-construction </div><div>and observed the single components in our deployment. See [2]</div><div><br></div><div>Everything is working except the security groups. </div><div>We observed that ip-tables rules are generated for the quantum-openvswi-* chains of iptables. </div><div>And the traffic arriving untagged (native vlan for management) on the machine is processed by iptables but not </div><div>the traffic which arrived encapsulated.</div><div><br></div><div>The traffic which is unpacked by openvswitch and is bridged via the veth and the tap into </div><div>the machine isn't processed by the iptables rules.</div><div><br></div><div>We have no remaining clue/idea how to solve this issue… :(</div><div><br></div><div>Greetings</div><div> Sebastian</div><div><br></div><div>[1] <a href="http://docs.openstack.org/trunk/openstack-network/admin/content/under_the_hood_openvswitch.html">http://docs.openstack.org/trunk/openstack-network/admin/content/under_the_hood_openvswitch.html</a></div><div>[2] <a href="http://pastebin.com/WXMH6y4A">http://pastebin.com/WXMH6y4A</a></div><div><br></div><div><div><div>--</div><div>Sebastian Porombka, M.Sc. </div><div>Zentrum für Informations- und Medientechnologien (IMT)</div><div>Universität Paderborn</div><div><br></div><div>E-Mail: <a href="mailto:porombka@uni-paderborn.de">porombka@uni-paderborn.de</a></div><div>Tel.: 05251/60-5999</div><div>Fax: 05251/60-48-5999</div><div>Raum: N5.314 </div><div><br></div><div>--------------------------------------------</div><div>Q: Why is this email five sentences or less?</div><div>A: <a href="http://five.sentenc.es/">http://five.sentenc.es</a></div><div><br></div><div>Please consider the environment before printing this email.</div></div></div></div></div></div></body></html>