<div dir="ltr">Hi Lorin,<div>I think yours is a very good question; I am afraid I am not able to provide a straight answer regarding in which cases one service should be preferred to the other.<br></div><div><br></div><div>
Technically the difference would be that a firewall rule is enforced only at the edge of your network, and is therefore not enforced for intra-tenant and inter-tenant traffic, whereas a security group rule is enforced on every port where the security group applies.</div>
<div><br></div><div>As an example, one could use a security group to allow traffic on ports 80 and 443 on all instances regardless of the source security group, and a firewall rule to block access to port 80 from external sources. The result would be that HTTP would be open for 'internal' traffic whereas only HTTPS would be available for externally-generated traffic.</div>
<div>It is completely true that the same could be achieved with security groups only, but in this way one would not pay the performance penalty of having to evaluate the HTTP rule for internal traffic.<br></div><div>It might be argued that a tenant should not really have to be aware of the network topology and the burden of choosing where the rule should be enforced should be up to underlying implementation; this is definitely an argument worth discussing.<br>
</div><div><br></div><div>Moreover, another technical difference is that security group rules express what traffic is allowed, assuming that the baseline is deny all; whereas firewall rules can express both allow or deny action.</div>
<div><br></div><div>Regards,</div><div>Salvatore</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 25 November 2013 19:38, Lorin Hochstein <span dir="ltr"><<a href="mailto:lorin@nimbisservices.com" target="_blank">lorin@nimbisservices.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><div class="im">On Mon, Nov 25, 2013 at 10:43 AM, Remo Mattei <span dir="ltr"><<a href="mailto:Remo@mattei.org" target="_blank">Remo@mattei.org</a>></span> wrote:<br>
</div><div class="gmail_quote"><div class="im">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div style="font-family:Calibri,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
the FWaaS is different than Security Groups. It acts on the router port whereas Security Groups handles the provider network layer.</div><div style="font-family:Calibri,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
<br></div><div style="font-family:Calibri,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto"><br></div></div></blockquote></div><div><br>What's the difference from the point of view of the end-user? In particular, when should they use security groups and when should they use FWaaS? And when there's overlapping functionality, how should they decide which one to use? <br>
<br></div><div><br>Lorin<br></div><div class="im"><div><br><br><br> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div style="font-family:Calibri,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
</div> <div><span style="font-family:helvetica,arial;font-size:13px"></span>-- <br>Remo Mattei<br><br></div> <br><p style="color:#a0a0a8"> November 25, 2013 at 7:42:57, Liu Wenmao (<a href="mailto://marvelliu@gmail.com" target="_blank">marvelliu@gmail.com</a>) ha scritto:</p>
<blockquote type="cite"><span><div><div><div><div>
<div dir="ltr">
<div>
<div>
<div>Hi all:<br>
<br></div>
I notice that there are two security ACL approaches in neutron:
security group and FWaaS, both have standard CUPD operations.
why is FWaaS *service*, bug security group is not?<br>
<br></div>
I wonder what the definition a service is. thanks<br>
<br></div>
Liu Wenmao<br></div></div></div>
!DSPAM:2,52935d1a296201044898170!
_______________________________________________
<br>Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a>
<br>Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a>
<br>Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a>
<br>
<br>
<br>!DSPAM:2,52935d1a296201044898170!
<br></div></div></span></blockquote></div><br>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br></blockquote></div></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><br>-- <br><div dir="ltr">Lorin Hochstein<br><div>Lead Architect - Cloud Services</div><div>Nimbis Services, Inc.</div><div><a href="http://www.nimbisservices.com" target="_blank">www.nimbisservices.com</a></div>
</div>
</font></span></div></div>
<br>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br></blockquote></div><br></div>