<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:657344061;
mso-list-type:hybrid;
mso-list-template-ids:-403036724 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi StarlingX Community,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The neutron OVS firewall_driver driver was previously set to noop since there was no suitable firewall driver packaged. The security group support for OVS agent is now enabled by default with the native "openvswitch" firewall driver [0][1],
which is stateful and based on openflow + conntrack implementation [2].<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Due to this change, it requires that appropriate security group rules be added to allow ingress traffic to the VM.<o:p></o:p></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><i><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span></i><![endif]><i>List the available security groups and note the ID of the security group that you want to use for your instance:<o:p></o:p></i></p>
<p class="MsoListParagraph"><i>$ openstack security group list<o:p></o:p></i></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><i><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span></i><![endif]><i>By default (If you have not created any security groups), the “default” security group applies to all instances and includes firewall rules that deny remote access to instances. For Linux images such as CirrOS, we recommend allowing
at least ICMP (ping) and secure shell (SSH).<o:p></o:p></i></p>
<p class="MsoListParagraph"><i>Add rules to the “default” security group:<o:p></o:p></i></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in;mso-list:l0 level2 lfo1">
<![if !supportLists]><i><span style="mso-list:Ignore">a.<span style="font:7.0pt "Times New Roman"">
</span></span></i><![endif]><i>Permit ICMP (ping):<o:p></o:p></i></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><i>$ openstack security group rule create --proto icmp default<o:p></o:p></i></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in;mso-list:l0 level2 lfo1">
<![if !supportLists]><i><span style="mso-list:Ignore">b.<span style="font:7.0pt "Times New Roman"">
</span></span></i><![endif]><i>Permit secure shell (SSH) access:<o:p></o:p></i></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><i>$ openstack security group rule create --proto tcp --dst-port 22 default<o:p></o:p></i></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><i><span style="mso-list:Ignore">3.<span style="font:7.0pt "Times New Roman"">
</span></span></i><![endif]><i>In addition to the above rules (ICMP, SSH), other security group rules can be created, deleted and listed/showed within a certain security group
</i>[3]<i>. And other security groups (besides “default”) can also be created/added, removed for a certain VM instance/server
</i>[4]<i>.<o:p></o:p></i></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please kindly update your related StarlingX user docs/test cases w/ steps to apply the appropriate security rules.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Let me know if any question. Thanks a lot.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">BR,<o:p></o:p></p>
<p class="MsoNormal">Kailun<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[0] <a href="https://review.openstack.org/#/c/645054/">https://review.openstack.org/#/c/645054/</a><o:p></o:p></p>
<p class="MsoNormal">[1] <a href="https://storyboard.openstack.org/#!/story/2002944">
https://storyboard.openstack.org/#!/story/2002944</a><o:p></o:p></p>
<p class="MsoNormal">[2] <a href="https://docs.openstack.org/neutron/latest/contributor/internals/openvswitch_firewall.html">
https://docs.openstack.org/neutron/latest/contributor/internals/openvswitch_firewall.html</a><o:p></o:p></p>
<p class="MsoNormal">[3] <a href="https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/security-group-rule.html">
https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/security-group-rule.html</a><o:p></o:p></p>
<p class="MsoNormal">[4] <a href="https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/server.html">
https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/server.html</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>