Hi Curtis, Yes, this Story is to enable the security groups by default. They can be disabled via Helm overrides to change it globally (override to noop), or via port_security extension to enable/disable it on a per-network basis. Regards, Matt From: Curtis <serverascode@gmail.com> Date: Thursday, April 4, 2019 at 11:35 AM To: "Peters, Matt" <Matt.Peters@windriver.com> Cc: "Jones, Bruce E" <bruce.e.jones@intel.com>, "von Hoesslin, Volker" <Volker.Hoesslin@swsn.de>, "starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] port-security On Thu, Apr 4, 2019 at 7:40 AM Peters, Matt <Matt.Peters@windriver.com<mailto:Matt.Peters@windriver.com>> wrote: The Neutron security group support is already being tracked and in development under the following storyboard. https://storyboard.openstack.org/#!/story/2002944 A Storyboard is not required to enable/disable the port_security extension. It can be configured through Helm overrides for the neutron service. You would use the “system helm-override-xxxx” commands to show and modify the configuration overrides. For the port security extension, you would issue the following: system helm-override-update neutron openstack --set conf.plugins.ml2_conf.ml2.extension_drivers="port_security" Thanks Matt, that's great to know. Is the idea that security groups will be enabled by default? Thanks, Curtis From: Curtis <serverascode@gmail.com<mailto:serverascode@gmail.com>> Date: Monday, April 1, 2019 at 2:22 PM To: "Jones, Bruce E" <bruce.e.jones@intel.com<mailto:bruce.e.jones@intel.com>> Cc: "von Hoesslin, Volker" <Volker.Hoesslin@swsn.de<mailto:Volker.Hoesslin@swsn.de>>, "starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io>" <starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io>> Subject: Re: [Starlingx-discuss] port-security On Mon, Apr 1, 2019 at 1:08 PM Jones, Bruce E <bruce.e.jones@intel.com<mailto:bruce.e.jones@intel.com>> wrote: Volker, please follow the process Curtis mentioned below and submit a StoryBoard Story. Then I’d suggest you send the story link out to the mailing list and ask the Networking sub-project to work with you to fill in any additional details needed. Meanwhile Curtis can you add this to the ethercalc as an item for the next release? I added it into the ethercalc. Thank, Curtis brucej From: Curtis [mailto:serverascode@gmail.com<mailto:serverascode@gmail.com>] Sent: Monday, April 1, 2019 10:00 AM To: von Hoesslin, Volker <Volker.Hoesslin@swsn.de<mailto:Volker.Hoesslin@swsn.de>> Cc: starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] port-security On Mon, Apr 1, 2019 at 10:40 AM von Hoesslin, Volker <Volker.Hoesslin@swsn.de<mailto:Volker.Hoesslin@swsn.de>> wrote: Ok, this is an very intressting point! I would prefere to add port-security maybe an system switch to change this behavior in runtime (of cource, it need an re-provisining). I should know this better, but I believe if you'd like to request a feature you could go through this process: https://wiki.openstack.org/wiki/StarlingX/Feature_Development_Process If that's not the process we're following for the project hopefully someone on the list will correct me. Once it's there it could be discussed. :) Is there an releation with my other problem? One Instance with multiple Networks and for every Network an floating IP -> only one floating IP is working all other are without any response? Also port-forwarding in the router are broken and do not word … Is there any chance it's just a routing problem? ie. reply packets for the non-working interfaces are going out the working interface b/c it has the single default gw? Something like that? Thanks, Curtis Von: Curtis [mailto:serverascode@gmail.com<mailto:serverascode@gmail.com>] Gesendet: Freitag, 29. März 2019 19:44 An: von Hoesslin, Volker Cc: starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io> Betreff: Re: [Starlingx-discuss] pre-stable version bevor next release? On Fri, Mar 29, 2019 at 10:55 AM von Hoesslin, Volker <Volker.Hoesslin@swsn.de<mailto:Volker.Hoesslin@swsn.de>> wrote: Hi anybody, i realy love this project but I have some reason to deploy now an working stack. Is there currently an working version or have to wait until new release date? The current stable version isn’t working in all details for me, look at discuss “Unrecognized attribute(s) 'port_security_enabled'”. With regards to port security, I tried to write this email a couple times, it's tough b/c I don't know the history, but here are my thoughts: - Security groups are effectively disabled in stx (noop driver), at least in my deployment from an ISO from last week - This is probably for performance reasons, ie. iptables, but I'm not sure of the history - Maybe it's time to revisit security groups? eg. k8s is there and uses iptables, or maybe openflow based driver would be an option...or other? - Likely we (the project) just need to make sure it gets properly documented, if it's not already Maybe some others with more history will chip in. :) Thanks, Curtis Thx, Volker… _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io<mailto:Starlingx-discuss@lists.starlingx.io> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss -- Blog: serverascode.com<http://serverascode.com> -- Blog: serverascode.com<http://serverascode.com> -- Blog: serverascode.com<http://serverascode.com> -- Blog: serverascode.com<http://serverascode.com>