[Starlingx-discuss] port-security

[Curtis]

On Thu, Apr 4, 2019 at 7:40 AM Peters, Matt <Matt.Peters at windriver.com>
wrote:

> The Neutron security group support is already being tracked and in
> development under the following storyboard.
>
> https://storyboard.openstack.org/#!/story/2002944
>
>
>
> A Storyboard is not required to enable/disable the port_security
> extension.  It can be configured through Helm overrides for the neutron
> service.
>
> You would use the “system helm-override-xxxx” commands to show and modify
> the configuration overrides.
>
>
>
> For the port security extension, you would issue the following:
>
> system helm-override-update neutron openstack --set
> conf.plugins.ml2_conf.ml2.extension_drivers="port_security"
>

Thanks Matt, that's great to know.

Is the idea that security groups will be enabled by default?

Thanks,
Curtis



>
>
> *From: *Curtis <serverascode at gmail.com>
> *Date: *Monday, April 1, 2019 at 2:22 PM
> *To: *"Jones, Bruce E" <bruce.e.jones at intel.com>
> *Cc: *"von Hoesslin, Volker" <Volker.Hoesslin at swsn.de>, "
> starlingx-discuss at lists.starlingx.io" <
> starlingx-discuss at lists.starlingx.io>
> *Subject: *Re: [Starlingx-discuss] port-security
>
>
>
>
>
>
>
> On Mon, Apr 1, 2019 at 1:08 PM Jones, Bruce E <bruce.e.jones at intel.com>
> wrote:
>
> Volker, please follow the process Curtis mentioned below and submit a
> StoryBoard Story.  Then I’d suggest you send the story link out to the
> mailing list and ask the Networking sub-project to work with you to fill in
> any additional details needed.
>
>
>
> Meanwhile Curtis can you add this to the ethercalc as an item for the next
> release?
>
>
>
>
>
> I added it into the ethercalc.
>
>
>
> Thank,
>
> Curtis
>
>
>
>
>
>      brucej
>
>
>
> *From:* Curtis [mailto:serverascode at gmail.com]
> *Sent:* Monday, April 1, 2019 10:00 AM
> *To:* von Hoesslin, Volker <Volker.Hoesslin at swsn.de>
> *Cc:* starlingx-discuss at lists.starlingx.io
> *Subject:* Re: [Starlingx-discuss] port-security
>
>
>
> On Mon, Apr 1, 2019 at 10:40 AM von Hoesslin, Volker <
> Volker.Hoesslin at swsn.de> wrote:
>
> Ok, this is an very intressting point! I would prefere to add
> port-security maybe an system switch to change this behavior in runtime (of
> cource, it need an re-provisining).
>
>
>
> I should know this better, but I believe if you'd like to request a
> feature you could go through this process:
>
>
>
> https://wiki.openstack.org/wiki/StarlingX/Feature_Development_Process
>
>
>
> If that's not the process we're following for the project hopefully
> someone on the list will correct me.
>
>
>
> Once it's there it could be discussed. :)
>
>
>
>
>
> Is there an releation with my other problem? One Instance with multiple
> Networks and for every Network an floating IP -> only one floating IP is
> working all other are without any response? Also port-forwarding in the
> router are broken and do not word …
>
>
>
>
>
> Is there any chance it's just a routing problem? ie. reply packets for the
> non-working interfaces are going out the working interface b/c it has the
> single default gw? Something like that?
>
>
>
> Thanks,
>
> Curtis
>
>
>
>
>
> *Von:* Curtis [mailto:serverascode at gmail.com]
> *Gesendet:* Freitag, 29. März 2019 19:44
> *An:* von Hoesslin, Volker
> *Cc:* starlingx-discuss at lists.starlingx.io
> *Betreff:* Re: [Starlingx-discuss] pre-stable version bevor next release?
>
>
>
> On Fri, Mar 29, 2019 at 10:55 AM von Hoesslin, Volker <
> Volker.Hoesslin at swsn.de> wrote:
>
> Hi anybody,
>
> i realy love this project but I have some reason to deploy now an working
> stack. Is there currently an working version or have to wait until new
> release date? The current stable version isn’t working in all details for
> me, look at discuss “Unrecognized attribute(s) 'port_security_enabled'”.
>
>
>
>
>
> With regards to port security, I tried to write this email a couple times,
> it's tough b/c I don't know the history, but here are my thoughts:
>
>
>
> - Security groups are effectively disabled in stx (noop driver), at least
> in my deployment from an ISO from last week
>
> - This is probably for performance reasons, ie. iptables, but I'm not sure
> of the history
>
> - Maybe it's time to revisit security groups? eg. k8s is there and uses
> iptables, or maybe openflow based driver would be an option...or other?
>
> - Likely we (the project) just need to make sure it gets properly
> documented, if it's not already
>
>
>
> Maybe some others with more history will chip in. :)
>
>
>
> Thanks,
>
> Curtis
>
>
>
>
>
>
>
> Thx,
>
> Volker…
>
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
>
>
>
> --
>
> Blog: serverascode.com
>
>
>
> --
>
> Blog: serverascode.com
>
>
>
> --
>
> Blog: serverascode.com
>


-- 
Blog: serverascode.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20190404/37e0ebe5/attachment.html>