Security groups don't appear to work
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Cisco Openstack |
Fix Released
|
High
|
Chris Ricker | ||
Grizzly |
Fix Released
|
High
|
Chris Ricker |
Bug Description
With g0, security groups don't appear to be configured in a default deny stance out of the box
I see rules but they're blank:
root@ci-os-con1:~# for i in `quantum security-
+------
| Field | Value |
+------
| direction | egress |
| ethertype | IPv4 |
| id | 17a706e6-
| port_range_max | |
| port_range_min | |
| protocol | |
| remote_group_id | |
| remote_ip_prefix | |
| security_group_id | bb236971-
| tenant_id | 959675d2ff7a4b3
+------
+------
| Field | Value |
+------
| direction | ingress |
| ethertype | IPv6 |
| id | 644f06ce-
| port_range_max | |
| port_range_min | |
| protocol | |
| remote_group_id | bb236971-
| remote_ip_prefix | |
| security_group_id | bb236971-
| tenant_id | 959675d2ff7a4b3
+------
+------
| Field | Value |
+------
| direction | egress |
| ethertype | IPv6 |
| id | da7e330d-
| port_range_max | |
| port_range_min | |
| protocol | |
| remote_group_id | |
| remote_ip_prefix | |
| security_group_id | bb236971-
| tenant_id | 959675d2ff7a4b3
+------
+------
| Field | Value |
+------
| direction | ingress |
| ethertype | IPv4 |
| id | e6e89214-
| port_range_max | |
| port_range_min | |
| protocol | |
| remote_group_id | bb236971-
| remote_ip_prefix | |
| security_group_id | bb236971-
| tenant_id | 959675d2ff7a4b3
+------
root@ci-os-con1:~#
Changed in openstack-cisco: | |
milestone: | none → g.1 |
To fix, we need to add
firewall_driver = quantum. agent.linux. iptables_ firewall. OVSHybridIptabl esFirewallDrive r
to the [SECURITYGROUP] stanza of the ovs_quantum_ plugin. ini file on compute nodes
and switch the libvirt_vif_driver back to nova.virt. libvirt. vif.LibvirtHybr idOVSBridgeDriv er