Difference between revisions of "GroupBasedPolicy/InstallDevstack"
(→Installing and Running GBP) |
|||
Line 69: | Line 69: | ||
####CHECKPOINT: HTTP stops working for both the client EPGs, HTTPs is now enabled | ####CHECKPOINT: HTTP stops working for both the client EPGs, HTTPs is now enabled | ||
+ | |||
+ | == Configuring and testing External Connecitiviy == |
Revision as of 22:03, 11 December 2014
Contents
Installing and Running GBP
The following are a set of instructions for installing and working with GBP:
Devstack Installation
0. Install Ubuntu 14.04
1. git clone http://github.com/group-policy/devstack -b juno-gbp-3
2. cd devstack
3. ./stack.sh
4. source openrc demo demo
5. Use the "gbp" CLI binary ("gbp --help" will give you the commands)
GBP in action
Example scenario: Modeling connectivity between Web and App Tiers using GBP:
# Create allow action that can used in several rules gbp policy-action-create allow --action-type allow
# Create ICMP rule gbp policy-classifier-create icmp-traffic --protocol icmp --direction bi gbp policy-rule-create ping-policy-rule --classifier icmp-traffic --actions allow
# Create SSH Rule (Optional) # gbp policy-classifier-create ssh-traffic --protocol tcp --port-range 22 --direction bi # gbp policy-rule-create ssh-policy-rule --classifier ssh-traffic --actions allow
# Create HTTP Rule gbp policy-classifier-create web-traffic --protocol tcp --port-range 80 --direction in gbp policy-rule-create web-policy-rule --classifier web-traffic --actions allow
# Create HTTPs Rule gbp policy-classifier-create secure-web-traffic --protocol tcp --port-range 443 --direction in gbp policy-rule-create secure-web-policy-rule --classifier secure-web-traffic --actions allow
# ICMP policy-rule-set gbp policy-rule-set-create icmp-policy-rule-set --policy-rules ping-policy-rule
# WEB policy-rule-set gbp policy-rule-set-create web-policy-rule-set --policy-rules web-policy-rule
# Policy Target Group creation gbp group-create web gbp group-create client-1 gbp group-create client-2
# Policy Target ceation and launching VMs WEB1=$(gbp policy-target-create web-ep-1 --policy-target-group web | awk "/port_id/ {print \$4}") CLIENT1=$(gbp policy-target-create client-ep-1 --policy-target-group client-1 | awk "/port_id/ {print \$4}") CLIENT2=$(gbp policy-target-create client-ep-2 --policy-target-group client-2 | awk "/port_id/ {print \$4}")
nova boot --flavor m1.nano --image cirros-0.3.2-x86_64-uec --nic port-id=$WEB1 web-vm-1 nova boot --flavor m1.nano --image cirros-0.3.2-x86_64-uec --nic port-id=$CLIENT1 client-vm-1 nova boot --flavor m1.nano --image cirros-0.3.2-x86_64-uec --nic port-id=$CLIENT2 client-vm-2
####CHECKPOINT: No traffic flows
# policy-rule-set Association gbp group-update client-1 --consumed-policy-rule-sets "icmp-policy-rule-set=true,web-policy-rule-set=true" gbp group-update client-2 --consumed-policy-rule-sets "icmp-policy-rule-set=true,web-policy-rule-set=true" gbp group-update web --provided-policy-rule-sets "icmp-policy-rule-set=true,web-policy-rule-set=true"
####CHECKPOINT: ICMP and HTTP work from app to web and vice versa
gbp policy-rule-set-update web-policy-rule-set --policy-rules "secure-web-policy-rule"
####CHECKPOINT: HTTP stops working for both the client EPGs, HTTPs is now enabled