Neutron/FWaaS/HavanaPlan
The following is the proposed plan/schedule for design and implementation of the Firewall As A Service feature in OpenStack Networking for the Havana release. While our long term goal for FWaaS is to make it very feature rich, we will follow a pragmatic path - develop in iterations, and deliver a basic experimental reference implementation that will allow us to evaluate the API, resource model and usability of this feature. This will allow us to gather feedback, and make enhancements if required.
| Task | Blueprint | Milestone |
|---|---|---|
| API, Resource and DB Models | https://blueprints.launchpad.net/quantum/+spec/quantum-fwaas | H1 |
| FW Service Plugin | https://blueprints.launchpad.net/quantum/+spec/quantum-fwaas-plugin | H1 |
| FW Agent | https://blueprints.launchpad.net/quantum/+spec/quantum-fwaas-agent | H2 |
| FW Driver | https://blueprints.launchpad.net/quantum/+spec/quantum-fwaas-iptables-driver | H2 |
| Client library & CLI | https://blueprints.launchpad.net/python-quantumclient/+spec/fwaas-client-cli | H2 |
| Horizon | https://blueprints.launchpad.net/horizon/+spec/fwaas-horizon | H2 |
| Devstack | Blueprint-link | H2 |
| Documentation | Blueprint-link | H3 |
Reference Implementation
The current plan is to provide an Iptables based reference backend implementation to realize the firewall rules. The Iptables configuration will be realized by an angent-driver combination that will program the Iptables rules on a gateway host. This agent will most likely be collocated with the L3 agent (possibly leveraged as a mixin class).
Firewall Mode
Based on the above deployment configuration, this reference implementation will serve as a perimeter firewall. In the future, we will extend this with firewall drivers that will allow us to demonstrate the firewall deployment in other modes (e.g. L2, bump-in-the-wire).
