Jump to: navigation, search

Difference between revisions of "Quantum/FWaaS/Testing"

< Quantum‎ | FWaaS
(Created page with " == FWaaS Testing ==")
 
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
  
−
== FWaaS Testing ==
+
== FWaaS and VPNaaS Integration Tests  ==
 +
=== Objective ===
 +
Validate basic functionality with FWaaS and VPNaaS enabled.
 +
 
 +
1) Set up a VPN tunnel between devstack instance East and devstack instance West  - validate connectivity.
 +
 
 +
2) Apply firewall rules and verify that the behavior is as expected.
 +
 
 +
=== Setup VPN tunnel across 2 devstack instances (East & West) ===
 +
Add
 +
 
 +
enable_service q-fwaas
 +
 
 +
enable_service q-vpn
 +
 
 +
to localrc
 +
 
 +
Use directions from:
 +
https://wiki.openstack.org/wiki/Quantum/VPNaaS/HowToInstall
 +
 
 +
for VPN setup. Firewall setup directions are present on this wiki page.
 +
 
 +
==== Verify Tunnel ====
 +
neutron ipsec-site-connection-show vpnconnection1
 +
 
 +
East:
 +
<pre><nowiki>
 +
stack@east-virtual-machine:~/devstack$ neutron ipsec-site-connection-show vpnconnection1
 +
+----------------+----------------------------------------------------+
 +
| Field          | Value                                              |
 +
+----------------+----------------------------------------------------+
 +
| admin_state_up | True                                              |
 +
| auth_mode      | psk                                                |
 +
| description    |                                                    |
 +
| dpd            | {"action": "hold", "interval": 30, "timeout": 120} |
 +
| id            | 8d2faebb-3b9c-4b93-8594-f2246c9a92ad              |
 +
| ikepolicy_id  | eeeea7ad-d730-40b5-a24a-ecfa58113b53              |
 +
| initiator      | bi-directional                                    |
 +
| ipsecpolicy_id | 90597431-ee8f-46d2-a9f7-039efca0bed7              |
 +
| mtu            | 1500                                              |
 +
| name          | vpnconnection1                                    |
 +
| peer_address  | 172.24.4.21                                        |
 +
| peer_cidrs    | 10.2.0.0/24                                        |
 +
| peer_id        | 172.24.4.21                                        |
 +
| psk            | secret                                            |
 +
| route_mode    | static                                            |
 +
| status        | ACTIVE                                            |
 +
| tenant_id      | d98aa7dd12f94af29a4c1d7b8174643c                  |
 +
| vpnservice_id  | 3f21d590-1e30-4d08-a412-a7d9e5b2560f              |
 +
+----------------+----------------------------------------------------+
 +
stack@east-virtual-machine:~/devstack$
 +
</nowiki></pre>
 +
 
 +
West
 +
<pre><nowiki>
 +
stack@west:~/devstack$ neutron ipsec-site-connection-show vpnconnection1
 +
+----------------+----------------------------------------------------+
 +
| Field          | Value                                              |
 +
+----------------+----------------------------------------------------+
 +
| admin_state_up | True                                              |
 +
| auth_mode      | psk                                                |
 +
| description    |                                                    |
 +
| dpd            | {"action": "hold", "interval": 30, "timeout": 120} |
 +
| id            | b7330d13-0ff1-4529-b0d5-91c2e7c4cfbf              |
 +
| ikepolicy_id  | 858eb8f5-a2ee-4649-861a-0f0ca5814556              |
 +
| initiator      | bi-directional                                    |
 +
| ipsecpolicy_id | ba86e218-6ef6-46a5-baf1-f63177590a6e              |
 +
| mtu            | 1500                                              |
 +
| name          | vpnconnection1                                    |
 +
| peer_address  | 172.24.4.11                                        |
 +
| peer_cidrs    | 10.1.0.0/24                                        |
 +
| peer_id        | 172.24.4.11                                        |
 +
| psk            | secret                                            |
 +
| route_mode    | static                                            |
 +
| status        | ACTIVE                                            |
 +
| tenant_id      | b0caec5cacce45babb19be70066b22ce                  |
 +
| vpnservice_id  | 9c6fee8a-85aa-4f8e-911e-95d4d5c997d7              |
 +
+----------------+----------------------------------------------------+
 +
stack@west:~/devstack$
 +
</nowiki></pre>
 +
Spawn the VMs
 +
 
 +
East
 +
<pre><nowiki>
 +
stack@east-virtual-machine:~/devstack$ nova list
 +
+--------------------------------------+----------+--------+------------+-------------+------------------+
 +
| ID                                  | Name    | Status | Task State | Power State | Networks        |
 +
+--------------------------------------+----------+--------+------------+-------------+------------------+
 +
| 23850324-d8d8-4859-a5ac-e48c2834e661 | East-VM1 | ACTIVE | None      | Running    | private=10.1.0.2 |
 +
+--------------------------------------+----------+--------+------------+-------------+------------------+
 +
</nowiki></pre>
 +
West
 +
<pre><nowiki>
 +
stack@west:~/devstack$ nova list
 +
+--------------------------------------+----------+--------+------------+-------------+------------------+
 +
| ID                                  | Name    | Status | Task State | Power State | Networks        |
 +
+--------------------------------------+----------+--------+------------+-------------+------------------+
 +
| c0cd320e-eab9-4131-b959-823f90bb7563 | West-VM1 | ACTIVE | None      | Running    | private=10.2.0.2 |
 +
| e4e68302-d76b-4067-bce1-31e7634451d2 | West-VM2 | ACTIVE | None      | Running    | private=10.2.0.4 |
 +
+--------------------------------------+----------+--------+------------+-------------+------------------+
 +
stack@west:~/devstack$
 +
</nowiki></pre>
 +
Pings over VPN (no FW yet)
 +
 
 +
East to West
 +
<pre><nowiki>
 +
sudo ip netns exec qrouter-2269732f-1e8d-42bb-bed4-7a1f7e101967 ssh cirros@10.1.0.2
 +
The authenticity of host '10.1.0.2 (10.1.0.2)' can't be established.
 +
RSA key fingerprint is 6b:1b:a8:e4:3a:d0:09:63:8d:7b:af:19:2b:e5:29:27.
 +
Are you sure you want to continue connecting (yes/no)? yes
 +
Warning: Permanently added '10.1.0.2' (RSA) to the list of known hosts.
 +
cirros@10.1.0.2's password:
 +
 
 +
$ ifconfig
 +
eth0      Link encap:Ethernet  HWaddr FA:16:3E:EC:DC:4B 
 +
          inet addr:10.1.0.2  Bcast:10.1.0.255  Mask:255.255.255.0
 +
          inet6 addr: fe80::f816:3eff:feec:dc4b/64 Scope:Link
 +
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
 +
          RX packets:123 errors:0 dropped:0 overruns:0 frame:0
 +
          TX packets:80 errors:0 dropped:0 overruns:0 carrier:0
 +
          collisions:0 txqueuelen:1000
 +
          RX bytes:17909 (17.4 KiB)  TX bytes:10258 (10.0 KiB)
 +
 
 +
lo        Link encap:Local Loopback 
 +
          inet addr:127.0.0.1  Mask:255.0.0.0
 +
          inet6 addr: ::1/128 Scope:Host
 +
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
 +
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
 +
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
 +
          collisions:0 txqueuelen:0
 +
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
 +
 
 +
$ ping 10.2.0.2
 +
PING 10.2.0.2 (10.2.0.2): 56 data bytes
 +
64 bytes from 10.2.0.2: seq=0 ttl=62 time=13.522 ms
 +
64 bytes from 10.2.0.2: seq=1 ttl=62 time=1.541 ms
 +
^C
 +
 
 +
$ ping 10.2.0.4
 +
PING 10.2.0.4 (10.2.0.4): 56 data bytes
 +
64 bytes from 10.2.0.4: seq=0 ttl=62 time=24.885 ms
 +
64 bytes from 10.2.0.4: seq=1 ttl=62 time=1.456 ms
 +
64 bytes from 10.2.0.4: seq=2 ttl=62 time=1.457 ms
 +
^C
 +
</nowiki></pre>
 +
 
 +
West to East
 +
<pre><nowiki>
 +
stack@west:~/devstack$ sudo ip netns exec qrouter-47e92836-08d8-4bb1-a2e9-6ac4eaec7610 ssh cirros@10.2.0.2
 +
The authenticity of host '10.2.0.2 (10.2.0.2)' can't be established.
 +
RSA key fingerprint is a0:0c:fb:f0:28:21:20:d2:27:39:9c:93:e9:77:36:ef.
 +
Are you sure you want to continue connecting (yes/no)? yes
 +
Warning: Permanently added '10.2.0.2' (RSA) to the list of known hosts.
 +
cirros@10.2.0.2's password:
 +
$ ifconfig
 +
eth0      Link encap:Ethernet  HWaddr FA:16:3E:10:ED:05 
 +
          inet addr:10.2.0.2  Bcast:10.2.0.255  Mask:255.255.255.0
 +
          inet6 addr: fe80::f816:3eff:fe10:ed05/64 Scope:Link
 +
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
 +
          RX packets:77 errors:0 dropped:0 overruns:0 frame:0
 +
          TX packets:59 errors:0 dropped:0 overruns:0 carrier:0
 +
          collisions:0 txqueuelen:1000
 +
          RX bytes:10792 (10.5 KiB)  TX bytes:7424 (7.2 KiB)
 +
 
 +
lo        Link encap:Local Loopback 
 +
          inet addr:127.0.0.1  Mask:255.0.0.0
 +
          inet6 addr: ::1/128 Scope:Host
 +
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
 +
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
 +
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
 +
          collisions:0 txqueuelen:0
 +
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
 +
 
 +
$ ping 10.1.0.2
 +
PING 10.1.0.2 (10.1.0.2): 56 data bytes
 +
64 bytes from 10.1.0.2: seq=0 ttl=62 time=21.485 ms
 +
64 bytes from 10.1.0.2: seq=1 ttl=62 time=1.332 ms
 +
64 bytes from 10.1.0.2: seq=2 ttl=62 time=1.477 ms
 +
^C
 +
--- 10.1.0.2 ping statistics ---
 +
3 packets transmitted, 3 packets received, 0% packet loss
 +
round-trip min/avg/max = 1.332/8.098/21.485 ms
 +
$
 +
</nowiki></pre>
 +
 
 +
=== Add a Firewall with a rule to deny all icmp on West ===
 +
 
 +
<pre><nowiki>
 +
stack@west:~/devstack$ neutron firewall-rule-create --protocol icmp --action deny
 +
Created a new firewall_rule:
 +
+------------------------+--------------------------------------+
 +
| Field                  | Value                                |
 +
+------------------------+--------------------------------------+
 +
| action                | deny                                |
 +
| description            |                                      |
 +
| destination_ip_address |                                      |
 +
| destination_port      |                                      |
 +
| enabled                | True                                |
 +
| firewall_policy_id    |                                      |
 +
| id                    | f1deebab-5a54-4a98-8684-174e967c5520 |
 +
| ip_version            | 4                                    |
 +
| name                  |                                      |
 +
| position              |                                      |
 +
| protocol              | icmp                                |
 +
| shared                | False                                |
 +
| source_ip_address      |                                      |
 +
| source_port            |                                      |
 +
| tenant_id              | b0caec5cacce45babb19be70066b22ce    |
 +
+------------------------+--------------------------------------+
 +
stack@west:~/devstack$ neutron firewall-policy-create --firewall-rules "f1deebab-5a54-4a98-8684-174e967c5520" test-policy
 +
Created a new firewall_policy:
 +
+----------------+--------------------------------------+
 +
| Field          | Value                                |
 +
+----------------+--------------------------------------+
 +
| audited        | False                                |
 +
| description    |                                      |
 +
| firewall_rules | f1deebab-5a54-4a98-8684-174e967c5520 |
 +
| id            | cff10b50-a324-4640-9cf8-a88538c429ef |
 +
| name          | test-policy                          |
 +
| shared        | False                                |
 +
| tenant_id      | b0caec5cacce45babb19be70066b22ce    |
 +
+----------------+--------------------------------------+
 +
stack@west:~/devstack$ neutron firewall-create cff10b50-a324-4640-9cf8-a88538c429ef
 +
Created a new firewall:
 +
+--------------------+--------------------------------------+
 +
| Field              | Value                                |
 +
+--------------------+--------------------------------------+
 +
| admin_state_up    | True                                |
 +
| description        |                                      |
 +
| firewall_policy_id | cff10b50-a324-4640-9cf8-a88538c429ef |
 +
| id                | 3772cc7a-3467-4238-82b8-904d50ebfb4d |
 +
| name              |                                      |
 +
| status            | PENDING_CREATE                      |
 +
| tenant_id          | b0caec5cacce45babb19be70066b22ce    |
 +
+--------------------+--------------------------------------+
 +
stack@west:~/devstack$ neutron firewall-show 3772cc7a-3467-4238-82b8-904d50ebfb4d
 +
+--------------------+--------------------------------------+
 +
| Field              | Value                                |
 +
+--------------------+--------------------------------------+
 +
| admin_state_up    | True                                |
 +
| description        |                                      |
 +
| firewall_policy_id | cff10b50-a324-4640-9cf8-a88538c429ef |
 +
| id                | 3772cc7a-3467-4238-82b8-904d50ebfb4d |
 +
| name              |                                      |
 +
| status            | ACTIVE                              |
 +
| tenant_id          | b0caec5cacce45babb19be70066b22ce    |
 +
+--------------------+--------------------------------------+
 +
stack@west:~/devstack$
 +
</nowiki></pre>
 +
 
 +
Ping from East to West
 +
 
 +
<pre><nowiki>
 +
$ ping 10.2.0.4
 +
PING 10.2.0.4 (10.2.0.4): 56 data bytes
 +
^C
 +
--- 10.2.0.4 ping statistics ---
 +
3 packets transmitted, 0 packets received, 100% packet loss
 +
$ ping 10.2.0.2
 +
PING 10.2.0.2 (10.2.0.2): 56 data bytes
 +
^C
 +
--- 10.2.0.2 ping statistics ---
 +
4 packets transmitted, 0 packets received, 100% packet loss
 +
$
 +
</nowiki></pre>
 +
 
 +
Ping from West to East
 +
<pre><nowiki>
 +
$ ifconfig
 +
eth0      Link encap:Ethernet  HWaddr FA:16:3E:10:ED:05 
 +
          inet addr:10.2.0.2  Bcast:10.2.0.255  Mask:255.255.255.0
 +
          inet6 addr: fe80::f816:3eff:fe10:ed05/64 Scope:Link
 +
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
 +
          RX packets:230 errors:0 dropped:0 overruns:0 frame:0
 +
          TX packets:163 errors:0 dropped:0 overruns:0 carrier:0
 +
          collisions:0 txqueuelen:1000
 +
          RX bytes:25915 (25.3 KiB)  TX bytes:20690 (20.2 KiB)
 +
 
 +
lo        Link encap:Local Loopback 
 +
          inet addr:127.0.0.1  Mask:255.0.0.0
 +
          inet6 addr: ::1/128 Scope:Host
 +
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
 +
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
 +
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
 +
          collisions:0 txqueuelen:0
 +
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
 +
 
 +
$ ping 10.1.0.2
 +
PING 10.1.0.2 (10.1.0.2): 56 data bytes
 +
^C
 +
--- 10.1.0.2 ping statistics ---
 +
3 packets transmitted, 0 packets received, 100% packet loss
 +
$
 +
</nowiki></pre>
 +
 
 +
Remove Firewall in West
 +
<pre><nowiki>
 +
stack@west:~/devstack$ neutron firewall-list
 +
+--------------------------------------+------+--------------------------------------+
 +
| id                                  | name | firewall_policy_id                  |
 +
+--------------------------------------+------+--------------------------------------+
 +
| 3772cc7a-3467-4238-82b8-904d50ebfb4d |      | cff10b50-a324-4640-9cf8-a88538c429ef |
 +
+--------------------------------------+------+--------------------------------------+
 +
stack@west:~/devstack$ neutron firewall-delete 3772cc7a-3467-4238-82b8-904d50ebfb4d
 +
Deleted firewall: 3772cc7a-3467-4238-82b8-904d50ebfb4d
 +
stack@west:~/devstack$ neutron firewall-list
 +
 
 +
stack@west:~/devstack$
 +
</nowiki></pre>
 +
 
 +
Check Ping
 +
<pre><nowiki>
 +
$ ping 10.2.0.2
 +
PING 10.2.0.2 (10.2.0.2): 56 data bytes
 +
64 bytes from 10.2.0.2: seq=0 ttl=62 time=14.469 ms
 +
64 bytes from 10.2.0.2: seq=1 ttl=62 time=1.458 ms
 +
^C
 +
--- 10.2.0.2 ping statistics ---
 +
2 packets transmitted, 2 packets received, 0% packet loss
 +
round-trip min/avg/max = 1.458/7.963/14.469 ms
 +
$ ping 10.2.0.4
 +
PING 10.2.0.4 (10.2.0.4): 56 data bytes
 +
64 bytes from 10.2.0.4: seq=0 ttl=62 time=13.530 ms
 +
64 bytes from 10.2.0.4: seq=1 ttl=62 time=1.732 ms
 +
^C
 +
--- 10.2.0.4 ping statistics ---
 +
2 packets transmitted, 2 packets received, 0% packet loss
 +
round-trip min/avg/max = 1.732/7.631/13.530 ms
 +
</nowiki></pre>
 +
 
 +
=== Add a firewall with a destination icmp rule on East to allow pings to West-VM2 but not West-VM1 ===
 +
<pre><nowiki>
 +
stack@east-virtual-machine:~/devstack$ neutron firewall-rule-create --protocol icmp --destination_ip_address 10.2.0.4 --action allow
 +
Created a new firewall_rule:
 +
+------------------------+--------------------------------------+
 +
| Field                  | Value                                |
 +
+------------------------+--------------------------------------+
 +
| action                | allow                                |
 +
| description            |                                      |
 +
| destination_ip_address | 10.2.0.4                            |
 +
| destination_port      |                                      |
 +
| enabled                | True                                |
 +
| firewall_policy_id    |                                      |
 +
| id                    | a70cf19e-8178-4de6-85e3-6e2610fcc620 |
 +
| ip_version            | 4                                    |
 +
| name                  |                                      |
 +
| position              |                                      |
 +
| protocol              | icmp                                |
 +
| shared                | False                                |
 +
| source_ip_address      |                                      |
 +
| source_port            |                                      |
 +
| tenant_id              | d98aa7dd12f94af29a4c1d7b8174643c    |
 +
+------------------------+--------------------------------------+
 +
stack@east-virtual-machine:~/devstack$ neutron firewall-rule-list
 +
+--------------------------------------+------+--------------------+------------------------+---------+
 +
| id                                  | name | firewall_policy_id | summary                | enabled |
 +
+--------------------------------------+------+--------------------+------------------------+---------+
 +
| a70cf19e-8178-4de6-85e3-6e2610fcc620 |      |                    | ICMP,                  | True    |
 +
|                                      |      |                    |  source: none(none),  |        |
 +
|                                      |      |                    |  dest: 10.2.0.4(none), |        |
 +
|                                      |      |                    |  allow                |        |
 +
| f2349c92-3f1b-4aad-90ed-d6626b80f41e |      |                    | ICMP,                  | True    |
 +
|                                      |      |                    |  source: none(none),  |        |
 +
|                                      |      |                    |  dest: 10.2.0.2(none), |        |
 +
|                                      |      |                    |  deny                  |        |
 +
+--------------------------------------+------+--------------------+------------------------+---------+
 +
stack@east-virtual-machine:~/devstack$ neutron firewall-policy-create --firewall-rules "a70cf19e-8178-4de6-85e3-6e2610fcc620 f2349c92-3f1b-4aad-90ed-d6626b80f41e" test-policy-east
 +
Created a new firewall_policy:
 +
+----------------+--------------------------------------+
 +
| Field          | Value                                |
 +
+----------------+--------------------------------------+
 +
| audited        | False                                |
 +
| description    |                                      |
 +
| firewall_rules | a70cf19e-8178-4de6-85e3-6e2610fcc620 |
 +
|                | f2349c92-3f1b-4aad-90ed-d6626b80f41e |
 +
| id            | e00ce2a6-8387-4c41-9654-641ae6470f56 |
 +
| name          | test-policy-east                    |
 +
| shared        | False                                |
 +
| tenant_id      | d98aa7dd12f94af29a4c1d7b8174643c    |
 +
+----------------+--------------------------------------+
 +
stack@east-virtual-machine:~/devstack$ neutron firewall-create e00ce2a6-8387-4c41-9654-641ae6470f56
 +
Created a new firewall:
 +
+--------------------+--------------------------------------+
 +
| Field              | Value                                |
 +
+--------------------+--------------------------------------+
 +
| admin_state_up    | True                                |
 +
| description        |                                      |
 +
| firewall_policy_id | e00ce2a6-8387-4c41-9654-641ae6470f56 |
 +
| id                | b072f9e2-b035-4a26-b9c3-0145800e86b8 |
 +
| name              |                                      |
 +
| status            | PENDING_CREATE                      |
 +
| tenant_id          | d98aa7dd12f94af29a4c1d7b8174643c    |
 +
+--------------------+--------------------------------------+
 +
stack@east-virtual-machine:~/devstack$ neutron firewall-show b072f9e2-b035-4a26-b9c3-0145800e86b8
 +
+--------------------+--------------------------------------+
 +
| Field              | Value                                |
 +
+--------------------+--------------------------------------+
 +
| admin_state_up    | True                                |
 +
| description        |                                      |
 +
| firewall_policy_id | e00ce2a6-8387-4c41-9654-641ae6470f56 |
 +
| id                | b072f9e2-b035-4a26-b9c3-0145800e86b8 |
 +
| name              |                                      |
 +
| status            | ACTIVE                              |
 +
| tenant_id          | d98aa7dd12f94af29a4c1d7b8174643c    |
 +
+--------------------+--------------------------------------+
 +
stack@east-virtual-machine:~/devstack$ sudo ip netns exec qrouter-2269732f-1e8d-42bb-bed4-7a1f7e101967 ssh cirros@10.1.0.2
 +
cirros@10.1.0.2's password:
 +
$ ping 10.2.0.4
 +
PING 10.2.0.4 (10.2.0.4): 56 data bytes
 +
64 bytes from 10.2.0.4: seq=0 ttl=62 time=29.759 ms
 +
64 bytes from 10.2.0.4: seq=1 ttl=62 time=1.480 ms
 +
^C
 +
--- 10.2.0.4 ping statistics ---
 +
2 packets transmitted, 2 packets received, 0% packet loss
 +
round-trip min/avg/max = 1.480/15.619/29.759 ms
 +
$ ping 10.2.0.2
 +
PING 10.2.0.2 (10.2.0.2): 56 data bytes
 +
^C
 +
--- 10.2.0.2 ping statistics ---
 +
2 packets transmitted, 0 packets received, 100% packet loss
 +
$ exit
 +
Connection to 10.1.0.2 closed.
 +
stack@east-virtual-machine
 +
</nowiki></pre>
 +
 
 +
We can actually remove the explicit deny rule for 10.2.0.2 and allow the default deny all to pick that up
 +
<pre><nowiki>
 +
stack@east-virtual-machine:~/devstack$ neutron firewall-rule-list
 +
+--------------------------------------+------+--------------------------------------+------------------------+---------+
 +
| id                                  | name | firewall_policy_id                  | summary                | enabled |
 +
+--------------------------------------+------+--------------------------------------+------------------------+---------+
 +
| a70cf19e-8178-4de6-85e3-6e2610fcc620 |      | e00ce2a6-8387-4c41-9654-641ae6470f56 | ICMP,                  | True    |
 +
|                                      |      |                                      |  source: none(none),  |        |
 +
|                                      |      |                                      |  dest: 10.2.0.4(none), |        |
 +
|                                      |      |                                      |  allow                |        |
 +
| f2349c92-3f1b-4aad-90ed-d6626b80f41e |      | e00ce2a6-8387-4c41-9654-641ae6470f56 | ICMP,                  | True    |
 +
|                                      |      |                                      |  source: none(none),  |        |
 +
|                                      |      |                                      |  dest: 10.2.0.2(none), |        |
 +
|                                      |      |                                      |  deny                  |        |
 +
+--------------------------------------+------+--------------------------------------+------------------------+---------+
 +
stack@east-virtual-machine:~/devstack$ neutron firewall-policy-remove-rule e00ce2a6-8387-4c41-9654-641ae6470f56 f2349c92-3f1b-4aad-90ed-d6626b80f41e
 +
Removed firewall rule from firewall policy e00ce2a6-8387-4c41-9654-641ae6470f56
 +
stack@east-virtual-machine:~/devstack$ neutron firewall-policy-show test-policy-east
 +
+----------------+--------------------------------------+
 +
| Field          | Value                                |
 +
+----------------+--------------------------------------+
 +
| audited        | False                                |
 +
| description    |                                      |
 +
| firewall_rules | a70cf19e-8178-4de6-85e3-6e2610fcc620 |
 +
| id            | e00ce2a6-8387-4c41-9654-641ae6470f56 |
 +
| name          | test-policy-east                    |
 +
| shared        | False                                |
 +
| tenant_id      | d98aa7dd12f94af29a4c1d7b8174643c    |
 +
+----------------+--------------------------------------+
 +
stack@east-virtual-machine:~/devstack$ sudo ip netns exec qrouter-2269732f-1e8d-42bb-bed4-7a1f7e101967 ssh cirros@10.1.0.2
 +
cirros@10.1.0.2's password:
 +
$ ping 10.2.0.2
 +
PING 10.2.0.2 (10.2.0.2): 56 data bytes
 +
^C
 +
--- 10.2.0.2 ping statistics ---
 +
2 packets transmitted, 0 packets received, 100% packet loss
 +
$ ping 10.2.0.4
 +
PING 10.2.0.4 (10.2.0.4): 56 data bytes
 +
64 bytes from 10.2.0.4: seq=0 ttl=62 time=23.280 ms
 +
64 bytes from 10.2.0.4: seq=1 ttl=62 time=1.545 ms
 +
^C
 +
--- 10.2.0.4 ping statistics ---
 +
2 packets transmitted, 2 packets received, 0% packet loss
 +
round-trip min/avg/max = 1.545/12.412/23.280 ms
 +
$
 +
</nowiki></pre>
 +
== Tempest Tests ==
 +
=== Neutron API tests ===
 +
Started with individual runs of the different API tests present for Neutron
 +
 
 +
Just used nosetests to run the tests individually as below:
 +
 
 +
<pre><nowiki>
 +
/opt/stack/tempest$ nosetests tempest.api.network.test_floating_ips
 +
</nowiki></pre>
 +
 
 +
==== Baseline ====
 +
<pre><nowiki>
 +
tempest.api.network.test_extensions ..
 +
tempest.api.network.test_floating_ips ......
 +
tempest.api.network.test_load_balancer EE
 +
tempest.api.network.test_networks_negative ..........
 +
tempest.api.network.test_networks ............................
 +
tempest.api.network.test_quotas .
 +
tempest.api.network.test_routers_negative …
 +
tempest.api.network.test_routers .........
 +
tempest.api.network.test_security_groups_negative ..............
 +
tempest.api.network.test_security_groups ........
 +
tempest.api.network.test_service_type_management FF
 +
tempest.api.network.test_vpnaas_extensions ......
 +
</nowiki></pre>
 +
==== FWaaS Enabled ====
 +
<pre><nowiki>
 +
tempest.api.network.test_extensions ..
 +
tempest.api.network.test_floating_ips ......
 +
tempest.api.network.test_load_balancer EE
 +
tempest.api.network.test_networks_negative ..........
 +
tempest.api.network.test_networks ............................
 +
tempest.api.network.test_quotas .
 +
tempest.api.network.test_routers_negative …
 +
tempest.api.network.test_routers .........
 +
tempest.api.network.test_security_groups_negative ..............
 +
tempest.api.network.test_security_groups ........
 +
tempest.api.network.test_service_type_management FF
 +
nosetests tempest.api.network.test_vpnaas_extensions ......
 +
</nowiki></pre>
 +
 
 +
Results are the same with no additional failures introduced by enabling FWaaS.

Latest revision as of 19:40, 6 February 2014

FWaaS and VPNaaS Integration Tests

Objective

Validate basic functionality with FWaaS and VPNaaS enabled.

1) Set up a VPN tunnel between devstack instance East and devstack instance West - validate connectivity.

2) Apply firewall rules and verify that the behavior is as expected.

Setup VPN tunnel across 2 devstack instances (East & West)

Add

enable_service q-fwaas

enable_service q-vpn

to localrc

Use directions from: https://wiki.openstack.org/wiki/Quantum/VPNaaS/HowToInstall

for VPN setup. Firewall setup directions are present on this wiki page.

Verify Tunnel

neutron ipsec-site-connection-show vpnconnection1

East: 

stack@east-virtual-machine:~/devstack$ neutron ipsec-site-connection-show vpnconnection1
+----------------+----------------------------------------------------+
| Field          | Value                                              |
+----------------+----------------------------------------------------+
| admin_state_up | True                                               |
| auth_mode      | psk                                                |
| description    |                                                    |
| dpd            | {"action": "hold", "interval": 30, "timeout": 120} |
| id             | 8d2faebb-3b9c-4b93-8594-f2246c9a92ad               |
| ikepolicy_id   | eeeea7ad-d730-40b5-a24a-ecfa58113b53               |
| initiator      | bi-directional                                     |
| ipsecpolicy_id | 90597431-ee8f-46d2-a9f7-039efca0bed7               |
| mtu            | 1500                                               |
| name           | vpnconnection1                                     |
| peer_address   | 172.24.4.21                                        |
| peer_cidrs     | 10.2.0.0/24                                        |
| peer_id        | 172.24.4.21                                        |
| psk            | secret                                             |
| route_mode     | static                                             |
| status         | ACTIVE                                             |
| tenant_id      | d98aa7dd12f94af29a4c1d7b8174643c                   |
| vpnservice_id  | 3f21d590-1e30-4d08-a412-a7d9e5b2560f               |
+----------------+----------------------------------------------------+
stack@east-virtual-machine:~/devstack$

West 

stack@west:~/devstack$ neutron ipsec-site-connection-show vpnconnection1
+----------------+----------------------------------------------------+
| Field          | Value                                              |
+----------------+----------------------------------------------------+
| admin_state_up | True                                               |
| auth_mode      | psk                                                |
| description    |                                                    |
| dpd            | {"action": "hold", "interval": 30, "timeout": 120} |
| id             | b7330d13-0ff1-4529-b0d5-91c2e7c4cfbf               |
| ikepolicy_id   | 858eb8f5-a2ee-4649-861a-0f0ca5814556               |
| initiator      | bi-directional                                     |
| ipsecpolicy_id | ba86e218-6ef6-46a5-baf1-f63177590a6e               |
| mtu            | 1500                                               |
| name           | vpnconnection1                                     |
| peer_address   | 172.24.4.11                                        |
| peer_cidrs     | 10.1.0.0/24                                        |
| peer_id        | 172.24.4.11                                        |
| psk            | secret                                             |
| route_mode     | static                                             |
| status         | ACTIVE                                             |
| tenant_id      | b0caec5cacce45babb19be70066b22ce                   |
| vpnservice_id  | 9c6fee8a-85aa-4f8e-911e-95d4d5c997d7               |
+----------------+----------------------------------------------------+
stack@west:~/devstack$

Spawn the VMs

East 

stack@east-virtual-machine:~/devstack$ nova list
+--------------------------------------+----------+--------+------------+-------------+------------------+
| ID                                   | Name     | Status | Task State | Power State | Networks         |
+--------------------------------------+----------+--------+------------+-------------+------------------+
| 23850324-d8d8-4859-a5ac-e48c2834e661 | East-VM1 | ACTIVE | None       | Running     | private=10.1.0.2 |
+--------------------------------------+----------+--------+------------+-------------+------------------+

West 

stack@west:~/devstack$ nova list
+--------------------------------------+----------+--------+------------+-------------+------------------+
| ID                                   | Name     | Status | Task State | Power State | Networks         |
+--------------------------------------+----------+--------+------------+-------------+------------------+
| c0cd320e-eab9-4131-b959-823f90bb7563 | West-VM1 | ACTIVE | None       | Running     | private=10.2.0.2 |
| e4e68302-d76b-4067-bce1-31e7634451d2 | West-VM2 | ACTIVE | None       | Running     | private=10.2.0.4 |
+--------------------------------------+----------+--------+------------+-------------+------------------+
stack@west:~/devstack$

Pings over VPN (no FW yet)

East to West 

sudo ip netns exec qrouter-2269732f-1e8d-42bb-bed4-7a1f7e101967 ssh cirros@10.1.0.2
The authenticity of host '10.1.0.2 (10.1.0.2)' can't be established.
RSA key fingerprint is 6b:1b:a8:e4:3a:d0:09:63:8d:7b:af:19:2b:e5:29:27.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.1.0.2' (RSA) to the list of known hosts.
cirros@10.1.0.2's password: 

$ ifconfig
eth0      Link encap:Ethernet  HWaddr FA:16:3E:EC:DC:4B  
          inet addr:10.1.0.2  Bcast:10.1.0.255  Mask:255.255.255.0
          inet6 addr: fe80::f816:3eff:feec:dc4b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:123 errors:0 dropped:0 overruns:0 frame:0
          TX packets:80 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:17909 (17.4 KiB)  TX bytes:10258 (10.0 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

$ ping 10.2.0.2
PING 10.2.0.2 (10.2.0.2): 56 data bytes
64 bytes from 10.2.0.2: seq=0 ttl=62 time=13.522 ms
64 bytes from 10.2.0.2: seq=1 ttl=62 time=1.541 ms
^C

$ ping 10.2.0.4
PING 10.2.0.4 (10.2.0.4): 56 data bytes
64 bytes from 10.2.0.4: seq=0 ttl=62 time=24.885 ms
64 bytes from 10.2.0.4: seq=1 ttl=62 time=1.456 ms
64 bytes from 10.2.0.4: seq=2 ttl=62 time=1.457 ms
^C

West to East 

stack@west:~/devstack$ sudo ip netns exec qrouter-47e92836-08d8-4bb1-a2e9-6ac4eaec7610 ssh cirros@10.2.0.2
The authenticity of host '10.2.0.2 (10.2.0.2)' can't be established.
RSA key fingerprint is a0:0c:fb:f0:28:21:20:d2:27:39:9c:93:e9:77:36:ef.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.2.0.2' (RSA) to the list of known hosts.
cirros@10.2.0.2's password: 
$ ifconfig
eth0      Link encap:Ethernet  HWaddr FA:16:3E:10:ED:05  
          inet addr:10.2.0.2  Bcast:10.2.0.255  Mask:255.255.255.0
          inet6 addr: fe80::f816:3eff:fe10:ed05/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:77 errors:0 dropped:0 overruns:0 frame:0
          TX packets:59 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:10792 (10.5 KiB)  TX bytes:7424 (7.2 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

$ ping 10.1.0.2
PING 10.1.0.2 (10.1.0.2): 56 data bytes
64 bytes from 10.1.0.2: seq=0 ttl=62 time=21.485 ms
64 bytes from 10.1.0.2: seq=1 ttl=62 time=1.332 ms
64 bytes from 10.1.0.2: seq=2 ttl=62 time=1.477 ms
^C
--- 10.1.0.2 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 1.332/8.098/21.485 ms
$

Add a Firewall with a rule to deny all icmp on West

stack@west:~/devstack$ neutron firewall-rule-create --protocol icmp --action deny
Created a new firewall_rule:
+------------------------+--------------------------------------+
| Field                  | Value                                |
+------------------------+--------------------------------------+
| action                 | deny                                 |
| description            |                                      |
| destination_ip_address |                                      |
| destination_port       |                                      |
| enabled                | True                                 |
| firewall_policy_id     |                                      |
| id                     | f1deebab-5a54-4a98-8684-174e967c5520 |
| ip_version             | 4                                    |
| name                   |                                      |
| position               |                                      |
| protocol               | icmp                                 |
| shared                 | False                                |
| source_ip_address      |                                      |
| source_port            |                                      |
| tenant_id              | b0caec5cacce45babb19be70066b22ce     |
+------------------------+--------------------------------------+
stack@west:~/devstack$ neutron firewall-policy-create --firewall-rules "f1deebab-5a54-4a98-8684-174e967c5520" test-policy
Created a new firewall_policy:
+----------------+--------------------------------------+
| Field          | Value                                |
+----------------+--------------------------------------+
| audited        | False                                |
| description    |                                      |
| firewall_rules | f1deebab-5a54-4a98-8684-174e967c5520 |
| id             | cff10b50-a324-4640-9cf8-a88538c429ef |
| name           | test-policy                          |
| shared         | False                                |
| tenant_id      | b0caec5cacce45babb19be70066b22ce     |
+----------------+--------------------------------------+
stack@west:~/devstack$ neutron firewall-create cff10b50-a324-4640-9cf8-a88538c429ef
Created a new firewall:
+--------------------+--------------------------------------+
| Field              | Value                                |
+--------------------+--------------------------------------+
| admin_state_up     | True                                 |
| description        |                                      |
| firewall_policy_id | cff10b50-a324-4640-9cf8-a88538c429ef |
| id                 | 3772cc7a-3467-4238-82b8-904d50ebfb4d |
| name               |                                      |
| status             | PENDING_CREATE                       |
| tenant_id          | b0caec5cacce45babb19be70066b22ce     |
+--------------------+--------------------------------------+
stack@west:~/devstack$ neutron firewall-show 3772cc7a-3467-4238-82b8-904d50ebfb4d
+--------------------+--------------------------------------+
| Field              | Value                                |
+--------------------+--------------------------------------+
| admin_state_up     | True                                 |
| description        |                                      |
| firewall_policy_id | cff10b50-a324-4640-9cf8-a88538c429ef |
| id                 | 3772cc7a-3467-4238-82b8-904d50ebfb4d |
| name               |                                      |
| status             | ACTIVE                               |
| tenant_id          | b0caec5cacce45babb19be70066b22ce     |
+--------------------+--------------------------------------+
stack@west:~/devstack$

Ping from East to West 

$ ping 10.2.0.4
PING 10.2.0.4 (10.2.0.4): 56 data bytes
^C
--- 10.2.0.4 ping statistics ---
3 packets transmitted, 0 packets received, 100% packet loss
$ ping 10.2.0.2
PING 10.2.0.2 (10.2.0.2): 56 data bytes
^C
--- 10.2.0.2 ping statistics ---
4 packets transmitted, 0 packets received, 100% packet loss
$

Ping from West to East 

$ ifconfig
eth0      Link encap:Ethernet  HWaddr FA:16:3E:10:ED:05  
          inet addr:10.2.0.2  Bcast:10.2.0.255  Mask:255.255.255.0
          inet6 addr: fe80::f816:3eff:fe10:ed05/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:230 errors:0 dropped:0 overruns:0 frame:0
          TX packets:163 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:25915 (25.3 KiB)  TX bytes:20690 (20.2 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

$ ping 10.1.0.2
PING 10.1.0.2 (10.1.0.2): 56 data bytes
^C
--- 10.1.0.2 ping statistics ---
3 packets transmitted, 0 packets received, 100% packet loss
$

Remove Firewall in West 

stack@west:~/devstack$ neutron firewall-list
+--------------------------------------+------+--------------------------------------+
| id                                   | name | firewall_policy_id                   |
+--------------------------------------+------+--------------------------------------+
| 3772cc7a-3467-4238-82b8-904d50ebfb4d |      | cff10b50-a324-4640-9cf8-a88538c429ef |
+--------------------------------------+------+--------------------------------------+
stack@west:~/devstack$ neutron firewall-delete 3772cc7a-3467-4238-82b8-904d50ebfb4d
Deleted firewall: 3772cc7a-3467-4238-82b8-904d50ebfb4d
stack@west:~/devstack$ neutron firewall-list

stack@west:~/devstack$

Check Ping 

$ ping 10.2.0.2
PING 10.2.0.2 (10.2.0.2): 56 data bytes
64 bytes from 10.2.0.2: seq=0 ttl=62 time=14.469 ms
64 bytes from 10.2.0.2: seq=1 ttl=62 time=1.458 ms
^C
--- 10.2.0.2 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 1.458/7.963/14.469 ms
$ ping 10.2.0.4
PING 10.2.0.4 (10.2.0.4): 56 data bytes
64 bytes from 10.2.0.4: seq=0 ttl=62 time=13.530 ms
64 bytes from 10.2.0.4: seq=1 ttl=62 time=1.732 ms
^C
--- 10.2.0.4 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 1.732/7.631/13.530 ms

Add a firewall with a destination icmp rule on East to allow pings to West-VM2 but not West-VM1

stack@east-virtual-machine:~/devstack$ neutron firewall-rule-create --protocol icmp --destination_ip_address 10.2.0.4 --action allow
Created a new firewall_rule:
+------------------------+--------------------------------------+
| Field                  | Value                                |
+------------------------+--------------------------------------+
| action                 | allow                                |
| description            |                                      |
| destination_ip_address | 10.2.0.4                             |
| destination_port       |                                      |
| enabled                | True                                 |
| firewall_policy_id     |                                      |
| id                     | a70cf19e-8178-4de6-85e3-6e2610fcc620 |
| ip_version             | 4                                    |
| name                   |                                      |
| position               |                                      |
| protocol               | icmp                                 |
| shared                 | False                                |
| source_ip_address      |                                      |
| source_port            |                                      |
| tenant_id              | d98aa7dd12f94af29a4c1d7b8174643c     |
+------------------------+--------------------------------------+
stack@east-virtual-machine:~/devstack$ neutron firewall-rule-list
+--------------------------------------+------+--------------------+------------------------+---------+
| id                                   | name | firewall_policy_id | summary                | enabled |
+--------------------------------------+------+--------------------+------------------------+---------+
| a70cf19e-8178-4de6-85e3-6e2610fcc620 |      |                    | ICMP,                  | True    |
|                                      |      |                    |  source: none(none),   |         |
|                                      |      |                    |  dest: 10.2.0.4(none), |         |
|                                      |      |                    |  allow                 |         |
| f2349c92-3f1b-4aad-90ed-d6626b80f41e |      |                    | ICMP,                  | True    |
|                                      |      |                    |  source: none(none),   |         |
|                                      |      |                    |  dest: 10.2.0.2(none), |         |
|                                      |      |                    |  deny                  |         |
+--------------------------------------+------+--------------------+------------------------+---------+
stack@east-virtual-machine:~/devstack$ neutron firewall-policy-create --firewall-rules "a70cf19e-8178-4de6-85e3-6e2610fcc620 f2349c92-3f1b-4aad-90ed-d6626b80f41e" test-policy-east
Created a new firewall_policy:
+----------------+--------------------------------------+
| Field          | Value                                |
+----------------+--------------------------------------+
| audited        | False                                |
| description    |                                      |
| firewall_rules | a70cf19e-8178-4de6-85e3-6e2610fcc620 |
|                | f2349c92-3f1b-4aad-90ed-d6626b80f41e |
| id             | e00ce2a6-8387-4c41-9654-641ae6470f56 |
| name           | test-policy-east                     |
| shared         | False                                |
| tenant_id      | d98aa7dd12f94af29a4c1d7b8174643c     |
+----------------+--------------------------------------+
stack@east-virtual-machine:~/devstack$ neutron firewall-create e00ce2a6-8387-4c41-9654-641ae6470f56
Created a new firewall:
+--------------------+--------------------------------------+
| Field              | Value                                |
+--------------------+--------------------------------------+
| admin_state_up     | True                                 |
| description        |                                      |
| firewall_policy_id | e00ce2a6-8387-4c41-9654-641ae6470f56 |
| id                 | b072f9e2-b035-4a26-b9c3-0145800e86b8 |
| name               |                                      |
| status             | PENDING_CREATE                       |
| tenant_id          | d98aa7dd12f94af29a4c1d7b8174643c     |
+--------------------+--------------------------------------+
stack@east-virtual-machine:~/devstack$ neutron firewall-show b072f9e2-b035-4a26-b9c3-0145800e86b8
+--------------------+--------------------------------------+
| Field              | Value                                |
+--------------------+--------------------------------------+
| admin_state_up     | True                                 |
| description        |                                      |
| firewall_policy_id | e00ce2a6-8387-4c41-9654-641ae6470f56 |
| id                 | b072f9e2-b035-4a26-b9c3-0145800e86b8 |
| name               |                                      |
| status             | ACTIVE                               |
| tenant_id          | d98aa7dd12f94af29a4c1d7b8174643c     |
+--------------------+--------------------------------------+
stack@east-virtual-machine:~/devstack$ sudo ip netns exec qrouter-2269732f-1e8d-42bb-bed4-7a1f7e101967 ssh cirros@10.1.0.2
cirros@10.1.0.2's password: 
$ ping 10.2.0.4
PING 10.2.0.4 (10.2.0.4): 56 data bytes
64 bytes from 10.2.0.4: seq=0 ttl=62 time=29.759 ms
64 bytes from 10.2.0.4: seq=1 ttl=62 time=1.480 ms
^C
--- 10.2.0.4 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 1.480/15.619/29.759 ms
$ ping 10.2.0.2
PING 10.2.0.2 (10.2.0.2): 56 data bytes
^C
--- 10.2.0.2 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
$ exit
Connection to 10.1.0.2 closed.
stack@east-virtual-machine

We can actually remove the explicit deny rule for 10.2.0.2 and allow the default deny all to pick that up 

stack@east-virtual-machine:~/devstack$ neutron firewall-rule-list
+--------------------------------------+------+--------------------------------------+------------------------+---------+
| id                                   | name | firewall_policy_id                   | summary                | enabled |
+--------------------------------------+------+--------------------------------------+------------------------+---------+
| a70cf19e-8178-4de6-85e3-6e2610fcc620 |      | e00ce2a6-8387-4c41-9654-641ae6470f56 | ICMP,                  | True    |
|                                      |      |                                      |  source: none(none),   |         |
|                                      |      |                                      |  dest: 10.2.0.4(none), |         |
|                                      |      |                                      |  allow                 |         |
| f2349c92-3f1b-4aad-90ed-d6626b80f41e |      | e00ce2a6-8387-4c41-9654-641ae6470f56 | ICMP,                  | True    |
|                                      |      |                                      |  source: none(none),   |         |
|                                      |      |                                      |  dest: 10.2.0.2(none), |         |
|                                      |      |                                      |  deny                  |         |
+--------------------------------------+------+--------------------------------------+------------------------+---------+
stack@east-virtual-machine:~/devstack$ neutron firewall-policy-remove-rule e00ce2a6-8387-4c41-9654-641ae6470f56 f2349c92-3f1b-4aad-90ed-d6626b80f41e
Removed firewall rule from firewall policy e00ce2a6-8387-4c41-9654-641ae6470f56
stack@east-virtual-machine:~/devstack$ neutron firewall-policy-show test-policy-east
+----------------+--------------------------------------+
| Field          | Value                                |
+----------------+--------------------------------------+
| audited        | False                                |
| description    |                                      |
| firewall_rules | a70cf19e-8178-4de6-85e3-6e2610fcc620 |
| id             | e00ce2a6-8387-4c41-9654-641ae6470f56 |
| name           | test-policy-east                     |
| shared         | False                                |
| tenant_id      | d98aa7dd12f94af29a4c1d7b8174643c     |
+----------------+--------------------------------------+
stack@east-virtual-machine:~/devstack$ sudo ip netns exec qrouter-2269732f-1e8d-42bb-bed4-7a1f7e101967 ssh cirros@10.1.0.2
cirros@10.1.0.2's password: 
$ ping 10.2.0.2
PING 10.2.0.2 (10.2.0.2): 56 data bytes
^C
--- 10.2.0.2 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
$ ping 10.2.0.4
PING 10.2.0.4 (10.2.0.4): 56 data bytes
64 bytes from 10.2.0.4: seq=0 ttl=62 time=23.280 ms
64 bytes from 10.2.0.4: seq=1 ttl=62 time=1.545 ms
^C
--- 10.2.0.4 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 1.545/12.412/23.280 ms
$

Tempest Tests

Neutron API tests

Started with individual runs of the different API tests present for Neutron

Just used nosetests to run the tests individually as below: 

/opt/stack/tempest$ nosetests tempest.api.network.test_floating_ips

Baseline

tempest.api.network.test_extensions					..
tempest.api.network.test_floating_ips					......
tempest.api.network.test_load_balancer				EE
tempest.api.network.test_networks_negative				..........
tempest.api.network.test_networks					............................
tempest.api.network.test_quotas						.
tempest.api.network.test_routers_negative				…
tempest.api.network.test_routers						.........
tempest.api.network.test_security_groups_negative			..............
tempest.api.network.test_security_groups				........
tempest.api.network.test_service_type_management			FF
tempest.api.network.test_vpnaas_extensions				......

FWaaS Enabled

tempest.api.network.test_extensions					..
tempest.api.network.test_floating_ips					......
tempest.api.network.test_load_balancer				EE
tempest.api.network.test_networks_negative				..........
tempest.api.network.test_networks					............................
tempest.api.network.test_quotas						.
tempest.api.network.test_routers_negative				…
tempest.api.network.test_routers						.........
tempest.api.network.test_security_groups_negative			..............
tempest.api.network.test_security_groups				........
tempest.api.network.test_service_type_management			FF
nosetests tempest.api.network.test_vpnaas_extensions		......

Results are the same with no additional failures introduced by enabling FWaaS.

Retrieved from "https://wiki.openstack.org/w/index.php?title=Quantum/FWaaS/Testing&oldid=41544"