Subject: [I2nsf] Can we leverage Group Policy defined by OpenStack?

From: Linda Dunbar <[email-masked]>
Date: Mon, 6 Oct 2014 20:08:55 +0000

OpenStack Neutron presentation (https://www.openstack.org/summit/openstack-summit-atlanta-2014/session-videos/presentation/network-policy-abstractions-in-neutron ) introduced the concept of group policy for web services hosted in Data Center. In a nutshell, it defines the  Policy rules as

              +--------------+
               | Policy Rule  |
               +-------+------+
                       |
        +--------------+--------------+
        |
   +----------+                     +-------+
   |Classifier|                     | Action|
   +----------+                     +-------+

And then defines the command to Neutron for web services, such as:

❖ Create contract:
neutron classifier-create Insecure-Web-Access --port 80 --protocol TCP --direction IN
neutron policy-rule insecure-web --policy-classifier Insecure-Web-Access --actions ALLOW
neutron contract-create Web-Server-Contract --policy-rule insecure-web

❖ Create EPGs and provide/consume contracts:
neutron epg-create Web-Server-EPG --provides-contract Web-Server-Contract
neutron ep-create --endpoint-group Web-Server-EPG
neutron epg-create Outside-EPG --consumes-contract Web-Server-Contract

Those policies are only for web services hosted in data center.
In order for clients to use virtual CPE hosted by operators, clients need to express their specific security policies among their own network (or virtual networks).
Maybe we can use utilize the Virtual Network Context  terminology defined by IETF NVO3 framework to define the desired behavior, and expand what OpenStack has defined for its group policy.

Looking for comments and suggestions.

Linda