18:45:52 #startmeeting Networking FWaaS 18:45:53 Meeting started Wed Mar 26 18:45:52 2014 UTC and is due to finish in 60 minutes. The chair is SumitNaiksatam. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:45:54 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 18:45:56 The meeting name has been set to 'networking_fwaas' 18:46:16 SridarK RajeshMohan: there? 18:46:21 hi 18:46:24 SumitNaiksatam: Hi 18:46:54 RajeshMohan: apologies for the delay, but it would be nice to have you in the previous meeting as well 18:47:07 SumitNaiksatam: I am sorry. I had a clash 18:47:16 not sure if we have gary or yi today? 18:47:27 SumitNaiksatam: I am trying to reschedule the other one 18:47:34 RajeshMohan: ok great 18:47:46 RajeshMohan: lots of discussion on service context over there 18:47:58 SumitNaiksatam: I will go over them 18:47:58 #topic Service Insertion and Firewall 18:48:09 https://review.openstack.org/#/c/62599 18:48:42 RajeshMohan: is the earlier issue raised by akihiro fixed? 18:49:13 RajeshMohan: we have not rebased since march 6th 18:49:16 SumitNaiksatam: No, I was waiitng for kevin's patch to merge. I see that it is merged now 18:49:29 RajeshMohan: the one on the UTs? 18:49:32 SumitNaiksatam: I can put back the 'router-in-use' 18:49:58 'router-in-use" check should take care of one issue he raised 18:50:13 So with this the router will not get deleted when fw-delete happens ? 18:50:20 RajeshMohan: ok, lets get it wrapped up and have akihiro agree to it 18:50:23 The other one was about router not gettng deleted 18:50:36 RajeshMohan: i think the latter should be fixed now, right? 18:51:06 SridarK: any updates on that - sorry I cannot find the link to your patch 18:51:31 #link https://review.openstack.org/#/c/74290 18:51:53 SumitNaiksatam: those two will take care of what looked like bugs 18:51:55 one issue pending is Akihiro comments on using a ',' delimeter 18:52:12 oops sorry 18:52:16 u asked abt the bug 18:52:29 yes that will take care of one of Akihiro's issues 18:52:33 ok good 18:52:50 so RajeshMohan lets reach out akihiro once we have rebased and patched 18:52:56 this will of course not mereg 18:53:32 SumitNaiksatam: there was general issue on attributes.py file 18:53:32 but if we get his approval, it will be easier to proceed once Juno opens 18:53:41 RajeshMohan: what was that? 18:54:12 SumitNaiksatam: 1 sec 18:54:17 yeah 18:54:26 SridarK: how is the CLI patch looking 18:54:30 SridarK: are we set? 18:54:47 one issue pending is Akihiro comments on using a ',' delimeter for the resource list 18:55:04 i used a space delimiter to keep it consistent with FW rules list 18:55:38 there is no religion there just trying to maintain some consistency 18:55:51 wanted to get ur opinion and i can change it 18:56:30 SumitNaiksatam: I cannot find it - it was the discussion on defining 'routers', 'network' etc in common file 18:56:51 SumitNaiksatam: He was not sure if all types will make sense for all services 18:56:54 SridarK: ah ok, i think we can go with what Akihiro wants (comma separated) 18:57:03 ok done 18:57:14 SumitNaiksatam: Not sure if we discussed that in Advanced Services meeting 18:57:24 SridarK: we can later, change the firewall rules to keep consistency 18:57:29 RajeshMohan: ok 18:57:30 ok 18:57:43 RajeshMohan: i think i recall that comment in the review 18:57:52 RajeshMohan: lets leave it the way it is now 18:58:09 RajeshMohan: the reviewer can get back on this if its still an issue 18:58:20 SumitNaiksatam: Ok. I will address the comments and rebase once Sridar's patch merges 18:58:37 RajeshMohan: SridarK's patch? 18:58:54 SumitNaiksatam: yes - router not getting deleted fix 18:59:01 RajeshMohan: that is merged 18:59:08 RajeshMohan: yeah 18:59:15 RajeshMohan: that happened on March 15th 18:59:35 SumitNaiksatam SridarK: Ok. Then I will rebase 18:59:49 RajeshMohan: ok thanks 18:59:57 RajeshMohan: one other issue was when we try to delete these routers (which has no i/f) - Akihiro's issue 19:00:13 or rather a follow on to Akihiro's issue 19:00:25 i have an email out to u 19:00:49 SridarK: i think i glossed over that 19:00:58 SridarK: can't seem to recollect the context 19:01:21 SumitNaiksatam: when we delete - there was an issue on the db 19:01:31 SridarK: ok 19:01:43 SridarK: is the comment on RajeshMohan's patch? 19:01:57 SumitNaiksatam: No details in email to u guys 19:01:58 SridarK: I also seem to be missing some context - To me 'Akihiro's issue' and 'router not deleted' are same 19:02:18 I will resend the email 19:02:30 SridarK: ok great, sorry about that 19:02:57 RajeshMohan: /opt/stack/neutron/neutron/db/service_context.py(266)_delete_resource_context() -> service_context_id=service_context_db.id).one() ---------------------------------------------------------------------- > /usr/local/lib/python2.7/dist-packages/sqlalchemy/orm/query.py(2193)one() -> "Multiple rows were found for one()") (Pdb) 19:03:07 was the traceback 19:03:29 SridarK: ok - got that 19:03:34 this copy paste comes out terribly :-) 19:03:40 RajeshMohan: ok great 19:03:47 SridarK: but it did the trick :-) 19:03:49 SridarK: I need to fix that as well along with rebase 19:04:03 RajeshMohan: ok 19:04:36 RajeshMohan: if possible we should have a UT to cover that case 19:04:58 SumitNaiksatam SridarK: Will have a patch out by end of this week 19:05:29 RajeshMohan: ok thanks 19:05:42 ok cool i will also refactor the CLI to change as per Akihiro's comment for ',' 19:05:48 we should focus on getting this in before we take up other things 19:05:55 lets not lose our tempo on this 19:05:55 so we should be good to go when Juno reopens 19:06:13 SridarK: yeah, thanks 19:06:29 Sooner the better - I need to work on our plugin as well after that 19:06:43 RajeshMohan: ok cool 19:06:52 #topic 19:06:55 #undo 19:06:56 Removing item from minutes: 19:07:15 #topic Zones 19:07:47 so this will be a primary target for Juno 19:08:06 SridarK: I think we need to discuss as a team 19:08:20 yes 19:08:29 per our earlier discussion this was definitely a priority 19:08:32 i think we had some points down 19:08:32 All firewalls have zones - though the definition of zones may differ a bit 19:08:45 but will be good to cover it as a team 19:08:53 but still good to have a discussion 19:09:12 RajeshMohan: you wanted to discuss something beyond what we have currently defined? 19:09:15 SumitNaiksatam SridarK: We already discussed this in the HK summit 19:09:17 RajeshMohan: yes i think some minor diferences 19:09:30 across vendors 19:09:46 I propose that we start working on the patch - after we document the API 19:09:54 but seems like nothing too controversial hopefully and we can have a model that works for all 19:10:25 RajeshMohan: definitely, if we can crystallize the resource model and the API, we can proceed on this 19:10:43 perhaps we can start the discussions - i can start capturing into a doc 19:10:47 SridarK: let's document what we mean by zones and get folks to agree 19:10:57 so we have something out there for all to comment 19:11:10 RajeshMohan: we are on the same page :-) 19:11:20 zones - collection of neutron ports is what we were pushing in the lcehouse design summit 19:11:37 SridarK: ok great 19:11:58 I see some similarities with our discussions on insertion context 19:12:11 service context 19:12:45 SridarK: yes - we have to link the two at some stage - maybe at validation stage 19:13:05 yeah, one general comment (i think we discussed this earlier) is that not every construct of a service needs to be represented at the neutron level 19:13:25 i do agree that from a firewall perspective, zone is a fundamental construct 19:13:55 SumitNaiksatam: yes i think we need to discuss more on that 19:14:01 however, i think we will need to convince the community that certain use cases cannot be satisfied if zones are not defined 19:14:47 All firewalls have zones - is that not good enough :-) 19:15:02 RajeshMohan: probably not 19:15:10 we need different policy for different pair of zones 19:15:24 RajeshMohan: all switches mostly support VLANs 19:15:43 RajeshMohan: but we don't expose them in the neutron abstraction 19:15:51 may not be the best analogy 19:15:56 SumitNaiksatam: i think u are saying to justify this new construct of szone 19:16:02 *zone 19:16:04 i am just playing the devil's advocate 19:16:18 instead of just saying collection of ports 19:16:19 SumitNaiksatam: Ok - we will try to build a case for firewall zones 19:16:47 RajeshMohan: great 19:17:17 #topic open discussion 19:17:26 anything else we need to discuss? 19:17:31 Summit prep ? 19:17:35 yeah 19:17:39 thanks SridarK just typing 19:17:43 we should discuss will all folks 19:17:45 i did post a summit session 19:17:48 oh ok :-) 19:18:03 I want to propose an extension to firewall "Firewall DPI Configuration" 19:18:04 like last time 19:18:21 I can get a BP ready for that 19:18:43 #link http://summit.openstack.org/cfp/details/17 19:19:07 RajeshMohan: great 19:19:09 RajeshMohan: i attribute my baldness to debugging DPI issues on a NPU ;-) 19:19:12 We need a knob at Firewall level to say that "IPS is enabled", "Gateway AntiVirus is enabled" and few more DPI based firewall services 19:19:19 so +1 on that 19:19:52 i think we need to get into a room (at least some of us) to converge on the priority of topics 19:20:09 anything more? 19:20:10 SumitNaiksatam: yes that will be great 19:20:24 SumitNaiksatam: Sure. I am sure this will be priority for most firewall vendors 19:20:58 SumitNaiksatam SridarK: Just to confirm. What are next actions on Firewall zones? 19:20:59 yeah 19:21:23 SumitNaiksatam SridarK: Are we going to work on a patch based on last design summit? 19:21:23 Lets start some discussion and capture into a doc 19:21:44 SridarK: +1 19:22:07 SridarK: IMO, we already discussed this in last two summits. We can have a quick discussion this time 19:22:48 RajeshMohan: ok lets get some convergence amongst the sub team 19:22:59 so there are no issues raised later on 19:23:25 SridarK SumitNaiksatam: Sorry for pushing on Firewall zones but this is important for DELL plugin 19:23:40 SridarK: yeah, i think we need to convince the rest of the community 19:23:48 I am ok with one more discussion but we have discussed this a lot already 19:24:04 RajeshMohan: Agreed very important for us also and also for other participants 19:24:18 SumitNaiksatam SridarK: Ok. Let's start with documentation 19:24:23 RajeshMohan: there is also always an option of having vendor specific extensions 19:24:57 RajeshMohan: document sounds like a good idea 19:25:05 lets call it a wrap for today 19:25:12 ok 19:25:13 unless there is something else 19:25:17 SumitNaiksatam SridarK: ok. Thanks 19:25:20 nope 19:25:22 thanks 19:25:30 thanks folks for joining 19:25:30 SumitNaiksatam: RajeshMohan ttyl 19:25:35 bye 19:25:36 #endmeeting