18:31:18 <SumitNaiksatam> #startmeeting Networking FWaaS 18:31:19 <openstack> Meeting started Wed Dec 3 18:31:18 2014 UTC and is due to finish in 60 minutes. The chair is SumitNaiksatam. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:31:20 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 18:31:23 <openstack> The meeting name has been set to 'networking_fwaas' 18:31:34 <SumitNaiksatam> #info SPD: Monday 12-8-2014 SAD: Monday 12-15-2014 18:31:54 <SumitNaiksatam> #info Kilo-1 is 12-18-2014 18:32:17 <SumitNaiksatam> any other related announcements anyone would like to share for the benefit of the team? 18:32:51 <SumitNaiksatam> #topic Bugs 18:33:11 <SridarK> SumitNaiksatam: nothing new 18:33:32 <SumitNaiksatam> SridarK: yes 18:33:51 <SumitNaiksatam> i did a quick review on this: #link https://review.openstack.org/#/c/104132/ 18:33:58 <Swami> hi 18:34:20 <SridarK> Swami: hi 18:34:45 <SridarK> SumitNaiksatam: yes u beat me to it - i was trying to understand when i saw ur review go by :-) 18:34:55 <SumitNaiksatam> Swami: hi 18:35:12 <SumitNaiksatam> SridarK: ah ok, do you disagree with the change? 18:35:16 <SridarK> SumitNaiksatam: seems fairly straight forward 18:35:36 <SridarK> SumitNaiksatam: no was just trying compare the change with the original 18:35:46 <SridarK> SumitNaiksatam: it is good 18:35:53 <SumitNaiksatam> SridarK: i thought the change was trying to make things consistent 18:36:01 <SridarK> SumitNaiksatam: yes 18:36:04 <SumitNaiksatam> i however did not have a chance to actually test it out 18:36:16 <SumitNaiksatam> it would be nice if some actually can 18:36:29 <SridarK> SumitNaiksatam: i will try to get to this later today 18:36:35 <SumitNaiksatam> SridarK: sweet 18:36:53 <SumitNaiksatam> i guess we are missing badveli not sure if anything showed up on his bug triage radar 18:37:09 <SumitNaiksatam> #topic Docs 18:37:23 <SumitNaiksatam> i guess we have three pending items here 18:37:44 <SridarK> SumitNaiksatam: yes - i could not even look at any of this trying to get specs out 18:37:44 <SumitNaiksatam> Swami: anything for us to review or contribute in terms of DVR? 18:38:08 <SumitNaiksatam> SridarK: np, that definitely is high priority too 18:38:45 <Swami> SumitNaiksatam: I have created a document for the documentation folks to consume. 18:39:01 <Swami> I have added a section for the services and added a high level note for all the services. 18:39:06 <Swami> #link https://docs.google.com/document/d/1qmKoP4GVdjeEEVvqf3tYptVuvUzVIeQmJiTPWPoi_E0/edit 18:39:31 <Swami> If you can take a look at the services part and if you feel like I have missed anything please fill in the gap. 18:40:02 <Swami> I am working with "Elke Vorgheise" on the documentation. I think she is the tech writer for the networking guide. 18:40:10 <SumitNaiksatam> Swami: ah ok 18:40:17 <SumitNaiksatam> thanks for the link 18:41:26 <SridarK> Swami: thx - overview on services covers major points - will see if we need to add any more details 18:41:29 <SumitNaiksatam> Swami: perhaps we need to add some notes on the migration to the legacy mode (or the lack of when using FWaaS) 18:41:58 <SridarK> Swami: over the the quick scan of the doc for DVR - looks really good and comprehensive 18:42:00 <SumitNaiksatam> but the team here can this a little more detailed read, and provide feedback 18:42:12 <SumitNaiksatam> SridarK: +1, great job Swami! 18:42:24 <Swami> Yes, we can add a section on migration and how the services are handled. 18:42:41 <Swami> I will take a first stab at it and you can add your feedback or data to this document. 18:42:52 <SridarK> Swami: i see a book deal coming :-) Swami signing DVR books at Vancouver :-) 18:42:56 <Swami> SumitNaiksatam: sure. 18:43:11 <SumitNaiksatam> lol! 18:43:34 <Swami> SridarK: Sure, I like the idea. 18:43:38 <SumitNaiksatam> Swami: also, conf is missing, not sure that is meant for this document thought 18:43:41 <SridarK> :-) 18:44:00 <Swami> SumitNaiksatam: When you say config, are you talking about multinode config or single node config. 18:44:29 <Swami> I think I had a section on configuration that deals with the DVR specific configurations. 18:44:32 <SumitNaiksatam> yeah, and specifically in the context of FWaaS what needs to be set on which node 18:45:10 <SumitNaiksatam> i dont think that is terribly different from the DVR base configuration, but i vaguely recall that we had one or two extra things in there 18:45:19 <SumitNaiksatam> just need to confirm 18:45:22 <SridarK> SumitNaiksatam: i don't think we need to set anything specific for FWaaS 18:45:33 <SumitNaiksatam> SridarK: okay 18:45:41 <Swami> For DVR there is no specific action that is required for Firewall configuration. As far as the firewall service is enabled, it should work. 18:46:03 <SridarK> FWaaS just looks at the 'distributed' flag 18:46:03 <SumitNaiksatam> next doc item - #link https://bugs.launchpad.net/openstack-manuals/+bug/1373674 18:46:12 <SumitNaiksatam> SridarK: okay 18:46:48 <SumitNaiksatam> i am not sure if we need address the “openstack-api-site” related documentation 18:47:20 <SumitNaiksatam> third doc item was: #link https://bugs.launchpad.net/openstack-manuals/+bug/1346986 18:47:31 <SumitNaiksatam> i believe there isnt an update on this 18:47:41 <SridarK> SumitNaiksatam: not sure on that the second one - but i recall last week we saw that it was fixed 18:48:03 <SumitNaiksatam> SridarK: it was fixed in one of the documents but it shows open in the other 18:48:15 <SridarK> SumitNaiksatam: hmm ok 18:48:20 <SridarK> sorry missed that 18:48:34 <SumitNaiksatam> SridarK: if this doesnt swap out of my memory i will try to ping the guy :-) 18:48:42 <SumitNaiksatam> #topic Kilo Blueprints 18:48:56 <SumitNaiksatam> we have to post the blueprints by Dec 8th 18:49:06 <SridarK> SumitNaiksatam: badveli just sent an email - he is running late 18:49:33 <SumitNaiksatam> SridarK: thanks, yeah i saw that earlier, was hoping he would make it 18:49:46 <SumitNaiksatam> make it before we get to security groups 18:49:54 <SumitNaiksatam> *service groups 18:50:02 <RuiZang> what do you mean by "post the blueprints by Dec 8th"? 18:50:04 <vishwanathj> SumitNaiksatam, SridarK: I will upload a patch later today to address your comments 18:50:07 <SridarK> I pushed some comments out on service groups a little early today 18:50:08 <SumitNaiksatam> commute is bad today! 18:50:48 <SumitNaiksatam> RuiZang: i meant post a gerrit spec for review; i think you are good since you already posted your blueprint 18:50:52 <SumitNaiksatam> vishwanathj: sure, np 18:51:00 <SumitNaiksatam> SridarK: nice, i did not notice that 18:51:07 <SridarK> SumitNaiksatam: mostly nits on service groups 18:51:07 <SumitNaiksatam> so lets take one bp at a time 18:51:31 <SridarK> SumitNaiksatam: oops sorry - are we on service groups ? 18:51:40 <RuiZang> SumitNaiksatam> Oh OK 18:52:00 <SumitNaiksatam> lets start with hot spec of the day - FWaaS Insertion Model on a Single Router - #link https://review.openstack.org/#/c/138672/ 18:52:10 <SridarK> :-) 18:52:16 <SumitNaiksatam> SridarK: your baby :-) 18:52:32 <SridarK> SumitNaiksatam: thanks for the comments 18:52:37 <SumitNaiksatam> hot spec puts you in the hot seat ;-P 18:52:41 <SridarK> :-) 18:52:42 <SumitNaiksatam> SridarK: sure 18:52:49 <SumitNaiksatam> probably folks havent had a chance to review it 18:52:58 <SumitNaiksatam> please do so and provide comments at the earliest 18:53:22 <SridarK> SumitNaiksatam: i think i have tried to capture most of the discussions from the summit and also in the mtgs 18:53:24 <SumitNaiksatam> this is probably the most important bp/spec for FWaaS for Kilo 18:53:51 <SumitNaiksatam> SridarK: and very articulated at that! 18:54:07 <SridarK> :-) 18:54:40 <badveli> hello all 18:54:51 <badveli> sorry delayed due to weather 18:55:17 <SridarK> I am hoping that if we get most things thrashed out this week - next week can get some core attention 18:55:20 <SridarK> badveli: hi 18:55:28 <SumitNaiksatam> badveli: yes, glad you could make it, and pretty much at the right time 18:55:28 <badveli> hello sridark 18:55:35 <badveli> oh..thanks 18:55:45 <SridarK> SumitNaiksatam: of course thanks of the core attention from u 18:55:52 <SridarK> *for 18:56:08 <SumitNaiksatam> SridarK: yeah, i would say we pre-emptively approach some of the other cores 18:56:21 <SridarK> SumitNaiksatam: ok sounds good - will do that 18:56:23 <SumitNaiksatam> SridarK: i think we should add all the cores to the review 18:56:31 <SumitNaiksatam> SridarK: you want me to do that? 18:56:35 <SridarK> SumitNaiksatam: ok sure 18:56:57 <SumitNaiksatam> SridarK: ok done :-) 18:57:27 <SumitNaiksatam> did anyone else get a chance to look at Sridar’s spec? 18:57:36 <SumitNaiksatam> in case we want to spend a few mins discussing here 18:57:40 <SridarK> SumitNaiksatam: definitely want to thrash out some of the extensions related areas - i have left that a bit open as i am not sure how to proceed there with all the changes 18:57:44 <badveli> just going through 18:58:04 <SumitNaiksatam> is glebo here? 18:58:41 <badveli> no i do not see him here 18:58:44 <SumitNaiksatam> the next bp is Service group and Service Object for firewall as a service: #link https://review.openstack.org/#/c/131596 18:59:20 <SumitNaiksatam> badveli: looks like we again have some formatting and grammar nit issues 18:59:32 <SridarK> badveli: i provided some comments earlier today 18:59:34 <SumitNaiksatam> looking at SridarK’s comment 18:59:38 <SumitNaiksatam> *comments 18:59:46 <SumitNaiksatam> ideally we should have been way past this point now 18:59:48 <SridarK> badveli: mostly looks good except for the nits 18:59:49 <badveli> taking a look 19:00:23 <SumitNaiksatam> badveli: did you or glebo hear from any of the other cores that glebo had approached to review this? 19:00:37 <badveli> we did not get anything 19:00:44 <badveli> we are still waiting 19:00:45 <SumitNaiksatam> badveli: hmmm 19:01:00 <SumitNaiksatam> badveli: once you get a new rev out, i will review immediately 19:01:03 <SridarK> badveli: possibly the 2 issues i have listed - if u change the wording on that or clarify and with the nits fixed - i am good 19:01:29 <SumitNaiksatam> badveli: would appreciate if you can send a headup when you do to the entire team 19:01:40 <SumitNaiksatam> *headsup 19:01:49 <badveli> ok 19:02:03 <badveli> i will give a heads up on the new review 19:02:09 <SumitNaiksatam> the third bp is regarding FWaaS for E-W traffic when deploying DVR 19:02:14 <SumitNaiksatam> badveli: thanks 19:02:33 <SumitNaiksatam> Swami sent out a proposal last week: #link https://docs.google.com/document/d/11Gp62Yfyi1WH6yM6E_308OB4CC9A6xhxKZJ8B5jOwLc/edit 19:02:42 <SumitNaiksatam> and we had a brief discussion 19:03:07 <SumitNaiksatam> Swami: have you identified a preferred path in terms of what is feasible on the DVR side of things? 19:03:30 <Swami> SumitNaiksatam: I was counting on vivek to give me some feedback on proposal 1. 19:03:38 <SumitNaiksatam> Swami: ah ok 19:03:44 <Swami> But he was busy on something else. 19:04:06 <SumitNaiksatam> so i am a bit concerned that we are cutting too close to the SPD, since we dont have a spec in place yet 19:04:18 <SumitNaiksatam> how do we want to go about pursuing this? 19:04:25 <Swami> SumitNaiksatam: So I have to take up the task to investigate the pros and cons of option 1> 19:04:25 <Swami> Option 2: is prety much straight forward and DVR will not have any impact. 19:04:43 <Swami> But I personnally like option1 since the firewall rules will be in one single place. 19:05:07 <badveli> yes swami, i think option 1 is looking good 19:05:10 <SumitNaiksatam> we need to firm on both - (1) the technical path that we want to take, and (2) the logisitics of who will post the spec 19:05:19 <Swami> Did you guys do a round table discussion on both options? If so what do you like or see as a valuable going forward. 19:05:53 <SumitNaiksatam> on (2) we need to decide whether we need 2 specs (one for DVR and another for FWaaS) or 1 19:06:21 <SumitNaiksatam> Swami: a meeting dedicated to this would definitely be helpful, lets take that offline and set up one for the earliest 19:06:41 <SridarK> SumitNaiksatam: Swami: Yes i think that will be good 19:06:45 <Swami> In either case, if we choose either of the options mentioned above, this addition of a new bridge or addition of a new rule to redirect the packets to the router should only happen if there is a firewall enabled. 19:06:50 <SumitNaiksatam> #action SumitNaiksatam to setup DVR E-W traffic discussion meeting 19:07:09 <SumitNaiksatam> Swami: so seems like we are shooting for two specs? 19:07:10 <Swami> SumitNaiksatam: Yes I agree with you on having a separate chat on this. 19:07:56 <Swami> SumitNaiksatam: No at this point let us keep the implementation decision out of the spec. 19:08:18 <Swami> Let us file a blueprint of applying the firewall rules for the DVR East-West. 19:08:36 <Swami> I don't think we are going to introduce any API change at this time or any database change for this feature. 19:09:11 <SridarK> Swami: A sort of tangential but related question 19:09:15 <SumitNaiksatam> Swami: okay lets discuss further in the meeting 19:09:35 <badveli> to me it lloked like option 1 is better 19:09:36 <Swami> Yes sounds good. 19:09:46 <SumitNaiksatam> Swami: do you think Vivek needs to attend the meeting or you would sync up offline with him? (that will help to set the time for the meeting) 19:09:54 <SumitNaiksatam> badveli: Swami: yes i agree 19:10:10 <SridarK> Swami: With DVR is there some significance for an interface that carries the E -W traffic ? 19:10:26 <badveli> thanks sumit 19:10:27 <Swami> SumitNaiksatam: Yes I will investigate it further and if we need viveks help we can pull in as required. He seems to busy in some other work. 19:11:06 <SridarK> Swami: or is the interface just a logical entity and we cannot discriminate or associate E - W traffic with a specific Router interface ? 19:11:10 <SumitNaiksatam> Swami: okay some i am shooting for 9 AM PST tomorrow (if that works for everyone) 19:11:31 <Swami> SridarK: I don't think there is any significane on interface that is driving traffic for E-W. But we can easily sort out there are different ports that direct traffic for North-South and for East-West. 19:11:31 <badveli> 19:11:59 <Swami> Tomorrow 9 a.m should work. 19:12:08 <badveli> 19:12:28 <badveli> sumit, can we do a bit late 19:12:31 <vishwanathj> 9AM PST works 19:12:35 <SridarK> Swami: ok lets discuss more on this, i am trying to think in terms of the router insertion work that we are planning to see if we can leverage that for handling this case 19:13:20 <SridarK> SumitNaiksatam: i am okay with any time in the morning 19:13:25 <Swami> SridarK: Yes we can discuss this in futher details in the meeting tomorrow. 19:14:04 <SumitNaiksatam> okay i will send out an invite accordingly 19:14:18 <SumitNaiksatam> next vendor blueprints 19:14:25 <badveli> i have a doctor appointment in the morning 19:14:34 <SumitNaiksatam> badveli: okay lets discuss offline 19:14:39 <badveli> i will try to attend it 19:15:03 <SumitNaiksatam> we currently have only one vendor spec posted on the wiki: #link https://wiki.openstack.org/wiki/Meetings/FWaaS#Vendor_Blueprints 19:15:12 <SridarK> #link https://review.openstack.org/#/c/129836/ 19:15:13 <SumitNaiksatam> however we have at least a couple of more 19:15:30 <SumitNaiksatam> SridarK: ah i guess we need to update the link 19:15:33 <RuiZang> Do I have to post the review on wiki by myself? 19:15:37 <SridarK> SumitNaiksatam: ok will do 19:15:40 <SumitNaiksatam> vishwanathj: RuiZang: can you update the wiki page 19:15:40 <RuiZang> Sorry, I am totallynew to this 19:15:52 <RuiZang> Sure, I can 19:15:57 <SumitNaiksatam> RuiZang: no worries, it wil be great if you can update the wiki 19:16:01 <vishwanathj> SumitNaiksatam, will update 19:16:29 <SumitNaiksatam> RuiZang: this not a required step, its a nice to have since it will be visible to other FWaaS team member for ready reference and they can provide reviews 19:16:29 <SridarK> RuiZang: pls feel free to reach out if u have any questions 19:16:37 <SumitNaiksatam> we will also track every week 19:16:55 <SumitNaiksatam> RuiZang: i did a quick read through, and provided a couple of high level comments 19:17:01 <SumitNaiksatam> RuiZang: but mostly looks good to me 19:17:04 <RuiZang> SumitNaikstam: Sridark: thanks you guys, I will update the wiki 19:17:26 <SumitNaiksatam> RuiZang: are you the one shepherding this spec or is it isaku? 19:17:42 <RuiZang> Isaku is on relocation to U.S 19:17:46 <SumitNaiksatam> RuiZang: sorry, i know you have two specs 19:17:50 <RuiZang> So currently it is me 19:17:58 <SumitNaiksatam> RuiZang: i was referring to the first one, which is the L3 plugin 19:18:09 <SumitNaiksatam> RuiZang: i have not yet read through the fwaas driver 19:18:29 <RuiZang> SumitNaiksatam: yes I am responsible for both of them 19:18:33 <SumitNaiksatam> RuiZang: great 19:18:54 <SumitNaiksatam> RuiZang: as SridarK mentioned please feel free to reach out to this team if you need any help 19:19:03 <SumitNaiksatam> vishwanathj: any blockers for your spec? 19:19:27 <RuiZang> SumitNaiksatam: Sridark: Sure, thanks very much 19:19:54 <vishwanathj> SumitNaiksatam, None at this time, I need to upload the next patch set addressing SridarK and your comments 19:20:02 <SumitNaiksatam> vishwanathj: ok great 19:20:28 <SumitNaiksatam> btw, Spec for introducing Brocade Vyatta Firewall solution using a new vendor specific device driver for Neutron L3 agent: #link https://review.openstack.org/136953 19:21:03 <SumitNaiksatam> and Ruiz’s specs are: l3-router: add mcafee ngfw l3 router plugin #link https://review.openstack.org/134198 19:21:05 <vishwanathj> SumitNaiksatam, I have updated the wiki and added link to brocade vyatta firewall spec 19:21:28 <SumitNaiksatam> and, firewall: add mcafee ngfw driver support: #link https://review.openstack.org/#/c/91286/ 19:21:39 <SumitNaiksatam> vishwanathj: nice, thanks! 19:22:07 <SumitNaiksatam> the other blueprint/work we need to discuss with high priority is the L3 agent refactoring 19:22:17 <SumitNaiksatam> #topic L3 Agent refactoring 19:23:44 <SumitNaiksatam> #link https://review.openstack.org/#/q/status:open+project:openstack/neutron+branch:master+topic:bp/restructure-l3-agent,n,z 19:23:55 <SumitNaiksatam> this will affect the firewall agent 19:24:07 <SumitNaiksatam> so just want to confirm who signed up for this 19:24:16 <SumitNaiksatam> SridarK: was it you and pc_m? 19:24:26 <pc_m> yup 19:24:36 <SumitNaiksatam> pc_m: okay great, thanks! 19:24:38 <pc_m> I'm doing VPN 19:24:43 <SumitNaiksatam> pc_m: ah okay 19:24:54 <pc_m> And have started on the refactoring. 19:24:55 <SumitNaiksatam> pc_m: who is doing firewall? 19:25:13 <pc_m> I thought SridarK signed up. 19:25:22 <SumitNaiksatam> pc_m: okay 19:25:50 <SumitNaiksatam> badveli: i vaguely recall glebo mentioning that you were going to look at this too 19:26:10 <SumitNaiksatam> pc_m: i am guessing that the scope of this work in the context of fwaas is pretty limited, right? 19:26:27 <badveli> sumit, i am planning to do the e-w spec side 19:26:41 <SumitNaiksatam> badveli: ah okay, got it 19:26:51 <pc_m> SumitNaiksatam: yes. 19:26:58 <badveli> i will get the details from pc_m 19:27:25 <pc_m> SumitNaiksatam: Mostly will be determining the hook points for L3 agent notifications to the services 19:27:39 <SumitNaiksatam> pc_m: right 19:27:48 <badveli> 19:27:48 <SumitNaiksatam> i think we lost SridarK for a bit there 19:27:50 <SridarK_> sorry network glitch 19:27:53 <pc_m> SumitNaiksatam: And of course, teasing apart the inheritance tree 19:27:55 <SumitNaiksatam> SridarK: np 19:28:07 <pc_m> #link https://review.openstack.org/#/c/131535 19:28:12 <pc_m> Is the BP spec. 19:28:12 <SumitNaiksatam> SridarK: we were discussing the l3 agent refactor and its implications for the fwaas agent 19:28:18 <Swami> pc_m: is there design doc for this hook points 19:28:28 <SumitNaiksatam> SridarK: trying to nail down who signed up for this at our end 19:28:34 <SumitNaiksatam> SridarK: did you? 19:28:38 <SridarK_> on this L3 refactor, Carl pinged me on the fwaas side to see if i can take a look - so will look into that 19:28:40 <pc_m> Swami: no. There was some discussion on the ML and some info in the BP 19:28:59 <SridarK_> SumitNaiksatam: so i have signed up 19:29:04 <pc_m> Please look at the BP spec and comment from a FW POV 19:29:21 * pc_m just check - it's approved 19:29:30 <SumitNaiksatam> pc_m: yeah, was going to say :-) 19:29:39 <pc_m> Still would give the main points. 19:30:16 <SumitNaiksatam> so i think we proposed in the adv services’ meeting yesterday we will target this for Kilo-2 19:30:23 <SumitNaiksatam> ok folks we are out of time 19:30:30 <SumitNaiksatam> hope we didnt miss anything 19:30:34 <SumitNaiksatam> thanks for joining 19:30:35 <SumitNaiksatam> bye! 19:30:39 <SumitNaiksatam> #endmeeting