Feature Overview 

VPC (Virtual Private Cloud) has emerged as one of the high priority need for cloud service providers. One of the key aspects for VPC is to be able to apply and admin and policy control for a group of resources such that it is scalable across the resources under same isolated admin control. Applying security policy at the network or router port level constitutes an important part of enabling customers/users to achieve VPC equivalence for Openstack deployments. 

Red Hat Openstack relies primarily on security groups for enabling security rules. Although security groups provide sufficient capability to specify security policy at a VM instance level or VM port level, it does not have support to specify policy at a network or router port level. FWaaS project provides this additional capability to specify the security policies at the router port level and enables specifying multiple policy rules within the same policy group and also supports application of L3 or L2 policy at the router port level. 

Additionally, FWaaS provides support for NGFW 3rd party plugins such as Juniper sRX, Mcafee and others enabling firewall capabilities beyond the ACL level. Features and capabilities such as DPI, Malware protection, IPS and IDP. [1][2][3]

Goals

Support FWaaS for RHOSO 18 to address the gap of specifying security policies at the network or router port level and thus enabling VPC equivalence with RHOSO.

Multiple cloud service providers have expressed the requirement to support VPC equivalence and is one of the key must-have requirements for adoption of Red Hat Openstack. 

Requirements 

Done - Acceptance Criteria

• Validate the scenarios listed in the requirements section for functional operation
• Implement automation for regression test suite
• Assess the performance impact of firewall rules on dataplane forwarding performance wih incremental increase of security rules in same policy group or incremental increase of policy groups
• Assess stability of the feature support and review level of support for the feature upstream
• Support for 3rd party NGFW plugin and integration with at least 1 3rd party plugin

Use Cases 

• Use of firewall rules at router port level to provide scalable firewall rule definition for group of virtual infrastructure resources thus enabling implementation of logical constructs such as VPC
• Support NFGW capabilities such as DPI, IPD and IPS at the virtual infrastructure level enabling zero trust architecture
• Global firewal rules per tenant / project

Documentation Considerations 

New feature that requires documentation for Networking User Guide as well as release notes.

Background and Strategic Fit 

Feature / Capability already supported upstream for sometime. The feature/capability addresses a critical gap in ease of implementing VPC equivalent functionality with Openstack for Cloud Service Providers. Multiple requests have been received from current and potential RHOSO customers for VPC support and this feature helps in addressing the need and improve in adoption of RHOSO and improves the overall value proposition of RHOSO for customers. Also, helps in retaining this customers by strengthening the value proposition and addressing a competitive feature gap.

Team Sign Off (Completion while in Planning status)

• All required Epics (known at the time) are linked to the this Feature
• All required Stories, Tasks (known at the time) for the most immediate Epics have been created and estimated
• Add - Reviewers name, Team Name
• Acceptance == Feature as “Ready” - well understood and scope is clear - Acceptance Criteria (scope) is elaborated, well defined, and understood
• Note: Only set FixVersion/s: on a Feature if the delivery team agrees they have the capacity and have committed that capability for that milestone

References:

[1] https://wiki.openstack.org/wiki/Neutron/mcafee-ngfw-firewall

[2] https://docs.openstack.org/mitaka/config-reference/networking/fwaas.html

[3] https://www.juniper.net/documentation/us/en/software/open-stack/open-stack-quick-reference/topics/task/openstack-neutron-config-fwaas.html