OpenStack Security Group設定

為了讓Security Group的相關設定都交給Quantum Service來代理(proxy)處理，所以必須在/etc/nova/nova.conf中做以下的設定，以避免與原來Nova Networking所處理的Security Group相衝突。



## security groups ##
firewall_driver = nova.virt.firewall.NoopFirewallDriver
security_group_api = quantum

Nova Networking Design Mode

Type	Strengths	Weaknesses
Flat	Extremely simple. No DHCP broadcasts.	Requires file injection into the instance. Limited to certain distributions of Linux. Difficult to configure and is not recommended.
FlatDHCP	Relatively simple to setup. Standard networking. Works with all operating systems.	Requires its own DHCP broadcast domain.
VlanManager	Each tenant is isolated to their own VLANs.	More complex to set up. Requires its own DHCP broadcast domain. Requires many VLANs to be trunked onto a single port. Standard VLAN number limitation. Switches must support 802.1q VLAN tagging.
FlatDHCP Multi-host HA	Networking failure is isolated to the VMs running on the hypervisor affected. DHCP traffic can be isolated within an individual host. Network traffic is distributed to the compute nodes.	More complex to set up. By default, compute nodes need public IP addresses. Options must be carefully configured for live migration to work with networking.

Quanum Network Deploy Legacy Case

Quantum把網路分成"network"、"subnet"、"port"等三個部分

1. network: 

network為虛擬的switch

2. subnet:

ip區段(including ipv4 、 ipv6)，主要是用來分派位於某個特定Network內虛擬機器的IP位址，而每個Quantum L2 Network可以擁有多個Subnets

3. port:

至於port的部分，則是用來代表在某個Quantum L2 Network的虛擬埠號(Virtual Port)之對應。簡單來說，可以把它視為在某個虛擬交換器當中的虛擬埠(Virtual Port)。

• Single Flat Network

• Multiple Flat Network

          每個tenant可以看到多個共享網路(shared networks)並選擇想要將VMs附加到哪一個共享網路底下

• Mixed Flat and Private Network

• Provider Router and Private Networks

• Per-Tenant Router and Private Networks