Working with security groups

Security groups can be managed in either the Neutron CLI or the Horizon dashboard. Both methods offer a fairly comprehensive experience and are discussed in the following sections.

Managing security groups in the CLI

From within the Neutron command-line client, a number of commands can be used to manage security groups, including:

  • security-group-create
  • security-group-delete
  • security-group-list
  • security-group-rule-create
  • security-group-rule-delete
  • security-group-rule-list
  • security-group-rule-show
  • security-group-show
  • security-group-update

Creating security groups in the CLI

To create a security group within the CLI, use the Neutron security-group-create command as follows:

Usage:   security-group-create [--tenant-id TENANT_ID]
         [--description DESCRIPTION] NAME

Note

By default, security groups in Neutron are prepopulated with two egress rules that allow all outbound traffic over IPv4 and IPv6. Ingress traffic from hosts outside of the associated group is not permitted by default.

Deleting security groups in the CLI

To delete a security group within the CLI, use the Neutron security-group-delete command as follows:

Usage:   security-group-delete SECURITY_GROUP

The keyword, SECURITY_GROUP, can be the ID or name of the security group to delete.

Note

A security group must be removed from all ports before it can be deleted.

Listing security groups in the CLI

To obtain a listing of security groups within the CLI, use the Neutron security-group-list command as follows:

Usage:   security-group-list

The output returned includes the ID, name, and description of all security groups within the tenant where the command was run. If run as an administrator, all security groups across all tenants will be listed.

Showing the details of a security group in the CLI

To display the details of a security group, use the Neutron security-group-show command as follows:

Usage:   security-group-show SECURITY_GROUP

The keyword, SECURITY_GROUP, can be the ID or name of the security group to show. The output returned includes the description, ID, name, associated tenant ID, and the individual rules within the security group.

Updating security groups in the CLI

To update the attributes of a security group, use the Neutron security-group-update command as follows:

Usage:   security-group-update [--description DESCRIPTION] 
         [--name NAME]

Note

It is not possible to change the name of the default security groups provided by Neutron.

Creating security group rules in the CLI

To create a security group rule, use the Neutron security-group-rule-create command as follows:

usage:    security-group-rule-create 
          [--tenant-id TENANT_ID][--direction {ingress,egress}]
          [--ethertype ETHERTYPE][--protocol PROTOCOL]
          [--port-range-min PORT_RANGE_MIN]
          [--port-range-max PORT_RANGE_MAX]
          [--remote-ip-prefix REMOTE_IP_PREFIX]
          [--remote-group-id REMOTE_GROUP]
          SECURITY_GROUP

The --direction flag is optional and allows you to specify the direction of traffic that should be affected. Specifying ingress means the rule applies to incoming traffic, while specifying egress means the rule applies to outgoing traffic from the instance. The default value is ingress.

The --ethertype flag is optional and allows you to specify whether the rule applies to the IPv4 or IPv6 traffic. The default value is IPv4.

The --protocol flag is optional and allows you to specify the type of traffic the rule applies to. Possible options include ICMP, TCP, UDP, or an IP protocol number.

The --port-range-min flag is optional and allows you to specify the starting port of a range of ports. If this option is specified, a protocol must also be defined.

The --port-range-max flag is optional and allows you to specify the ending port of a range of ports. If this option is specified, a protocol must also be defined.

The --remote-ip-prefix flag is optional and allows you to specify the source address or network the rule applies to. The address or network should be defined in the CIDR format.

The --remote-group-id flag is optional and allows you to specify the ID of a security group the rule should apply to rather than individual IP addresses or networks. For example, when creating a rule to allow inbound SQL traffic to database servers, you can specify the ID of a security group that application servers are a member of without having to specify their individual IP addresses.

The SECURITY_GROUP keyword is used to specify the ID of the security group that the rule should be placed in.

Deleting security group rules in the CLI

To delete a security group rule, use the Neutron security-group-rule-delete command as follows:

Usage:   security-group-rule-delete SECURITY_GROUP_RULE_ID

Note

While it is possible to delete the rules within the default security group, it is not possible to delete the group itself.

Listing security group rules in the CLI

To list the security group rules within a security group, use the Neutron security-group-rule-list command as follows:

Usage:   security-group-rule-list

The output returned includes details of individual security group rules, such as their ID, associated security group, direction, protocol, remote IP prefix, and remote group name.

Showing the details of a security group rule in the CLI

To display the details of a particular security group rule, use the Neutron security-group-rule-show command as follows:

Usage:   security-group-rule-show SECURITY_GROUP_RULE_ID

The output returned includes the ID, direction, ethertype, port range, protocol, remote group IP, remote IP prefix, tenant ID, and associated security group ID of the specified security group rule.

Applying security groups to instances and ports in the CLI

Applying security groups to instances within the CLI is typically done at instance creation using nova boot, as follows:

nova boot --flavor <FLAVOR_ID> --image <IMAGE_ID> 
--nic net-id=<NETWORK_ID> --security-group <SECURITY_GROUP_ID> 
INSTANCE_NAME

Security groups can also be applied to running instances using either the Neutron port-update command or the Nova add-secgroup command. The following example demonstrates the use of port-update to apply security groups to a port:

neutron port-update <PORT_ID> --security-group <SECURITY_GROUP_ID>

Note

Using port-update to assign security groups to a port will overwrite the existing security group associations.

Multiple security groups can be associated with a Neutron port simultaneously. To apply multiple security groups to a port, use the --security-group flag before each security group, as follows:

neutron port-update <PORT_ID> 
--security-group <SECURITY_GROUP_ID1> 
--security-group <SECURITY_GROUP_ID2> 
--security-group <SECURITY_GROUP_ID3>

The following example demonstrates the use of the Nova add-secgroup command to apply a security group to all ports connected to an instance:

nova add-secgroup <INSTANCE_ID> <SECURITY_GROUP_ID>

Removing security groups from instances and ports in the CLI

To remove an individual security group rule, execute the Nova remove-secgroup command as shown in the following example:

nova remove-secgroup <INSTANCE_ID> <SECURITY_GROUP_ID>

To remove all security groups from a port, use the Neutron port-update command with the --no-security-groups flag, as shown in the following example:

neutron port-update <neutron_port_id> --no-security-groups

Note

It is not possible to remove single security groups from a port using the port-update command. All security groups should be removed from the port and then the select groups should be added back.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset