)]}'
{"security-guide/section_networking-services.xml":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"3d03534f996de2070224b65c5eb93cea363e5f78","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eNetworking services\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eIn the initial architectural phases of designing your OpenStack Network infrastructure it is important to ensure appropriate expertise is available to assist with the design of the physical networking infrastructure, to identify proper security controls and auditing mechanisms.\u003c/para\u003e"},{"line_number":10,"context_line":"    \u003cpara\u003eOpenStack Networking adds a layer of virtualized network services which gives tenants the capability to architect their own virtual networks. Currently, these virtualized services are not as mature as their traditional networking counterparts. The current state of these virtualized services should be considered as this will dictate what controls must be at the virtualized and traditional network boundaries.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003csection xml:id\u003d\"networking-services-l2-isolation-using-vlans-and-tunneling\"\u003e"},{"line_number":12,"context_line":"      \u003ctitle\u003eL2 isolation using VLANs and tunneling\u003c/title\u003e"},{"line_number":13,"context_line":"      \u003cpara\u003eOpenStack Networking can employ two different mechanisms for traffic segregation on a per tenant/network combination: VLANs (IEEE 802.1Q tagging) or L2 tunnels using GRE encapsulation. The method that should be utilized for traffic segregation or isolation is determined by the scope and scale of your OpenStack deployment.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"5ad0253b_de6dd4cd","line":10,"updated":"2015-04-28 18:49:18.000000000","message":"Use active voice like \"Consider the current state...\"\n\nhttps://wiki.openstack.org/wiki/Documentation/Conventions#Writing_style","commit_id":"57c4a7ce2ec69e54046599dd0cd12335249c84ef"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"3d03534f996de2070224b65c5eb93cea363e5f78","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    \u003cpara\u003eOpenStack Networking adds a layer of virtualized network services which gives tenants the capability to architect their own virtual networks. Currently, these virtualized services are not as mature as their traditional networking counterparts. The current state of these virtualized services should be considered as this will dictate what controls must be at the virtualized and traditional network boundaries.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003csection xml:id\u003d\"networking-services-l2-isolation-using-vlans-and-tunneling\"\u003e"},{"line_number":12,"context_line":"      \u003ctitle\u003eL2 isolation using VLANs and tunneling\u003c/title\u003e"},{"line_number":13,"context_line":"      \u003cpara\u003eOpenStack Networking can employ two different mechanisms for traffic segregation on a per tenant/network combination: VLANs (IEEE 802.1Q tagging) or L2 tunnels using GRE encapsulation. The method that should be utilized for traffic segregation or isolation is determined by the scope and scale of your OpenStack deployment.\u003c/para\u003e"},{"line_number":14,"context_line":"      \u003csection xml:id\u003d\"networking-services-l2-isolation-using-vlans-and-tunneling-vlans\"\u003e"},{"line_number":15,"context_line":"        \u003ctitle\u003eVLANs\u003c/title\u003e"},{"line_number":16,"context_line":"        \u003cpara\u003eVLANs are realized as packets on a specific physical network containing IEEE 802.1Q headers with a specific VLAN ID (VID) field value. VLAN networks sharing the same physical network are isolated from each other at L2, and can even have overlapping IP address spaces. Each distinct physical network supporting VLAN networks is treated as a separate VLAN trunk, with a distinct space of VID values. Valid VID values are 1 through 4094.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"5ad0253b_5e62e4d9","line":13,"updated":"2015-04-28 18:49:18.000000000","message":"this changes from active to passive - please go back to active voice.","commit_id":"57c4a7ce2ec69e54046599dd0cd12335249c84ef"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"3d03534f996de2070224b65c5eb93cea363e5f78","unresolved":false,"context_lines":[{"line_number":34,"context_line":"        \u003cpara\u003eOpenStack Compute supports tenant network traffic access controls directly when deployed with the legacy nova-network service, or may defer access control to the OpenStack Networking service.\u003c/para\u003e"},{"line_number":35,"context_line":"        \u003cpara\u003eNote, legacy nova-network security groups are applied to all virtual interface ports on an instance using iptables.\u003c/para\u003e"},{"line_number":36,"context_line":"        \u003cpara\u003eSecurity groups allow administrators and tenants the ability to specify the type of traffic, and direction (ingress/egress) that is allowed to pass through a virtual interface port. Security groups rules are stateful L2-L4 traffic filters.\u003c/para\u003e"},{"line_number":37,"context_line":"        \u003cpara\u003eDuring utilization of the Networking service, security groups should be enabled in this service but disabled in the Compute service.\u003c/para\u003e"},{"line_number":38,"context_line":"      \u003c/section\u003e"},{"line_number":39,"context_line":"      \u003csection xml:id\u003d\"networking-services-network-services-l3-routing-and-nat\"\u003e"},{"line_number":40,"context_line":"        \u003ctitle\u003eL3 routing and NAT\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"5ad0253b_5eb9c42d","line":37,"updated":"2015-04-28 18:49:18.000000000","message":"https://wiki.openstack.org/wiki/Documentation/Conventions#Writing_style\n\nUse active voice and present tense","commit_id":"57c4a7ce2ec69e54046599dd0cd12335249c84ef"}]}