From 23a75aa5aba8d1d9fbb1868459e15b8d707743d6 Mon Sep 17 00:00:00 2001 From: garciadeblas Date: Fri, 11 Nov 2016 22:03:22 +0100 Subject: [PATCH] Unfiltered virtual interfaces in VNFs Change-Id: I2123bdb858bab283ab0b862d64595e6ffe37f4eb Signed-off-by: garciadeblas --- .../unfiltered_virtual_interfaces_in_VNFs.md | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 Release2/unfiltered_virtual_interfaces_in_VNFs.md diff --git a/Release2/unfiltered_virtual_interfaces_in_VNFs.md b/Release2/unfiltered_virtual_interfaces_in_VNFs.md new file mode 100644 index 0000000..b92866c --- /dev/null +++ b/Release2/unfiltered_virtual_interfaces_in_VNFs.md @@ -0,0 +1,36 @@ +# Unfiltered virtual interfaces in VNFs # + +## Proposer ## +- Gerardo Garcia (Telefonica) +- Alfonso Tierno (Telefonica) +- Francisco Javier Ramon (Telefonica) + +## Type ## +**Feature** + +## Target MDG/TF ## +UI, SO, RO + +## Description ## +When VLDs are created as overlay networks on an NFVI, some VIMs like Openstack +implement some security policies that apply L2-L4 filtering rules to the frames +in those networks. By default, when creating VLDs (networks in VIMs) and when +attaching VDUs to the VLDs (attaching a VM to a network in a VIM), those +security policies are created in the VIM. + +Those security policies (e.g. port security in Openstack) can be disabled at a +network level or at port level in the VIM. However, this ability to disable those +security policies has not been implemented as an end-to-end option in OSM. + +This feature proposes the addition of a parameter to enable or disable that port +security per VDU/VM interface. This will affect the data model for the VDU +managed by the SO, will affect the UI, which should offer the option to enable or +disable it, and will affect the RO, which should specify that capability down to +the VIMs that support it. + +## Demo or definition of done ## +An end-to-end use case is required, where the user creates a VNF in the UI and +disables the filtering policy on a VM interface. Once the VNF is instantiated as +part of a NS instance, it should be checked in the VIM that the filtering policy +has been disabled in that interface/port, while in the network should be enabled. + -- 2.17.1