GET'> PUT'> POST'> DELETE'> '> '> ]>
Firewall as a Service (FWaaS) Extension The FWaaS extension provides OpenStack users with the ability to deploy firewalls to protect their networks. The current features provided by the FWaaS extension are: Apply firewall rules on traffic entering and leaving tenant networks. Support for applying tcp, udp, icmp, or protocol agnostic rules. Creation and sharing of firewall policies which hold an ordered collection of the firewall rules. Ability to audit firewall rules and policies. This extension introduces new resources: firewall: represents a logical firewall resource that a tenant can instantiate and manage. A firewall is associated with one firewall_policy. firewall_policy: is an ordered collection of firewall_rules. A firewall_policy can be shared across tenants. Thus it can also be made part of an audit workflow wherein the firewall_policy can be audited by the relevant entity that is authorized (and can be different from the tenants which create or use the firewall_policy). firewall_rule: represents a collection of attributes like ports, ip addresses which define match criteria and action (allow, or deny) that needs to be taken on the matched data traffic.
Firewall Rule Operations This section discusses operations for managing a Firewall Rule through this extension.
Firewall Rule Attributes
Attribute Type Required CRUD C. Use the attribute in create operations. R. This attribute is returned in response to show and list operations. U. You can update the value of this attribute. D. You can delete the value of this attribute. Default Value Validation Constraints Notes
id uuid-str N/A R generated N/A Unique identifier for the Firewall Rule object.
tenant_id uuid-str Yes CR Derived from Authentication token N/A Owner of the Firewall Rule. Only admin users can specify a tenant identifier other than their own.
name String No CRU None N/A Human readable name for the Firewall Rule (255 characters limit). Does not have to be unique.
description String No CRU None N/A Human readable description for the Firewall Rule (1024 characters limit).
firewall_policy_id uuid-str No R None N/A This is a readonly attribute which gets populated with the uuid of the Firewall Policy when this Firewall Rule is associated with a Firewall Policy. A Firewall Rule can be associated with one Firewall Policy at a time. The association can however be updated to a different Firewall Policy. This attribute can be "null" if the rule is not associated with any firewall policy.
shared Bool No CRU false {true | false} When set to True makes this Firewall Rule visible to tenants other than its owner, and can be used in Firewall Policies not owned by its tenant.
protocol String No CRU None {icmp | tcp | udp | null} IP Protocol
ip_version Integer No CRU 4 {4 | 6} IP Protocol Version
source_ip_address String (IP address or CIDR) No CRU None valid IP address (v4 or v6), or CIDR Source IP address or CIDR
destination_ip_address String (IP address or CIDR) No CRU None Valid IP address (v4 or v6), or CIDR Destination IP address or CIDR
source_port Integer No CRU None Valid port number (integer or string), or port range in the format of a ':' separated range). In the case of port range, both ends of the range are included. Source port number or a range
destination_port Integer No CRU None Valid port number (integer or string), or port range in the format of a ':' separated range. In the case of port range, both ends of the range are included. Destination port number or a range
position Integer No R None N/A This is a readonly attribute that gets assigned to this rule when the rule is associated with a Firewall Policy. It indicates the position of this rule in that Firewall Policy. This position number starts at 1. The position can be "null" if the firewall rule is not associated with any policy.
action String No CRU deny {allow | deny} Action to be performed on the traffic matching the rule (allow, deny)
enabled Bool No CRU true {true | false} When set to False will disable this rule in the Firewall Policy. Facilitates selectively turning off rules without having to disassociate the rule from the Firewall Policy
List Firewall Rules Verb URI Description &GET; /fw/firewall_rules List Firewall Rules. Normal Response Code: 200 Error Response Codes: Unauthorized (401). This operation does not require a request body. This operation returns a response body. List Firewall Rules: Request GET /v2.0/fw/firewall_rules.json User-Agent: python-neutronclient Accept: application/json List Firewall Rules: Response
Show Firewall Rule Verb URI Description &GET; /fw/firewall_rules/firewall_rule-id Returns details about a specific Firewall Rule. Normal Response Code: 200 Error Response Codes: Unauthorized (401), Forbidden (403), Not Found (404) This operation does not require a request body. This operation returns a response body. Show Firewall Rule: Request GET /v2.0/fw/firewall_rules/9faaf49f-dd89-4e39-a8c6-101839aa49bc.json User-Agent: python-neutronclient Accept: application/json Show Firewall Rule: Response
Create Firewall Rule Verb URI Description &POST; /fw/firewall_rules Creates a new Firewall Rule. Normal Response Code: 201 Error Response Codes: Unauthorized (401), Bad Request (400) This operation requires a request body. This operation returns a response body. Create Firewall Rule: Request POST /v2.0/fw/firewall_rules.json User-Agent: python-neutronclient Accept: application/json Create Firewall Rule: Response HTTP/1.1 201 Created Content-Type: application/json; charset=UTF-8
Update Firewall Rule Verb URI Description &PUT; /fw/firewall_rules/firewall_rule-id Updates a Firewall Rule. Normal Response Code: 200 Error Response Codes: Unauthorized (401), Bad Request (400), Not Found (404) Update Firewall Rule: Request PUT /v2.0/fw/firewall_rules/41bfef97-af4e-4f6b-a5d3-4678859d2485.json User-Agent: python-neutronclient Accept: application/json Update Firewall Rule: Response HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8
Delete Firewall Rule Verb URI Description &DELETE; /fw/firewall_rules/firewall_rule-id Removes a Firewall Rule. Normal Response Code: 204 Error Response Codes: Unauthorized (401), Not Found (404), Conflict (409). The Conflict error response is returned when an operation is performed while the firewall is in a PENDING state. This operation does not require a request body. This operation does not return a response body. Delete Firewall Rule: Request DELETE /v2.0/fw/firewall_rules/1be5e5f7-c45e-49ba-85da-156575b60d50.json User-Agent: python-neutronclient Accept: application/json Delete Firewall Rule: Response HTTP/1.1 204 No Content Content-Length: 0
Firewall Policy Operations This section discusses operations for managing a Firewall Policy through this extension.
Firewall Policy Attributes
Attribute Type Required CRUD C. Use the attribute in create operations. R. This attribute is returned in response to show and list operations. U. You can update the value of this attribute. D. You can delete the value of this attribute. Default Value Validation Constraints Notes
id uuid-str N/A R generated N/A Unique identifier for the Firewall Policy object.
tenant_id uuid-str Yes CR Derived from Authentication token N/A Owner of the Firewall Policy. Only admin users can specify a tenant identifier other than their own.
name String No CRU None N/A Human readable name for the Firewall Policy (255 characters limit). Does not have to be unique.
description String No CRU None N/A Human readable description for the Firewall Policy (1024 characters limit)
shared Bool No CRU false {true | false} When set to True makes this Firewall Policy visible to tenants other than its owner.
firewall_rules List No CRU Empty list JSON list of Firewall Rule uuids This is an ordered list of Firewall Rule uuids. The Firewall applies the rules in the order in which they appear in this list.
audited Bool No CRU false {true | false} When set to True by the policy owner indicates that the Firewall Policy has been audited. This attribute is meant to aid in the firewall policy audit workflows. Each time the Firewall Policy or the associated Firewall Rules are changed, this attribute will be set to False and will have to be explicitly set to True through an update operation.
List Firewall Policies Verb URI Description &GET; /fw/firewall_policies List Firewall Policies. Normal Response Code: 200 Error Response Codes: Unauthorized (401), Forbidden (403) This operation does not require a request body. This operation returns a response body. List Firewall Policies: Request GET /v2.0/fw/firewall_policies.json User-Agent: python-neutronclient Accept: application/json List Firewall Policies: Response
Show Firewall Policy Verb URI Description &GET; /fw/firewall_policies/firewall_policy-id Returns details about a specific Firewall Policy. Normal Response Code: 200 Error Response Codes: Unauthorized (401), Not Found (404) This operation does not require a request body. This operation returns a response body. Show Firewall Policy: Request GET /v2.0/fw/firewall_policies/9faaf49f-dd89-4e39-a8c6-101839aa49bc.json User-Agent: python-neutronclient Accept: application/json Show Firewall Policy: Response
Create Firewall Policy Verb URI Description &POST; /fw/firewall_policies Creates a new Firewall Policy. Normal Response Code: 201 Error Response Codes: Unauthorized (401). This operation requires a request body. This operation returns a response body. Create Firewall Policy: Request POST /v2.0/fw/firewall_policies.json User-Agent: python-neutronclient Accept: application/json Create Firewall Policy: Response HTTP/1.1 201 Created Content-Type: application/json; charset=UTF-8
Update Firewall Policy Verb URI Description &PUT; /fw/firewall_policies/firewall_policy-id Updates a Firewall Policy. Normal Response Code: 200 Error Response Codes: Unauthorized (401), Not Found (404) Update Firewall Policy: Request PUT /v2.0/fw/firewall_policies/41bfef97-af4e-4f6b-a5d3-4678859d2485.json User-Agent: python-neutronclient Accept: application/json Update Firewall Policy: Response HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8
Delete Firewall Policy Verb URI Description &DELETE; /fw/firewall_policies/firewall_policy-id Removes a Firewall Policy. Normal Response Code: 204 Error Response Codes: Unauthorized (401), Not Found (404), Conflict (409 ). Conflict error code is returned the firewall policy is in use. This operation does not require a request body. This operation does not return a response body. Delete Firewall Policy: Request DELETE /v2.0/fw/firewall_policies/1be5e5f7-c45e-49ba-85da-156575b60d50.json User-Agent: python-neutronclient Accept: application/json Delete Firewall Policy: Response HTTP/1.1 204 No Content Content-Length: 0
Positionally inserting a Firewall Rule in a Firewall Policy Verb URI Description &PUT; /fw/firewall_policies/firewall_policy-id/insert_rule Inserts a Firewall Rule in a Firewall Policy relative to the position of other rules. Normal Response Code: 200 Error Response Codes: Unauthorized (401), Bad Request (400), Not Found (404). Bad Request error is returned in the case the rule information is missing. Insert Firewall Rule in Firewall Policy: Request PUT /v2.0/fw/firewall_policies/41bfef97-af4e-4f6b-a5d3-4678859d2485/insert_rule.json User-Agent: python-neutronclient Accept: application/json Insert Firewall Rule in Firewall Policy: Response HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 insert_before and insert_after parameters refer to firewall rule uuids already associated with the firewall policy. firewall_rule_id refers to uuid of the rule being inserted. insert_before takes precedence over insert_after and if neither is specified, firewall_rule_is is inserted at the first position.
Removing a Firewall Rule from a Firewall Policy Verb URI Description &PUT; /fw/firewall_policies/firewall_policy-idremove_rule Removes a Firewall Rule from a Firewall Policy. Normal Response Code: 200 Error Response Codes: Unauthorized (401), Bad Request (400), Not Found (404). Bad Request error is returned if the rule information is missing or when a firewall rule is tried to be removed from a firewall policy to which it is not associated. Remove Firewall Rule from Firewall Policy: Request PUT /v2.0/fw/firewall_policies/41bfef97-af4e-4f6b-a5d3-4678859d2485/remove_rule.json User-Agent: python-neutronclient Accept: application/json Remove Firewall Rule from Firewall Policy: Response HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8
Firewall Operations This section discusses operations for managing a Firewall through this extension.
Firewall Attributes
Attribute Type Required CRUD C. Use the attribute in create operations. R. This attribute is returned in response to show and list operations. U. You can update the value of this attribute. D. You can delete the value of this attribute. Default Value Validation Constraints Notes
id uuid-str N/A R generated N/A Unique identifier for the Firewall object.
tenant_id uuid-str Yes CR Derived from Authentication token N/A Owner of the Firewall. Only admin users can specify a tenant identifier other than their own.
name String No CRU None N/A Human readable name for the Firewall (255 characters limit). Does not have to be unique.
description String No CRU None N/A Human readable description for the Firewall (1024 characters limit)
admin_state_up Bool N/A CRU true {true | false } Administrative state of the Firewall. If false (down), firewall does not forward packets and will drop all traffic to/from VMs behind the firewall.
status String N/A R N/A N/A Indicates whether Firewall resource is currently operational. Possible values include: ACTIVE, DOWN, BUILD, ERROR, PENDING_CREATE, PENDING_UPDATE, or PENDING_DELETE.
shared Bool No CRU false {true | false} When set to True makes this Firewall Rule visible to tenants other than its owner, and can be used in Firewall Policies not owned by its tenant.
firewall_policy_id uuid-str No CRU None valid Firewall Policy uuid The Firewall Policy uuid that this Firewall is associated with. This Firewall will implement the rules contained in the Firewall Policy represented by this uuid.
List Firewalls Verb URI Description &GET; /fw/firewalls List Firewalls. Normal Response Code: 200 Error Response Codes: Unauthorized (401) This operation does not require a request body. This operation returns a response body. List Firewalls: Request GET /v2.0/fw/firewalls.json User-Agent: python-neutronclient Accept: application/json List Firewalls: Response
Show Firewall Verb URI Description &GET; /fw/firewalls/firewall-id Returns details about a specific Firewall. Normal Response Code: 200 Error Response Codes: Unauthorized (401), Forbidden (403), Not Found (404) This operation does not require a request body. This operation returns a response body. Show Firewall: Request GET /v2.0/fw/firewalls/9faaf49f-dd89-4e39-a8c6-101839aa49bc.json User-Agent: python-neutronclient Accept: application/json Show Firewall: Response
Create Firewall Verb URI Description &POST; /fw/firewalls Creates a new Firewall. Normal Response Code: 201 Error Response Codes: Unauthorized (401), Bad Request (400) This operation requires a request body. This operation returns a response body. Create Firewall: Request POST /v2.0/fw/firewalls.json User-Agent: python-neutronclient Accept: application/json Create Firewall: Response HTTP/1.1 201 Created Content-Type: application/json; charset=UTF-8
Update Firewall Verb URI Description &PUT; /fw/firewalls/firewall-id Updates a Firewall, provided status is not indicating a PENDING_* state. Normal Response Code: 200 Error Response Codes: Unauthorized (401), Bad Request (400), Not Found (404) Update Firewall: Request PUT /v2.0/fw/firewalls/41bfef97-af4e-4f6b-a5d3-4678859d2485.json User-Agent: python-neutronclient Accept: application/json Update Firewall: Response HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8
Delete Firewall Verb URI Description &DELETE; /fw/firewalls/firewall-id Removes a Firewall. Normal Response Code: 204 Error Response Codes: Unauthorized (401), Not Found (404) This operation does not require a request body. This operation does not return a response body. Delete Firewall: Request DELETE /v2.0/fw/firewalls/1be5e5f7-c45e-49ba-85da-156575b60d50.json User-Agent: python-neutronclient Accept: application/json Delete Firewall: Response HTTP/1.1 204 No Content Content-Length: 0