2.8. OpenStack Networking

OpenStack Networking applies anti-spoofing firewall rules by default, with the result that a VM cannot communicate using a MAC or IP address that is not configured on its network port. In Red Hat Enterprise Linux OpenStack Platform 7, it is now possible to enable or disable the security-group feature on a per port basis, using the new 'port-security-enabled' attribute. Consequently, Project administrators get granular control over the firewall's position in the network topology.

View the state of HA routers - Administrators are now able to view the state of High Availability routers on each node, and specifically, where the active instance is hosted. This new functionality also serves as a sanity test and offers assurance that a router is indeed active on only one node.

Support for multiple subnets on external networks - HA routers are now able to allocate floating IP addresses to all on-link subnets.

LBaaS version 2.0 allows for increased robustness in load-balancing deployments, including support for SSL/TLS termination. This update to v2 includes a redesign of the LBaaS architecture and the HAProxy reference plugin.

Red Hat Enterprise Linux OpenStack Platform 7.0 (kilo) adds support for interconnecting between VLAN and VXLAN/GRE when using distributed routers. This integration allows connectivity between VLANs and VXLAN/GRE tunnels in DVR.

In RHEL OpenStack Platform 7, the core OpenStack services are able to operate over IPv6 networks. At present, RHEL OpenStack Platform director will not deploy or manage nodes over IPv6-based networks.