Chapter 1. Introduction to OpenStack networking The Networking service (neutron) is the software-defined networking (SDN) component of Red Hat OpenStack Services on OpenShift (RHOSO). The RHOSO Networking service manages internal and external traffic to and from VM instances and provides core services such as routing, segmentation, DHCP, and metadata. The Networking service provides the API for virtual networking capabilities and management of switches, routers, ports, and firewalls. With the RHOSO Networking service (neutron) you can effectively meet your site's networking goals. You can do the following tasks: Provide connectivity to VM instances within a project. Project networks primarily enable general (non-privileged) projects to manage networks without involving administrators. These networks are entirely virtual and require virtual routers to interact with other project networks and external networks such as the Internet. Project networks also usually provide DHCP and metadata services to VM (virtual machine) instances. RHOSO supports the following project network types: flat, VLAN, VXLAN, and GENEVE. For more information, see Managing project networks . Provide connectivity to VM instances using a public or floating IP address. You can direct ingress network traffic to your Red Hat OpenStack Services on OpenShift (RHOSO) instances using a public or floating IP address. You can assign either a static floating IP address to the instance, or use a method that randomly assigns a floating IP address from a pool of external IP addresses. The RHOSO Networking service also provides you with port forwarding for a floating IP address. When the Networking service detects incoming, external traffic addressed to a specific address and port, the service forwards the traffic to the internal IP address and port. For more information, see Managing floating IP addresses . Set ingress and egress limits for traffic on VM instances. You can offer varying service levels for instances by using quality of service (QoS) policies to apply rate limits to egress and ingress traffic. You can apply QoS policies to individual ports. You can also apply QoS policies to a project network, where ports with no specific policy attached inherit the policy. For more information, see Using Quality of Service (QoS) policies to manage data traffic . Optimize your VM instances for Network Functions Virtualization (NFV). Instances can send and receive VLAN-tagged traffic over a single virtual NIC. This is particularly useful for NFV applications (VNFs) that expect VLAN-tagged traffic, allowing a single virtual NIC to serve multiple customers or services. In a VLAN transparent network, you set up VLAN tagging in the VM instances. The VLAN tags are transferred over the network and consumed by the VM instances on the same VLAN, and ignored by other instances and devices. VLAN trunks support VLAN-aware instances by combining VLANs into a single trunked port. For more information, see VLAN-aware instances . Manage port traffic. With allowed address pairs you identify a specific MAC address, IP address, or both to allow network traffic to pass through a port regardless of the subnet. When you define allowed address pairs, you are able to use protocols like VRRP (Virtual Router Redundancy Protocol) that float an IP address between two VM instances to enable fast data plane failover. For more information, see Configuring allowed address pairs . Control network access to and from instances. You can control network and protocol access to and from instances by using security groups. Security groups are sets of IP filter rules that, for example, allow users to perform an ICMP ping on an instance, and run SSH to connect to an instance. The security group rules are applied to all instances within a project. For more information, see Configuring security groups . Logging traffic flow events into and out of an instance. You can create packet logs for security groups to monitor traffic flows into and out of a virtual machine (VM) instance. Each log generates a stream of data about packet flow events and appends it to a common log file on the Compute host from which the VM instance was launched. For more information, see Logging security group actions .

Commands: