Hello,
We are using neutron with open-vswitch and GRE tunnels. I have been asked to investigate whether it is possible to have these tunnels encrypted.
So far I've found some information hinting at ipsec capabilities in openvswitch. Is this something we could use?
thanks,
The GRE tunnels you are talking about should have been setup in a secured network, possibly with a dedicated switch or an isolated vlan. I believe some guides call it the "Data" network. It is supposed to be segregated so that only the openvswitch traffic communicates over it, and it has not access to the outside world. This is pretty much the only security it provides. Swift operates with a "Data" network in the same manner as well.
Proper network security is the way to keep everything secure in this case.
IPsec is used in neutron for vpn connections externally, not internally.
There is a seperate VLAN.for Tenant traffic. However this does not provide enough security to satisfy our security department. We were looking in to encrypting everything on L2, but our networking hardware doesn't allow it. So I'm looking at other alternatives.
Asked: 2014-04-01 09:19:32 -0500
Seen: 196 times
Last updated: Apr 01 '14
