25d19d243f
Sentence and paragraph structure edits, and an additional heading to review the Neutron Concept section. Change-Id: I8328e7ae5d36c1f1aa365ed01a0ffee4b759229f backport: none Implements: blueprint installation-guide-improvements
61 lines
3.6 KiB
XML
61 lines
3.6 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<section xml:id="neutron-concepts"
|
|
xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink" version="5.0">
|
|
<title>Networking concepts</title>
|
|
<para>OpenStack Networking (neutron) manages all of the networking
|
|
facets for the Virtual Networking Infrastructure (VNI) in your
|
|
OpenStack environment. OpenStack Networking also manages the access
|
|
layer aspects of the Physical Networking Infrastructure (PNI).
|
|
Tenants can create advanced virtual network topologies using
|
|
OpenStack Networking. These topologies include services such as
|
|
<glossterm baseform="firewall">firewalls</glossterm>,
|
|
<glossterm baseform="load balancer">load balancers</glossterm>, and
|
|
<glossterm baseform="virtual private network (VPN)">
|
|
virtual private networks (VPNs)</glossterm>.</para>
|
|
<para>Networking provides the following object abstractions: networks,
|
|
routers, and subnets. Each has a functionality that mimics its
|
|
physical counterpart: networks contain subnets, and routers route
|
|
traffic between different subnet and networks.</para>
|
|
<para>Each router has one gateway that connects to a network, and many
|
|
interfaces connected to subnets. Subnets can access machines on
|
|
other subnets connected to the same router.</para>
|
|
<para>Any given Networking set up has at least one external network.
|
|
This external network, unlike the other networks, is not solely a
|
|
virtually defined network. It instead provides a view into a slice
|
|
of the network accessible outside the OpenStack installation, which
|
|
is the outside network. IP addresses on the external network are
|
|
accessible by anybody physically on the outside network. DHCP is
|
|
disabled on this network.</para>
|
|
<para>Machines can access the outside network through the gateway
|
|
for the router. For the outside network to access VMs, and for VM's
|
|
to access the outside network, routers between the networks are
|
|
needed.</para>
|
|
<para>In addition to external networks, any Networking set up has one
|
|
or more internal networks. These software-defined networks connect
|
|
directly to the VMs. Only the VMs on any given internal network,
|
|
or those on subnets connected through interfaces to a similar
|
|
router, can access VMs connected to that network directly.</para>
|
|
<para>Additionally, you can allocate IP addresses on external
|
|
networks to ports on the internal network. Whenever something is
|
|
connected to a subnet, that connection is called a port.You can
|
|
associate external network IP addresses with ports to VMs.
|
|
This way, entities on the outside network can access VMs.</para>
|
|
<para>Networking also supports <emphasis role="italic">security
|
|
groups</emphasis>, which enable administrators to define
|
|
firewall rules in groups. A VM can belong to one or more
|
|
security groups. Networking applies the rules in those security
|
|
groups to block or unblock ports, port ranges, or traffic types
|
|
for that VM.</para>
|
|
<simplesect><title>Networking plug-ins</title>
|
|
<para>Each plug-in that Networking uses has its own concepts. These
|
|
plug-in concepts are not vital to operating Networking.
|
|
Understanding these concepts can help you set up the Openstack
|
|
Networking service, however. All Networking installations use a core
|
|
plug-in and a security group plug-in (or just the No-Op security
|
|
group plug-in). Additionally, Firewall-as-a-service (FWaaS) and
|
|
Load-balancing-as-a-service (LBaaS) plug-ins are available.</para>
|
|
</simplesect>
|
|
</section>
|