<commit_before>Firewall-as-a-Service (FWaaS) v2 scenario
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Enable FWaaS v2
---------------

#. Enable the FWaaS plug-in in the ``/etc/neutron/neutron.conf`` file:

   .. code-block:: ini

      service_plugins = firewall_v2

      [service_providers]
      # ...
      service_provider = FIREWALL:Iptables:neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver:default

      [fwaas]
      driver = neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas_v2.IptablesFwaasDriver
      enabled = True

   .. note::

      On Ubuntu, modify the ``[fwaas]`` section in the
      ``/etc/neutron/fwaas_driver.ini`` file instead of
      ``/etc/neutron/neutron.conf``.

#. Configure the FWaaS plugin for the L3 agent.

   In the ``AGENT`` section of ``l3_agent.ini``, make sure the FWaaS extension
   is loaded:

   .. code-block:: ini

      [AGENT]
      extensions = fwaas

   Edit the FWaaS section in the ``/etc/neutron/neutron.conf`` file to indicate
   the agent version and driver:

   .. code-block:: ini

      [fwaas]
      agent_version = v2
      driver = iptables
      enabled = True

#. Create the required tables in the database:

   .. code-block:: console

      # neutron-db-manage --subproject neutron-fwaas upgrade head

#. Enable the option in the ``local_settings.py`` file,
   which is typically located on the controller node:

   .. code-block:: python

      OPENSTACK_NEUTRON_NETWORK = {
          # ...
          'enable_firewall' = True,
          # ...
      }

   .. note::

      By default, ``enable_firewall`` option value is ``True`` in
      ``local_settings.py`` file.

   Apply the settings by restarting the web server.

#. Restart the ``neutron-l3-agent`` and ``neutron-server`` services
   to apply the settings.

Configure Firewall-as-a-Service v2
----------------------------------

Create the firewall rules and create a policy that contains them.
Then, create a firewall that applies the policy.

#. Create a firewall rule:

   .. code-block:: console

      $ neutron firewall-rule-create --protocol {tcp,udp,icmp,any} \
        --source-ip-address SOURCE_IP_ADDRESS \
        --destination-ip-address DESTINATION_IP_ADDRESS \
        --source-port SOURCE_PORT_RANGE --destination-port DEST_PORT_RANGE \
        --action {allow,deny,reject}

   The Networking client requires a protocol value.  If the rule is protocol
   agnostic, you can use the ``any`` value.

   .. note::

      When the source or destination IP address are not of the same IP
      version (for example, IPv6), the command returns an error.<commit_msg>Remove horizon related config for firewall v2<commit_after>Firewall-as-a-Service (FWaaS) v2 scenario
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Enable FWaaS v2
---------------

#. Enable the FWaaS plug-in in the ``/etc/neutron/neutron.conf`` file:

   .. code-block:: ini

      service_plugins = firewall_v2

      [service_providers]
      # ...
      service_provider = FIREWALL:Iptables:neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver:default

      [fwaas]
      driver = neutron_fwaas.services.firewall.drivers.linux.iptables_fwaas_v2.IptablesFwaasDriver
      enabled = True

   .. note::

      On Ubuntu, modify the ``[fwaas]`` section in the
      ``/etc/neutron/fwaas_driver.ini`` file instead of
      ``/etc/neutron/neutron.conf``.

#. Configure the FWaaS plugin for the L3 agent.

   In the ``AGENT`` section of ``l3_agent.ini``, make sure the FWaaS extension
   is loaded:

   .. code-block:: ini

      [AGENT]
      extensions = fwaas

   Edit the FWaaS section in the ``/etc/neutron/neutron.conf`` file to indicate
   the agent version and driver:

   .. code-block:: ini

      [fwaas]
      agent_version = v2
      driver = iptables
      enabled = True

#. Create the required tables in the database:

   .. code-block:: console

      # neutron-db-manage --subproject neutron-fwaas upgrade head

#. Restart the ``neutron-l3-agent`` and ``neutron-server`` services
   to apply the settings.

   .. note::

      Firewall v2 is not supported by horizon yet.

Configure Firewall-as-a-Service v2
----------------------------------

Create the firewall rules and create a policy that contains them.
Then, create a firewall that applies the policy.

#. Create a firewall rule:

   .. code-block:: console

      $ neutron firewall-rule-create --protocol {tcp,udp,icmp,any} \
        --source-ip-address SOURCE_IP_ADDRESS \
        --destination-ip-address DESTINATION_IP_ADDRESS \
        --source-port SOURCE_PORT_RANGE --destination-port DEST_PORT_RANGE \
        --action {allow,deny,reject}

   The Networking client requires a protocol value.  If the rule is protocol
   agnostic, you can use the ``any`` value.

   .. note::

      When the source or destination IP address are not of the same IP
      version (for example, IPv6), the command returns an error.
{'fraction_non_alphanumeric': 0.13298195824042164, 'fraction_numerical': 0.004459760794648287, 'mean_word_length': 2.598832968636032, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4885515', 'n_tokens_mistral': 1574, 'n_tokens_neox': 1466, 'n_words': 451}