From 7dbbdd59c7fbed3507964dfe4332c9cb53b188e0 Mon Sep 17 00:00:00 2001 From: Jessica Tomechak Date: Wed, 30 Jan 2013 16:16:35 -0800 Subject: [PATCH] Docs. CLOUDSTACK-737. Documentation for security groups in advanced zones. In about-security-groups.xml, add 1 sentence: "In advanced zones, security groups are supported only on the KVM hypervisor." This replaces a sentence that states they are supported only in basic zones. New section: security-groups-advanced-zones.xml. In security-groups.xml: include the new section. --- docs/en-US/about-security-groups.xml | 7 ++- docs/en-US/security-groups-advanced-zones.xml | 52 +++++++++++++++++++ docs/en-US/security-groups.xml | 3 +- 3 files changed, 60 insertions(+), 2 deletions(-) create mode 100644 docs/en-US/security-groups-advanced-zones.xml diff --git a/docs/en-US/about-security-groups.xml b/docs/en-US/about-security-groups.xml index 85e8477cfb1..6a31b25ef48 100644 --- a/docs/en-US/about-security-groups.xml +++ b/docs/en-US/about-security-groups.xml @@ -24,7 +24,12 @@
About Security Groups - Security groups provide a way to isolate traffic to VMs. A security group is a group of VMs that filter their incoming and outgoing traffic according to a set of rules, called ingress and egress rules. These rules filter network traffic according to the IP address that is attempting to communicate with the VM. Security groups are particularly useful in zones that use basic networking, because there is a single guest network for all guest VMs. In &PRODUCT; 3.0.3 - 3.0.5, security groups are supported only in zones that use basic networking. + Security groups provide a way to isolate traffic to VMs. A security group is a group of + VMs that filter their incoming and outgoing traffic according to a set of rules, called + ingress and egress rules. These rules filter network traffic according to the IP address + that is attempting to communicate with the VM. Security groups are particularly useful in + zones that use basic networking, because there is a single guest network for all guest VMs. + In advanced zones, security groups are supported only on the KVM hypervisor. In a zone that uses advanced networking, you can instead define multiple guest networks to isolate traffic to VMs. diff --git a/docs/en-US/security-groups-advanced-zones.xml b/docs/en-US/security-groups-advanced-zones.xml new file mode 100644 index 00000000000..bfae1883cc9 --- /dev/null +++ b/docs/en-US/security-groups-advanced-zones.xml @@ -0,0 +1,52 @@ + + +%BOOK_ENTITIES; +]> + + + +
+ Security Groups in Advanced Zones (KVM Only) + &PRODUCT; provides the ability to use security groups to provide isolation between + guests on a single shared, zone-wide network in an advanced zone where KVM is the + hypervisor. Using security groups in advanced zones rather than multiple VLANs allows a greater range + of options for setting up guest isolation in a cloud. + + Limitations + The following are not supported for this feature: + + + + Two IP ranges with the same VLAN and different gateway or netmask in security + group-enabled shared network. + + + Two IP ranges with the same VLAN and different gateway or netmask in + account-specific shared networks. + + + Multiple VLAN ranges in security group-enabled shared network. + + + Multiple VLAN ranges in account-specific shared networks. + + + Security groups must be enabled in the zone in order for this feature to be used. +
diff --git a/docs/en-US/security-groups.xml b/docs/en-US/security-groups.xml index 3c08965c8d3..00dbf5ed2e8 100644 --- a/docs/en-US/security-groups.xml +++ b/docs/en-US/security-groups.xml @@ -25,7 +25,8 @@
Security Groups - + +