Verify the OpenStack security groups¶

If you have connectivity failures between VMs, you may need to troubleshoot the OpenStack security groups. You can verify the OpenStack security groups of a VM using CLI or Horizon.

To verify the OpenStack security groups using CLI:

1. Log in to any OpenStack controller node using CLI.

2. List the IDs of the security groups:

   openstack security group list --project <project_id>
   
   +--------------------------------------+------------+------------------------+---------+
   | ID                                   | Name       | Description            | Project |
   +--------------------------------------+------------+------------------------+---------+
   | 16463a93-6d87-4e2f-8f5b-8954ed6a243b | default    | Default security group |         |
   | 3b2490a1-8efb-4208-a202-455710088ac8 | other_secg | Security group         |         |
   +--------------------------------------+------------+------------------------+---------+
   

3. Verify the rules of the security group. For example

   openstack security group show 16463a93-6d87-4e2f-8f5b-8954ed6a243b
   
   +---------------+---------------------------------------------------------------------------------+
   |Field          |Value                                                                            |
   +---------------+---------------------------------------------------------------------------------+
   |created_at     |None                                                                             |
   |description    |Default security group                                                           |
   |id             |16463a93-6d87-4e2f-8f5b-8954ed6a243b                                             |
   |name           |default                                                                          |
   |project_id     |cf9b8bd8667b4b53a65192a486c4ab9c                                                 |
   |revision_number|None                                                                             |
   |rules          |direction='egress', ethertype='IPv4', id='97b1a242-ef00-4ff3-87f0-63c405c73570', |
   |               |port_range_max='65535', protocol='any', remote_ip_prefix='0.0.0.0/0'             |
   |               |direction='egress', ethertype='IPv6', id='9e037646-d99c-4e00-baf1-b422fa839253', |
   |               |port_range_max='65535', protocol='any', remote_ip_prefix='::/0'                  |
   |               |direction='ingress', ethertype='IPv4', id='5a4ac047-a410-4e03-a41f-261de909ed0a',|
   |               |port_range_max='65535', protocol='any', remote_ip_prefix='0.0.0.0/0'             |
   |updated_at     |None                                                                             |
   +---------------+---------------------------------------------------------------------------------+
   

To verify the OpenStack security groups using Horizon:

1. Log in to Horizon.
2. Go to Project > Network > Security Groups.
3. Select the security group that is used by the VM in question.
4. Add a new test rule that allows all ingress/egress traffic.
5. Test the connectivity between two VMs.
6. If connectivity fails, follow the steps described in Verify the IP address and default gateway on a VM.