Firewall on Demand

=======

1.1.1 RELEASE

Minor changes release

	- Change license to GPLv3

	- Minor documentation updates

VERSION = '1.1.2'

  **attention**

  Make sure your FoD server has ssh access to your flowspec device.

  **attention**

  Installation instructions assume a clean Debian Wheezy with Django 1.4

  **note**

  Set username and password for mysql if used

  **note**

  If you wish to deploy an outgoing mail server, now it is time to do

  it. Otherwise you could set FoD to send out mails via a third party

  account

- flowspy: core web application. Installation is done at /srv/flowspy::

  **note**

  Soon we will release a version with django-registration as a means to

  add users and Shibboleth will become an alternative

  **note**

  LOG\_FILE\_LOCATION in settings.py is set to **/var/log/fod**. Adjust

  the chown command above to your selected dir.

# -*- coding: utf-8 -*-

#

# fod documentation build configuration file, created by

# sphinx-quickstart on Wed Oct 16 17:20:20 2013.

#

# This file is execfile()d with the current directory set to its containing dir.

#

# Note that not all possible configuration values are present in this

# autogenerated file.

#

# All configuration values have a default; values that are commented out

# serve to show the default.

import sys, os

# If extensions (or modules to document with autodoc) are in another directory,

# add these directories to sys.path here. If the directory is relative to the

# documentation root, use os.path.abspath to make it absolute, like shown here.

#sys.path.append(os.path.abspath('.'))

# -- General configuration -----------------------------------------------------

# Add any Sphinx extension module names here, as strings. They can be extensions

# coming with Sphinx (named 'sphinx.ext.*') or your custom ones.

extensions = []

# Add any paths that contain templates here, relative to this directory.

templates_path = ['_templates']

# The suffix of source filenames.

source_suffix = '.rst'

# The encoding of source files.

#source_encoding = 'utf-8'

# The master toctree document.

master_doc = 'index'

# General information about the project.

project = u'fod'

copyright = u'2014, GRNET NOC, GRNET S.A'

# The version info for the project you're documenting, acts as replacement for

# |version| and |release|, also used in various other places throughout the

# built documents.

#

# The short X.Y version.

version = '1.1.1'

# The full version, including alpha/beta/rc tags.

release = '1.1.1'

# The language for content autogenerated by Sphinx. Refer to documentation

# for a list of supported languages.

#language = None

# There are two options for replacing |today|: either, you set today to some

# non-false value, then it is used:

#today = ''

# Else, today_fmt is used as the format for a strftime call.

#today_fmt = '%B %d, %Y'

# List of documents that shouldn't be included in the build.

#unused_docs = []

# List of directories, relative to source directory, that shouldn't be searched

# for source files.

exclude_trees = []

# The reST default role (used for this markup: `text`) to use for all documents.

#default_role = None

# If true, '()' will be appended to :func: etc. cross-reference text.

#add_function_parentheses = True

# If true, the current module name will be prepended to all description

# unit titles (such as .. function::).

#add_module_names = True

# If true, sectionauthor and moduleauthor directives will be shown in the

# output. They are ignored by default.

#show_authors = False

# The name of the Pygments (syntax highlighting) style to use.

pygments_style = 'sphinx'

# A list of ignored prefixes for module index sorting.

#modindex_common_prefix = []

# -- Options for HTML output ---------------------------------------------------

# The theme to use for HTML and HTML Help pages.  Major themes that come with

# Sphinx are currently 'default' and 'sphinxdoc'.

html_theme = 'default'

# Theme options are theme-specific and customize the look and feel of a theme

# further.  For a list of options available for each theme, see the

# documentation.

#html_theme_options = {}

# Add any paths that contain custom themes here, relative to this directory.

#html_theme_path = []

# The name for this set of Sphinx documents.  If None, it defaults to

# "<project> v<release> documentation".

#html_title = None

# A shorter title for the navigation bar.  Default is the same as html_title.

#html_short_title = None

# The name of an image file (relative to this directory) to place at the top

# of the sidebar.

#html_logo = None

# The name of an image file (within the static path) to use as favicon of the

# docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32

# pixels large.

#html_favicon = None

# Add any paths that contain custom static files (such as style sheets) here,

# relative to this directory. They are copied after the builtin static files,

# so a file named "default.css" will overwrite the builtin "default.css".

#html_static_path = ['_static']

# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,

# using the given strftime format.

#html_last_updated_fmt = '%b %d, %Y'

# If true, SmartyPants will be used to convert quotes and dashes to

# typographically correct entities.

#html_use_smartypants = True

# Custom sidebar templates, maps document names to template names.

#html_sidebars = {}

# Additional templates that should be rendered to pages, maps page names to

# template names.

#html_additional_pages = {}

# If false, no module index is generated.

#html_use_modindex = True

# If false, no index is generated.

#html_use_index = True

# If true, the index is split into individual pages for each letter.

#html_split_index = False

# If true, links to the reST sources are added to the pages.

#html_show_sourcelink = True

# If true, an OpenSearch description file will be output, and all pages will

# contain a <link> tag referring to it.  The value of this option must be the

# base URL from which the finished HTML is served.

#html_use_opensearch = ''

# If nonempty, this is the file name suffix for HTML files (e.g. ".xhtml").

#html_file_suffix = ''

# Output file base name for HTML help builder.

htmlhelp_basename = 'foddoc'

# -- Options for LaTeX output --------------------------------------------------

# The paper size ('letter' or 'a4').

#latex_paper_size = 'letter'

# The font size ('10pt', '11pt' or '12pt').

#latex_font_size = '10pt'

# Grouping the document tree into LaTeX files. List of tuples

# (source start file, target name, title, author, documentclass [howto/manual]).

latex_documents = [

  ('index', 'fod.tex', u'fod Documentation',

   u'Leonidas Poulopoulos', 'manual'),

]

# The name of an image file (relative to this directory) to place at the top of

# the title page.

#latex_logo = None

# For "manual" documents, if this is true, then toplevel headings are parts,

# not chapters.

#latex_use_parts = False

# Additional stuff for the LaTeX preamble.

#latex_preamble = ''

# Documents to append as an appendix to all manuals.

#latex_appendices = []

# If false, no module index is generated.

#latex_use_modindex = True

.. fod documentation master file, created by

   sphinx-quickstart on Wed Oct 16 17:20:20 2013.

   You can adapt this file completely to your liking, but it should at least

   contain the root `toctree` directive.

******************

Firewall on Demand

******************

Description

===========

Firewall on Demand applies, via Netconf, flow rules to a network device. These rules are then propagated via e-bgp to peering routers. Each user is authenticated against shibboleth. Authorization is performed via a combination of a Shibboleth attribute and the peer network address range that the user originates from.

FoD is meant to operate over this architecture::

          +-----------+          +------------+        +------------+

          |   FoD     | NETCONF  | flowspec   | ebgp   |   router   |

          | web app   +----------> device     +-------->            |

          +-----------+          +------+-----+        +------------+

                                        | ebgp

                                        |

                                 +------v-----+

                                 |   router   |

                                 |            |

                                 +------------+

NETCONF is chosen as the mgmt protocol to apply rules to a single flowspec capable device. Rules are then propagated via igbp to all flowspec capable routers. Of course FoD could apply rules directly (via NETCONF always) to a router and then ibgp would do the rest.

In GRNET's case the flowspec capable device is an EX4200.

.. attention::

	Make sure your FoD server has ssh access to your flowspec device.

.. attention::

   Installation instructions assume a clean Debian Wheezy with Django 1.4

Contact

=======

You can find more about FoD or raise your issues at `GRNET FoD repository <https://code.grnet.gr/projects/flowspy>`_ or `GRNET FoD Github repo <https://github.com/grnet/flowspy>`_ .

You can contact us directly at grnet{at}noc[dot]grnet(.)gr

Install

=======

.. toctree::

   :maxdepth: 2

   install