You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cloudstack.apache.org by Jayapal Reddy <ja...@citrix.com> on 2013/04/08 14:36:04 UTC

Review Request: Changes for Egress firewall rules feature support in SRX

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/
-----------------------------------------------------------

Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.


Description
-------

Added egress firewall rules support for SRX device.
Supported networks:
1. Advanced Isolated networks.


This addresses bug CLOUDSTACK-779.


Diffs
-----

  api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
  plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
  plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
  scripts/network/juniper/application-add.xml 6603850 
  scripts/network/juniper/security-policy-add.xml 632a17d 
  server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 

Diff: https://reviews.apache.org/r/10336/diff/


Testing
-------

Unit Testing done.


Thanks,

Jayapal Reddy


Re: Review Request: Changes for Egress firewall rules feature support in SRX

Posted by Jayapal Reddy <ja...@citrix.com>.

> On April 8, 2013, 11:25 p.m., Sheng Yang wrote:
> > plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java, line 830
> > <https://reviews.apache.org/r/10336/diff/1/?file=278647#file278647line830>
> >
> >     What's these trafficType and guestVlan for? Didn't see them in the scope.
> 
> Jayapal Reddy wrote:
>     1. The traffic type is for identifying the rule type whether it is Egress/Ingress.
>     2. Guest Vlan is used for crating unique egress firewall rule name.
> 
> Sheng Yang wrote:
>     I meant, I didn't see the reference of them anywhere in the code.

Those un used variables. I removed those.


- Jayapal


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/#review18804
-----------------------------------------------------------


On April 10, 2013, 12:46 p.m., Jayapal Reddy wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/10336/
> -----------------------------------------------------------
> 
> (Updated April 10, 2013, 12:46 p.m.)
> 
> 
> Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.
> 
> 
> Description
> -------
> 
> Added egress firewall rules support for SRX device.
> Supported networks:
> 1. Advanced Isolated networks.
> 
> 
> This addresses bug CLOUDSTACK-779.
> 
> 
> Diffs
> -----
> 
>   api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
>   scripts/network/juniper/application-add.xml 6603850 
>   scripts/network/juniper/security-policy-add.xml 632a17d 
>   server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 
>   server/src/com/cloud/upgrade/dao/Upgrade410to420.java f39038f 
> 
> Diff: https://reviews.apache.org/r/10336/diff/
> 
> 
> Testing
> -------
> 
> Unit Testing done.
> 
> 
> Thanks,
> 
> Jayapal Reddy
> 
>


Re: Review Request: Changes for Egress firewall rules feature support in SRX

Posted by Sheng Yang <sh...@yasker.org>.

> On April 8, 2013, 11:25 p.m., Sheng Yang wrote:
> > plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java, line 830
> > <https://reviews.apache.org/r/10336/diff/1/?file=278647#file278647line830>
> >
> >     What's these trafficType and guestVlan for? Didn't see them in the scope.
> 
> Jayapal Reddy wrote:
>     1. The traffic type is for identifying the rule type whether it is Egress/Ingress.
>     2. Guest Vlan is used for crating unique egress firewall rule name.

I meant, I didn't see the reference of them anywhere in the code.


> On April 8, 2013, 11:25 p.m., Sheng Yang wrote:
> > plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java, line 2572
> > <https://reviews.apache.org/r/10336/diff/1/?file=278647#file278647line2572>
> >
> >     I am not sure if you need create application for egress rules. Ingress firewall don't need it. I suppose applications are for security policy rather than firewall filter?
> 
> Jayapal Reddy wrote:
>     Application for egress required because in case of ingress security policies while deleting a policy it is deleting the applications which are not used by it.
>     
>     Example:
>     1. security policy ingress rule for tcp-22-22
>     2. Egress rule for tcp-22-22
>     3. If we don't add separate egress application name there will be one application with name tcp-22-22
>     4. Deleting security policy ingress rule will delete tcp-22-22 application which needed by egress rule.
>        So we need separate application name for egress/
>     
>

In fact I'm talking about firewall filter, which doesn't need applications. But seems you're using security policy for egress purpose. Then it should be fine.


- Sheng


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/#review18804
-----------------------------------------------------------


On April 9, 2013, 6:12 a.m., Jayapal Reddy wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/10336/
> -----------------------------------------------------------
> 
> (Updated April 9, 2013, 6:12 a.m.)
> 
> 
> Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.
> 
> 
> Description
> -------
> 
> Added egress firewall rules support for SRX device.
> Supported networks:
> 1. Advanced Isolated networks.
> 
> 
> This addresses bug CLOUDSTACK-779.
> 
> 
> Diffs
> -----
> 
>   api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
>   scripts/network/juniper/application-add.xml 6603850 
>   scripts/network/juniper/security-policy-add.xml 632a17d 
>   server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 
>   server/src/com/cloud/upgrade/dao/Upgrade410to420.java f39038f 
> 
> Diff: https://reviews.apache.org/r/10336/diff/
> 
> 
> Testing
> -------
> 
> Unit Testing done.
> 
> 
> Thanks,
> 
> Jayapal Reddy
> 
>


Re: Review Request: Changes for Egress firewall rules feature support in SRX

Posted by Jayapal Reddy <ja...@citrix.com>.

> On April 8, 2013, 11:25 p.m., Sheng Yang wrote:
> > plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java, line 830
> > <https://reviews.apache.org/r/10336/diff/1/?file=278647#file278647line830>
> >
> >     What's these trafficType and guestVlan for? Didn't see them in the scope.

1. The traffic type is for identifying the rule type whether it is Egress/Ingress.
2. Guest Vlan is used for crating unique egress firewall rule name.


> On April 8, 2013, 11:25 p.m., Sheng Yang wrote:
> > plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java, line 2572
> > <https://reviews.apache.org/r/10336/diff/1/?file=278647#file278647line2572>
> >
> >     I am not sure if you need create application for egress rules. Ingress firewall don't need it. I suppose applications are for security policy rather than firewall filter?

Application for egress required because in case of ingress security policies while deleting a policy it is deleting the applications which are not used by it.

Example:
1. security policy ingress rule for tcp-22-22
2. Egress rule for tcp-22-22
3. If we don't add separate egress application name there will be one application with name tcp-22-22
4. Deleting security policy ingress rule will delete tcp-22-22 application which needed by egress rule.
   So we need separate application name for egress/


- Jayapal


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/#review18804
-----------------------------------------------------------


On April 8, 2013, 12:36 p.m., Jayapal Reddy wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/10336/
> -----------------------------------------------------------
> 
> (Updated April 8, 2013, 12:36 p.m.)
> 
> 
> Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.
> 
> 
> Description
> -------
> 
> Added egress firewall rules support for SRX device.
> Supported networks:
> 1. Advanced Isolated networks.
> 
> 
> This addresses bug CLOUDSTACK-779.
> 
> 
> Diffs
> -----
> 
>   api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
>   scripts/network/juniper/application-add.xml 6603850 
>   scripts/network/juniper/security-policy-add.xml 632a17d 
>   server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 
> 
> Diff: https://reviews.apache.org/r/10336/diff/
> 
> 
> Testing
> -------
> 
> Unit Testing done.
> 
> 
> Thanks,
> 
> Jayapal Reddy
> 
>


Re: Review Request: Changes for Egress firewall rules feature support in SRX

Posted by Sheng Yang <sh...@yasker.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/#review18804
-----------------------------------------------------------



plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java
<https://reviews.apache.org/r/10336/#comment39257>

    What's these trafficType and guestVlan for? Didn't see them in the scope.



plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java
<https://reviews.apache.org/r/10336/#comment39261>

    I am not sure if you need create application for egress rules. Ingress firewall don't need it. I suppose applications are for security policy rather than firewall filter?


- Sheng Yang


On April 8, 2013, 12:36 p.m., Jayapal Reddy wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/10336/
> -----------------------------------------------------------
> 
> (Updated April 8, 2013, 12:36 p.m.)
> 
> 
> Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.
> 
> 
> Description
> -------
> 
> Added egress firewall rules support for SRX device.
> Supported networks:
> 1. Advanced Isolated networks.
> 
> 
> This addresses bug CLOUDSTACK-779.
> 
> 
> Diffs
> -----
> 
>   api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
>   scripts/network/juniper/application-add.xml 6603850 
>   scripts/network/juniper/security-policy-add.xml 632a17d 
>   server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 
> 
> Diff: https://reviews.apache.org/r/10336/diff/
> 
> 
> Testing
> -------
> 
> Unit Testing done.
> 
> 
> Thanks,
> 
> Jayapal Reddy
> 
>


Re: Review Request: Changes for Egress firewall rules feature support in SRX

Posted by Jayapal Reddy <ja...@citrix.com>.

> On April 9, 2013, 6:22 p.m., Sheng Yang wrote:
> > server/src/com/cloud/upgrade/dao/Upgrade410to420.java, line 331
> > <https://reviews.apache.org/r/10336/diff/2/?file=279173#file279173line331>
> >
> >     This would by default allow all egress traffic right? How can these rules applied to SRX after mgmt server upgrade?

As part of upgrade for this feature we need to restart the network. 
Network restart applies  the rules on the SRX


- Jayapal


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/#review18867
-----------------------------------------------------------


On April 9, 2013, 6:12 a.m., Jayapal Reddy wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/10336/
> -----------------------------------------------------------
> 
> (Updated April 9, 2013, 6:12 a.m.)
> 
> 
> Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.
> 
> 
> Description
> -------
> 
> Added egress firewall rules support for SRX device.
> Supported networks:
> 1. Advanced Isolated networks.
> 
> 
> This addresses bug CLOUDSTACK-779.
> 
> 
> Diffs
> -----
> 
>   api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
>   scripts/network/juniper/application-add.xml 6603850 
>   scripts/network/juniper/security-policy-add.xml 632a17d 
>   server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 
>   server/src/com/cloud/upgrade/dao/Upgrade410to420.java f39038f 
> 
> Diff: https://reviews.apache.org/r/10336/diff/
> 
> 
> Testing
> -------
> 
> Unit Testing done.
> 
> 
> Thanks,
> 
> Jayapal Reddy
> 
>


Re: Review Request: Changes for Egress firewall rules feature support in SRX

Posted by Sheng Yang <sh...@yasker.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/#review18867
-----------------------------------------------------------



server/src/com/cloud/upgrade/dao/Upgrade410to420.java
<https://reviews.apache.org/r/10336/#comment39319>

    This would by default allow all egress traffic right? How can these rules applied to SRX after mgmt server upgrade?


- Sheng Yang


On April 9, 2013, 6:12 a.m., Jayapal Reddy wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/10336/
> -----------------------------------------------------------
> 
> (Updated April 9, 2013, 6:12 a.m.)
> 
> 
> Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.
> 
> 
> Description
> -------
> 
> Added egress firewall rules support for SRX device.
> Supported networks:
> 1. Advanced Isolated networks.
> 
> 
> This addresses bug CLOUDSTACK-779.
> 
> 
> Diffs
> -----
> 
>   api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
>   scripts/network/juniper/application-add.xml 6603850 
>   scripts/network/juniper/security-policy-add.xml 632a17d 
>   server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 
>   server/src/com/cloud/upgrade/dao/Upgrade410to420.java f39038f 
> 
> Diff: https://reviews.apache.org/r/10336/diff/
> 
> 
> Testing
> -------
> 
> Unit Testing done.
> 
> 
> Thanks,
> 
> Jayapal Reddy
> 
>


Re: Review Request: Changes for Egress firewall rules feature support in SRX

Posted by Sheng Yang <sh...@yasker.org>.

> On April 10, 2013, 6:01 p.m., Sheng Yang wrote:
> > Ship It!
> 
> Abhinandan Prateek wrote:
>     The patch fails to apply on master please check and resubmit.

I've already applied it to master. Seems my comment didn't get out...


- Sheng


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/#review18961
-----------------------------------------------------------


On April 10, 2013, 12:46 p.m., Jayapal Reddy wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/10336/
> -----------------------------------------------------------
> 
> (Updated April 10, 2013, 12:46 p.m.)
> 
> 
> Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.
> 
> 
> Description
> -------
> 
> Added egress firewall rules support for SRX device.
> Supported networks:
> 1. Advanced Isolated networks.
> 
> 
> This addresses bug CLOUDSTACK-779.
> 
> 
> Diffs
> -----
> 
>   api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
>   scripts/network/juniper/application-add.xml 6603850 
>   scripts/network/juniper/security-policy-add.xml 632a17d 
>   server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 
>   server/src/com/cloud/upgrade/dao/Upgrade410to420.java f39038f 
> 
> Diff: https://reviews.apache.org/r/10336/diff/
> 
> 
> Testing
> -------
> 
> Unit Testing done.
> 
> 
> Thanks,
> 
> Jayapal Reddy
> 
>


Re: Review Request: Changes for Egress firewall rules feature support in SRX

Posted by Abhinandan Prateek <ap...@apache.org>.

> On April 10, 2013, 6:01 p.m., Sheng Yang wrote:
> > Ship It!

The patch fails to apply on master please check and resubmit.


- Abhinandan


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/#review18961
-----------------------------------------------------------


On April 10, 2013, 12:46 p.m., Jayapal Reddy wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/10336/
> -----------------------------------------------------------
> 
> (Updated April 10, 2013, 12:46 p.m.)
> 
> 
> Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.
> 
> 
> Description
> -------
> 
> Added egress firewall rules support for SRX device.
> Supported networks:
> 1. Advanced Isolated networks.
> 
> 
> This addresses bug CLOUDSTACK-779.
> 
> 
> Diffs
> -----
> 
>   api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
>   scripts/network/juniper/application-add.xml 6603850 
>   scripts/network/juniper/security-policy-add.xml 632a17d 
>   server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 
>   server/src/com/cloud/upgrade/dao/Upgrade410to420.java f39038f 
> 
> Diff: https://reviews.apache.org/r/10336/diff/
> 
> 
> Testing
> -------
> 
> Unit Testing done.
> 
> 
> Thanks,
> 
> Jayapal Reddy
> 
>


Re: Review Request: Changes for Egress firewall rules feature support in SRX

Posted by Sheng Yang <sh...@yasker.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/#review18961
-----------------------------------------------------------

Ship it!


Ship It!

- Sheng Yang


On April 10, 2013, 12:46 p.m., Jayapal Reddy wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/10336/
> -----------------------------------------------------------
> 
> (Updated April 10, 2013, 12:46 p.m.)
> 
> 
> Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.
> 
> 
> Description
> -------
> 
> Added egress firewall rules support for SRX device.
> Supported networks:
> 1. Advanced Isolated networks.
> 
> 
> This addresses bug CLOUDSTACK-779.
> 
> 
> Diffs
> -----
> 
>   api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
>   plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
>   scripts/network/juniper/application-add.xml 6603850 
>   scripts/network/juniper/security-policy-add.xml 632a17d 
>   server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 
>   server/src/com/cloud/upgrade/dao/Upgrade410to420.java f39038f 
> 
> Diff: https://reviews.apache.org/r/10336/diff/
> 
> 
> Testing
> -------
> 
> Unit Testing done.
> 
> 
> Thanks,
> 
> Jayapal Reddy
> 
>


Re: Review Request: Changes for Egress firewall rules feature support in SRX

Posted by Jayapal Reddy <ja...@citrix.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/
-----------------------------------------------------------

(Updated April 10, 2013, 12:46 p.m.)


Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.


Changes
-------

Removed un used variables trafficType and guestVlan


Description
-------

Added egress firewall rules support for SRX device.
Supported networks:
1. Advanced Isolated networks.


This addresses bug CLOUDSTACK-779.


Diffs (updated)
-----

  api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
  plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
  plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
  scripts/network/juniper/application-add.xml 6603850 
  scripts/network/juniper/security-policy-add.xml 632a17d 
  server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 
  server/src/com/cloud/upgrade/dao/Upgrade410to420.java f39038f 

Diff: https://reviews.apache.org/r/10336/diff/


Testing
-------

Unit Testing done.


Thanks,

Jayapal Reddy


Re: Review Request: Changes for Egress firewall rules feature support in SRX

Posted by Jayapal Reddy <ja...@citrix.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/10336/
-----------------------------------------------------------

(Updated April 9, 2013, 6:12 a.m.)


Review request for cloudstack, Abhinandan Prateek, Sheng Yang, and Murali Reddy.


Changes
-------

Added upgrade changes.


Description
-------

Added egress firewall rules support for SRX device.
Supported networks:
1. Advanced Isolated networks.


This addresses bug CLOUDSTACK-779.


Diffs (updated)
-----

  api/src/com/cloud/agent/api/to/FirewallRuleTO.java 7f77936 
  plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java af0912a 
  plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java 8482168 
  scripts/network/juniper/application-add.xml 6603850 
  scripts/network/juniper/security-policy-add.xml 632a17d 
  server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java 1fc32d0 
  server/src/com/cloud/upgrade/dao/Upgrade410to420.java f39038f 

Diff: https://reviews.apache.org/r/10336/diff/


Testing
-------

Unit Testing done.


Thanks,

Jayapal Reddy