Back to Checks
openstack

Networks are administratively enabled

networking_admin_state_down
Service: networkingSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:OS::Neutron::Net

OpenStack networks are evaluated to verify that admin_state_up is True (administratively enabled). Networks with admin_state_up=False cannot carry traffic and are typically disabled temporarily during maintenance or troubleshooting. Best practices recommend re-enabling networks promptly after maintenance to prevent service outages from forgotten disabled networks.

Prowler logoProwlerprowler-provider-openstack

Risk

Networks with admin_state_up=False cause complete connectivity loss for all attached instances, preventing access to databases, APIs, and storage. Forgotten disabled networks after maintenance result in prolonged outages that violate SLAs. Multi-tier applications (web-app-db) fail when inter-tier networks are disabled, breaking functionality even when instances are healthy.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks networking_admin_state_down

Recommendation

Enable admin state on all production networks unless there is a documented maintenance window. Implement change management procedures to track network administrative state changes and ensure re-enablement after maintenance. Use monitoring alerts to detect when networks remain disabled longer than expected.

Remediation

CLI

openstack network set --enable <network_id>

Terraform

resource "openstack_networking_network_v2" "network" {
  name           = "app-network"
  admin_state_up = true  # GOOD: Administratively enabled
}

Other

1*Enable network via Horizon:**
2Navigate to **Project > Network > Networks**
3For each network with Admin State = DOWN
4Click **Edit Network**
5Check the **Admin State** checkbox
6Click **Save**

Check Code

"""OpenStack Network Admin State Check."""

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.networking.networking_client import (
    networking_client,
)


class networking_admin_state_down(Check):
    """Ensure networks are administratively enabled."""

    def execute(self) -> List[CheckReportOpenStack]:
        """Execute networking_admin_state_down check.

        Iterates over all networks and verifies that admin_state_up is True,
        meaning networks are administratively enabled and operational.

        Returns:
            list[CheckReportOpenStack]: List of findings for each network.
        """
        findings: List[CheckReportOpenStack] = []

        for network in networking_client.networks:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=network)
            report.resource_id = network.id
            report.resource_name = network.name
            report.region = network.region

            if not network.admin_state_up:
                report.status = "FAIL"
                report.status_extended = f"Network {network.name} ({network.id}) is administratively disabled (admin_state_up=False) and cannot carry traffic."
            else:
                report.status = "PASS"
                report.status_extended = f"Network {network.name} ({network.id}) is administratively enabled."

            findings.append(report)

        return findings

References