Check ID:
Provider: OpenStack
Service:
Severity: MEDIUM
Categories:
Resource type:
networking_admin_state_downProvider: OpenStack
Service:
networkingSeverity: MEDIUM
Categories:
resilienceResource type:
OS::Neutron::NetWhat this check verifies
OpenStack networks are evaluated to verify that admin_state_up is True (administratively enabled). Networks with admin_state_up=False cannot carry traffic and are typically disabled temporarily during maintenance or troubleshooting. Best practices recommend re-enabling networks promptly after maintenance to prevent service outages from forgotten disabled networks.Risk
Networks with admin_state_up=False cause complete connectivity loss for all attached instances, preventing access to databases, APIs, and storage. Forgotten disabled networks after maintenance result in prolonged outages that violate SLAs. Multi-tier applications (web-app-db) fail when inter-tier networks are disabled, breaking functionality even when instances are healthy.Recommendation
Enable admin state on all production networks unless there is a documented maintenance window. Implement change management procedures to track network administrative state changes and ensure re-enablement after maintenance. Use monitoring alerts to detect when networks remain disabled longer than expected.Remediation
- CLI
- Terraform
- Dashboard steps
openstack network set —enable <network_id>
References
Where this check fires
This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable byCheck ID = networking_admin_state_down. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks