def _add_firewall_rule(self, context, fwp_tenant_id, **fwr):
        """
        :param obj:
        :param context:
        :param kwargs: dictionary, firewall rule
        firewall_rule: {'source_ip_address': u'192.176.10.0/24',... }
        :return:
        """
        LOG.debug("# _add_firewall_rule() called")
        namespace = fortinet_db.Fortinet_ML2_Namespace.query_one(
            context, tenant_id=fwp_tenant_id)
        vdom = getattr(namespace, 'vdom', None)
        if not vdom or not fwr:
            return None
        inf_int, inf_ext = utils.get_vlink_intf(
            self, context, vdom=namespace.vdom)
        srcaddr = self._add_fwr_ip_address(
            context, vdom, place='source_ip_address', **fwr)
        dstaddr = self._add_fwr_ip_address(
            context, vdom, place='destination_ip_address', **fwr)
        service = self._add_fwr_service(context, vdom, **fwr)
        action = self._get_fwr_action(**fwr)
        profiles = self._get_fwp_profiles(action)
        match_vip = 'enable'
        name = fwr.get('name', '')
        # add a basic firewall rule('accept': incoming, 'deny': bidirectional)
        fortinet_fwp = utils.add_fwpolicy_to_head(self, context,
                                                  vdom=vdom,
                                                  srcaddr=srcaddr['name'],
                                                  srcintf='any',
                                                  dstaddr=dstaddr['name'],
                                                  dstintf='any',
                                                  service=service['name'],
                                                  match_vip=match_vip,
                                                  action=action,
                                                  comments=name,
                                                  **profiles)
        utils.add_record(self, context,
                         fortinet_db.Fortinet_FW_Rule_Association,
                         fwr_id=fwr['id'],
                         fortinet_pid=fortinet_fwp.id,
                         type=constants.TYPE_INT)

        if action in ['accept']:
            # if allow, for the outgoing traffic it need to enable nat
            fortinet_fwp = utils.add_fwpolicy_to_head(self, context,
                                                      vdom=vdom,
                                                      srcaddr=srcaddr['name'],
                                                      srcintf='any',
                                                      dstaddr=dstaddr['name'],
                                                      dstintf=inf_int,
                                                      nat='enable',
                                                      service=service['name'],
                                                      action=action,
                                                      comments=name,
                                                      **profiles)
            utils.add_record(self, context,
                             fortinet_db.Fortinet_FW_Rule_Association,
                             fwr_id=fwr['id'],
                             fortinet_pid=fortinet_fwp.id,
                             type=constants.TYPE_EXT)
    def _allocate_floatingip(self, context, obj):
        """
        1. mapping floatingip to the one of a pair of internal ips based on
           the vip function.
        2. add another ip of the ip pair to the secondaryip list of
           the external interface.

        obj example:
        {
            'floating_network_id': u'1c1dbecc-9dac-4311-a346-f147a04c8dc8',
            'router_id': None,
            'fixed_ip_address': None,
            'floating_ip_address': u'10.160.37.113',
            'tenant_id': u'3998b33381fb48f694369689065a3760',
            'status': 'DOWN',
            'port_id': None,
            'id': '5ec1b08b-77c1-4e39-80ac-224ee937ee9f'
        }

        The floatingip is a instance of neutron.db.l3_db.FloatingIP, example:
        {
            tenant_id=u'3998b33381fb48f694369689065a3760',
            id=u'25e1588a-5ec5-4fbc-bdef-eff8713da8f8',
            floating_ip_address=u'10.160.37.111',
            floating_network_id=u'1c1dbecc-9dac-4311-a346-f147a04c8dc8',
            floating_port_id=u'4b4120d4-77f9-4f82-b823-05876929a1c4',
            fixed_port_id=None,
            fixed_ip_address=None,
            router_id=None,
            last_known_router_id=None,
            status=u'DOWN'
        }
        """
        with context.session.begin(subtransactions=True):
            try:
                db_namespace = utils.add_vdom(self, context,
                                              tenant_id=obj['tenant_id'])

                db_fip = utils.add_record(self, context,
                                fortinet_db.Fortinet_FloatingIP_Allocation,
                                vdom=db_namespace.vdom,
                                floating_ip_address=obj['floating_ip_address'],
                                vip_name=obj['floating_ip_address'])
                mappedip = utils.get_ipaddr(db_fip.ip_subnet, 0)
                utils.add_vip(self, context,
                              vdom=const.EXT_VDOM,
                              name=db_fip.vip_name,
                              extip=db_fip.floating_ip_address,
                              extintf='any',
                              mappedip=mappedip)

                int_intf, ext_intf = utils.get_vlink_intf(self, context,
                                                       vdom=db_namespace.vdom)

                utils.add_fwpolicy(self, context,
                                   vdom=const.EXT_VDOM,
                                   dstintf=ext_intf,
                                   dstaddr=db_fip.vip_name,
                                   nat='enable')

                utils.add_routerstatic(self, context,
                                       vdom=const.EXT_VDOM,
                                       dst="%s 255.255.255.255" % mappedip,
                                       device=ext_intf,
                                       gateway=const.DEF_GW)

                utils.add_fwippool(self, context,
                                   name=db_fip.floating_ip_address,
                                   vdom=const.EXT_VDOM,
                                   startip=db_fip.floating_ip_address)

                utils.add_fwaddress(self, context,
                                    name=mappedip,
                                    vdom=const.EXT_VDOM,
                                    subnet="%s 255.255.255.255" % mappedip)

                db_fwpolicy = utils.add_fwpolicy(self, context,
                                   vdom=const.EXT_VDOM,
                                   srcintf=ext_intf,
                                   srcaddr=mappedip,
                                   dstintf=self._fortigate['ext_interface'],
                                   poolname=db_fip.floating_ip_address)
                utils.head_firewall_policy(self, context,
                                           vdom=const.EXT_VDOM,
                                           id=db_fwpolicy.edit_id)

                utils.add_fwippool(self, context,
                                   name=mappedip,
                                   vdom=db_namespace.vdom,
                                   startip=mappedip)
            except Exception as e:
                with excutils.save_and_reraise_exception():
                    utils._rollback_on_err(self, context, e)
        utils.update_status(self, context, t_consts.TaskStatus.COMPLETED)