[
https://issues.apache.org/jira/browse/CLOUDSTACK-1292?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sanjeev N closed CLOUDSTACK-1292.
---------------------------------
Verified on latest 4.1build: commit ccc51147a54ff3d0362b233914c1580de52696c1
Test Passed
> [F5-SRX-InlineMode] Update network from SRX,F5 as service provideds to VR as
> service provider does not delete firewall rules from SRX
> -------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CLOUDSTACK-1292
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-1292
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Components: Network Controller
> Affects Versions: 4.1.0
> Environment: ASF 4.1 latest build
> Reporter: Sanjeev N
> Assignee: Sheng Yang
> Priority: Critical
> Fix For: 4.1.0
>
> Attachments: vmops.rar
>
>
> [F5-SRX-InlineMode] Update network from SRX,F5 as service provideds to VR as
> service provider does not delete firewall rules from SRX
> Reproduction method:
> =================
> 1. . Create a NO1 using SRX for PF,Static NAT, Source Nat (Zone wide) and F5
> for LB(inline mode) and rest of the services are provided by VR.
> 2. Add SRX device.
> 3. Add F5 device
> 4. Add a user account.
> 5. Deploy the few VMs using the above created NO.
> 6. Acquire an Ip addresses.
> 7. Create Pf rule.Open firewall.
> 8. Create LB rule.Open firewall.
> 9. Create Static NAT.Open firewall.
> Steps:
> 1. Create a NO2 using VR as service provider for all services.
> 2. Update NO1 to NO2.
> Test Result:
> =========
> Firewall rules from SRX are not deleted after update network from network
> offering NO1 to NO2
> Expected Result:
> =============
> Firewall rules in untrust filter should be deleted from SRX
> Observations:
> ==========
> When network was implemented with network offering NO1, firewall rules were
> created on SRX to allow traffic from untrust zone.
> IPs allocated in this network are:
> mysql> select public_ip_address , network_id from user_ip_address where
> network_id=204;
> +-------------------+------------+
> | public_ip_address | network_id |
> +-------------------+------------+
> | 10.147.48.21 | 204 |
> | 10.147.48.26 | 204 |
> | 10.147.48.28 | 204 |
> | 10.147.48.29 | 204 |
> +-------------------+------------+
> 4 rows in set (0.21 sec)
> Output from SRX after network update from NO1 to NO2(All other configuration
> related to this netowrk was erased from SRX except the below firewall rules
> after network update):
> root# show firewall filter untrust term 10-147-48-21-10
> from {
> source-address {
> 0.0.0.0/0;
> }
> destination-address {
> 10.147.48.21/32;
> }
> protocol tcp;
> destination-port 1-65535;
> }
> then {
> count 10-147-48-21-i;
> accept;
> }
> [edit]
> root# show firewall filter untrust term 10-147-48-26-7
> from {
> source-address {
> 0.0.0.0/0;
> }
> destination-address {
> 10.147.48.26/32;
> }
> protocol tcp;
> destination-port 1-65535;
> }
> then {
> count 10-147-48-26-i;
> accept;
> }
> [edit]
> root# show firewall filter untrust term 10-147-48-28-9
> from {
> source-address {
> 0.0.0.0/0;
> }
> destination-address {
> 10.147.48.28/32;
> }
> protocol tcp;
> destination-port 1-65535;
> }
> then {
> count 10-147-48-28-i;
> accept;
> }
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
