Hi, Reflect is not evaluated across multiple interfaces, both ACLs must be on the same interface. Mentally you can imagine like a tiny firewall attached sitting inline with the VPP interface.
You can look at the test/test_acl_plugin*.py files which are the unit tests for more specifics on how it is configured and tested. --a > On 8 May 2017, at 13:59, mahmood gholipour <[email protected]> > wrote: > > Hi, > > I tested statefull ACL by writing an ACL rule with action of permit+reflect > and it didn't work. Is this feature completed in 17.04 and is expected to > work properly? > I define one deny ACL rule and set it as inbound ACL for interface B and also > define a permit+reflect ACL rule and set it as inbound ACL for interface A. I > expected a ssh session to be established successfully. In this scenario > interface A is ingress interface and interface B is egress interface. But > packets are dropped by inbound ACL on interface B. > > Best Regards, > > -- > Mahmood Gholipour > M.Sc Candidate, > School of Electrical and Computer Engineering, > College of Engineering, > University of Tehran > > > > > _______________________________________________ > vpp-dev mailing list > [email protected] > https://lists.fd.io/mailman/listinfo/vpp-dev
_______________________________________________ vpp-dev mailing list [email protected] https://lists.fd.io/mailman/listinfo/vpp-dev
