Return-Path: X-Original-To: apmail-cloudstack-issues-archive@www.apache.org Delivered-To: apmail-cloudstack-issues-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 5CCF510654 for ; Mon, 27 Apr 2015 11:01:40 +0000 (UTC) Received: (qmail 83426 invoked by uid 500); 27 Apr 2015 11:01:40 -0000 Delivered-To: apmail-cloudstack-issues-archive@cloudstack.apache.org Received: (qmail 83387 invoked by uid 500); 27 Apr 2015 11:01:40 -0000 Mailing-List: contact issues-help@cloudstack.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@cloudstack.apache.org Delivered-To: mailing list issues@cloudstack.apache.org Received: (qmail 83371 invoked by uid 500); 27 Apr 2015 11:01:40 -0000 Delivered-To: apmail-incubator-cloudstack-issues@incubator.apache.org Received: (qmail 83367 invoked by uid 99); 27 Apr 2015 11:01:40 -0000 Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 27 Apr 2015 11:01:40 +0000 Date: Mon, 27 Apr 2015 11:01:39 +0000 (UTC) From: "Rohit Yadav (JIRA)" To: cloudstack-issues@incubator.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Commented] (CLOUDSTACK-1633) Why do ACS security groups only support TCP, UDP, ICMP? MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/CLOUDSTACK-1633?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14513915#comment-14513915 ] Rohit Yadav commented on CLOUDSTACK-1633: ----------------------------------------- [~jlkinsel] ping? > Why do ACS security groups only support TCP, UDP, ICMP? > ------------------------------------------------------- > > Key: CLOUDSTACK-1633 > URL: https://issues.apache.org/jira/browse/CLOUDSTACK-1633 > Project: CloudStack > Issue Type: Improvement > Security Level: Public(Anyone can view this level - this is the default.) > Affects Versions: 4.0.0 > Reporter: John Kinsella > Assignee: John Kinsella > Fix For: 4.4.3 > > > If I attempt to make an API call to authorizeSecurityGroupIngress specifying a protocol of "41," I get an error of "Invalid protocol 41." > Real-world use for this - Windows AD servers attempt to establish an ISATAP[1] connection between servers. Without opening the firewall, packets will be dropped as shown in the log below: > Mar 11 19:07:27 c10 kernel: DROP:i-2-1711-VM-eg:IN=cloudbr0 OUT=cloudbr0 PHYSIN=vnet2 PHYSOUT=bond1 MAC=00:04:e9:ff:f3:90:06:c5:36:00:00:1a:0f:00 SRC=192.168.1.10 DST=192.168.1.20 LEN=68 TOS=0x00 PREC=0x00 TTL=128 ID=2898 PROTO=41 > 1:http://en.wikipedia.org/wiki/ISATAP -- This message was sent by Atlassian JIRA (v6.3.4#6332)