Mailing-List: contact cloudstack-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: cloudstack-dev@incubator.apache.org
Date: Fri, 15 Feb 2013 11:19:12 +0000 (UTC)
From: "Sanjeev N (JIRA)" <jira@apache.org>
To: cloudstack-dev@incubator.apache.org
Message-ID: <JIRA.12632565.1360926894829.292652.1360927152692@arcas>
In-Reply-To: <JIRA.12632565.1360926894829@arcas>
References: <JIRA.12632565.1360926894829@arcas>
Subject: [jira] [Updated] (CLOUDSTACK-1292) [F5-SRX-InlineMode] Update
 network from SRX,F5 as service provideds to VR as service provider does not
 delete firewall rules from SRX
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


     [ https://issues.apache.org/jira/browse/CLOUDSTACK-1292?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Sanjeev N updated CLOUDSTACK-1292:
----------------------------------

    Attachment: vmops.rar

Attached vmops.log file
                
> [F5-SRX-InlineMode] Update network from SRX,F5 as service provideds to VR as service provider does not delete firewall rules from SRX
> -------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CLOUDSTACK-1292
>                 URL: https://issues.apache.org/jira/browse/CLOUDSTACK-1292
>             Project: CloudStack
>          Issue Type: Bug
>      Security Level: Public(Anyone can view this level - this is the default.) 
>          Components: Network Controller
>    Affects Versions: 4.1.0
>         Environment: ASF 4.1 latest build
>            Reporter: Sanjeev N
>            Assignee: Sheng Yang
>            Priority: Critical
>             Fix For: 4.1.0
>
>         Attachments: vmops.rar
>
>
> [F5-SRX-InlineMode] Update network from SRX,F5 as service provideds to VR as service provider does not delete firewall rules from SRX
> Reproduction method:
> =================
> 1. . Create a NO1 using SRX for PF,Static NAT, Source Nat (Zone wide) and F5 for LB(inline mode) and rest of the services are provided by VR.
> 2. Add SRX device.
> 3. Add F5 device 
> 4. Add a user account.
> 5. Deploy the few VMs using the above created NO.
> 6. Acquire an Ip addresses.
> 7. Create Pf rule.Open firewall.
> 8. Create LB rule.Open firewall.
> 9. Create Static NAT.Open firewall.
> Steps:
>  1. Create a NO2 using VR as service provider for all services.
> 2. Update NO1 to NO2.
> Test Result:
> =========
> Firewall rules from SRX are not deleted after update network from network offering NO1 to NO2
> Expected Result:
> =============
> Firewall rules in untrust filter should be deleted from SRX
> Observations:
> ========== 
> When network was implemented with network offering NO1, firewall rules were created on SRX to allow traffic from untrust zone. 
> IPs allocated in this network are:
> mysql> select public_ip_address , network_id from user_ip_address where network_id=204;
> +-------------------+------------+
> | public_ip_address | network_id |
> +-------------------+------------+
> | 10.147.48.21      |        204 |
> | 10.147.48.26      |        204 |
> | 10.147.48.28      |        204 |
> | 10.147.48.29      |        204 |
> +-------------------+------------+
> 4 rows in set (0.21 sec)
> Output from SRX after network update from NO1 to NO2(All other configuration related to this netowrk was erased from SRX except the below firewall rules after network update):
> root# show firewall filter untrust term 10-147-48-21-10
> from {
>     source-address {
>         0.0.0.0/0;
>     }
>     destination-address {
>         10.147.48.21/32;
>     }
>     protocol tcp;
>     destination-port 1-65535;
> }
> then {
>     count 10-147-48-21-i;
>     accept;
> }
> [edit]
> root# show firewall filter untrust term 10-147-48-26-7
> from {
>     source-address {
>         0.0.0.0/0;
>     }
>     destination-address {
>         10.147.48.26/32;
>     }
>     protocol tcp;
>     destination-port 1-65535;
> }
> then {
>     count 10-147-48-26-i;
>     accept;
> }
> [edit]
> root# show firewall filter untrust term 10-147-48-28-9
> from {
>     source-address {
>         0.0.0.0/0;
>     }
>     destination-address {
>         10.147.48.28/32;
>     }
>     protocol tcp;
>     destination-port 1-65535;
> }
> then {
>     count 10-147-48-28-i;
>     accept;
> }

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira