Details
-
Bug
-
Status: Resolved
-
Resolution: Done
-
Boron
-
None
-
None
-
Operating System: All
Platform: All
-
7020
Description
Create multiple security groups (SG) with some common rules and associated both the SG's with the VM. Flow entries are created for SG rules and ping works.
When user dissociates any one of the SG from VM, flow entries corresponding to the common rules are getting deleted from the flow table and traffic fails.
Steps to reproduce:
-------------------
1. Create two SG's (sg1 and sg2) have some common rules. Below are two icmp rules common in both sg1 and sg2.
| sg1 | egress, IPv4, icmp, remote_ip_prefix: 0.0.0.0/0 |
| ingress, IPv4, icmp, remote_ip_prefix: 0.0.0.0/0 | |
| sg2 | egress, IPv4, icmp, remote_ip_prefix: 0.0.0.0/0 |
| ingress, IPv4, 80/tcp, remote_ip_prefix: 0.0.0.0/0 | |
| ingress, IPv4, icmp, remote_ip_prefix: 0.0.0.0/0 |
2. Create network, subnet
3. Create VM1 with sg1 and sg2. Verify flows
4. Dissociate sg2 from VM1
Observation:
--------------
Flow entries corresponding to icmp rules are deleted from table 41 and 252.
Expected behavior:
------------------
Since VM1 has one more SG (sg1) associated, flow entries corresponding to icmp rules should exist in table 41 and 252.
Attachments
Issue Links
- is duplicated by
-
NETVIRT-225 SG - Delete Security group influence of existing rules
- Resolved