Operating System: All
Platform: All

This looks like same issue i've been debugging for Openstack tempest scenario tests of networking-odl.

The test_network_basic_ops.TestNetworkBasicOps.test_network_basic_ops
test was failing due to not being able to ping the DHCP namespace.

See gerrit:

https://git.opendaylight.org/gerrit/48301
NETVIRT-258 - VM to DHCP ping not working with default SG

for a patch which allows the test to pass.

I have observed in my setup, that the DCHP port has 'port_security_enabled' set to False. It was created that way by Neutron.

Whereas, the VM port has 'port_security_enabled' and the default security groups.

Since the DHCP port does not have a security group, it does not match the remote security group of the default ingress rule for the VM port. Therefore, the ping replies from the DHCP port to the VM are dropped. That appears to be what is happening now.

I suppose the correct default behavior should be that the VM port should accept ingress traffic from other members of the VM's default security group 'AND' ports on the same tenant network with port security disabled.

That is based on the assumptions that:
1. neutron setting dhcp port security to disabled is correct and intended
2. tempest scenario tests that do this type of ping from vm to dhcp port without adding any additional security group rules are expected to pass (e.g. tempest.scenario.test_network_basic_ops.TestNetworkBasicOps.test_hotplug_nic)

Any thoughts or comments?

This is my first dive into security group details, so not sure my understanding is fully correct yet.

fixed in
Boron : https://git.opendaylight.org/gerrit/#/c/48720/
Master: https://git.opendaylight.org/gerrit/#/c/49008/