SFC terminating service action matches by a fixed tunnel key of 0, and classifier needs to ensure this is properly set. Currently, the classifier is not rewriting the tunnel key, thus the tunnel key set by netvirt related to the original destination of the packet remains.

This is a sample of the ACL flow where the tunnel key would be set but is not:

cookie=0xf005ba1100000002, duration=989.743s, table=101, n_packets=7, n_bytes=518, priority=500,tcp,in_port=2,nw_src=10.0.0.0/24,tp_dst=80 actions=push_nsh,load:0x1->NXM_NX_NSH_MDTYPE[],load:0x3->NXM_NX_NSH_NP[],load:0x8->NXM_NX_NSP[0..23],load:0xff->NXM_NX_NSI[],load:0->NXM_NX_NSH_C1[],load:0->NXM_NX_NSH_C2[],load:0xac130002->NXM_NX_REG0[],resubmit(,17)

This is the terminating service action on the SFF:

cookie=0x9000000, duration=1055.050s, table=36, n_packets=422, n_bytes=47686, priority=5,tun_id=0 actions=goto_table:83

This is the terminating service action on the original destination:

cookie=0x9000008, duration=1398.995s, table=36, n_packets=3, n_bytes=182, priority=5,tun_id=0x8 actions=load:0x800->NXM_NX_REG6[],resubmit(,220)

And the vxlan gpe nsh packet:

Virtual eXtensible Local Area Network
Flags: 0x0c
..00 .... = Version: 0
.... 1... = Instance: 1
.... .1.. = Next Protocol Bit: 1
.... ...0 = OAM bit: 0
00.. ..0. = Reserved(R): 0
Reserved: 0
Next Protocol: Ethernet (3)
VXLAN Network Identifier (VNI): 8
Reserved: 0
Ethernet II, Src: 86:18:bf:f5:11:77 (86:18:bf:f5:11:77), Dst: e2:b8:b2:6d:5b:71 (e2:b8:b2:6d:5b:71)
Destination: e2:b8:b2:6d:5b:71 (e2:b8:b2:6d:5b:71)
Address: e2:b8:b2:6d:5b:71 (e2:b8:b2:6d:5b:71)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: 86:18:bf:f5:11:77 (86:18:bf:f5:11:77)
Address: 86:18:bf:f5:11:77 (86:18:bf:f5:11:77)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: Network Service Header (0x894f)
Network Service Header
00.. .... .... .... = Version: 0 (0x0)
..0. .... .... .... = O Bit: 0
...0 .... .... .... = C Bit: 0
.... 0000 00.. .... = Reserved Bits: 0x00
.... .... ..00 0110 = Length: 6 (0x06)
MD Type: 1 (0x01)
Next Protocol: Ethernet (3)
SPI: 8 (0x000008)
SI: 255 (0xff)
Context Header: 00000000
Context Header: 00000008
Context Header: 00000000
Context Header: 00000000