[NETVIRT-92] Restart to an VM instance in OpenStack bypass ACL flows

Thu, 3 May 2018 14:37:01 +0000

I have created 3 instances on a private network in OpenStack, without router (so i'm not using the L3 pipeline). Two instances on one compute and the third instance on a different compute.
All instances received IP from the DHCP server as part of the boot process.

I have observed that there is no ping from the DHCP to the instances (and between themselves).
After debugging the flows I saw that the packets were droped in table 251 (ACL table).

Restart to an instance (in the OpenStack GUI), causes the flows in table 220 to change their actions and instead of a goto table 251 instruction, now there is an output to a port, which causes the ping to pass (both request and reply).

Same thing for an instance on a different compute. I had ran ping from the DHCP server to an instance in different compute, a restart to the instance had cause the flows in the remote ovs to bypass the ACL table also.

OpenDaylight JIRA

[NETVIRT-92] Restart to an VM instance in OpenStack bypass ACL flows