SNAT router port should have port_security_enabled: False
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
Juniper Openstack | Status tracked in Trunk | |||||
R3.1 |
In Progress
|
High
|
Petr Jediný | |||
R3.1.1.x |
In Progress
|
High
|
Petr Jediný | |||
R3.2 |
In Progress
|
High
|
Petr Jediný | |||
R3.2.3.x |
In Progress
|
High
|
Petr Jediný | |||
R4.0 |
In Progress
|
High
|
Petr Jediný | |||
R4.1 |
In Progress
|
High
|
Petr Jediný | |||
Trunk |
In Progress
|
High
|
Petr Jediný |
Bug Description
Issue replication steps:
1) create a private network
2) create a private router and connect it to that network
3) set gateway on the router to be in FIP network
4) create instance A
5) create a new sec group allowing ingress on ports 22, 80 and 443 and egress everywhere to all ports
6) associate that sec group with instance A
(there should be no default Sec Group associated with VM A (only the new one create in step 5)
Expected behavior is to be able to get outside of that instance (traffic should go via router)
Actual behavior is that the VM cannot communicate outside
---
This is caused by port_security_
Btw neutron extension actually sets the default SG on the port but the WebUI will create port with port_security_
---
To workaround this issue: disable port security on the router_interface port.
Neutron/OVS uses similar approach: they consider router interface trusted and are disabling the port security on the port. https:/
Review in progress for https:/ /review. opencontrail. org/39944
Submitter: Petr Jediný (<email address hidden>)