Configuration failure in CIDR as source and vn/policy as destination.

[Ritam Gangopadhyay]

When CIDR is configured as source and a VN or policy is configured at the destination end of a policy. The configuration is treated as invalid because no VN name is found at the source of the policy. I see the following error:

==> /var/log/contrail/schema.log <==
09/08/2014 04:12:54 PM [nodeg1:Schema:Config:0]: Update network-policy-entries/{'network-policy': 'default-domain:ProjA:Pol13'}/<Element {http://www.contrailsystems.com/vnc_cfg.xsd}network-policy-entries at 0x2db07a0>. Calling 'add_network_policy_entries'.
09/08/2014 04:12:54 PM [nodeg1:Schema:Config:0]: network policy rule attached to default-domain:ProjA:vn1has svn = None, dvn = default-domain:ProjA:vn3. Ignored.

Similarly when the source is a CIDR and destination is a policy - PolA which is attached to vn3, the error says:

==> /var/log/contrail/schema.log <==
09/08/2014 04:32:39 PM [nodeg1:Schema:Config:0]: Update network-policy-entries/{'network-policy': 'default-domain:ProjA:Pol13'}/<Element {http://www.contrailsystems.com/vnc_cfg.xsd}network-policy-entries at 0x2d94cf8>. Calling 'add_network_policy_entries'.
09/08/2014 04:32:39 PM [nodeg1:Schema:Config:0]: network policy rule attached to default-domain:ProjA:vn1has src = None, dst = default-domain:ProjA:PolA. Ignored.

This is how the configured policy looks like:

Pol13 ---------- attached to ------ vn1
rule1 -------- deny protocol icmp 10.1.1.2/32 ports any <> network vn3 ports any
rule2 -------- pass protocol any network vn1 ports any <> network vn3 ports any

[Sachin Bansal (sbansal)]

This is working as designed. For policy rules to be applied to a VN, the attached VN must be present in either source or destination. In this case, dest VN is vn3, while you are attaching it to vn1, hence the rule is ignored. You will see the same behavior if you configure it with src as vn3 and cidr as destination.