Juniper Openstack

Device Manager: Firewall filter generated for Piublic VRF doesn't have have the from clause in term t1 to redirect the traffic

Bug #1446020 reported by Suresh Balineni on 2015-04-19

This bug affects 1 person

	Status	Importance	Assigned to	Milestone
Juniper Openstack	Status tracked in Trunk
R2.20	Fix Committed	High	Suresh Balineni	Juniper Openstack r2.20-fcs
Trunk	Fix Committed	High	Suresh Balineni	Juniper Openstack r3.0-fcs

Bug Description

When public VRF is configured with floating ip pool, we need to generate firewall filters with destination addresses.
Config as follows:

root@a5-mx80-1# show routing-instances nsheth-public
instance-type vrf;
vrf-target target:64512:7;
vrf-table-label;
routing-options {
    static {
        /* subnet for the public vn */
        route 192.168.7.0/24 discard;
        /* default route points to inet.0 */
        route 0.0.0.0/0 next-table inet.0;
    }
}

root@a5-mx80-1# show forwarding-options
family inet {
    filter {
        input redirect-to-public-vrf;
    }
}

root@a5-mx80-1# show firewall
filter redirect-to-public-vrf {
    term t1 {
        from {
            destination-address {
                192.168.7.0/24;
            }
        }
        then {
            routing-instance nsheth-public;
        }
    }
    term t2 {
        then accept;
    }
}

root@a5-mx80-1# show routing-instances nsheth-public | display set
set routing-instances nsheth-public instance-type vrf
set routing-instances nsheth-public vrf-target target:64512:7
set routing-instances nsheth-public vrf-table-label
set routing-instances nsheth-public routing-options static route 192.168.7.0/24 discard
set routing-instances nsheth-public routing-options static route 0.0.0.0/0 next-table inet.0

root@a5-mx80-1# show forwarding-options | display set
set forwarding-options family inet filter input redirect-to-public-vrf

[edit]
root@a5-mx80-1# show firewall | display set
set firewall filter redirect-to-public-vrf term t1 from destination-address 192.168.7.0/24
set firewall filter redirect-to-public-vrf term t1 then routing-instance nsheth-public
set firewall filter redirect-to-public-vrf term t2 then accept

[edit]
root@a5-mx80-1#

We ran into a problem with the configuration generated for public VRF.
The firewall filter we generate to redirect the traffic doesn't have have the
from clause in term t1 (refer to the manually configured example below).

The from clause should have a list of destination addresses where each
entry in the list is the subnet for a floating-ip pool. We had configured a
public network subnet and with the external flag set. So there was a FIP
pool in our configuration.

Could you please investigate further and fix it? Please verify that the fix
works in case there's 1 pool or > 1 pool.

If for whatever reason there's no FIP pools, then it would be best to make
the code defensive and not generate term t1 at all. Generating it with an
empty from clause causes loss of connectivity to the MX - that's very bad.

-Nischal

Tags:

Suresh Balineni (sbalineni) on 2015-04-19

Changed in juniperopenstack:
importance:	Undecided → High

Nischal Sheth (nsheth) on 2015-04-20

tags:

added: config device-manager