Unable to ping instance created by murano package

[Pradip Rawat]

Hi Everyone,

I am not able to ping instances after deployment of Murano environment. I have verified the security group, ICMP rule is there.
After deleting the ICMP rule and adding once again to security group I am able to ping instances.

Please fix the issue.

[Stan Lagun (slagun)]

why is this a Murano issue? Murano's duty is to add the rule to security group. If they don't work then it is an issue of Neutron. Or am I missing something?

[Lin Yang (lin-a-yang)]

When protocol is ICMP in security group, port_range_min and port_range_max are used to indicate type and code for ICMP.

https://github.com/openstack/murano/blob/master/meta/io.murano/Classes/system/NeutronSecurityGroupManager.yaml#L82
In this case, it will create iptable rule like below

         0 0 RETURN icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 0 code 0

which result in user cannot ping the instance as expected.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/286363

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/286363
Committed: https://git.openstack.org/cgit/openstack/murano/commit/?id=47b406d603821f12f8b4bf49d37969ad08aa4ead
Submitter: Jenkins
Branch: master

commit 47b406d603821f12f8b4bf49d37969ad08aa4ead
Author: Lin Yang <email address hidden>
Date: Tue Mar 1 10:59:06 2016 +0800

    Fix incorrect ICMP rule in SecurityGroup

    When protocol is ICMP in security group, port_range_min and
    port_range_max are used to indicate type and code for ICMP. The
    default port setting in core library generates ICMP rule with
    incorrect setting 'icmptype 0 code 0', which make user cannot ping
    instance created by Murano environment. So removed them.

    Change-Id: I93b5073db2ece804e3eccdde8432216d4fb12301
    Closes-Bug: #1512710

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/murano 2.0.0.0b3 development milestone.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/liberty
Review: https://review.openstack.org/302241

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/302241
Committed: https://git.openstack.org/cgit/openstack/murano/commit/?id=e08969f8106201ff0a338e555534e35f936c71df
Submitter: Jenkins
Branch: stable/liberty

commit e08969f8106201ff0a338e555534e35f936c71df
Author: Lin Yang <email address hidden>
Date: Tue Mar 1 10:59:06 2016 +0800

    Fix incorrect ICMP rule in SecurityGroup

    When protocol is ICMP in security group, port_range_min and
    port_range_max are used to indicate type and code for ICMP. The
    default port setting in core library generates ICMP rule with
    incorrect setting 'icmptype 0 code 0', which make user cannot ping
    instance created by Murano environment. So removed them.

    Change-Id: I93b5073db2ece804e3eccdde8432216d4fb12301
    Closes-Bug: #1512710
    (cherry picked from commit 47b406d603821f12f8b4bf49d37969ad08aa4ead)

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/murano 1.0.3 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/murano 1.0.3 release.