Build 2710 : Port mirroring not working when svc template v2 is used

[Ankit Jain]

Steps:

1) Create a template

pt_template - v2
Transparent
Analyzer
Left
analyzer / m1.medium

Details

    Name pt_template
    Display Name pt_template
    UUID b67f6e41-6bab-4c0d-9401-8df6b934b68e
    Version 2
    Mode Transparent
    Type Analyzer
    Scaling Enabled
    Availability Zone Enabled
    Interface Type (s) Left
    Image analyzer
    Flavor m1.medium
    Virtualization Type Virtual Machine
    Service Instances admin:pminstance

2. Launch an analyzer instance
pmsvm
 analyzer

    1.1.1.252
    1.1.1.250

 m1.medium -

bc4b5875-29df-4ed6-9a40-9a9f397226af
left_vn
1.1.1.252
1.1.1.250
-
compute:None

3. Use the above port tuple to launch svc instance pminstance with the template created in step1
pminstance
pt_template (transparent, version 2)
  Inactive
-
UmGDhLy2KJYJnz9n

4. Create a policy pt_policy

pt_policy
left_vn
pass protocol any network left_vn ports any <> network right_vn ports any mirror pminstance
Policy Detail

    Display Name pt_policy
    UUID 513b7569-ad6a-4b2d-996a-b0b5f9f25a47
    Connected networks left_vn
    Rules pass protocol any network left_vn ports any <> network right_vn ports any mirror pminstance

5 .Launch left_vm and right_vm
 ubuntu

    1.1.1.249

right_vm
 ubuntu

    1.1.1.251

Traffic from left_vm to right_vm should be mirrored to analyzer instance pmsvm

Also, service instance is inactive in the UI

pminstance
pt_template (transparent, version 2)
  Inactive
-
UmGDhLy2KJYJnz9n

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/16919
Submitter: Sachin Bansal (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/16919
Committed: http://github.org/Juniper/contrail-controller/commit/8025eee0a78bea65717b44710ce41187b7a7c5a9
Submitter: Zuul
Branch: master

commit 8025eee0a78bea65717b44710ce41187b7a7c5a9
Author: Sachin Bansal <email address hidden>
Date: Fri Feb 5 09:59:20 2016 -0800

Use correct variable name

Change-Id: I2689a2a85bbcaf36e278cda3476460c1ca5fa11e
Closes-Bug: 1542311

[Ankit Jain (ankitja)]

With this above fix, problem did not get solved.

When I configured mirroring using policy between two VNs, I see the following ACL rules in the agent if map introspect
type:access-control-list name:default-domain:admin:my_vn1:my_vn1 access-control-list-entries dynamic:false acl-rule match-condition protocol:any src-address subnet ip-prefix-len:0 virtual-network:any src-port start-port:-1 end-port:-1 dst-address subnet ip-prefix-len:0 virtual-network:any dst-port start-port:-1 end-port:-1 action-list simple-action:pass mirror-to analyzer-name:default-domain:admin:svctest2 udp-port:0 log:false alert:false rule-uuid:b7f5ffdb-0423-4d5d-bb46-d82394874d10 id-perms permissions owner:cloud-admin owner-access:7 group:cloud-admin-group group-access:7 other-access:7 uuid uuid-mslong:5973287049156316904 uuid-lslong:10391912417391903427 Uuid : 52e560ec-6267-4ee8-9037-7d48ef9d82c3 enable:true created:2016-02-09T06:01:45 last-modified:2016-02-09T10:57:08 user-visible:true perms2 owner-access:7 global-access:0 display-name:my_vn1 Adjacencies: virtual-network default-domain:admin:my_vn1
type:access-control-list name:default-domain:admin:my_vn2:my_vn2 access-control-list-entries dynamic:false acl-rule match-condition protocol:any src-address subnet ip-prefix-len:0 virtual-network:any src-port start-port:-1 end-port:-1 dst-address subnet ip-prefix-len:0 virtual-network:any dst-port start-port:-1 end-port:-1 action-list simple-action:pass mirror-to analyzer-name:default-domain:admin:svctest2 udp-port:0 log:false alert:false rule-uuid:b7f5ffdb-0423-4d5d-bb46-d82394874d10 id-perms permissions owner:cloud-admin owner-access:7 group:cloud-admin-group group-access:7 other-access:7 uuid uuid-mslong:7208681036659835273 uuid-lslong:10652992244752191557 Uuid : 640a6135-a934-4189-93d7-08012f721045 enable:true created:2016-02-09T06:01:50 last-modified:2016-02-09T10:57:08 user-visible:true perms2 owner-access:7 global-access:0 display-name:my_vn2 Adjacencies: virtual-network default-domain:admin:my_vn2

this shows only “simple-action:pass mirror-to analyzer-name:default-domain:admin:svctest2 udp-port:0
there is no service instance IP, port info etc in these rules

please check if this is due to any schema issue
Setup @ nodeg13

[Sachin Bansal (sbansal)]

I wasn't able to recreate this on build 2714. Please leave the setup to debug if you are still seeing the issue.

[Ankit Jain (ankitja)]

It's working on the latest build 2715