vRouter discards packets if svc-chain cfgd between FIP VNs

[amit surana]

Unable to setup service-chain between floating IPs of two VMs. The floating IPs for each VM comes from different FIP pools.

left_vm——left_vn—left_fip_vn———SC———right_fip_vn—right_vn——right_vm

Left_vm pings right VMs FIP. The echo request packet is dropped by the vRouter hosting the right_vm. The vrf translate looks to be wrong. The incoming packet belongs to vrf 1 and the vrf translate says go to vrf 20.
Post DNAT (6.1.2.3 to 5.1.2.3), there is no route for 5.1.2.3 in vrf 20 (which is the FIP vrf). The vrf translate should've been 1->1.

left_vm: 5.1.1.6, FIP: 6.1.1.6
right_vm: 5.1.2.3, FIP: 6.1.2.3

listening on bond0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:42:17.756356 90:e2:ba:5e:a0:04 > 90:e2:ba:4c:67:f8, ethertype IPv4 (0x0800), length 126: 172.16.180.13 > 172.16.180.15: GREv0, proto MPLS unicast (0x8847), length 92: MPLS (label 76, exp 0, [S], ttl 61) 6.1.1.6 > 6.1.2.3: ICMP echo request, id 9229, seq 19305, length 64
13:42:18.764439 90:e2:ba:5e:a0:04 > 90:e2:ba:4c:67:f8, ethertype IPv4 (0x0800), length 126: 172.16.180.13 > 172.16.180.15: GREv0, proto MPLS unicast (0x8847), length 92: MPLS (label 76, exp 0, [S], ttl 61) 6.1.1.6 > 6.1.2.3: ICMP echo request, id 9229, seq 19306, length 64
^C
2 packets captured
3 packets received by filter
0 packets dropped by kernel
root@csol2-node15:~#
root@csol2-node15:~#
root@csol2-node15:~# mpls --get 76
MPLS Input Label Map

   Label NextHop
-------------------
      76 201
root@csol2-node15:~# nh --get 201
Id:201 Type:Encap Fmly: AF_INET Rid:0 Ref_cnt:6 Vrf:1
              Flags:Valid, Policy,
              EncapFmly:0806 Oif:3 Len:14
              Encap Data: 02 34 77 2c 39 68 00 00 5e 00 01 00 08 00

root@csol2-node15:~# flow -l | grep 6.1.1.6 -C2
    Index Source:Port/Destination:Port Proto(V)
-----------------------------------------------------------------------------------
       72<=>412228 6.1.1.6:9229 1 (1->20)
                         6.1.2.3:0
(Gen: 8, K(nh):201, Action:N(D), Flags:, S(nh):47, Stats:19331/1623804, SPort 50395)
--

   412228<=>72 5.1.2.3:9229 1 (1->20)
                         6.1.1.6:0
(Gen: 6, K(nh):201, Action:N(S), Flags:, S(nh):201, Stats:0/0, SPort 64393)

[amit surana (asurana-t)]

The vrf translate looks to be wrong. The incoming packet falls in vrf 1 and the vrf translate says go to vrf 20. Post DNAT (6.1.2.3 to 5.1.2.3), there is no route for 5.1.2.3 in vrf 20 (which is the FIP vrf) and so the packet is discarded. The vrf translate should've been
1->1.

Furthermore:

1) This bug is seen even if the source VM is in the left_fip_vn (meaning, not NAT for source VM).
2) This bug is only seen if there is a service-chain connecting right_fip_vn and left_fip_vn. If the two VNs are connected via a regular network policy, the vrf translate rule is setup correctly on the destination compute.

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/18812
Submitter: Naveen N (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/18813
Submitter: Naveen N (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/19104
Submitter: Naveen N (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/19104
Committed: http://github.org/Juniper/contrail-controller/commit/ab3ec285b9a3d4635530522fa488367cab944fb8
Submitter: Zuul
Branch: master

commit ab3ec285b9a3d4635530522fa488367cab944fb8
Author: Naveen N <email address hidden>
Date: Wed Apr 6 14:35:47 2016 +0530

Apply VRF translate rule for DNAT traffic
In case of multiple service chain policy RPF
has to be calculated after applying VRF translation rule.
Test case for same.
Add a check to see if mirror index exists before accessing the same.
Closes-bug:#1561775

Change-Id: Iea4a788bba2968f6ab7699d815080264cb437e1e

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/19242
Submitter: Naveen N (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/19242
Committed: http://github.org/Juniper/contrail-controller/commit/5f6ce1a0379301a57539f22c0237bbb99fa322a1
Submitter: Zuul
Branch: master

commit 5f6ce1a0379301a57539f22c0237bbb99fa322a1
Author: Naveen N <email address hidden>
Date: Tue Apr 12 15:18:48 2016 +0530

* Fix mirror index not being programmed in ksync

Change-Id: I8bab3c02cda8779574e0c9a75abd30b2ac3d2fa5
Closes-bug:#1561775

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/19311
Submitter: Naveen N (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/19311
Committed: http://github.org/Juniper/contrail-controller/commit/032aa597f88fcd1e7e4aa0f5395f66751158ab7d
Submitter: Zuul
Branch: R3.0

commit 032aa597f88fcd1e7e4aa0f5395f66751158ab7d
Author: Naveen N <email address hidden>
Date: Fri Apr 15 12:19:20 2016 +0530

Apply VRF translate rule for DNAT traffic

In case of multiple service chain policy RPF
has to be calculated after applying VRF translation rule.
Test case for same.
Add a check to see if mirror index exists before accessing the same.
Closes-bug:#1561775

Change-Id: I6b0f3d9bda8fd39829091c2706fcfe4fe6a56a2f