[apic-mapping] Contract doesn't take effect when same classifier is used in both redirect and allow rule

[vks1]

Created TCP and ICMP wildcard classifier. Attached TCP classifier to REDIRECT and ALLOW rule. Create a external consumer and provider which consumes and provides same PRS respectively. ICMP traffic between consumer and provider works fine but TCP traffic doesn't reach to TAP interface of head of chain.

After debugging it show the contract doesn't take effect in ACI.

[Ivar Lazzaro (mmaleckk)]

Can you verify that this works if only ONE action is set in the policy rule? (In this case, only REDIRECT, which implicitly means allow).

[vks1 (vikash-kumar)]

Yes it worked if we remove the rule from ACTION and allow only the rule in REDIRECT.

[Magesh GV (magesh-gv)]

Had a discussion with Mandeep, we should not allow creating the PRS with this overlap if it is not supported on APIC.