Port security enabled=True is not respected

[Dmitry Ratushnyy]

It is possible to send traffic through port with port_security_enabled=True.

Steps to reproduce.

1) Create three VMS on one network:
    Guest os:
     ubuntu-14.04

    "destination" VM to ping (10.100.0.3)
    "router" VM to send traffic through (10.100.0.2)
    "source" VM that will ping "destination" VM(10.100.0.1)

2) On source VM add route to destination via router ( sudo ip route add 10.100.0.3 via 10.100.0.2)
3) On "router" VM set net.ipv4.ip_forward = 1 (sudo sysctl net.ipv4.ip_forward = 1)
4) On "destination" VM add route to 'source' via router ( sudo ip route add 10.100.0.1 via 10.100.0.2)
5) Start to ping "destination" on "source" VM.
    5.1) Check traffic on all VMs

[Dmitry Ratushnyy (dmitry-ratushnyy)]

6) Check that port on "router" VM has port_security_enabled=True and there is security group attached

[Kevin Benton (kevinbenton)]

Did you confirm that it's not just generating an ICMP redirect?

[Dmitry Ratushnyy (dmitry-ratushnyy)]

I can see ssh traffic from source to destination (and backwards) on router interface.
To check it, I've created two networks.destination server is on another network than source server, and there is no route to destination except through router-server

[Armando Migliaccio (armando-migliaccio)]

This bug is > 172 days without activity. We are unsetting assignee and milestone and setting status to Incomplete in order to allow its expiry in 60 days.

If the bug is still valid, then update the bug status.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]