Steps to reproduce this bug:
#1 Create network net0 with subnet subnet0
openstack network create --share net0
openstack subnet create subnet0 --ip-version 4 --gateway 10.10.0.1 --network net0 --subnet-range 10.10.0.0/24
#2 Create router router0 and attach subnet0 to router0
openstack router create router0
openstack router add subnet router0 subnet0
#3 Create fwg1 with default ingress, egress firewall group policy from admin project
project_id=$(openstack project show admin | grep ' id' | awk '{print$4}')
i_fwp_id=$(openstack firewall group policy list --long | grep ingress | grep $project_id | awk '{print$2}')
e_fwp_id=$(openstack firewall group policy list --long | grep egress | grep $project_id | awk '{print$2}')
#4 Create and attach fwg1 to internal router port that attaches to net0
net0_port=$(openstack port list | grep -e "'10.10.0.1'" | awk '{print$2}')
openstack firewall group create --name fwg1 --port $net0_port --ingress-firewall-policy $i_fwp_id --egress-firewall-policy $e_fwp_id
#5 Create a logging resource for fwg1
openstack network log create --resource-type firewall_group --resource fwg1 --enable --event ALL Log_all_defined_resource
# Check iptables of netns of router0 => NFLOGs are added (OK)
http://paste.openstack.org/show/728805/
#6 Update net0_port 'state' into 'DOWN'
openstack port set $net0_port --disable
# Check iptables of netns of router0 => NFLOGs stay the same (are not removed)
=> this is accepted
#7 Restart q-l3.service
sudo systemctl restart <email address hidden>
# Check iptables of netns of router0 => NFLOGs are removed
http://paste.openstack.org/show/728806/
#8 Changing net0_port status from 'DOWN' to 'UP'
openstack port set $net0_port --enable
# Check iptables of netns of router0
Expected result: NFLOGs should be recovered like http://paste.openstack.org/show/728805/
Actual result: NFLOGs are NOT recovered (http://paste.openstack.org/show/728806/)
In addition, without step "#7 Restart q-l3.service", everything works as expected.
Thanks for procedure. I confirmed this is a new bug in FW Logging.