By default Horizon sets Firewall group admin state to False when user trying to set it true Firewall always remains in DOWN state

[varun kumar yadav]

Create a openStack Firewall-V2 group by setting admin state to False through Horizon.
Only openStack Horizon gives that option to set the Firewall group admin state to false not openstack cli command.

Add Firewall-V2 policy to the Firewall group. After adding router port to Firewall group its status remains in the DOWN state it is expected as admin state is set to False.

But when admin-state is set to true it never comes into Active state and always remains in DOWN state.

>Before Admin state is false

Add port to the Firewall-V2 policy.

[root@vioshim-l42jp6xt7m-vioshim-84bb866c4d-lw6wj /]# openstack firewall group show F2
+-------------------+-------------------------------------------+
| Field | Value |
+-------------------+-------------------------------------------+
| Description | |
| Egress Policy ID | None |
| ID | b951672d-1c9a-41cf-b096-db574601d6e2 |
| Ingress Policy ID | 1338b6c9-2f16-4e2b-8f9b-d876ec744a03 |
| Name | F2 |
| Ports | [u'3693155c-c07d-4e0b-8723-6f83acb85943'] |
| Project | 52e5cd63615243cd9439952c5214d0f7 |
| Shared | False |
| State | DOWN |
| Status | DOWN |
| project_id | 52e5cd63615243cd9439952c5214d0f7 |
+-------------------+-------------------------------------------+

> after Admin state is set to true.

[root@vioshim-l42jp6xt7m-vioshim-84bb866c4d-lw6wj /]# openstack firewall group show b951672d-1c9a-41cf-b096-db574601d6e2
+-------------------+-------------------------------------------+
| Field | Value |
+-------------------+-------------------------------------------+
| Description | |
| Egress Policy ID | None |
| ID | b951672d-1c9a-41cf-b096-db574601d6e2 |
| Ingress Policy ID | 1338b6c9-2f16-4e2b-8f9b-d876ec744a03 |
| Name | F2 |
| Ports | [u'3693155c-c07d-4e0b-8723-6f83acb85943'] |
| Project | 52e5cd63615243cd9439952c5214d0f7 |
| Shared | False |
| State | UP |
| Status | DOWN |
| project_id | 52e5cd63615243cd9439952c5214d0f7 |
+-------------------+-------------------------------------------+

Expected: Firewall group should come into ACTIVE state.
          Default option should remain same in both Horizon and Cli command.
             openstack Firewall group create set the admin state to true by default.

Issue observed: Port update code is not called during admin state change.

[Akihiro Motoki (amotoki)]

> Create a openStack Firewall-V2 group by setting admin state to False through Horizon.
> Only openStack Horizon gives that option to set the Firewall group admin state to false not openstack cli command.

--enable/--disable option of "openstack firewall group create" can be used to control the admin state ofa firewall group.

neutron-fwaas-dashboard just calls FWaaS v2 API, so if you hit this issue it should be a bug in neutron-fwaas.

[Akihiro Motoki (amotoki)]

Marking this as Incomplete from neutron-fwaas-dashboard perspective.

[varun kumar yadav (vkyadav)]

If it is neutron-Fwass issue i am assiginig it neutron project.
Please assign accordingly.

issue is if firewall-v2 group is created with admin state false it remain in DOWN state.
but changing the admin state to true does not make status ACTIVE. please assign accordingly.

[YAMAMOTO Takashi (yamamoto)]

probably _need_pending_update should check the admin state?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/683817

[OpenStack Infra (hudson-openstack)]

Change abandoned by Slawek Kaplonski (<email address hidden>) on branch: master
Review: https://review.opendev.org/683817
Reason: As we are going to deprecate master branch in this project this patch is not needed anymore.