You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by ya...@apache.org on 2014/01/11 02:14:27 UTC

[1/2] Contrail plugin 4.3 fixes

Updated Branches:
  refs/heads/4.3 9df5c1885 -> 343b6acae


http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/VirtualNetworkModel.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/VirtualNetworkModel.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/VirtualNetworkModel.java
index b4968ac..f05517f 100644
--- a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/VirtualNetworkModel.java
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/VirtualNetworkModel.java
@@ -23,7 +23,6 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 
-import org.apache.cloudstack.network.contrail.management.ContrailManager;
 import org.apache.log4j.Logger;
 
 import com.cloud.dc.VlanVO;
@@ -39,8 +38,10 @@ import net.juniper.contrail.api.types.NetworkIpam;
 import net.juniper.contrail.api.types.Project;
 import net.juniper.contrail.api.types.SubnetType;
 import net.juniper.contrail.api.types.VirtualNetwork;
+import net.juniper.contrail.api.types.VirtualNetworkPolicyType;
 import net.juniper.contrail.api.types.VnSubnetsType;
 import net.juniper.contrail.api.ApiConnector;
+import org.apache.cloudstack.network.contrail.management.ContrailManager;
 
 public class VirtualNetworkModel extends ModelObjectBase {
     private static final Logger s_logger = Logger.getLogger(VirtualNetworkModel.class);
@@ -65,6 +66,7 @@ public class VirtualNetworkModel extends ModelObjectBase {
     private NetworkIpam _ipam;
 
     private FloatingIpPoolModel _fipPoolModel;
+    private NetworkPolicyModel _policyModel;
 
     public VirtualNetworkModel(Network network, String uuid, String name, TrafficType trafficType) {
         _uuid = uuid;
@@ -132,6 +134,10 @@ public class VirtualNetworkModel extends ModelObjectBase {
             successor.delete(controller);
         }
 
+        if (_policyModel != null) {
+            _policyModel.removeSuccessor(this);
+        }
+
         try {
             api.delete(VirtualNetwork.class, _uuid);
         } catch (IOException ex) {
@@ -180,6 +186,8 @@ public class VirtualNetworkModel extends ModelObjectBase {
                 s_logger.warn("Unable to read virtual-network", ex);
             }
         }
+
+        _id = network.getId();
         
         try {
             _projectId = manager.getProjectId(network.getDomainId(), network.getAccountId());
@@ -225,6 +233,16 @@ public class VirtualNetworkModel extends ModelObjectBase {
                 vn.setUuid(_uuid);
             } 
         }
+
+        if (_policyModel == null) {
+            vn.clearNetworkPolicy();
+        } else if (!_policyModel.hasPolicyRules()) {
+            vn.clearNetworkPolicy();
+            _policyModel.removeSuccessor(this);
+        } else {
+            vn.setNetworkPolicy(_policyModel.getPolicy(), new VirtualNetworkPolicyType(
+                    new VirtualNetworkPolicyType.SequenceType(1, 0), null));
+        }
      
         if (_ipam == null) {
             NetworkIpam ipam = null;
@@ -403,7 +421,23 @@ public class VirtualNetworkModel extends ModelObjectBase {
                     "; db: " + dbSubnets + ", vnc: " + vncSubnets + ", diff: " + diff);
             return false;
         }
-        
+
+        List<ObjectReference<VirtualNetworkPolicyType>> policyRefs = _vn.getNetworkPolicy();
+        if ((policyRefs == null || policyRefs.isEmpty()) && _policyModel != null) {
+            return false;
+        }
+
+        if ((policyRefs != null && !policyRefs.isEmpty()) && _policyModel == null) {
+            return false;
+        }
+
+        if (policyRefs != null && !policyRefs.isEmpty() && _policyModel != null) {
+            ObjectReference<VirtualNetworkPolicyType> ref = policyRefs.get(0);
+            if (!ref.getUuid().equals(_policyModel.getUuid())) {
+                return false; 
+            }
+        }
+
         for (ModelObject successor: successors()) {
             if (!successor.verify(controller)) {
                 return false;
@@ -415,8 +449,6 @@ public class VirtualNetworkModel extends ModelObjectBase {
     @Override
     public boolean compare(ModelController controller, ModelObject o) {
         VirtualNetworkModel latest;
-        ApiConnector api = controller.getApiAccessor();
-
         assert this._vn != null : "vnc virtual network current is not initialized";
 
         try {
@@ -481,14 +513,64 @@ public class VirtualNetworkModel extends ModelObjectBase {
                     "; db: " + currentSubnets + ", vnc: " + newSubnets + ", diff: " + diff);
             return false;
         }
-                
+
+        List<ObjectReference<VirtualNetworkPolicyType>> currentPolicyRefs = this._vn.getNetworkPolicy();
+        List<ObjectReference<VirtualNetworkPolicyType>> latestPolicyRefs = latest._vn.getNetworkPolicy();
+
+        if (currentPolicyRefs == null && latestPolicyRefs == null) {
+            return true;
+        }
+
+        if ((currentPolicyRefs == null && latestPolicyRefs != null) ||
+                (currentPolicyRefs != null && latestPolicyRefs == null) || 
+                (currentPolicyRefs.size() != latestPolicyRefs.size())) {
+            return false;
+        }
+
+        if (currentPolicyRefs.isEmpty() && latestPolicyRefs.isEmpty()) {
+            return true;
+        }
+
+        //both must be non empty lists
+        ObjectReference<VirtualNetworkPolicyType> ref1 = currentPolicyRefs.get(0);
+        ObjectReference<VirtualNetworkPolicyType> ref2 = latestPolicyRefs.get(0);
+
+        if ((ref1 != null && ref2 == null) || (ref1 == null && ref2 != null)) {
+            return false;
+        }
+
+        if ((ref1.getUuid() != null && ref2.getUuid() == null) || (ref1.getUuid() == null && ref2.getUuid() != null)) {
+            return false;
+        }
+        if (ref1.getUuid() == null && ref2.getUuid() == null) {
+            return true;
+        }
+        if (!ref1.getUuid().equals(ref2.getUuid())) {
+            return false; 
+        }
         return true;
     }
 
     public FloatingIpPoolModel getFipPoolModel() {
         return _fipPoolModel;
     }
+
     public void setFipPoolModel(FloatingIpPoolModel fipPoolModel) {
         _fipPoolModel = fipPoolModel;
     }
+
+    public NetworkPolicyModel getNetworkPolicyModel() {
+        return _policyModel;
+    }
+
+    public void addToNetworkPolicy(NetworkPolicyModel policyModel) {
+        if (_policyModel != null) {
+            _policyModel.removeSuccessor(this);
+        }
+        _policyModel = policyModel;
+        if (_policyModel != null) {
+            _policyModel.addSuccessor(this);
+        }
+    } 
+
 }

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/ManagementServerMock.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/ManagementServerMock.java b/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/ManagementServerMock.java
index ac93cbd..bbff466 100644
--- a/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/ManagementServerMock.java
+++ b/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/ManagementServerMock.java
@@ -348,12 +348,12 @@ public class ManagementServerMock {
         }
 
         Pair<List<? extends PhysicalNetworkServiceProvider>, Integer> providers =
-                _networkService.listNetworkServiceProviders(_znet.getId(), Provider.JuniperContrail.getName(),
+                _networkService.listNetworkServiceProviders(_znet.getId(), Provider.JuniperContrailRouter.getName(),
                         null, null, null);
         if (providers.second() == 0) {
-            s_logger.debug("Add " + Provider.JuniperContrail.getName() + " to network " + _znet.getName());
+            s_logger.debug("Add " + Provider.JuniperContrailRouter.getName() + " to network " + _znet.getName());
             PhysicalNetworkServiceProvider provider =
-                    _networkService.addProviderToPhysicalNetwork(_znet.getId(), Provider.JuniperContrail.getName(),
+                    _networkService.addProviderToPhysicalNetwork(_znet.getId(), Provider.JuniperContrailRouter.getName(),
                             null, null);
             _networkService.updateNetworkServiceProvider(provider.getId(),
                     PhysicalNetworkServiceProvider.State.Enabled.toString(), null);
@@ -369,7 +369,7 @@ public class ManagementServerMock {
                 PhysicalNetworkServiceProvider.State.Enabled.toString(), null, null);
         s_logger.debug(_znet.getName() + " has " + providers.second().toString() + " Enabled providers");
         for (PhysicalNetworkServiceProvider provider: providers.first()) {
-            if (provider.getProviderName().equals(Provider.JuniperContrail.getName())) {
+            if (provider.getProviderName().equals(Provider.JuniperContrailRouter.getName())) {
                 continue;
             }
             s_logger.debug("Disabling " + provider.getProviderName());

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/NetworkProviderTest.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/NetworkProviderTest.java b/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/NetworkProviderTest.java
index 40cd1ea..86e973e 100644
--- a/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/NetworkProviderTest.java
+++ b/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/NetworkProviderTest.java
@@ -203,7 +203,7 @@ public class NetworkProviderTest extends TestCase {
         ManagementServerMock.setParameter(cmd, "accountName", BaseCmd.CommandType.STRING, system.getAccountName());
         ManagementServerMock.setParameter(cmd, ApiConstants.NAME, BaseCmd.CommandType.STRING, name);
         ManagementServerMock.setParameter(cmd, "displayText", BaseCmd.CommandType.STRING, "test network");
-        ManagementServerMock.setParameter(cmd, "networkOfferingId", BaseCmd.CommandType.LONG, _contrailMgr.getOffering().getId());
+        ManagementServerMock.setParameter(cmd, "networkOfferingId", BaseCmd.CommandType.LONG, _contrailMgr.getRouterOffering().getId());
         ManagementServerMock.setParameter(cmd, "zoneId", BaseCmd.CommandType.LONG, zone.getId());
         ManagementServerMock.setParameter(cmd, ApiConstants.GATEWAY, BaseCmd.CommandType.STRING, "10.0.1.254");
         ManagementServerMock.setParameter(cmd, ApiConstants.NETMASK, BaseCmd.CommandType.STRING, "255.255.255.0");


[2/2] git commit: updated refs/heads/4.3 to 343b6ac

Posted by ya...@apache.org.
Contrail plugin 4.3 fixes

Signed-off-by: Sheng Yang <sh...@citrix.com>


Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/343b6aca
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/343b6aca
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/343b6aca

Branch: refs/heads/4.3
Commit: 343b6acae2db773ae0464925581bb93e886e2b40
Parents: 9df5c18
Author: sbalineni <sb...@contrailsystems.com>
Authored: Sat Jan 4 14:56:54 2014 +0000
Committer: Sheng Yang <sh...@citrix.com>
Committed: Fri Jan 10 17:14:01 2014 -0800

----------------------------------------------------------------------
 api/src/com/cloud/network/Network.java          |   2 +-
 .../management/ContrailElementImpl.java         |  41 ++-
 .../contrail/management/ContrailGuru.java       |  30 +-
 .../contrail/management/ContrailManager.java    |  23 +-
 .../management/ContrailManagerImpl.java         | 229 ++++++++++----
 .../contrail/management/ModelDatabase.java      |  24 +-
 .../contrail/management/ServerDBSyncImpl.java   | 211 ++++++++++++-
 .../management/ServerEventHandlerImpl.java      |  10 -
 .../contrail/management/ServiceManagerImpl.java |  21 +-
 .../contrail/model/NetworkPolicyModel.java      | 308 +++++++++++++++++++
 .../contrail/model/ServiceInstanceModel.java    | 121 +++-----
 .../contrail/model/VirtualMachineModel.java     |  55 +++-
 .../contrail/model/VirtualNetworkModel.java     |  92 +++++-
 .../management/ManagementServerMock.java        |   8 +-
 .../management/NetworkProviderTest.java         |   2 +-
 15 files changed, 971 insertions(+), 206 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/api/src/com/cloud/network/Network.java
----------------------------------------------------------------------
diff --git a/api/src/com/cloud/network/Network.java b/api/src/com/cloud/network/Network.java
index 0d916ab..f83e6c3 100644
--- a/api/src/com/cloud/network/Network.java
+++ b/api/src/com/cloud/network/Network.java
@@ -115,7 +115,7 @@ public interface Network extends ControlledEntity, StateObject<Network.State>, I
         private static List<Provider> supportedProviders = new ArrayList<Provider>();
 
         public static final Provider VirtualRouter = new Provider("VirtualRouter", false);
-        public static final Provider JuniperContrail = new Provider("JuniperContrail", false);
+        public static final Provider JuniperContrailRouter = new Provider("JuniperContrailRouter", false);
         public static final Provider JuniperSRX = new Provider("JuniperSRX", true);
         public static final Provider PaloAlto = new Provider("PaloAlto", true);
         public static final Provider F5BigIp = new Provider("F5BigIp", true);

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailElementImpl.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailElementImpl.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailElementImpl.java
index dfbe7d3..18e8bde 100644
--- a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailElementImpl.java
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailElementImpl.java
@@ -52,12 +52,8 @@ import com.cloud.network.element.IpDeployer;
 import com.cloud.network.element.NetworkACLServiceProvider;
 import com.cloud.network.element.SourceNatServiceProvider;
 import com.cloud.network.element.StaticNatServiceProvider;
-import com.cloud.network.element.VpcProvider;
 import com.cloud.network.rules.StaticNat;
 import com.cloud.network.vpc.NetworkACLItem;
-import com.cloud.network.vpc.PrivateGateway;
-import com.cloud.network.vpc.StaticRouteProfile;
-import com.cloud.network.vpc.Vpc;
 import com.cloud.offering.NetworkOffering;
 import com.cloud.utils.component.AdapterBase;
 import com.cloud.vm.NicProfile;
@@ -68,14 +64,21 @@ import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineProfile;
 import com.cloud.vm.dao.NicDao;
 import com.cloud.network.IpAddress;
+import com.cloud.server.ConfigurationServer;
+import com.cloud.server.ConfigurationServerImpl;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.resource.ResourceManager;
 
 @Component
-@Local(value = {ContrailElement.class, StaticNatServiceProvider.class})
+@Local(value = {ContrailElement.class, StaticNatServiceProvider.class, IpDeployer.class, SourceNatServiceProvider.class})
 public class ContrailElementImpl extends AdapterBase
-    implements ContrailElement, IpDeployer, StaticNatServiceProvider {
+    implements ContrailElement, StaticNatServiceProvider, IpDeployer, SourceNatServiceProvider, DhcpServiceProvider {
 
 	private static final Map<Service, Map<Capability, String>> _capabilities = InitCapabilities();
 
+        @Inject ResourceManager _resourceMgr;
+        @Inject NetworkDao _networksDao;
 	@Inject ContrailManager _manager;
 	@Inject NicDao _nicDao;
 	@Inject ServerDBSync  _dbSync;
@@ -99,7 +102,7 @@ public class ContrailElementImpl extends AdapterBase
     // NetworkElement API
     @Override
     public Provider getProvider() {
-        return Provider.JuniperContrail;
+        return Provider.JuniperContrailRouter;
     }
 
     private static Map<Service, Map<Capability, String>> InitCapabilities() {
@@ -346,4 +349,28 @@ public class ContrailElementImpl extends AdapterBase
         }
         return false;        
     }
+
+    @Override
+    public boolean addDhcpEntry(Network network, NicProfile nic,
+    		VirtualMachineProfile vm,
+    		DeployDestination dest, ReservationContext context)
+    				throws ConcurrentOperationException, InsufficientCapacityException,
+    				ResourceUnavailableException {
+    	return false;
+    }
+
+    @Override
+    public boolean configDhcpSupportForSubnet(Network network, NicProfile nic,
+    		VirtualMachineProfile vm,
+    		DeployDestination dest, ReservationContext context)
+    				throws ConcurrentOperationException, InsufficientCapacityException,
+    				ResourceUnavailableException {
+    	return false;
+    }
+
+    @Override
+    public boolean removeDhcpSupportForSubnet(Network network)
+    		throws ResourceUnavailableException {
+    	return false;
+    }
 }

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailGuru.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailGuru.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailGuru.java
index ca53f41..6587534 100644
--- a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailGuru.java
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailGuru.java
@@ -19,8 +19,11 @@ package org.apache.cloudstack.network.contrail.management;
 
 
 import java.io.IOException;
+import java.net.URI;
+import java.util.List;
 
 import javax.inject.Inject;
+import javax.ejb.Local;
 
 import net.juniper.contrail.api.types.MacAddressesType;
 import net.juniper.contrail.api.types.VirtualMachineInterface;
@@ -60,18 +63,28 @@ import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineProfile;
 import com.cloud.vm.dao.NicDao;
 import com.cloud.vm.NicVO;
+import com.cloud.network.dao.IPAddressDao;
+import com.cloud.network.dao.IPAddressVO;
+import com.cloud.network.addr.PublicIp;
+import com.cloud.user.AccountManager;
+import com.cloud.network.IpAddressManager;
 
-@Component
+@Local(value = {NetworkGuru.class})
 public class ContrailGuru extends AdapterBase implements NetworkGuru {
     @Inject NetworkDao _networkDao;
     @Inject ContrailManager _manager;
     @Inject NicDao _nicDao;
+    @Inject IPAddressDao _ipAddressDao;
+    @Inject AccountManager _accountMgr;
+    @Inject IpAddressManager _ipAddrMgr;
 
     private static final Logger s_logger = Logger.getLogger(ContrailGuru.class);
     private static final TrafficType[] _trafficTypes = {TrafficType.Guest};
 
     private boolean canHandle(NetworkOffering offering) {
-        return (offering.getName().equals(ContrailManager.offeringName));
+        if (offering.getId() == _manager.getRouterOffering().getId())
+            return true;
+        return false;
     }
 
     @Override
@@ -142,7 +155,13 @@ public class ContrailGuru extends AdapterBase implements NetworkGuru {
         }
 
         profile.setStrategy(ReservationStrategy.Start);
-        
+        URI broadcastUri = null;
+        try {
+            broadcastUri = new URI("vlan://untagged");
+        } catch (Exception e) {
+            s_logger.warn("unable to instantiate broadcast URI: " + e);
+        }
+        profile.setBroadcastUri(broadcastUri);
         return profile;
     }
 
@@ -225,7 +244,9 @@ public class ContrailGuru extends AdapterBase implements NetworkGuru {
         if (nic.getIp4Address() == null) {
             s_logger.debug("Allocated IP address " + ipModel.getAddress());
             nic.setIp4Address(ipModel.getAddress());
-            nic.setNetmask(NetUtils.cidr2Netmask(network.getCidr()));
+            if (network.getCidr() != null) {
+                nic.setNetmask(NetUtils.cidr2Netmask(network.getCidr()));
+            }
             nic.setGateway(network.getGateway());
             nic.setFormat(AddressFormat.Ip4);
         }
@@ -296,6 +317,7 @@ public class ContrailGuru extends AdapterBase implements NetworkGuru {
             return;
         }
         try {
+            _manager.getDatabase().getVirtualNetworks().remove(vnModel);
             vnModel.delete(_manager.getModelController());
         } catch (IOException e) {
             s_logger.warn("virtual-network delete", e);

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailManager.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailManager.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailManager.java
index b96b00c..550abb7 100644
--- a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailManager.java
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailManager.java
@@ -25,6 +25,9 @@ import org.apache.cloudstack.network.contrail.model.VirtualNetworkModel;
 
 import net.juniper.contrail.api.ApiConnector;
 import net.juniper.contrail.api.types.FloatingIp;
+import net.juniper.contrail.api.types.NetworkPolicy;
+import net.juniper.contrail.api.types.Project;
+
 import net.juniper.contrail.api.types.VirtualNetwork;
 
 import com.cloud.network.Network;
@@ -36,16 +39,21 @@ import com.cloud.network.dao.PhysicalNetworkVO;
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.domain.DomainVO;
 import com.cloud.projects.ProjectVO;
+import com.cloud.network.vpc.NetworkACLVO;
 
 public interface ContrailManager {
-    public static final String offeringName = "Juniper Contrail offering";
-    public static final String offeringDisplayText = "Juniper Contrail network offering";
+    public static final String routerOfferingName = "Juniper Contrail Network Offering";
+    public static final String routerOfferingDisplayText = "Juniper Contrail Network Offering";
+    public static final String routerPublicOfferingName = "Juniper Contrail Public Network Offering";
+    public static final String routerPublicOfferingDisplayText = "Juniper Contrail Public Network Offering";
     public static final int DB_SYNC_INTERVAL_DEFAULT = 600000;
     public static final String VNC_ROOT_DOMAIN = "default-domain";
     public static final String VNC_DEFAULT_PROJECT = "default-project";
     public static final String managementNetworkName = "ip-fabric";
 
-    public NetworkOffering getOffering();
+    public NetworkOffering getRouterOffering();
+    public NetworkOffering getPublicRouterOffering();
+
     public void syncNetworkDB(short syncMode) throws IOException;
 
     public boolean isManagedPhysicalNetwork(Network network);
@@ -68,6 +76,7 @@ public interface ContrailManager {
     public String getDefaultPublicNetworkFQN();
     public String getProjectId(long domainId, long accountId) throws IOException;
     public net.juniper.contrail.api.types.Project getVncProject(long domainId, long accountId) throws IOException;
+    public net.juniper.contrail.api.types.Project  getDefaultVncProject() throws IOException;
     public boolean isSystemRootDomain(net.juniper.contrail.api.types.Domain vnc);
     public boolean isSystemRootDomain(DomainVO domain);
     public boolean isSystemDefaultProject(net.juniper.contrail.api.types.Project project);
@@ -80,14 +89,16 @@ public interface ContrailManager {
     public ApiConnector getApiConnector();
     public ModelDatabase getDatabase();
     public ModelController getModelController(); 
-    public List<NetworkVO> findJuniperManagedNetworks(List<TrafficType> types);
-    public List<IPAddressVO> findJuniperManagedPublicIps();
+    public List<NetworkVO> findManagedNetworks(List<TrafficType> types);
+    public List<NetworkVO> findSystemNetworks(List<TrafficType> types);
+    public List<IPAddressVO> findManagedPublicIps();
+    public List<NetworkACLVO> findManagedACLs();
     public VirtualNetwork findDefaultVirtualNetwork(TrafficType trafficType)
             throws IOException;
     public List<FloatingIp> getFloatingIps();
     public VirtualNetworkModel lookupPublicNetworkModel();
-    public void createPublicNetworks();
     public boolean createFloatingIp(PublicIpAddress ip);
     public boolean deleteFloatingIp(PublicIpAddress ip);
+    public boolean isSystemDefaultNetworkPolicy(NetworkPolicy policy);
 }
   

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailManagerImpl.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailManagerImpl.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailManagerImpl.java
index 4eaafca..eea5026 100644
--- a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailManagerImpl.java
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ContrailManagerImpl.java
@@ -19,7 +19,6 @@ package org.apache.cloudstack.network.contrail.management;
 
 import java.io.IOException;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
@@ -38,6 +37,8 @@ import net.juniper.contrail.api.ApiPropertyBase;
 import net.juniper.contrail.api.ObjectReference;
 import net.juniper.contrail.api.types.FloatingIp;
 import net.juniper.contrail.api.types.FloatingIpPool;
+import net.juniper.contrail.api.types.NetworkPolicy;
+import net.juniper.contrail.api.types.Project;
 import net.juniper.contrail.api.types.VirtualNetwork;
 
 import org.apache.cloudstack.network.contrail.model.FloatingIpModel;
@@ -50,13 +51,14 @@ import org.springframework.stereotype.Component;
 
 import com.cloud.configuration.ConfigurationManager;
 import com.cloud.configuration.ConfigurationService;
+import com.cloud.server.ConfigurationServer;
+import com.cloud.server.ConfigurationServerImpl;
 import com.cloud.dc.DataCenter;
 import com.cloud.dc.dao.DataCenterDao;
 import com.cloud.dc.dao.VlanDao;
 import com.cloud.domain.Domain;
 import com.cloud.domain.DomainVO;
 import com.cloud.domain.dao.DomainDao;
-import com.cloud.exception.InternalErrorException;
 import com.cloud.projects.ProjectVO;
 import com.cloud.user.dao.AccountDao;
 import com.cloud.user.Account;
@@ -72,11 +74,12 @@ import com.cloud.network.dao.NetworkVO;
 import com.cloud.network.dao.PhysicalNetworkDao;
 import com.cloud.network.dao.PhysicalNetworkServiceProviderDao;
 import com.cloud.network.dao.PhysicalNetworkVO;
-import com.cloud.offering.NetworkOffering.State;
 import com.cloud.offering.NetworkOffering;
 import com.cloud.offering.NetworkOffering.Availability;
 import com.cloud.offerings.NetworkOfferingVO;
 import com.cloud.offerings.dao.NetworkOfferingDao;
+import com.cloud.network.vpc.dao.NetworkACLDao;
+import com.cloud.network.vpc.NetworkACLVO;
 import com.cloud.projects.dao.ProjectDao;
 import com.cloud.utils.component.ComponentLifecycle;
 import com.cloud.utils.component.ManagerBase;
@@ -99,6 +102,7 @@ import java.io.FileInputStream;
 @Component
 public class ContrailManagerImpl extends ManagerBase implements ContrailManager {
     @Inject public ConfigurationService _configService;
+    @Inject ConfigurationServer _configServer;
     @Inject NetworkOfferingDao _networkOfferingDao;
 
     @Inject DomainDao _domainDao;
@@ -115,12 +119,15 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
     @Inject IPAddressDao _ipAddressDao;
     @Inject VlanDao _vlanDao;
     @Inject UserVmDao _vmDao;
+    @Inject NetworkACLDao _networkAclDao;
 
     private static final Logger s_logger = Logger.getLogger(ContrailManager.class);
 
     private ApiConnector _api;
 
     private NetworkOffering _offering;
+    private NetworkOffering _routerOffering;
+    private NetworkOffering _routerPublicOffering;
     private Timer _dbSyncTimer;
     private int   _dbSyncInterval = DB_SYNC_INTERVAL_DEFAULT;
     private final String configuration = "contrail.properties";
@@ -153,21 +160,56 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
     public ModelDatabase getDatabase() {
         return _database;
     }
-    
-    private NetworkOffering LocateOffering() {
+
+    private NetworkOffering LocatePublicNetworkOffering(String offeringName, 
+                                           String offeringDisplayText, Provider provider) {
+        List<? extends NetworkOffering> offerList = _configService.listNetworkOfferings(TrafficType.Public, false);
+        for (NetworkOffering offer: offerList) {
+            if (offer.getName().equals(offeringName)) {
+                if (offer.getState() != NetworkOffering.State.Enabled) {
+                    return EnableNetworkOffering(offer.getId());
+                }
+                return offer;
+            }
+        }
+        Map<Service, Set<Provider>> serviceProviderMap = new HashMap<Service, Set<Provider>>();
+        Set<Provider> providerSet = new HashSet<Provider>();
+        providerSet.add(provider);
+        final Service[] services = {
+                Service.Connectivity,
+                Service.Dhcp,
+                Service.NetworkACL,
+                Service.StaticNat,
+                Service.SourceNat
+        };
+        for (Service svc: services) {
+            serviceProviderMap.put(svc, providerSet);
+        }
+        ConfigurationManager configMgr = (ConfigurationManager) _configService;
+        NetworkOfferingVO voffer = configMgr.createNetworkOffering(offeringName, offeringDisplayText,
+                TrafficType.Public, null, true, Availability.Optional, null, serviceProviderMap, true,
+                Network.GuestType.Shared, false, null, false, null, true, false, null, true, null, false);
+
+        voffer.setState(NetworkOffering.State.Enabled);
+        long id = voffer.getId();
+        _networkOfferingDao.update(id, voffer);
+        return _networkOfferingDao.findById(id);
+    }
+
+    private NetworkOffering LocateNetworkOffering(String offeringName, 
+                                           String offeringDisplayText, Provider provider) {
         List<? extends NetworkOffering> offerList = _configService.listNetworkOfferings(TrafficType.Guest, false);
         for (NetworkOffering offer: offerList) {
             if (offer.getName().equals(offeringName)) {
-                if (offer.getState() != State.Enabled) {
+                if (offer.getState() != NetworkOffering.State.Enabled) {
                     return EnableNetworkOffering(offer.getId());
                 }
                 return offer;
             }
         }
         Map<Service, Set<Provider>> serviceProviderMap = new HashMap<Service, Set<Provider>>();
-        // Map<Service, Map<Capability, String>> serviceCapabilityMap = new HashMap<Service, Map<Capability, String>>();
         Set<Provider> providerSet = new HashSet<Provider>();
-        providerSet.add(Provider.JuniperContrail);
+        providerSet.add(provider);
         final Service[] services = {
                 Service.Connectivity,
                 Service.Dhcp,
@@ -183,7 +225,7 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
                 TrafficType.Guest, null, false, Availability.Optional, null, serviceProviderMap, true,
                 Network.GuestType.Isolated, false, null, false, null, false, true, null, true, null, false);
 
-        voffer.setState(State.Enabled);
+        voffer.setState(NetworkOffering.State.Enabled);
         long id = voffer.getId();
         _networkOfferingDao.update(id, voffer);
         return _networkOfferingDao.findById(id);
@@ -191,7 +233,7 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
 
     private NetworkOffering EnableNetworkOffering(long id) {
         NetworkOfferingVO offering = _networkOfferingDao.createForUpdate(id);
-        offering.setState(State.Enabled);
+        offering.setState(NetworkOffering.State.Enabled);
         _networkOfferingDao.update(id, offering);
         return _networkOfferingDao.findById(id);                
     }
@@ -222,7 +264,10 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
 
         _controller = new ModelController(this, _api, _vmDao, _networksDao, _nicDao, _vlanDao, _ipAddressDao);
 
-        _offering = LocateOffering();
+        _routerOffering = LocateNetworkOffering(routerOfferingName, routerOfferingDisplayText, 
+                                                                  Provider.JuniperContrailRouter);
+        _routerPublicOffering = LocatePublicNetworkOffering(routerPublicOfferingName, routerPublicOfferingDisplayText, 
+                                                                  Provider.JuniperContrailRouter);
 
         _eventHandler.subscribe();
 
@@ -232,8 +277,13 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
     }
 
     @Override
-    public NetworkOffering getOffering() {
-        return _offering;
+    public NetworkOffering getPublicRouterOffering() {
+        return _routerPublicOffering;
+    }
+
+    @Override
+    public NetworkOffering getRouterOffering() {
+        return _routerOffering;
     }
 
     @Override
@@ -329,13 +379,20 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
     public net.juniper.contrail.api.types.Project getVncProject(long domainId, long accountId) throws IOException {
         String projectId = getProjectId(domainId, accountId);
         if (projectId == null) {
-            return null;
+            return getDefaultVncProject();
         }
         return (net.juniper.contrail.api.types.Project)
                 _api.findById(net.juniper.contrail.api.types.Project.class, projectId);
     }
 
     @Override
+    public net.juniper.contrail.api.types.Project getDefaultVncProject() throws IOException {
+        net.juniper.contrail.api.types.Project project = null;
+        project = (net.juniper.contrail.api.types.Project)_api.findByFQN(net.juniper.contrail.api.types.Project.class, VNC_ROOT_DOMAIN + ":" + VNC_DEFAULT_PROJECT);
+        return project;
+    }
+
+    @Override
     public String getFQN(Network net) {
         // domain, project, name
         String fqname = getDomainName(net.getDomainId());
@@ -392,7 +449,7 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
     public boolean isManagedPhysicalNetwork(Network network) {
         List<PhysicalNetworkVO> net_list = _physicalNetworkDao.listByZone(network.getDataCenterId());
         for (PhysicalNetworkVO phys : net_list) {
-            if(_physProviderDao.findByServiceProvider(phys.getId(), Network.Provider.JuniperContrail.getName()) != null) {
+            if(_physProviderDao.findByServiceProvider(phys.getId(), Network.Provider.JuniperContrailRouter.getName()) != null) {
                 return true;
             }  
         }
@@ -415,7 +472,54 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
         List<String> fqn = ImmutableList.copyOf(StringUtils.split(netname, ':'));
         return _api.findByName(VirtualNetwork.class, fqn);
     }
-    
+
+    @Override
+    public List<NetworkVO> findSystemNetworks(List<TrafficType> types) {
+        SearchBuilder<NetworkVO> searchBuilder = _networksDao.createSearchBuilder();
+        searchBuilder.and("trafficType", searchBuilder.entity().getTrafficType(), Op.IN);
+        SearchCriteria<NetworkVO> sc = searchBuilder.create();
+        if (types == null || types.isEmpty()) {
+            types = new ArrayList<TrafficType>();
+            types.add(TrafficType.Control);    
+            types.add(TrafficType.Management);
+            types.add(TrafficType.Public);
+            types.add(TrafficType.Storage);
+        } 
+        sc.setParameters("trafficType", types.toArray());
+        List<NetworkVO> dbNets = _networksDao.search(sc, null);
+        if (dbNets == null) {
+            s_logger.debug("no system networks for the given traffic types: " + types.toString());
+            dbNets = new ArrayList<NetworkVO>();
+        }
+
+        List<PhysicalNetworkVO> phys_list = _physicalNetworkDao.listAll();
+        final String provider = Provider.JuniperContrailRouter.getName();
+        for (Iterator<PhysicalNetworkVO> iter = phys_list.iterator(); iter.hasNext(); ) {
+            PhysicalNetworkVO phys = iter.next();
+            if (_physProviderDao.findByServiceProvider(phys.getId(), provider) != null) {
+                List<NetworkVO> infraNets = new ArrayList<NetworkVO>();
+                findInfrastructureNetworks(phys, infraNets);
+                for (NetworkVO net:infraNets) {
+                    if (types == null || types.isEmpty()) {
+                        if (!dbNets.contains(net)) {
+                            dbNets.add(net);
+                        }
+                        continue;
+                    }
+                    for(TrafficType type:types) {
+                        if (net.getTrafficType() == type) {
+                            if (!dbNets.contains(net)) {
+                                dbNets.add(net);
+                            } 
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+        return dbNets; 
+    }
+
     @Override
     public VirtualNetwork findDefaultVirtualNetwork(TrafficType trafficType) throws IOException {
         if (trafficType == TrafficType.Guest ||
@@ -435,14 +539,17 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
      * Returns list of networks managed by Juniper VRouter filtered by traffic types 
      */
     @Override
-    public List<NetworkVO> findJuniperManagedNetworks(List<TrafficType> types) {
+    public List<NetworkVO> findManagedNetworks(List<TrafficType> types) {
 
         SearchBuilder<NetworkVO> searchBuilder = _networksDao.createSearchBuilder();
         searchBuilder.and("trafficType", searchBuilder.entity().getTrafficType(), Op.IN);
-        searchBuilder.and("networkOfferingId", searchBuilder.entity().getNetworkOfferingId(), Op.EQ);
+        searchBuilder.and("networkOfferingId", searchBuilder.entity().getNetworkOfferingId(), Op.IN);
 
         SearchCriteria<NetworkVO> sc = searchBuilder.create();
-        sc.setParameters("networkOfferingId", getOffering().getId());
+        List<Long> offerings = new ArrayList<Long>();
+        offerings.add(getRouterOffering().getId());
+        offerings.add(getPublicRouterOffering().getId());
+        sc.setParameters("networkOfferingId", offerings.toArray());
 
         if (types == null || types.isEmpty()) {
             types = new ArrayList<TrafficType>();
@@ -461,7 +568,7 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
         }
 
         List<PhysicalNetworkVO> phys_list = _physicalNetworkDao.listAll();
-        final String provider = Network.Provider.JuniperContrail.getName();
+        final String provider = Network.Provider.JuniperContrailRouter.getName();
         for (Iterator<PhysicalNetworkVO> iter = phys_list.iterator(); iter.hasNext(); ) {
             PhysicalNetworkVO phys = iter.next();
             if (_physProviderDao.findByServiceProvider(phys.getId(), provider) != null) {
@@ -469,12 +576,16 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
                 findInfrastructureNetworks(phys, infraNets);
                 for (NetworkVO net:infraNets) {
                     if (types == null || types.isEmpty()) {
-                        dbNets.add(net);
+                        if (!dbNets.contains(net)) {
+                            dbNets.add(net);
+                        }
                         continue;
                     }
                     for(TrafficType type:types) {
                         if (net.getTrafficType() == type) {
-                            dbNets.add(net);
+                            if (!dbNets.contains(net)) {
+                                dbNets.add(net);
+                            }
                             break;
                         }
                     }
@@ -484,13 +595,19 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
         return dbNets; 
     }
 
+    @Override
+    public List<NetworkACLVO> findManagedACLs() {
+        /* contrail vpc is not yet implemented */
+        return null;
+    }
+
     /*
      * Returns list of public ip addresses managed by Juniper VRouter 
      */
     @Override
-    public List<IPAddressVO> findJuniperManagedPublicIps() {
+    public List<IPAddressVO> findManagedPublicIps() {
 
-        List<NetworkVO> dbNets = findJuniperManagedNetworks(null);
+        List<NetworkVO> dbNets = findManagedNetworks(null);
 
         if (dbNets == null || dbNets.isEmpty()) {
             s_logger.debug("Juniper managed networks is empty");
@@ -528,7 +645,7 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
         types.add(TrafficType.Storage); 
         types.add(TrafficType.Control); 
 
-        List<NetworkVO> dbNets = findJuniperManagedNetworks(types);
+        List<NetworkVO> dbNets = findManagedNetworks(types);
         for (NetworkVO net:dbNets) {
             
             VirtualNetworkModel vnModel = getDatabase().lookupVirtualNetwork(null, getCanonicalName(net), net.getTrafficType());
@@ -638,47 +755,26 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
     public VirtualNetworkModel lookupPublicNetworkModel() {
         List<TrafficType> types = new ArrayList<TrafficType>();
         types.add(TrafficType.Public);
-        List<NetworkVO> dbNets = findJuniperManagedNetworks(types);
+        List<NetworkVO> dbNets = findManagedNetworks(types);
         if (dbNets == null) {
             return null;
         }
-        NetworkVO net = dbNets.get(0);
-
-        VirtualNetworkModel vnModel = getDatabase().lookupVirtualNetwork(net.getUuid(), getCanonicalName(net), TrafficType.Public);
-        return vnModel;
-    }
-    
-    @Override
-    public void createPublicNetworks() {
-    	List<TrafficType> types = new ArrayList<TrafficType>(Arrays.asList(TrafficType.Public));
-    	List<NetworkVO> dbNets = findJuniperManagedNetworks(types);
-    	if (dbNets == null) {
-    	    return;
-    	}
-    	for (NetworkVO net: dbNets) {
-    	    VirtualNetworkModel vnModel = _database.lookupVirtualNetwork(net.getUuid(), getCanonicalName(net),
-    	            TrafficType.Public);
-    	    if (vnModel != null) {
-    	        continue;
-    	    }
-            vnModel = new VirtualNetworkModel(net, net.getUuid(), getCanonicalName(net), net.getTrafficType());
-            vnModel.build(_controller, net);
-            try {
-                vnModel.update(_controller);
-            } catch (InternalErrorException ex) {
-                s_logger.warn("virtual-network update", ex);
-                continue;
-            } catch (IOException ex) {
-                s_logger.warn("virtual-network update", ex);
-                continue;
+        NetworkVO network = dbNets.get(0);
+        VirtualNetworkModel vnModel = getDatabase().lookupVirtualNetwork(network.getUuid(), getCanonicalName(network), TrafficType.Public);
+        if (vnModel == null) {
+            vnModel = new VirtualNetworkModel(network, network.getUuid(),
+                        getCanonicalName(network), network.getTrafficType());
+            vnModel.setProperties(getModelController(), network);
+        }
+        try {
+            if (!vnModel.verify(getModelController())) {
+                vnModel.update(getModelController());
             }
-            _database.getVirtualNetworks().add(vnModel);
-            
-            // Add the Contrail NetworkElement to the Public network.
-            Map<String, String> providerMap = new HashMap<String, String>();
-            providerMap.put(Service.Connectivity.getName(), Provider.JuniperContrail.getName());
-            _networksDao.update(net.getId(), net, providerMap);
-    	}
+            getDatabase().getVirtualNetworks().add(vnModel);
+        } catch (Exception ex) {
+            s_logger.warn("virtual-network update: ", ex);
+        }
+        return vnModel;
     }
 
     public boolean createFloatingIp(PublicIpAddress ip) {
@@ -765,4 +861,13 @@ public class ContrailManagerImpl extends ManagerBase implements ContrailManager
         }
         return null;
     }
+    
+    @Override
+    public boolean isSystemDefaultNetworkPolicy(NetworkPolicy policy) {
+        if (policy.getName().equals("default-network-policy")) {
+            return true;
+        }
+        return false;
+    }
+
 }

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ModelDatabase.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ModelDatabase.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ModelDatabase.java
index f705f07..3eb66bf 100644
--- a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ModelDatabase.java
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ModelDatabase.java
@@ -20,6 +20,7 @@ package org.apache.cloudstack.network.contrail.management;
 import java.util.TreeSet;
 
 import org.apache.cloudstack.network.contrail.model.ModelObjectBase;
+import org.apache.cloudstack.network.contrail.model.NetworkPolicyModel;
 import org.apache.cloudstack.network.contrail.model.ServiceInstanceModel;
 import org.apache.cloudstack.network.contrail.model.VirtualMachineModel;
 import org.apache.cloudstack.network.contrail.model.VirtualNetworkModel;
@@ -30,8 +31,9 @@ public class ModelDatabase {
     TreeSet<ServiceInstanceModel> _serviceInstanceTable;
     TreeSet<VirtualMachineModel> _vmTable;
     TreeSet<VirtualNetworkModel> _vnTable;
+    TreeSet<NetworkPolicyModel> _policyTable;
     
-    ModelDatabase() {
+    public ModelDatabase() {
         initDb();
     }
 
@@ -39,16 +41,17 @@ public class ModelDatabase {
         _serviceInstanceTable = new TreeSet<ServiceInstanceModel>(new ModelObjectBase.UuidComparator());
         _vmTable = new TreeSet<VirtualMachineModel>(new ModelObjectBase.UuidComparator());
         _vnTable = new TreeSet<VirtualNetworkModel>(new ModelObjectBase.UuidComparator());
+        _policyTable = new TreeSet<NetworkPolicyModel>(new ModelObjectBase.UuidComparator());
     }
     
     public TreeSet<ServiceInstanceModel> getServiceInstances() {
         return _serviceInstanceTable;
     }
     
-    public ServiceInstanceModel lookupServiceInstance(String uuid) {
-        ServiceInstanceModel siKey = new ServiceInstanceModel(uuid);
+    public ServiceInstanceModel lookupServiceInstance(String fqn) {
+        ServiceInstanceModel siKey = new ServiceInstanceModel(fqn);
         ServiceInstanceModel current = _serviceInstanceTable.ceiling(siKey);
-        if  (current != null && current.getUuid().equals(uuid)) {
+        if  (current != null && current.getQualifiedName().equals(fqn)) {
             return current;
         }
         return null;
@@ -86,4 +89,17 @@ public class ModelDatabase {
         }
         return null;
     }
+
+    public TreeSet<NetworkPolicyModel> getNetworkPolicys() {
+        return _policyTable;
+    }
+
+    public NetworkPolicyModel lookupNetworkPolicy(String uuid) {
+        NetworkPolicyModel vmKey = new NetworkPolicyModel(uuid, null);
+        NetworkPolicyModel current = _policyTable.ceiling(vmKey);
+        if (current != null && current.getUuid().equals(uuid)) {
+            return current;
+        }
+        return null;
+    }
 }

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServerDBSyncImpl.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServerDBSyncImpl.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServerDBSyncImpl.java
index 7a77040..f8a8d97 100644
--- a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServerDBSyncImpl.java
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServerDBSyncImpl.java
@@ -27,6 +27,7 @@ import java.lang.reflect.Method;
 
 import net.juniper.contrail.api.types.FloatingIp;
 import net.juniper.contrail.api.types.FloatingIpPool;
+import net.juniper.contrail.api.types.NetworkPolicy;
 import net.juniper.contrail.api.types.ServiceInstance;
 import net.juniper.contrail.api.types.VirtualNetwork;
 import net.juniper.contrail.api.types.VirtualMachine;
@@ -39,6 +40,7 @@ import net.juniper.contrail.api.ObjectReference;
 
 import org.apache.cloudstack.network.contrail.model.FloatingIpModel;
 import org.apache.cloudstack.network.contrail.model.FloatingIpPoolModel;
+import org.apache.cloudstack.network.contrail.model.NetworkPolicyModel;
 import org.apache.cloudstack.network.contrail.model.ServiceInstanceModel;
 import org.apache.cloudstack.network.contrail.model.VMInterfaceModel;
 import org.apache.cloudstack.network.contrail.model.VirtualMachineModel;
@@ -65,6 +67,10 @@ import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.network.dao.PhysicalNetworkDao;
 import com.cloud.network.dao.PhysicalNetworkServiceProviderDao;
+import com.cloud.network.vpc.NetworkACLItemDao;
+import com.cloud.network.vpc.NetworkACLItemVO;
+import com.cloud.network.vpc.NetworkACLVO;
+import com.cloud.network.vpc.dao.NetworkACLDao;
 
 import javax.inject.Inject;
 
@@ -80,6 +86,9 @@ public class ServerDBSyncImpl implements ServerDBSync {
     @Inject PhysicalNetworkDao _physicalNetworkDao;
     @Inject PhysicalNetworkServiceProviderDao _physProviderDao;
     @Inject ContrailManager _manager;
+    @Inject NetworkACLItemDao _networkACLItemDao;
+    @Inject NetworkACLDao _networkACLDao;
+
     DBSyncGeneric _dbSync;
     Class<?>[] _vncClasses;
     // Read-Write (true) or Read-Only mode.
@@ -90,6 +99,7 @@ public class ServerDBSyncImpl implements ServerDBSync {
         _vncClasses = new Class[] {
                 net.juniper.contrail.api.types.Domain.class,
                 net.juniper.contrail.api.types.Project.class,
+                NetworkPolicy.class,
                 VirtualNetwork.class,
                 VirtualMachine.class,
                 ServiceInstance.class,
@@ -437,7 +447,7 @@ public class ServerDBSyncImpl implements ServerDBSync {
             List<TrafficType> types = new ArrayList<TrafficType>();
             types.add(TrafficType.Public);
             types.add(TrafficType.Guest);            
-            List<NetworkVO> dbNets = _manager.findJuniperManagedNetworks(types);
+            List<NetworkVO> dbNets = _manager.findManagedNetworks(types);
 
             List<VirtualNetwork> vList = (List<VirtualNetwork>) api.list(VirtualNetwork.class, null);
             List<VirtualNetwork> vncList = new ArrayList<VirtualNetwork>(); 
@@ -498,6 +508,16 @@ public class ServerDBSyncImpl implements ServerDBSync {
         
         VirtualNetworkModel vnModel = new VirtualNetworkModel(dbNet, 
                 dbNet.getUuid(), _manager.getCanonicalName(dbNet), dbNet.getTrafficType());
+        if (dbNet.getTrafficType() == TrafficType.Guest && dbNet.getNetworkACLId() != null) {
+            NetworkACLVO acl = _networkACLDao.findById(dbNet.getNetworkACLId());
+            NetworkPolicyModel policyModel = _manager.getDatabase().lookupNetworkPolicy(acl.getUuid());
+            if (policyModel == null) {
+                s_logger.error("Network(" + dbNet.getName() + ") has ACL but policy model not created: " + 
+                                       acl.getUuid() + ", name: " + acl.getName());      
+            } else {
+                vnModel.addToNetworkPolicy(policyModel);
+            }
+        }
         vnModel.build(_manager.getModelController(), dbNet);
 
         if (_rw_mode) {
@@ -573,6 +593,17 @@ public class ServerDBSyncImpl implements ServerDBSync {
 
         VirtualNetworkModel vnModel = new VirtualNetworkModel(dbn, vnet.getUuid(), 
                 _manager.getCanonicalName(dbn), dbn.getTrafficType());
+
+        if (dbn.getTrafficType() == TrafficType.Guest && dbn.getNetworkACLId() != null) {
+            NetworkACLVO acl = _networkACLDao.findById(dbn.getNetworkACLId());
+            NetworkPolicyModel policyModel = _manager.getDatabase().lookupNetworkPolicy(acl.getUuid());
+            if (policyModel == null) {
+                s_logger.error("Network(" + dbn.getName() + ") has ACL but policy model not created: " + 
+                                       acl.getUuid() + ", name: " + acl.getName());      
+            } else {
+                vnModel.addToNetworkPolicy(policyModel);
+            }
+        }
         vnModel.build(_manager.getModelController(), dbn);
 
         if (_rw_mode) {
@@ -593,6 +624,23 @@ public class ServerDBSyncImpl implements ServerDBSync {
             } catch (Exception ex) {
                 s_logger.warn("update virtual-network", ex);
             }
+            if (current != null) {
+                NetworkPolicyModel oldPolicyModel = current.getNetworkPolicyModel();
+                if (oldPolicyModel != vnModel.getNetworkPolicyModel()) {
+                    /*
+                     * if no other VNs are associated with the old policy, 
+                     * we could delete it from the Contrail VNC
+                     */
+                    if (oldPolicyModel != null && !oldPolicyModel.hasDescendents()) {
+                        try {
+                            oldPolicyModel.delete(_manager.getModelController());
+                            _manager.getDatabase().getNetworkPolicys().remove(oldPolicyModel);
+                        } catch (IOException e) {
+                            e.printStackTrace();
+                        }
+                    }
+                }
+            }
         } else {
             //compare 
             if (current != null && current.compare(_manager.getModelController(), vnModel) == false) {
@@ -786,7 +834,7 @@ public class ServerDBSyncImpl implements ServerDBSync {
      
     public boolean syncFloatingIp() throws Exception {
         
-        List<IPAddressVO> ipList = _manager.findJuniperManagedPublicIps();
+        List<IPAddressVO> ipList = _manager.findManagedPublicIps();
         List<FloatingIp> vncList = _manager.getFloatingIps();  
         if (ipList == null) {
             ipList = new ArrayList<IPAddressVO>();
@@ -962,5 +1010,164 @@ public class ServerDBSyncImpl implements ServerDBSync {
         }
         return inSync;
     }
+
+    /*
+     *  Network Policy Synchronization methods
+     */
+    @SuppressWarnings({ "unchecked" })
+    public boolean syncNetworkPolicy() throws Exception {
+        final ApiConnector api = _manager.getApiConnector();
+        try {
+
+            List<NetworkACLVO> dbAcls = _manager.findManagedACLs();
+            if (dbAcls == null) {
+                dbAcls = new ArrayList<NetworkACLVO>();
+            }
+
+            List<NetworkPolicy> pList = (List<NetworkPolicy>) api.list(NetworkPolicy.class, null);
+            List<NetworkPolicy> vncList = new ArrayList<NetworkPolicy>(); 
+
+            for (NetworkPolicy policy:pList) {
+                if (!_manager.isSystemDefaultNetworkPolicy(policy)) {
+                    vncList.add(policy);
+                }
+            }
+            s_logger.debug("sync Network Policy - DB size: " + dbAcls.size() + " VNC Size: " + vncList.size());
+            return _dbSync.syncGeneric(NetworkPolicy.class, dbAcls, vncList);
+        } catch (Exception ex) {
+            s_logger.warn("sync network-policys", ex);
+            throw ex;
+        }
+    }
+
+    public Comparator<NetworkACLVO> dbComparatorNetworkPolicy() {
+        Comparator<NetworkACLVO> comparator = new Comparator<NetworkACLVO>() {
+            public int compare(NetworkACLVO u1, NetworkACLVO u2) {
+                return u1.getUuid().compareTo(u2.getUuid());
+            }
+        };
+        return comparator;
+    }
+
+    public Comparator<?> vncComparatorNetworkPolicy() {
+        Comparator<?> comparator = new Comparator<NetworkPolicy>() {
+            public int compare(NetworkPolicy u1, NetworkPolicy u2) {
+                return u1.getUuid().compareTo(u2.getUuid());
+            }
+        };
+        return comparator;
+    }
+
+    public void createNetworkPolicy(NetworkACLVO db, StringBuffer syncLogMesg) throws IOException {
+        syncLogMesg.append("Policy# DB: " + db.getName() +
+                "(" + db.getUuid() + "); VNC: none;  action: create\n");
+
+        if (_manager.getDatabase().lookupNetworkPolicy(db.getUuid()) != null) {
+             s_logger.warn("Policy model object is already present in DB: " + 
+                                   db.getUuid() + ", name: " + db.getName());      
+        }
+        NetworkPolicyModel policyModel = new NetworkPolicyModel(db.getUuid(), db.getName());
+        net.juniper.contrail.api.types.Project project = null;
+        try {
+            project = _manager.getDefaultVncProject();
+        } catch (IOException ex) {
+            s_logger.warn("read project", ex);
+            throw ex;
+        }
+        policyModel.setProject(project);
+        List<NetworkACLItemVO> rules = _networkACLItemDao.listByACL(db.getId());
+        try {
+            policyModel.build(_manager.getModelController(), rules);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+
+        if (_rw_mode) {
+            try {
+                if (!policyModel.verify(_manager.getModelController())) {
+                    policyModel.update(_manager.getModelController());
+                }
+            } catch (Exception ex) {
+                s_logger.warn("create network-policy", ex);
+                syncLogMesg.append("Error: Policy# VNC : Unable to create network policy " + 
+                    db.getName() + "\n");
+                return;
+            }
+            s_logger.debug("add model " + policyModel.getName());
+            _manager.getDatabase().getNetworkPolicys().add(policyModel);
+            syncLogMesg.append("Policy# VNC: " + db.getUuid() + ", " + policyModel.getName() + " created\n");
+        } else {
+            syncLogMesg.append("Policy# VNC: " + policyModel.getName() + " created \n");
+        }
+    }
+
+    public void deleteNetworkPolicy(NetworkPolicy policy, StringBuffer syncLogMesg) throws IOException {
+        final ApiConnector api = _manager.getApiConnector();
+        if (_manager.isSystemDefaultNetworkPolicy(policy)) {
+            syncLogMesg.append("Policy# System default Network Policy# VNC: " + policy.getName() + " can not be deleted\n");
+            return;
+        }
+        syncLogMesg.append("Policy# DB: none; VNC: " + policy.getName() + "(" + policy.getUuid() + "); action: delete\n");
+        api.delete(policy);
+        syncLogMesg.append("Policy# VNC: " + policy.getName() + " deleted\n");
+    }
+
+    public Integer compareNetworkPolicy(NetworkACLVO dbn, NetworkPolicy policy, StringBuffer syncLogMesg) {
+        if (_manager.isSystemDefaultNetworkPolicy(policy)) {
+            return 1;
+        }
+        return dbn.getUuid().compareTo(policy.getUuid());
+    }
+
+    public Boolean filterNetworkPolicy(NetworkPolicy policy, StringBuffer syncLogMesg)  {
+        if (_manager.isSystemDefaultNetworkPolicy(policy)) {
+            syncLogMesg.append("Policy# VNC: " + policy.getName() + " filtered; action: don't delete\n");
+            return true;
+        }
+        return false;
+    }
+
+    public Boolean equalNetworkPolicy(NetworkACLVO db, NetworkPolicy policy, StringBuffer syncLogMesg) {
+        syncLogMesg.append("Policy# DB: " + db.getName() + 
+                "; VNC: " + policy.getName() + "; action: equal\n");
+        NetworkPolicyModel current = _manager.getDatabase().lookupNetworkPolicy(policy.getUuid());
+        NetworkPolicyModel policyModel = new NetworkPolicyModel(db.getUuid(), db.getName());
+        net.juniper.contrail.api.types.Project project = null;
+        try {
+            project = _manager.getDefaultVncProject();
+        } catch (IOException ex) {
+            s_logger.warn("read project", ex);
+        }
+        policyModel.setProject(project);
+        List<NetworkACLItemVO> rules = _networkACLItemDao.listByACL(db.getId());
+        try {
+            policyModel.build(_manager.getModelController(), rules);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        if (_rw_mode) {
+            if (current != null) {
+                _manager.getDatabase().getNetworkPolicys().remove(current);
+            }
+            s_logger.debug("add policy model " + policyModel.getName());
+            _manager.getDatabase().getNetworkPolicys().add(policyModel);   
+            try {
+                if (!policyModel.verify(_manager.getModelController())) {
+                    policyModel.update(_manager.getModelController());
+                }
+            } catch (Exception ex) {
+                s_logger.warn("update network-policy", ex);
+            }
+        } else {
+            //compare 
+            if (current != null && current.compare(_manager.getModelController(), policyModel) == false) {
+                syncLogMesg.append("Policy# DB: " + db.getName() + 
+                        "; VNC: " + policy.getName() + "; attributes differ\n");
+                return false;
+            }
+        }
+        return true;
+    }
+
 }
 

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServerEventHandlerImpl.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServerEventHandlerImpl.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServerEventHandlerImpl.java
index ec37440..4ebce59 100644
--- a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServerEventHandlerImpl.java
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServerEventHandlerImpl.java
@@ -81,14 +81,6 @@ public class ServerEventHandlerImpl implements ServerEventHandler {
     public void defaultMessageHandler(String subject, String topic, Object args) {
         s_logger.info("DB Event Received - topic: " + topic + "; subject: " + subject);
         
-        if (subject.equals("VLAN.IP.RANGE.CREATE")) {
-            _manager.createPublicNetworks();
-            return;
-        } else if (subject.equals("VLAN.IP.RANGE.DELETE")) {
-            // TODO
-            return;
-        }
-
         org.apache.cloudstack.framework.events.Event event = (org.apache.cloudstack.framework.events.Event)args;
         
         /* Method name should be on<ClassName><Operation> for example: onDomainCreate */
@@ -240,8 +232,6 @@ public class ServerEventHandlerImpl implements ServerEventHandler {
         _messageBus.subscribe(EventTypes.EVENT_PROJECT_DELETE, MessageDispatcher.getDispatcher(this));
         _messageBus.subscribe(EventTypes.EVENT_DOMAIN_CREATE, MessageDispatcher.getDispatcher(this));
         _messageBus.subscribe(EventTypes.EVENT_DOMAIN_DELETE, MessageDispatcher.getDispatcher(this));
-        _messageBus.subscribe(EventTypes.EVENT_VLAN_IP_RANGE_CREATE, MessageDispatcher.getDispatcher(this));
-        _messageBus.subscribe(EventTypes.EVENT_VLAN_IP_RANGE_DELETE, MessageDispatcher.getDispatcher(this));
     }
 }
 

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServiceManagerImpl.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServiceManagerImpl.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServiceManagerImpl.java
index 47fc99e..82f2cc4 100644
--- a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServiceManagerImpl.java
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/management/ServiceManagerImpl.java
@@ -64,6 +64,7 @@ import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.network.contrail.api.response.ServiceInstanceResponse;
 import org.apache.cloudstack.network.contrail.model.ServiceInstanceModel;
 import org.apache.cloudstack.network.contrail.model.VirtualMachineModel;
+import org.apache.cloudstack.network.contrail.model.VirtualNetworkModel;
 
 import net.juniper.contrail.api.ApiConnector;
 import net.juniper.contrail.api.types.ServiceInstance;
@@ -148,17 +149,15 @@ public class ServiceManagerImpl implements ServiceManager {
         }
         
         final ApiConnector api = _manager.getApiConnector();
-        final VirtualNetwork netLeft;
-        try {
-            netLeft = (VirtualNetwork) api.findById(VirtualNetwork.class, left.getUuid());
-        } catch (IOException ex) {
-            throw new CloudRuntimeException("Unable to read virtual-network object", ex);
+        VirtualNetworkModel leftModel = _manager.getDatabase().lookupVirtualNetwork(left.getUuid(),
+                _manager.getCanonicalName(left), left.getTrafficType());
+        if (leftModel == null) {
+            throw new CloudRuntimeException("Unable to read virtual-network object");
         }
-        final VirtualNetwork netRight;
-        try {
-            netRight = (VirtualNetwork) api.findById(VirtualNetwork.class, right.getUuid());
-        } catch (IOException ex) {
-            throw new CloudRuntimeException("Unable to read virtual-network object", ex);
+        VirtualNetworkModel rightModel = _manager.getDatabase().lookupVirtualNetwork(right.getUuid(),
+                _manager.getCanonicalName(right), right.getTrafficType());
+        if (rightModel == null) {
+            throw new CloudRuntimeException("Unable to read virtual-network object");
         }
 
         net.juniper.contrail.api.types.Project project;
@@ -181,7 +180,7 @@ public class ServiceManagerImpl implements ServiceManager {
         
         // 1. Create service-instance.
         ServiceInstanceModel serviceModel = new ServiceInstanceModel(project, name, template, serviceOffering,
-                netLeft, netRight);
+                leftModel, rightModel);
 
         try {
             serviceModel.update(_manager.getModelController());

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/NetworkPolicyModel.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/NetworkPolicyModel.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/NetworkPolicyModel.java
new file mode 100644
index 0000000..d5a8722
--- /dev/null
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/NetworkPolicyModel.java
@@ -0,0 +1,308 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.network.contrail.model;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.commons.lang.StringUtils;
+import org.apache.log4j.Logger;
+
+import com.cloud.network.Networks;
+
+import net.juniper.contrail.api.types.NetworkPolicy;
+import net.juniper.contrail.api.types.PolicyEntriesType;
+import net.juniper.contrail.api.types.PolicyEntriesType.PolicyRuleType;
+import net.juniper.contrail.api.types.Project;
+import net.juniper.contrail.api.ApiConnector;
+import org.apache.cloudstack.network.contrail.management.ContrailManager;
+
+import com.cloud.exception.InternalErrorException;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.vpc.NetworkACLItem;
+import com.cloud.network.vpc.NetworkACLItem.Action;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import com.cloud.utils.db.SearchCriteria.Op;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class NetworkPolicyModel extends ModelObjectBase {
+    private static final Logger s_logger = Logger.getLogger(NetworkPolicyModel.class);
+
+    private String _uuid;
+    private String _fq_name;
+    private String _name;
+    private Project _project;
+    private NetworkPolicy _policy;
+    PolicyEntriesType _policyMap;
+
+    public NetworkPolicyModel(String uuid, String name) {
+        _uuid = uuid;
+        _name = name;
+    }
+
+     public String getQualifiedName() {
+        return _fq_name;
+    }
+    
+    public String getName() {
+        return _name;
+    }
+    
+    public NetworkVO cidrToNetwork(ModelController controller, String cidr) {
+        SearchBuilder<NetworkVO> searchBuilder = controller.getNetworkDao().createSearchBuilder();
+        searchBuilder.and("trafficType", searchBuilder.entity().getTrafficType(), Op.EQ);
+        searchBuilder.and("cidr", searchBuilder.entity().getCidr(), Op.EQ);
+        searchBuilder.and("networkOfferingId", searchBuilder.entity().getNetworkOfferingId(), Op.EQ);
+
+        SearchCriteria<NetworkVO> sc = searchBuilder.create();
+
+        sc.setParameters("networkOfferingId", controller.getManager().getRouterOffering().getId());
+        sc.setParameters("cidr", cidr);
+        sc.setParameters("trafficType", Networks.TrafficType.Guest);
+
+        List<NetworkVO> dbNets = controller.getNetworkDao().search(sc, null);
+        if (dbNets == null || dbNets.size() == 0) {
+            return null;
+        }
+        if (dbNets.size() > 1) {
+            s_logger.warn("more than one network found with cidr: " + cidr);
+        }
+        return dbNets.get(0); 
+    }
+    
+    public void build(ModelController controller, List<? extends NetworkACLItem> rules) throws Exception {
+        String projectName = null; 
+        if (_project != null) {
+            _fq_name = StringUtils.join(_project.getQualifiedName(), ':') + ":" + _name;
+            projectName = StringUtils.join(_project.getQualifiedName(), ':');
+        } else {
+            _fq_name = ContrailManager.VNC_ROOT_DOMAIN + ":" + ContrailManager.VNC_DEFAULT_PROJECT + ":" + _name;
+            projectName = ContrailManager.VNC_ROOT_DOMAIN + ":" + ContrailManager.VNC_DEFAULT_PROJECT;
+        }
+        
+        PolicyEntriesType policyMap = new PolicyEntriesType();
+
+        for (NetworkACLItem rule:rules) {
+            if (rule.getState() != NetworkACLItem.State.Active &&
+                 rule.getState() != NetworkACLItem.State.Add)  {
+                 continue;
+            }
+                 
+            String action = null;
+            if (rule.getAction() == Action.Allow) {
+                action = "pass";            
+            } else if (rule.getAction() == Action.Deny) {
+                action = "deny";        
+            }
+            List<String> cidrList = rule.getSourceCidrList();
+            String protocol = rule.getProtocol();
+            if (protocol == null || protocol.equalsIgnoreCase("ALL") || protocol.isEmpty()) {
+                protocol = "any";
+            } else {
+                protocol = protocol.toLowerCase();
+            }
+            
+            Integer portStart = rule.getSourcePortStart();
+            Integer portEnd = rule.getSourcePortStart();
+            if (portStart == null) {
+                portStart = 0;                
+            }
+            if (portEnd == null) {
+                portEnd = 65535;
+            }
+            
+            List<PolicyRuleType.AddressType> srcList = new ArrayList<PolicyRuleType.AddressType>();
+            List<PolicyRuleType.AddressType> dstList = new ArrayList<PolicyRuleType.AddressType>();
+           
+            List<PolicyRuleType.PortType> srcPorts = new ArrayList<PolicyRuleType.PortType>();
+            List<PolicyRuleType.PortType> dstPorts = new ArrayList<PolicyRuleType.PortType>();
+            
+            if (rule.getTrafficType() == NetworkACLItem.TrafficType.Egress){
+                for (String cidr: cidrList) {
+                    NetworkVO net = cidrToNetwork(controller, cidr);
+                    /*String[] maskInfo = StringUtils.splitByWholeSeparator(cidr, "/");
+                    SubnetType subnet = new SubnetType();
+                    subnet.setIpPrefix(maskInfo[0]);
+                    subnet.setIpPrefixLen(Integer.parseInt(maskInfo[1]));
+                    */
+                    String netName = projectName + ":" + controller.getManager().getCanonicalName(net);
+                    dstList.add(new PolicyRuleType.AddressType(null, netName, null));
+                }
+                dstPorts.add(new PolicyRuleType.PortType(portStart, portEnd));
+                srcList.add(new PolicyRuleType.AddressType(null, "local", null));
+                srcPorts.add(new PolicyRuleType.PortType(0, 65535));
+            } else {
+                for (String cidr: cidrList) {
+                    NetworkVO net = cidrToNetwork(controller, cidr);
+                    String netName = projectName + ":" + controller.getManager().getCanonicalName(net);
+                    dstList.add(new PolicyRuleType.AddressType(null, netName, null));
+                }
+                dstPorts.add(new PolicyRuleType.PortType(portStart, portEnd));
+
+                srcList.add(new PolicyRuleType.AddressType(null, "any", null));
+                srcPorts.add(new PolicyRuleType.PortType(0, 65535));
+            }
+
+            PolicyRuleType vnRule = new PolicyRuleType(
+                    new PolicyRuleType.SequenceType(1, 0), rule.getUuid(), "<>", protocol,
+                    srcList, srcPorts, null, dstList, dstPorts,
+                    new PolicyRuleType.ActionListType(action, null, null, null));
+            policyMap.addPolicyRule(vnRule);
+        }  
+        _policyMap = policyMap;        
+    }
+    
+    /* for service instance policy */
+    public void build(ModelController modelController, String leftVn, String rightVn, String gatewayName,
+            List<String> siList, String action) {
+        if (_project != null) {
+            _fq_name = StringUtils.join(_project.getQualifiedName(), ':') + ":" + _name;
+        } else {
+            _fq_name = ContrailManager.VNC_ROOT_DOMAIN + ":" + ContrailManager.VNC_DEFAULT_PROJECT + ":" + _name;
+        }
+        
+        PolicyEntriesType policyMap = new PolicyEntriesType();
+        List<PolicyRuleType.AddressType> srcList = new ArrayList<PolicyRuleType.AddressType>();
+        srcList.add(new PolicyRuleType.AddressType(null, leftVn, null));
+        List<PolicyRuleType.AddressType> dstList = new ArrayList<PolicyRuleType.AddressType>();
+        dstList.add(new PolicyRuleType.AddressType(null, rightVn, null));
+
+        List<PolicyRuleType.PortType> portAny = new ArrayList<PolicyRuleType.PortType>();
+        portAny.add(new PolicyRuleType.PortType(0, 65535));
+        
+        PolicyRuleType rule = new PolicyRuleType(
+                new PolicyRuleType.SequenceType(1, 0),  null, "<>", "any",
+                srcList, portAny, null, dstList, portAny,
+                new PolicyRuleType.ActionListType(action, gatewayName, siList, null));
+        policyMap.addPolicyRule(rule);
+        _policyMap = policyMap;        
+    }
+
+    
+    public boolean hasPolicyRules() {
+        if (_policyMap != null && _policyMap.getPolicyRule() != null && _policyMap.getPolicyRule().size() > 0) {
+            return true;
+        }
+        return false;
+    }
+    
+    @Override
+    public int compareTo(ModelObject o) {
+        NetworkPolicyModel other;
+        try {
+            other = (NetworkPolicyModel) o;
+        } catch (ClassCastException ex) {
+            String clsname = o.getClass().getName();
+            return NetworkPolicyModel.class.getName().compareTo(clsname);
+        }
+        return _uuid.compareTo(other._uuid);
+    }
+    
+    @Override
+    public void delete(ModelController controller) throws IOException {
+        ApiConnector api = controller.getApiAccessor();
+        if (_policy != null) {
+            api.delete(_policy);
+            _policy = null;
+        }
+    }
+    
+    @Override
+    public void destroy(ModelController controller) throws IOException {
+    }
+    
+  
+    public String getUuid() {
+        return _uuid;
+    }
+    
+    @Override
+    public void update(ModelController controller) throws InternalErrorException, IOException {
+        ApiConnector api = controller.getApiAccessor();
+        if (_project == null) {
+            s_logger.debug("Project is null for the policy: " + _name);
+            throw new IOException("Project is null for the policy: " + _name);
+        } 
+
+        NetworkPolicy policy = _policy;
+
+        if (policy == null) {
+            try {
+                String policyId = api.findByName(NetworkPolicy.class, _project, _name);
+                if (policyId != null) {
+                    policy = _policy = (NetworkPolicy) api.findById(NetworkPolicy.class, policyId);
+                }
+                if (policy == null) {
+                    policy = new NetworkPolicy();
+                    policy.setUuid(_uuid);
+                    policy.setName(_name);
+                    policy.setParent(_project);
+                }
+            } catch (IOException ex) {
+                s_logger.warn("network-policy read", ex);
+                return;
+            }
+        }
+        
+        policy.setEntries(_policyMap);
+        if (_policy == null) {
+            try {
+                api.create(policy);
+            } catch (Exception ex) {
+                s_logger.debug("network policy create", ex);
+                throw new CloudRuntimeException("Failed to create network policy", ex);
+            }
+            _policy = policy;
+        } else {
+            try {
+                api.update(policy);
+            } catch (IOException ex) {
+                s_logger.warn("network policy update", ex);
+                throw new CloudRuntimeException("Unable to update network policy", ex);
+            }            
+        }
+        for (ModelObject successor: successors()) {
+            successor.update(controller);
+        }
+    }
+
+    @Override
+    public boolean verify(ModelController controller) {
+        return false;
+    }
+
+    @Override
+    public boolean compare(ModelController controller, ModelObject current) {
+        return true;
+    }
+
+    public void setProperties(ModelController controller, List<? extends NetworkACLItem> rules) {
+        
+    }
+
+    public void setProject(Project project) {
+        _project = project;
+    }
+
+    public NetworkPolicy getPolicy() {
+        return _policy;
+    }
+    
+}

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/ServiceInstanceModel.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/ServiceInstanceModel.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/ServiceInstanceModel.java
index 20b80be..31c052c 100644
--- a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/ServiceInstanceModel.java
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/ServiceInstanceModel.java
@@ -20,10 +20,10 @@ package org.apache.cloudstack.network.contrail.model;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.UUID;
 
 import javax.inject.Inject;
 
-import org.apache.cloudstack.network.contrail.management.ContrailManager;
 import org.apache.commons.lang.StringUtils;
 import org.apache.log4j.Logger;
 
@@ -39,6 +39,7 @@ import net.juniper.contrail.api.types.ServiceTemplateType;
 import net.juniper.contrail.api.types.VirtualNetwork;
 import net.juniper.contrail.api.types.VirtualNetworkPolicyType;
 import net.juniper.contrail.api.ApiConnector;
+import org.apache.cloudstack.network.contrail.management.ContrailManager;
 
 import com.cloud.offering.ServiceOffering;
 import com.cloud.template.VirtualMachineTemplate;
@@ -57,11 +58,11 @@ public class ServiceInstanceModel extends ModelObjectBase {
     private String _templateName;
     private String _templateId;
     private String _templateUrl;
-    private VirtualNetwork _left;
-    private VirtualNetwork _right;
+    private VirtualNetworkModel _left;
+    private VirtualNetworkModel _right;
     private ServiceTemplate _tmpl;
     private ServiceInstance _serviceInstance;
-    private NetworkPolicy _policy;
+    private NetworkPolicyModel _policy;
 
     /**
      * Create a ServiceInstance as result of an API call.
@@ -74,7 +75,7 @@ public class ServiceInstanceModel extends ModelObjectBase {
      * @param right
      */
     public ServiceInstanceModel(Project project, String name, VirtualMachineTemplate template,
-            ServiceOffering serviceOffering, VirtualNetwork left, VirtualNetwork right) {
+            ServiceOffering serviceOffering, VirtualNetworkModel left, VirtualNetworkModel right) {
         String parent_name;
         if (project != null) {
             parent_name = StringUtils.join(project.getQualifiedName(), ':');
@@ -87,8 +88,8 @@ public class ServiceInstanceModel extends ModelObjectBase {
                 + ContrailManager.managementNetworkName;
         _left = left;
         _right = right;
-        _leftName = StringUtils.join(left.getQualifiedName(), ":");
-        _rightName = StringUtils.join(right.getQualifiedName(), ":");
+        _leftName = StringUtils.join(left.getVirtualNetwork().getQualifiedName(), ":");
+        _rightName = StringUtils.join(right.getVirtualNetwork().getQualifiedName(), ":");
         
         _templateName = template.getName();
         _templateId = template.getUuid();
@@ -113,31 +114,6 @@ public class ServiceInstanceModel extends ModelObjectBase {
         return _fq_name.substring(_fq_name.lastIndexOf(':') + 1);
     }
     
-    private void applyNetworkPolicy(ModelController controller, NetworkPolicy policy,
-            VirtualNetwork left, VirtualNetwork right) {
-        left.setNetworkPolicy(policy, new VirtualNetworkPolicyType(
-                new VirtualNetworkPolicyType.SequenceType(1, 0), null));
-        // TODO: network_ipam_refs attr is missing
-        left.clearNetworkIpam();
-        try {
-            ApiConnector api = controller.getApiAccessor();
-            api.update(left);
-        } catch (IOException ex) {
-            throw new CloudRuntimeException("Unable to update virtual-network", ex);
-        }
-        
-        right.setNetworkPolicy(policy, new VirtualNetworkPolicyType(
-                new VirtualNetworkPolicyType.SequenceType(1, 0), null));
-        // TODO: network_ipam_refs attr is missing
-        right.clearNetworkIpam();
-        try {
-            ApiConnector api = controller.getApiAccessor();
-            api.update(right);
-        } catch (IOException ex) {
-            throw new CloudRuntimeException("Unable to update virtual-network", ex);
-        }
-    }
-
     /**
      * Recreate the model object from the Contrail API which is the master for this type of object.
      * @param siObj
@@ -157,18 +133,6 @@ public class ServiceInstanceModel extends ModelObjectBase {
                 s_logger.warn("service-template read", ex);
             }
         }
-        try {
-            Project project = (Project) api.findById(Project.class, siObj.getParentUuid());
-            if (project != null) {
-                _projectId = project.getUuid();
-            }
-            String policyId = api.findByName(NetworkPolicy.class, project, siObj.getName());
-            if (policyId != null) {
-                _policy = (NetworkPolicy) api.findById(NetworkPolicy.class, policyId);
-            }
-        } catch (IOException ex) {
-            s_logger.warn("network-policy read", ex);
-        }
     }
     
     @Override
@@ -213,42 +177,53 @@ public class ServiceInstanceModel extends ModelObjectBase {
         
         return si_obj;
     }
-    
-    private NetworkPolicy createServicePolicy(ModelController controller) {
-        NetworkPolicy policy = new NetworkPolicy();
-        policy.setParent(_serviceInstance.getParent());
-        policy.setName(_serviceInstance.getName());
-        PolicyEntriesType policy_map = new PolicyEntriesType();
-        List<PolicyRuleType.AddressType> srcList = new ArrayList<PolicyRuleType.AddressType>();
-        srcList.add(new PolicyRuleType.AddressType(null, _leftName, null));
-        List<PolicyRuleType.AddressType> dstList = new ArrayList<PolicyRuleType.AddressType>();
-        dstList.add(new PolicyRuleType.AddressType(null, _rightName, null));
+
+    private void clearServicePolicy(ModelController controller) {
+    	_left.addToNetworkPolicy(null);
+    	_right.addToNetworkPolicy(null);
+    	try {
+            controller.getManager().getDatabase().getNetworkPolicys().remove(_policy);
+            _policy.delete(controller.getManager().getModelController());
+            _policy = null;
+        } catch (Exception e) {
+            s_logger.error(e);
+        }
+    	try {
+            _left.update(controller.getManager().getModelController());
+            _right.update(controller.getManager().getModelController());
+        } catch (Exception ex) {
+            s_logger.error("virtual-network update for policy delete: ", ex);
+        }
+    }
+
+    private NetworkPolicyModel setServicePolicy(ModelController controller) {
+    	NetworkPolicyModel policyModel = new NetworkPolicyModel(UUID.randomUUID().toString(), _serviceInstance.getName());
+    	policyModel.setProject((Project)_serviceInstance.getParent());
+    	_left.addToNetworkPolicy(policyModel);
+    	_right.addToNetworkPolicy(policyModel);
         List<String> siList = new ArrayList<String>();
         siList.add(StringUtils.join(_serviceInstance.getQualifiedName(), ':'));
-        List<PolicyRuleType.PortType> portAny = new ArrayList<PolicyRuleType.PortType>();
-        portAny.add(new PolicyRuleType.PortType(0, 65535));
-        
-        PolicyRuleType rule = new PolicyRuleType(
-                new PolicyRuleType.SequenceType(1, 0), /* uuid */ null, "<>", "any",
-                srcList, portAny, /* application */ null, dstList, portAny,
-                new PolicyRuleType.ActionListType("pass", "in-network", siList, null));
-        policy_map.addPolicyRule(rule);
-        policy.setEntries(policy_map);
-        
-        try {
-            ApiConnector api = controller.getApiAccessor();
-            if (!api.create(policy)) {
-                throw new CloudRuntimeException("Unable to create network-policy");
+    	try {
+            policyModel.build(controller.getManager().getModelController(), _leftName, _rightName, "in-network", siList, "pass");
+        } catch (Exception e) {
+            s_logger.error(e);
+            return null;
+        }
+    	try {
+            if (!policyModel.verify(controller.getManager().getModelController())) {
+                policyModel.update(controller.getManager().getModelController());
             }
-        } catch (IOException ex) {
-            throw new CloudRuntimeException("Unable to create network-policy", ex);
+            controller.getManager().getDatabase().getNetworkPolicys().add(policyModel);
+        } catch (Exception ex) {
+            s_logger.error("network-policy update: ", ex);
         }
-        return policy;
+        return policyModel;
     }
     
     @Override
     public void delete(ModelController controller) throws IOException {
         ApiConnector api = controller.getApiAccessor();
+        clearServicePolicy(controller);
         if (_serviceInstance != null) {
             api.delete(_serviceInstance);
         }
@@ -299,9 +274,7 @@ public class ServiceInstanceModel extends ModelObjectBase {
         }
         _uuid = _serviceInstance.getUuid();
         if (_policy == null) {
-            _policy = createServicePolicy(controller);
-            // TODO: update the network model objects and call update
-            applyNetworkPolicy(controller, _policy, _left, _right);
+            _policy = setServicePolicy(controller);
         }
     }
 

http://git-wip-us.apache.org/repos/asf/cloudstack/blob/343b6aca/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/VirtualMachineModel.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/VirtualMachineModel.java b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/VirtualMachineModel.java
index ec20a94..ec28798 100644
--- a/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/VirtualMachineModel.java
+++ b/plugins/network-elements/juniper-contrail/src/org/apache/cloudstack/network/contrail/model/VirtualMachineModel.java
@@ -22,8 +22,8 @@ import java.util.List;
 import java.util.Map;
 import java.util.TreeSet;
 
-import org.apache.cloudstack.network.contrail.management.ContrailManager;
 import org.apache.log4j.Logger;
+import org.apache.commons.lang.StringUtils;
 
 import com.cloud.exception.InternalErrorException;
 import com.cloud.network.dao.NetworkDao;
@@ -40,6 +40,7 @@ import net.juniper.contrail.api.types.Project;
 import net.juniper.contrail.api.types.ServiceInstance;
 import net.juniper.contrail.api.types.VirtualMachine;
 import net.juniper.contrail.api.ApiConnector;
+import org.apache.cloudstack.network.contrail.management.ContrailManager;
 
 public class VirtualMachineModel extends ModelObjectBase {
     private static final Logger s_logger = Logger.getLogger(VirtualMachineModel.class);
@@ -101,18 +102,27 @@ public class VirtualMachineModel extends ModelObjectBase {
         ApiConnector api = controller.getApiAccessor();
         _serviceUuid = serviceUuid;
         
-        ServiceInstanceModel siModel = manager.getDatabase().lookupServiceInstance(serviceUuid);
-        if (siModel == null) {
-            ServiceInstance siObj;
-            try {
-                siObj = (ServiceInstance) api.findById(ServiceInstance.class, serviceUuid);
-            } catch (IOException ex) {
-                s_logger.warn("service-instance read", ex);
-                throw new CloudRuntimeException("Unable to read service-instance object", ex);
-            }
-            if (siObj == null) {
-                siModel = new ServiceInstanceModel(serviceUuid);
-                siModel.build(controller, siObj);
+        ServiceInstance siObj;
+        try {
+            siObj = (ServiceInstance) api.findById(ServiceInstance.class, serviceUuid);
+        } catch (IOException ex) {
+            s_logger.warn("service-instance read", ex);
+            throw new CloudRuntimeException("Unable to read service-instance object", ex);
+        }
+        ServiceInstanceModel siModel;
+        if (siObj == null) {
+            siModel = new ServiceInstanceModel(serviceUuid);
+            siModel.build(controller, siObj);
+            manager.getDatabase().getServiceInstances().add(siModel);
+        } else {
+            String fqn = StringUtils.join(siObj.getQualifiedName(), ':');
+            siModel = manager.getDatabase().lookupServiceInstance(fqn);
+            if (siModel == null) {
+                if (siObj == null) {
+                    siModel = new ServiceInstanceModel(serviceUuid);
+                    siModel.build(controller, siObj);
+                    manager.getDatabase().getServiceInstances().add(siModel);
+                }
             }
         }
         _serviceModel = siModel;
@@ -337,8 +347,23 @@ public class VirtualMachineModel extends ModelObjectBase {
     
     @Override
     public boolean verify(ModelController controller) {
-        // TODO Auto-generated method stub
-        return false;
+        assert _initialized : "initialized is false";
+        assert _uuid != null : "uuid is not set";
+        ApiConnector api = controller.getApiAccessor();
+        try {
+            _vm = (VirtualMachine) api.findById(VirtualMachine.class, _uuid);
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+        if (_vm == null) {
+            return false;
+        }
+        for (ModelObject successor: successors()) {
+            if (!successor.verify(controller)) {
+                return false;
+            }
+        }
+        return true;
     }
 
     @Override