[jira] [Commented] (CLOUDSTACK-6761) Destroying an Instance that has a Static NAT bound, the security policy is removed and the firewall filter term is removed however the proxy-arp entry is not

["ASF subversion and git services (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CLOUDSTACK-6761?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14212099#comment-14212099 ] 

ASF subversion and git services commented on CLOUDSTACK-6761:
-------------------------------------------------------------

Commit d81b67939fc7290e4026e037c313a12bbe9bd762 in cloudstack's branch refs/heads/4.3 from Jayapal
[ https://git-wip-us.apache.org/repos/asf?p=cloudstack.git;h=d81b679 ]

CLOUDSTACK-6761: Fixed removing proxy arp rule on deleting static nat or PF rule on ip

 The proxy-arp add/del is done on firewall rule add/del.
 The proxy-arp rule is deleted only when there is no static nat or dest nat rule is not using the ip.

 When there is static nat or PF and firewall rule
   a. Delete firewall rule. It skips delete proxy-arp because the rule is used by static nat rule.
   b. After deleting fw rule if we disable static nat there is no way to delete proxy-arp rule.

   On VM expunge we are deleting firewall rules first then static nat rules. This caused the stale proxy-arp
   rules.

   With this fix adding/deleting proxy arp rule on static nat/PF rule add/del.

(cherry picked from commit 19668713ed2f12e61f538a238422d7dfd4841009)
Signed-off-by: Rohit Yadav <ro...@shapeblue.com>


> Destroying an Instance that has a Static NAT bound, the security policy is removed and the firewall filter term is removed however the proxy-arp entry is not
> -------------------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CLOUDSTACK-6761
>                 URL: https://issues.apache.org/jira/browse/CLOUDSTACK-6761
>             Project: CloudStack
>          Issue Type: Bug
>      Security Level: Public(Anyone can view this level - this is the default.) 
>          Components: Network Controller
>    Affects Versions: 4.0.0
>            Reporter: Jayapal Reddy
>            Assignee: Jayapal Reddy
>             Fix For: 4.4.0
>
>
> When destroying an Instance that has a Static NAT bound, the security policy is removed and the firewall filter term is removed however the proxy-arp entry is not
> This causing issue when network is configured with SRX and load balancer.
> For the same ip responses comes for two devices depending on who receives first.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)