529 explain return path #627
Conversation
…edStatefulConnectionsOld
…rectional no longer needed
…Properties.conn is no longer required for report endpoints and report subnets
…tring no longer needed
|
@ShiriMoran please add the issue referred to this PR, and a short description of this PR. |
| ==================================================================== | ||
|
|
||
| Allowed connections from vsi3a-ky[10.240.30.5] to vsi1-ky[10.240.10.4]: All Connections | ||
| TCP respond is enabled on protocol: TCP src-ports: 1-50 dst-ports: 1-600 |
There was a problem hiding this comment.
| TCP respond is enabled on protocol: TCP src-ports: 1-50 dst-ports: 1-600 | |
| TCP response is enabled on protocol: TCP src-ports: 1-50 dst-ports: 1-600 |
| security group sg1-ky allows connection with the following allow rules | ||
| index: 4, direction: inbound, conns: protocol: all, remote: sg3-ky (10.240.30.5/32,10.240.30.6/32), local: 0.0.0.0/0 | ||
|
|
||
| TCP respond partly enabled by the following rules: |
There was a problem hiding this comment.
| TCP respond partly enabled by the following rules: | |
| TCP response partly enabled by the following rules: |
There was a problem hiding this comment.
is there a test example where TCP response is not enabled at all? what is the output in such case?
There was a problem hiding this comment.
can you add a link to the output file for this test?
do you specify by which NACL it is blocked?
There was a problem hiding this comment.
Here
The blocking NACL + rules are specified in debug ("Verbose") mode.
Not sure we want to add a blocking path. In most cases it is redundant and having such a path only in a small subset of the cases may be confusing. Lets discuss.
Resolves #529 - adds responsive details in explainability |
If this issue should be closed with this PR, it should also be linked to this PR. |
…9_explain_return_path
…nt src and dst ports will be tested. The test failed and so a bug was fixed.
There was a problem hiding this comment.
please add a variation of this test, where both rules from src-to-dst and rules from dst-to-src add constraints on permitted TCP ports , so intersection is validated from all ingress&egress rules of both directions.
|
|
||
| Details: | ||
| ~~~~~~~~ | ||
| Path enabled by the following rules: |
There was a problem hiding this comment.
| Path enabled by the following rules: | |
| Path is enabled by the following rules: |
| security group sg1-ky allows connection with the following allow rules | ||
| index: 4, direction: inbound, conns: protocol: all, remote: sg3-ky (10.240.30.5/32,10.240.30.6/32), local: 0.0.0.0/0 | ||
|
|
||
| TCP response partly enabled by the following rules: |
There was a problem hiding this comment.
| TCP response partly enabled by the following rules: | |
| TCP response is partly enabled by the following rules: |
No description provided.