529 explain return path

pkg/ibmvpc/examples/out/explain_out/GroupingExternalSG1_all_vpcs_explain_debug.txt

@@ -11,11 +11,12 @@ Path:
 
 Details:
 ~~~~~~~~
-Egress:
-security group sg1-ky allows connection with the following allow rules
-	index: 2, direction: outbound,  conns: protocol: udp,  dstPorts: 1-65535, remote: 161.26.0.0/16, local: 0.0.0.0/0
-network ACL acl1-ky allows connection with the following allow rules
-	index: 0, direction: outbound , src: 0.0.0.0/0 , dst: 0.0.0.0/0, conn: all, action: allow
+Path enabled by the following rules:
+	Egress:
+		security group sg1-ky allows connection with the following allow rules
+			index: 2, direction: outbound,  conns: protocol: udp,  dstPorts: 1-65535, remote: 161.26.0.0/16, local: 0.0.0.0/0
+		network ACL acl1-ky allows connection with the following allow rules
+			index: 0, direction: outbound , src: 0.0.0.0/0 , dst: 0.0.0.0/0, conn: all, action: allow
 
 ------------------------------------------------------------------------------------------------------------------------
 
@@ -31,10 +32,11 @@ Path:
 
 Details:
 ~~~~~~~~
-Egress:
-security group sg1-ky blocks connection since there are no relevant allow rules
-network ACL acl1-ky allows connection with the following allow rules
-	index: 0, direction: outbound , src: 0.0.0.0/0 , dst: 0.0.0.0/0, conn: all, action: allow
+Path enabled by the following rules:
+	Egress:
+		security group sg1-ky blocks connection since there are no relevant allow rules
+		network ACL acl1-ky allows connection with the following allow rules
+			index: 0, direction: outbound , src: 0.0.0.0/0 , dst: 0.0.0.0/0, conn: all, action: allow
 
 ------------------------------------------------------------------------------------------------------------------------
 

pkg/ibmvpc/examples/out/explain_out/IksNodeToIksNode_all_vpcs_explain_debug.txt

@@ -2,6 +2,7 @@ Explaining connectivity from 192.168.8.4 (iks-node[192.168.8.4]) to 192.168.4.4
 ==========================================================================================================================
 
 Allowed connections from iks-node[192.168.8.4] to iks-node[192.168.4.4]: All Connections
+	The TCP sub-connection is responsive
 
 Path:
 	iks-node[192.168.8.4] -> security group[kube-clusterid:1, ky-test-default-sg] -> ky-test-private-subnet-3 -> network ACL ky-test-private-2-others-acl -> 
@@ -10,25 +11,35 @@ Path:
 
 Details:
 ~~~~~~~~
-Egress:
-security group kube-clusterid:1 allows connection with the following allow rules
-	index: 8, direction: outbound,  conns: protocol: all, remote: kube-clusterid:1 (192.168.0.4/32,192.168.4.4/32,192.168.8.4/32,192.168.16.4/32,192.168.20.4/32,192.168.24.4/32,192.168.32.4/32,192.168.36.4/32,192.168.40.4/32), local: 0.0.0.0/0
-security group ky-test-default-sg allows connection with the following allow rules
-	index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
-network ACL ky-test-private-2-others-acl allows connection with the following allow rules
-	index: 6, direction: outbound , src: 0.0.0.0/0 , dst: 192.168.0.0/20, conn: all, action: allow
-
-Ingress:
-network ACL ky-test-private-2-others-acl allows connection with the following allow rules
-	index: 2, direction: inbound , src: 192.168.0.0/20 , dst: 0.0.0.0/0, conn: all, action: allow
-security group kube-clusterid:1 allows connection with the following allow rules
-	index: 3, direction: inbound,  conns: protocol: tcp,  dstPorts: 30000-32767, remote: 0.0.0.0/0, local: 0.0.0.0/0
-	index: 4, direction: inbound,  conns: protocol: udp,  dstPorts: 30000-32767, remote: 0.0.0.0/0, local: 0.0.0.0/0
-	index: 6, direction: inbound,  conns: protocol: icmp,  icmpType: protocol: ICMP icmp-type: 8, remote: 0.0.0.0/0, local: 0.0.0.0/0
-	index: 7, direction: inbound,  conns: protocol: all, remote: kube-clusterid:1 (192.168.0.4/32,192.168.4.4/32,192.168.8.4/32,192.168.16.4/32,192.168.20.4/32,192.168.24.4/32,192.168.32.4/32,192.168.36.4/32,192.168.40.4/32), local: 0.0.0.0/0
-security group ky-test-default-sg allows connection with the following allow rules
-	index: 1, direction: inbound,  conns: protocol: all, remote: ky-test-default-sg (192.168.0.4/32,192.168.4.4/32,192.168.8.4/32,192.168.16.4/32,192.168.20.4/32,192.168.24.4/32,192.168.32.4/32,192.168.36.4/32,192.168.40.4/32), local: 0.0.0.0/0
-	index: 2, direction: inbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+Path enabled by the following rules:
+	Egress:
+		security group kube-clusterid:1 allows connection with the following allow rules
+			index: 8, direction: outbound,  conns: protocol: all, remote: kube-clusterid:1 (192.168.0.4/32,192.168.4.4/32,192.168.8.4/32,192.168.16.4/32,192.168.20.4/32,192.168.24.4/32,192.168.32.4/32,192.168.36.4/32,192.168.40.4/32), local: 0.0.0.0/0
+		security group ky-test-default-sg allows connection with the following allow rules
+			index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+		network ACL ky-test-private-2-others-acl allows connection with the following allow rules
+			index: 6, direction: outbound , src: 0.0.0.0/0 , dst: 192.168.0.0/20, conn: all, action: allow
+
+	Ingress:
+		network ACL ky-test-private-2-others-acl allows connection with the following allow rules
+			index: 2, direction: inbound , src: 192.168.0.0/20 , dst: 0.0.0.0/0, conn: all, action: allow
+		security group kube-clusterid:1 allows connection with the following allow rules
+			index: 3, direction: inbound,  conns: protocol: tcp,  dstPorts: 30000-32767, remote: 0.0.0.0/0, local: 0.0.0.0/0
+			index: 4, direction: inbound,  conns: protocol: udp,  dstPorts: 30000-32767, remote: 0.0.0.0/0, local: 0.0.0.0/0
+			index: 6, direction: inbound,  conns: protocol: icmp,  icmpType: protocol: ICMP icmp-type: 8, remote: 0.0.0.0/0, local: 0.0.0.0/0
+			index: 7, direction: inbound,  conns: protocol: all, remote: kube-clusterid:1 (192.168.0.4/32,192.168.4.4/32,192.168.8.4/32,192.168.16.4/32,192.168.20.4/32,192.168.24.4/32,192.168.32.4/32,192.168.36.4/32,192.168.40.4/32), local: 0.0.0.0/0
+		security group ky-test-default-sg allows connection with the following allow rules
+			index: 1, direction: inbound,  conns: protocol: all, remote: ky-test-default-sg (192.168.0.4/32,192.168.4.4/32,192.168.8.4/32,192.168.16.4/32,192.168.20.4/32,192.168.24.4/32,192.168.32.4/32,192.168.36.4/32,192.168.40.4/32), local: 0.0.0.0/0
+			index: 2, direction: inbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+
+TCP respond enabled by the following rules:
+	Egress:
+		network ACL ky-test-private-2-others-acl allows connection with the following allow rules
+			index: 6, direction: outbound , src: 0.0.0.0/0 , dst: 192.168.0.0/20, conn: all, action: allow
+
+	Ingress:
+		network ACL ky-test-private-2-others-acl allows connection with the following allow rules
+			index: 2, direction: inbound , src: 192.168.0.0/20 , dst: 0.0.0.0/0, conn: all, action: allow
 
 ------------------------------------------------------------------------------------------------------------------------
 

pkg/ibmvpc/examples/out/explain_out/NACLExternal1_all_vpcs_explain_debug.txt

@@ -11,11 +11,12 @@ Path:
 
 Details:
 ~~~~~~~~
-Egress:
-security group sg1-ky allows connection with the following allow rules
-	index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
-network ACL acl1-ky allows connection with the following allow rules
-	index: 1, direction: outbound , src: 10.240.10.0/24 , dst: 161.26.0.0/16, conn: protocol: udp, srcPorts: 1-65535, dstPorts: 1-65535, action: allow
+Path enabled by the following rules:
+	Egress:
+		security group sg1-ky allows connection with the following allow rules
+			index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+		network ACL acl1-ky allows connection with the following allow rules
+			index: 1, direction: outbound , src: 10.240.10.0/24 , dst: 161.26.0.0/16, conn: protocol: udp, srcPorts: 1-65535, dstPorts: 1-65535, action: allow
 
 ------------------------------------------------------------------------------------------------------------------------
 

pkg/ibmvpc/examples/out/explain_out/NACLExternal2_all_vpcs_explain_debug.txt

@@ -13,10 +13,11 @@ Path:
 
 Details:
 ~~~~~~~~
-Egress:
-security group sg1-ky allows connection with the following allow rules
-	index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
-network ACL acl1-ky blocks connection since there are no relevant allow rules
+Path enabled by the following rules:
+	Egress:
+		security group sg1-ky allows connection with the following allow rules
+			index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+		network ACL acl1-ky blocks connection since there are no relevant allow rules
 
 ------------------------------------------------------------------------------------------------------------------------
 

pkg/ibmvpc/examples/out/explain_out/NACLGrouping_all_vpcs_explain_debug.txt

@@ -11,11 +11,12 @@ Path:
 
 Details:
 ~~~~~~~~
-Egress:
-security group sg1-ky allows connection with the following allow rules
-	index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
-network ACL acl1-ky allows connection with the following allow rules
-	index: 1, direction: outbound , src: 10.240.10.0/24 , dst: 161.26.0.0/16, conn: protocol: udp, srcPorts: 1-65535, dstPorts: 1-65535, action: allow
+Path enabled by the following rules:
+	Egress:
+		security group sg1-ky allows connection with the following allow rules
+			index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+		network ACL acl1-ky allows connection with the following allow rules
+			index: 1, direction: outbound , src: 10.240.10.0/24 , dst: 161.26.0.0/16, conn: protocol: udp, srcPorts: 1-65535, dstPorts: 1-65535, action: allow
 
 ------------------------------------------------------------------------------------------------------------------------
 
@@ -31,10 +32,11 @@ Path:
 
 Details:
 ~~~~~~~~
-Egress:
-security group sg1-ky allows connection with the following allow rules
-	index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
-network ACL acl1-ky blocks connection since there are no relevant allow rules
+Path enabled by the following rules:
+	Egress:
+		security group sg1-ky allows connection with the following allow rules
+			index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+		network ACL acl1-ky blocks connection since there are no relevant allow rules
 
 ------------------------------------------------------------------------------------------------------------------------
 

pkg/ibmvpc/examples/out/explain_out/NACLInternal1_all_vpcs_explain.txt

@@ -2,6 +2,7 @@ Explaining connectivity from 10.240.10.4 (vsi1-ky[10.240.10.4]) to vsi2-ky withi
 ==============================================================================================
 
 Allowed connections from vsi1-ky[10.240.10.4] to vsi2-ky[10.240.20.4]: protocol: TCP,UDP
+	The TCP sub-connection is responsive
 
 Path:
 	vsi1-ky[10.240.10.4] -> security group sg1-ky -> subnet1-ky -> network ACL acl1-ky -> 

pkg/ibmvpc/examples/out/explain_out/NACLInternal1_all_vpcs_explain_debug.txt

@@ -2,6 +2,7 @@ Explaining connectivity from vsi1-ky to 10.240.20.4 (vsi2-ky[10.240.20.4]) withi
 ==============================================================================================
 
 Allowed connections from vsi1-ky[10.240.10.4] to vsi2-ky[10.240.20.4]: protocol: TCP,UDP
+	The TCP sub-connection is responsive
 
 Path:
 	vsi1-ky[10.240.10.4] -> security group sg1-ky -> subnet1-ky -> network ACL acl1-ky -> 
@@ -10,18 +11,28 @@ Path:
 
 Details:
 ~~~~~~~~
-Egress:
-security group sg1-ky allows connection with the following allow rules
-	index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
-network ACL acl1-ky allows connection with the following allow and deny rules
-	index: 0, direction: outbound , src: 10.240.10.0/24 , dst: 10.240.20.0/24, conn: protocol: icmp, action: deny
-	index: 2, direction: outbound , src: 10.240.10.0/24 , dst: 10.240.20.0/24, conn: all, action: allow
-
-Ingress:
-network ACL acl2-ky allows connection with the following allow rules
-	index: 6, direction: inbound , src: 10.240.10.0/24 , dst: 10.240.20.0/24, conn: all, action: allow
-security group sg1-ky allows connection with the following allow rules
-	index: 1, direction: inbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+Path enabled by the following rules:
+	Egress:
+		security group sg1-ky allows connection with the following allow rules
+			index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+		network ACL acl1-ky allows connection with the following allow and deny rules
+			index: 0, direction: outbound , src: 10.240.10.0/24 , dst: 10.240.20.0/24, conn: protocol: icmp, action: deny
+			index: 2, direction: outbound , src: 10.240.10.0/24 , dst: 10.240.20.0/24, conn: all, action: allow
+
+	Ingress:
+		network ACL acl2-ky allows connection with the following allow rules
+			index: 6, direction: inbound , src: 10.240.10.0/24 , dst: 10.240.20.0/24, conn: all, action: allow
+		security group sg1-ky allows connection with the following allow rules
+			index: 1, direction: inbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+
+TCP respond enabled by the following rules:
+	Egress:
+		network ACL acl2-ky allows connection with the following allow rules
+			index: 2, direction: outbound , src: 10.240.20.0/24 , dst: 10.240.10.0/24, conn: all, action: allow
+
+	Ingress:
+		network ACL acl1-ky allows connection with the following allow rules
+			index: 4, direction: inbound , src: 10.240.20.0/24 , dst: 10.240.10.0/24, conn: all, action: allow
 
 ------------------------------------------------------------------------------------------------------------------------
 

pkg/ibmvpc/examples/out/explain_out/NACLInternal2_all_vpcs_explain_debug.txt

@@ -2,6 +2,7 @@ Explaining connectivity from vsi2-ky to 10.240.10.4 (vsi1-ky[10.240.10.4]) withi
 ==============================================================================================
 
 Allowed connections from vsi2-ky[10.240.20.4] to vsi1-ky[10.240.10.4]: All Connections
+	The TCP sub-connection is responsive
 
 Path:
 	vsi2-ky[10.240.20.4] -> security group sg1-ky -> subnet2-ky -> network ACL acl2-ky -> 
@@ -10,17 +11,27 @@ Path:
 
 Details:
 ~~~~~~~~
-Egress:
-security group sg1-ky allows connection with the following allow rules
-	index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
-network ACL acl2-ky allows connection with the following allow rules
-	index: 2, direction: outbound , src: 10.240.20.0/24 , dst: 10.240.10.0/24, conn: all, action: allow
-
-Ingress:
-network ACL acl1-ky allows connection with the following allow rules
-	index: 4, direction: inbound , src: 10.240.20.0/24 , dst: 10.240.10.0/24, conn: all, action: allow
-security group sg1-ky allows connection with the following allow rules
-	index: 1, direction: inbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+Path enabled by the following rules:
+	Egress:
+		security group sg1-ky allows connection with the following allow rules
+			index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+		network ACL acl2-ky allows connection with the following allow rules
+			index: 2, direction: outbound , src: 10.240.20.0/24 , dst: 10.240.10.0/24, conn: all, action: allow
+
+	Ingress:
+		network ACL acl1-ky allows connection with the following allow rules
+			index: 4, direction: inbound , src: 10.240.20.0/24 , dst: 10.240.10.0/24, conn: all, action: allow
+		security group sg1-ky allows connection with the following allow rules
+			index: 1, direction: inbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+
+TCP respond enabled by the following rules:
+	Egress:
+		network ACL acl1-ky allows connection with the following allow rules
+			index: 2, direction: outbound , src: 10.240.10.0/24 , dst: 10.240.20.0/24, conn: all, action: allow
+
+	Ingress:
+		network ACL acl2-ky allows connection with the following allow rules
+			index: 6, direction: inbound , src: 10.240.10.0/24 , dst: 10.240.20.0/24, conn: all, action: allow
 
 ------------------------------------------------------------------------------------------------------------------------
 

pkg/ibmvpc/examples/out/explain_out/NACLInternal3_all_vpcs_explain_debug.txt

@@ -13,16 +13,17 @@ Path:
 
 Details:
 ~~~~~~~~
-Egress:
-security group sg1-ky allows connection with the following allow rules
-	index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
-network ACL acl1-ky blocks connection since there are no relevant allow rules
-
-Ingress:
-network ACL acl3-ky allows connection with the following allow rules
-	index: 2, direction: inbound , src: 10.240.10.0/24 , dst: 0.0.0.0/0, conn: all, action: allow
-security group sg1-ky allows connection with the following allow rules
-	index: 1, direction: inbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+Path enabled by the following rules:
+	Egress:
+		security group sg1-ky allows connection with the following allow rules
+			index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+		network ACL acl1-ky blocks connection since there are no relevant allow rules
+
+	Ingress:
+		network ACL acl3-ky allows connection with the following allow rules
+			index: 2, direction: inbound , src: 10.240.10.0/24 , dst: 0.0.0.0/0, conn: all, action: allow
+		security group sg1-ky allows connection with the following allow rules
+			index: 1, direction: inbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
 
 ------------------------------------------------------------------------------------------------------------------------
 

pkg/ibmvpc/examples/out/explain_out/NACLInternal4_all_vpcs_explain_debug.txt

@@ -2,6 +2,7 @@ Explaining connectivity from vsi3b-ky to vsi3a-ky within test-vpc1-ky
 =====================================================================
 
 Allowed connections from vsi3b-ky[10.240.30.6] to vsi3a-ky[10.240.30.5]: All Connections
+	The TCP sub-connection is responsive
 
 Path:
 	vsi3b-ky[10.240.30.6] -> security group sg1-ky -> 
@@ -10,13 +11,14 @@ Path:
 
 Details:
 ~~~~~~~~
-Egress:
-security group sg1-ky allows connection with the following allow rules
-	index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+Path enabled by the following rules:
+	Egress:
+		security group sg1-ky allows connection with the following allow rules
+			index: 0, direction: outbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
 
-Ingress:
-security group sg1-ky allows connection with the following allow rules
-	index: 1, direction: inbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
+	Ingress:
+		security group sg1-ky allows connection with the following allow rules
+			index: 1, direction: inbound,  conns: protocol: all, remote: 0.0.0.0/0, local: 0.0.0.0/0
 
 ------------------------------------------------------------------------------------------------------------------------