I have 8.3 architecture with MM and MDs with some configuration is global on folder level and some local on MD.s.
I have overwritten firewall CP rules on MD level.
But now when I want to remove local firewall CP I cannot remove last IPv6 rule
ipv6 deny any proto 0 ports 0 65535
When I try to remove it says
Invalid data: FW CP ACL not found
I would like to use inherited firewall CP, but this last rule seems to block inheritance
Any idea ? I appreciate any help
Have you tried a show "configuration effective detail" to see where this line of config is being derived from?
Thanks for reply
I have checked it now once more, this ACL rule is local.
If the controller configuration still can not be removed, I would try turning on disaster recovery with the "disaster-recovery on" command when your in MD connect or ssh directly into the controller, and then try to remove the configuration. When you're done turn disaster recovery off.
If it still doesn't go away, try a reboot. Next step after that may be a call to TAC.
From disaster-recovery mode it is the same - cannot delete ACL rule
It seems it is a kind of default deny any for all protocols and ports
I would call this problem to TAC
User roles typically end with an implicit deny all ... so anything not matched and acted on by policies will get dropped if there is no match. That may be what this is.
Where/how are you seeing the rule in question? Is it in the config file, show command output, etc?
it isn't user policy but in firewall cp
I see it in CLI and GUI.
In CLI ther is following entry
firewall cp ipv6 deny any proto 0 ports 0 65535
When I try to delete it I have message:
When I try to delete it from GUI message is a little bit different
Error: expecting integer from 0 to 254
Why are you trying to remove control plane firewall policies? That is a default policy. Control plane firewall policies should not be changed without guidance from TAC.
I use firewall cp policies to control access to controller itself like ssh/https.
I have defined custom policies to allow/deny my custom networks.
As I have written in original post I would like to move those policies from local config to folder config, but it isn't possible it seems even one last rule block inheritance from folder level.
Of course there is solution to write erase and to reconnet MD to MM, but in my case for this moment this is not the case.
Maybe yes it is kind of defult, but how to avoid problem ?
© Copyright 2023 Hewlett Packard Enterprise Development LPAll Rights Reserved.