There are several instances where the config objects present in vrouter config appears to be different from that of the config node.

This article can be used to browse through each intermediate component until it reaches the vrouter. 

Note: This article also discusses IFMAP server as it exists in releases prior to 4.x

Example

Allowed traffic is being blocked with an action "D" (Drop) in the flow which indicates that it is being dropped due to "SG"(Security Group). The user would like see the config.

1. Check the configuration as per the config node.

   a. Identify the VMI name and UUID

   

   In this example, the VMI ID is 755f37d6-38d8-4111-b61e-9db4252c2a3e 

   b. Navigate to config editor under the settings menu

   c. Click on virtual machine interfaces

   d. Click on "href link" of the VMI with the ID 755f37d6-38d8-4111-b61e-9db4252c2a3e

   

   e. Scroll down to the section where the security group ID is mentioned and confirm if this is the one that should exist on this VMI

   

   f. If required, click the URL provided for security group to see more details, such as the rules, created date, modified, etc.

   The security group named "SG_KB_TEST" should be applied on the VMI. Check on the control node if the same is observed there too.

2. Access the introspect page of the control node using the <control node IP> :8083

   This opens up a page with links for various introspect options of the control node. Each link provides more sub-options of data that we requested for.
   

   a. Click ifmap_server_show.xm l link

   b. Click the Send button below IFMapNodeTableListShowReq

   

   The next screen should display a list of table to query. Click the table depending on the object that you want to verify.

   c. Click virtual-machine-interface as we are trying to trace the SG config of a VMI

   d. Find the interface either using the ID or uuid.

   e. Verify the security group mentioned in the neighbors list if SG_KB_TEST

   

   Optional:

   f. Navigate back to the previous page 

   g. Click the security-group table link

   
   

   h. Verify if the security exists and if the rules for the security SG_KB_TEST are correct.

   Alternatively, query the introspect for VMI:

   curl http://10.219.95.55:8083/Snh_IFMapTableShowReq?x=virtual-machine-interface | python -c 'import sys;import xml.dom.minidom;s=sys.stdin.read();print xml.dom.minidom.parseString(s).toprettyxml()' | egrep -A30 755f37d6-38d8-4111-b61e-9db4252c2a3e | grep security-group

   Here the original query is curl http://10.219.95.55:8083/Snh_IFMapTableShowReq?x=virtual-machine-interface

   To pretty print the XML output, use python -c 'import sys;import xml.dom.minidom;s=sys.stdin.read();print xml.dom.minidom.parseString(s).toprettyxml()'

   First, egrep to find the VMI from the list and print only the next 30 lines. Fine tune if the security group cannot be seen in the first 30 lines of the output.

   Second, grep is filter for the security group from the VMI output.

     % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                    Dload  Upload   Total   Spent    Left  Speed
   100 24973  100 24973    0     0  3427k      0 --:--:-- --:--:-- --:--:-- 4064k
   <element>security-group:default-domain:Dayone:SG_KB_TEST  <-- The VMI has SG_KB_TEST as one of the security group as per control node.
   <element>security-group:default-domain:Dayone:default

   Find out if the security group has the rules that was seen in config node using the query:

   curl http://10.219.95.55:8083/Snh_IFMapTableShowReq?x=security-group | python -c 'import sys;import xml.dom.minidom;s=sys.stdin.read();print xml.dom.minidom.parseString(s).toprettyxml()'  | egrep -A150 SG_KB_TEST | egrep -A63 policy-rule
    
     % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 47966  100 47966    0     0  6856k      0 --:--:-- --:--:-- --:--:-- 7806k
                <policy-rule>
                        <rule-sequence>
                                <major>0</major>
                                <minor>0</minor>
                        </rule-sequence>
                        <rule-uuid>40791a81-e8fd-4636-94d7-75ab960c9b28</rule-uuid>
                        <direction>></direction>
                        <protocol>any</protocol>
                        <src-addresses>
                                <subnet>
                                        <ip-prefix></ip-prefix>
                                        <ip-prefix-len>0</ip-prefix-len>
                                </subnet>
                                <virtual-network></virtual-network>
                                <security-group>local</security-group>
                                <network-policy></network-policy>
                        </src-addresses>
                        <src-ports>
                                <start-port>0</start-port>
                                <end-port>65535</end-port>
                        </src-ports>
                        <dst-addresses>
                                <subnet>
                                        <ip-prefix>0.0.0.0</ip-prefix>
                                        <ip-prefix-len>0</ip-prefix-len>
                                </subnet>
                                <virtual-network></virtual-network>
                                <security-group></security-group>
                                <network-policy></network-policy>
                        </dst-addresses>
                        <dst-ports>
                                <start-port>0</start-port>
                                <end-port>65535</end-port>
                        </dst-ports>
                        <action-list>
                                <simple-action></simple-action>
                                <gateway-name></gateway-name>
                                <mirror-to>
                                        <analyzer-name></analyzer-name>
                                        <encapsulation></encapsulation>
                                        <analyzer-ip-address></analyzer-ip-address>
                                        <analyzer-mac-address></analyzer-mac-address>
                                        <routing-instance></routing-instance>
                                        <udp-port>0</udp-port>
                                        <juniper-header>true</juniper-header>
                                        <nh-mode></nh-mode>
                                        <static-nh-header>
                                                <vtep-dst-ip-address></vtep-dst-ip-address>
                                                <vtep-dst-mac-address></vtep-dst-mac-address>
                                                <vni>0</vni>
                                        </static-nh-header>
                                        <nic-assisted-mirroring>false</nic-assisted-mirroring>
                                        <nic-assisted-mirroring-vlan>0</nic-assisted-mirroring-vlan>
                                </mirror-to>
                                <assign-routing-instance></assign-routing-instance>
                                <log>false</log>
                                <alert>false</alert>
                                <qos-action></qos-action>
                                <host-based-service>false</host-based-service>
                        </action-list>
                        <ethertype>IPv4</ethertype>
                        <created>1970-01-01T00:00:00</created>
                        <last-modified>1970-01-01T00:00:00</last-modified>
                </policy-rule>
                <policy-rule>
                        <rule-sequence>
                                <major>0</major>
                                <minor>0</minor>
                        </rule-sequence>
                        <rule-uuid>610ddaff-14da-4de4-a941-722337188e01</rule-uuid>
                        <direction>></direction>
                        <protocol>any</protocol>
                        <src-addresses>
                                <subnet>
                                        <ip-prefix>0.0.0.0</ip-prefix>
                                        <ip-prefix-len>0</ip-prefix-len>
                                </subnet>
                                <virtual-network></virtual-network>
                                <security-group></security-group>
                                <network-policy></network-policy>
                        </src-addresses>
                        <src-ports>
                                <start-port>0</start-port>
                                <end-port>65535</end-port>
                        </src-ports>
                        <dst-addresses>
                                <subnet>
                                        <ip-prefix></ip-prefix>
                                        <ip-prefix-len>0</ip-prefix-len>
                                </subnet>
                                <virtual-network></virtual-network>
                                <security-group>local</security-group>
                                <network-policy></network-policy>
                        </dst-addresses>
                        <dst-ports>
                                <start-port>0</start-port>
                                <end-port>65535</end-port>
                        </dst-ports>
                        <action-list>
                                <simple-action></simple-action>
                                <gateway-name></gateway-name>
                                <mirror-to>
                                        <analyzer-name></analyzer-name>
                                        <encapsulation></encapsulation>
                                        <analyzer-ip-address></analyzer-ip-address>
                                        <analyzer-mac-address></analyzer-mac-address>
                                        <routing-instance></routing-instance>
                                        <udp-port>0</udp-port>
                                        <juniper-header>true</juniper-header>
                                        <nh-mode></nh-mode>
                                        <static-nh-header>
                                                <vtep-dst-ip-address></vtep-dst-ip-address>
                                                <vtep-dst-mac-address></vtep-dst-mac-address>
                                                <vni>0</vni>
                                        </static-nh-header>
                                        <nic-assisted-mirroring>false</nic-assisted-mirroring>
                                        <nic-assisted-mirroring-vlan>0</nic-assisted-mirroring-vlan>
                                </mirror-to>
                                <assign-routing-instance></assign-routing-instance>
                                <log>false</log>
                                <alert>false</alert>
                                <qos-action></qos-action>
                                <host-based-service>false</host-based-service>
                        </action-list>
                        <ethertype>IPv4</ethertype>
                        <created>1970-01-01T00:00:00</created>
                        <last-modified>1970-01-01T00:00:00</last-modified>
                </policy-rule>  
    

   Verify the compute node to see the same configuration is present.

3. Access the vrouter agent introspect port using the URL <compute IP> :8085

   

   a. Click the ifmap_agent.xml

   b. Click the Send button below ShowIFMapAgentReq

   

   This opens a new page with all the config details that the agent has downloaded from the controller.

   Note: The introspect outputs can span across multiple pages, click 'more' for navigating to the next page.

   c. Using browser search option, find the config object that we were tracing. As per this example, we are trying to find the security group for a VMI.

   
   
   
   

   Based on the output, the VMI is configured with the correct SG and SG has all the appropriate rules.

16-12-2025: Minor, non-technical edit