Tenant Security group is dropping traffic at 2 particular sites. The traffic with similar configuration for other sites is not getting dropped.

The issue is when both source VM and destination VM are in the same compute/contrail Agent.

The traffic flow is source VM to Gateway Router and Gateway Router to destination VM.

The SG is applied on both forward and reverse flows and the reverse flow SG is dropping the traffic.

Login to compute node and use contrail-tools command.

Review the flows that are impacted using the command flow --match <prefix> and look for the D "drop" Flag.

Analyse the impacted flow using the command flow --get <flow-index> and identify the acl which is dropping the pkts

Goto TF UI and navaigate to Monitor --> vRouter --> Flows --> Filter impacted flows and identify and confirm the UUID of the acl dropping the pkts

Add the required Ingress and Egress rules to Security Group to allow the traffic.

As a workaround you can enable the packet mode for the VMI as well.

Note : Packet mode will completely disable the flow processing for the VMI.