As Red pointed out, something is off here. The stateful flag has nothing to do with a provider or consumer being able to initiate communication. This is where the Providing or Consuming of a contract comes into play.
If you have a contract between two EPGs where you want BOTH EPGs to be able to reach each other via Web for example, then simply slapping a bi-directional contract with Reverse Ports and a single filter for dst tcp 80, will not achieve this. Same behavior would apply to SSH (or any protocol using ephemeral ports for that sake).
Let's look at an example:
WebServer2 Providing http contract to WebServer1
Apply in both dir: True
Reverse Ports: True
Filter: IP, TCP, Src any any, Dst 80-80
WebServer1_EPG SrcEGP = 16397
WebServer2_EPG SrcEPG = 16398
leaf2# show zoning-rule
+---------+--------+--------+----------+----------------+---------+----------+----------------------------+-----------------+----------------------+
| Rule ID | SrcEPG | DstEPG | FilterID | Dir | operSt | Scope | Name | Action | Priority |
+---------+--------+--------+----------+----------------+---------+----------+----------------------------+-----------------+----------------------+
| 4169 | 16397 | 16398 | 27 | bi-dir | enabled | 3047424 | Rob:Stateful_web | permit | fully_qual(7) |
| 4114 | 16398 | 16397 | 39 | uni-dir-ignore | enabled | 3047424 | Rob:Stateful_web | permit | fully_qual(7) |
+---------+--------+--------+----------+----------------+---------+----------+----------------------------+-----------------+----------------------+
leaf2# show zoning-filter filter 27
+----------+------+--------+-------------+------+-------------+----------+-------------+-------------+-----------+---------+-------+-------------+-------------+----------+
| FilterId | Name | EtherT | ArpOpc | Prot | ApplyToFrag | Stateful | SFromPort | SToPort | DFromPort | DToPort | Prio | Icmpv4T | Icmpv6T | TcpRules |
+----------+------+--------+-------------+------+-------------+----------+-------------+-------------+-----------+---------+-------+-------------+-------------+----------+
| 27 | 27_0 | ip | unspecified | tcp | no | no | unspecified | unspecified | http | http | dport | unspecified | unspecified | |
+----------+------+--------+-------------+------+-------------+----------+-------------+-------------+-----------+---------+-------+-------------+-------------+----------+
leaf2# show zoning-filter filter 39
+----------+------+--------+-------------+------+-------------+----------+-----------+---------+-------------+-------------+-------+-------------+-------------+----------+
| FilterId | Name | EtherT | ArpOpc | Prot | ApplyToFrag | Stateful | SFromPort | SToPort | DFromPort | DToPort | Prio | Icmpv4T | Icmpv6T | TcpRules |
+----------+------+--------+-------------+------+-------------+----------+-----------+---------+-------------+-------------+-------+-------------+-------------+----------+
| 39 | 39_0 | ip | unspecified | tcp | no | no | http | http | unspecified | unspecified | sport | unspecified | unspecified | |
+----------+------+--------+-------------+------+-------------+----------+-----------+---------+-------------+-------------+-------+-------------+-------------+----------+
leaf2#
What these filters have programmed is:
- WebServer1 can source from ANY (unspecified) port to a destination port of http (80)
- WebServer2 can source from http (80) to destination port of ANY (unspecified)
Result:
WebServer1 can access WebServer2 via http
WebServer2 can not access http on WebServer1.
Why? WebServer2 will use an ephemeral source port (not TCP 80 as the filter restricts) to try and reach WebServer1 on ANY (unspecified) port. We can quickly confirm this via a packet capture.
WebServer1 = 192.168.150.1
WebServer2 = 192.168.150.2
So how do you change this so each EPG can access each other via HTTP or SSH? You have two options. You can have both EPG provide & consume the same contract, or you can add a second filter entry to your existing contract that has the ports reversed (unspecified <> http).
I'd be surprised to see that stateful flag having any impact alone on your observed behavior.
Robert
