Running a container in iox inbound connections drop return packets

[drew-johnson]

We make software that provides encryption keys to IPsec implementations that use the Postquantum Preshared Keys (ppk) capability RFC 8784 defines.  We are moving it to run in a docker container on a Cisco 8000v VM in AWS.  I've attached the relevant config.  According to devnet we need to use a virtualportgroup to provide networking support.  Outbound connections are routed properly.  Inbound connections are not.  The nat setup sends inbound syn packets to the container.  The container responds with a synack that is dropped somewhere.  Inbound connections can come via the internal ikev2 daemon (comes from 192.168.35.101) or from anywhere on port 8888.  In both cases the synack is dropped.  What am i missing?

[ulineosan]

Does it work without the vrf?

[drew-johnson]

Technically no.  If I remove all of the 'vrf' config lines then it's broken.  I'm only using it because for the few examples I was able to see posted regarding docker and virtualportgroup config says it's needed.  

[Torbjørn]

I think you need to append "vrf GS match-in-vrf" to the static PAT line of config for this to work properly. 

If this doesn't work you can try to see what happens to the traffic with a FIA trace: Technote - Troubleshoot with the IOS-XE Datapath Packet Trace Feature