HOW-TO aci_contract with filter and filter entry?

[jhtut]

Hi

I tried the example provided in aci_contract with filter and filter entry. Is it suppose to create the subject as well which basically tied contract and filter. I think allowing to create filter/filter entry is good starting point but really need subject to make it complete. Are we expecting this in 0.5.2? Thanks.

resource "aci_contract" "foocontract" {
tenant_dn = "${aci_tenant.dev_tenant.id}"
description = "%s"
name = "demo_contract"
annotation = "tag_contract"
name_alias = "alias_contract"
prio = "level1"
scope = "tenant"
target_dscp = "unspecified"
filter {
annotation = "tag_filter"
description = "first filter from contract resource"
filter_entry {
entry_description = "hello world"
filter_entry_name = "check_entry3"
d_from_port = "http"
ether_t = "ipv4"
prot = "tcp"
}
filter_entry {
entry_description = "world"
filter_entry_name = "check_entry1"
d_from_port = "443"
ether_t = "ipv4"
prot = "tcp"
}
filter_name = "abcd"
name_alias = "abcd"
}
filter {
filter_name = "example2"
description = "second filter from contract resource"
annotation = "tag_filter"
name_alias = "example2"
}

}

[scotttyso]

You need another resource with the subject to attach the two. Below is an example

resource "aci_contract" "mgmt_ctx" {
	tenant_dn   = aci_tenant.mgmt.id
	description = "Default Mgmt Contract"
	name        = "mgmt_ctx"
	scope       = "tenant"
	filter {
		  description = "Mgmt Traffic"
		  filter_entry {
				entry_description	= "Allow https"
			filter_entry_name   	= "https"
				d_from_port        	= "https"
				d_to_port	        = "https"
				ether_t             = "ipv4"
				prot            	= "tcp"
				stateful			= "yes"  
		  }
		  filter_entry {
				entry_description   = "Allow icmp"
			filter_entry_name   	= "icmp"
				d_from_port        	= "unspecified"
				d_to_port        	= "unspecified"
				ether_t             = "ipv4"
				prot           		= "icmp"
		  }
		  filter_entry {
				entry_description   = "Allow SNMP"
			filter_entry_name   	= "snmp"
				d_from_port        	= "161"
				d_to_port        	= "162"
				ether_t             = "ipv4"
				prot           		= "udp"
		  }
		  filter_entry {
				entry_description   = "Allow ssh"
			filter_entry_name   	= "ssh"
				d_from_port        	= "22"
				d_to_port        	= "22"
				ether_t             = "ipv4"
				prot           		= "tcp" 
				stateful			= "yes" 
		  }
		  filter_name  = "Remote_Mgmt"
	}
}

resource "aci_contract_subject" "Mgmt_Subj" {
	contract_dn					 = aci_contract.mgmt_ctx.id
	name						 = "Mgmt_Subj"
	relation_vz_rs_subj_filt_att = ["uni/tn-mgmt/flt-Remote_Mgmt"]
	rev_flt_ports				 = "yes"
}

[jhtut]

@scotttyso Thanks. It's just my wishful thinking of having all done in one resource. 👍 It would be cool though as in our space, we always create one contract -> one subject -> one filter which is always provided by one EPG.

[lhercot]

@jhtut , as @scotttyso example shows the filter section in the aci_contract is incomplete and does not associated the contract with the filter through a subject.

We have made the decision to start deprecating the filter section under aci_contract and will be removing it from the documentation in the next release. We are also updating the example to show how to do a complete contract without it.

Those changes are in progress and will be part of #515

I think the use case of creating a contract with single subject and a series of filters is valid so I have created this issue (CiscoDevNet/terraform-aci-modules#1) on our module development repository.