Bug 1473366

Summary:	Firewall rules prevent appliance from getting a dynamic IPv6 address
Product:	Red Hat CloudForms Management Engine	Reporter:	Jan Krocil <jkrocil>
Component:	Appliance	Assignee:	Nick Carboni <ncarboni>
Status:	CLOSED CURRENTRELEASE	QA Contact:	luke couzens <lcouzens>
Severity:	high	Docs Contact:
Priority:	high
Version:	5.8.0	CC:	abellott, cpelland, jhardy, obarenbo, tpapaioa
Target Milestone:	GA	Keywords:	TestOnly, ZStream
Target Release:	5.9.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	ipv6:black
Fixed In Version:	5.9.0.1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1473424 (view as bug list)		Environment:
Last Closed:	2018-03-06 14:32:30 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	Bug
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1473424

Description Jan Krocil 2017-07-20 15:40:20 UTC

Description of problem:
SSIA

Version-Release number of selected component (if applicable):
5.8.1.2

How reproducible:
Always

Steps to Reproduce:
1. Get a fresh appliance with no IPv4 networking; IPv6 only
2. Start the appliance up
3. # ip a

Actual results:
The appliance has no IPv6 ULA assigned (it only has a link local address). 

Expected results:
The appliance has IPv6 ULA successfully assigned from the DHCP server.

Additional info:


Workaround:
-----------
1. systemctl stop firewalld
   or
   ip6tables -F
2. systemctl restart network

At this point, the IPv6 address is correctly assigned to the iface.

Comment 2 Jan Krocil 2017-07-20 16:02:39 UTC

Better workaround:
------------------
We need to open port 546/udp in the active zone.

# firewall-cmd --zone=manageiq --add-port=546/udp --permanent
# firewall-cmd --reload
# systemctl restart network

Comment 3 CFME Bot 2017-07-20 17:47:59 UTC

https://github.com/ManageIQ/manageiq-appliance-build/pull/217

Comment 4 CFME Bot 2017-07-20 18:57:48 UTC

New commit detected on ManageIQ/manageiq-appliance-build/master:
https://github.com/ManageIQ/manageiq-appliance-build/commit/75b970ce3b03ffca237237cbd4abf12e19639286

commit 75b970ce3b03ffca237237cbd4abf12e19639286
Author:     Nick Carboni <ncarboni>
AuthorDate: Thu Jul 20 13:33:28 2017 -0400
Commit:     Nick Carboni <ncarboni>
CommitDate: Thu Jul 20 13:33:28 2017 -0400

    Allow the DHCPv6 client through the appliance firewall
    
    Before this change appliances would not correctly receive IPv6
    addresses via DHCP.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1473366

 kickstarts/partials/post/firewalld.ks.erb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comment 6 luke couzens 2017-10-12 08:51:07 UTC

Verified in 5.9.0.2