title: VNF do not forward packets sent from Client in Openstack using VNFF Graph
body: <p>I'm trying to ping from Client to 8.8.8.8 via VNF1 so I use VNFFG to force ICMP traffic of Client go through VNF1 before going out to internet.</p>
  <p>After I apply the VNFFG rule in openstack, VNF1 can see MPLS packet encapsulated from Client's ICMP packet by openstack when I use tcpdump but the Forwarding Table of VNF1 do not receive any packet to continue forward that packet.</p>
  <p>This is packet seen on VNF1:</p>
  <pre><code>09:15:12.161830 MPLS (label 13311, exp 0, [S], ttl 255) IP 12.0.0.58 &gt; 8.8.8.8: ICMP echo request, id 10531, seq 15, length 64
  </code></pre>
  <p>I capture that packet, see that the content can be read (without encryption) and src, dst MAC belong to Client and VNF1 respectively.</p>
  <p>This is my VNFFG template:</p>
  <pre><code>tosca_definitions_version: tosca_simple_profile_for_nfv_1_0_0
  description: Sample VNFFG template
  topology_template:
    node_templates:
      Forwarding_path1:
        type: tosca.nodes.nfv.FP.TackerV2
        description: demo chain
        properties:
          id: 51
          policy:
            type: ACL
            criteria:
              - name: block_icmp
                classifier:
                  network_src_port_id: 0304e8b5-6c37-4634-bde2-1351cdee5134 #CLIENT PORT ID
                  ip_proto: 1
              - name: block_udp
                classifier:
                  network_src_port_id: 0304e8b5-6c37-4634-bde2-1351cdee5134 #CLIENT PORT ID
                  ip_proto: 17
          path:
            - forwarder: VNF1
              capability: CP1
    groups:
      VNFFG1:
        type: tosca.groups.nfv.VNFFG
        description: Traffic to server
        properties:
          vendor: tacker
          version: 1.0
          number_of_endpoints: 1
          dependent_virtual_link: [VL1]
          connection_point: [CP1]
          constituent_vnfs: [VNF1]
        members: [Forwarding_path1]
  </code></pre>
  <p>This is my VNF Descriptor:</p>
  <pre><code>tosca_definitions_version: tosca_simple_profile_for_nfv_1_0_0
  description: Demo example
  metadata:
    template_name: sample-tosca-vnfd
  topology_template:
    node_templates:
      VDU1:
        type: tosca.nodes.nfv.VDU.Tacker
        capabilities:
          nfv_compute:
            properties:
              num_cpus: 1
              mem_size: 2 GB
              disk_size: 20 GB
        properties:
          image: VNF1
          availability_zone: nova
          mgmt_driver: noop
          key_name: my-key-pair
          config: |
            param0: key1
            param1: key2
  
      CP1:
        type: tosca.nodes.nfv.CP.Tacker
        properties:
          management: true
          order: 0
          anti_spoofing_protection: false
        requirements:
          - virtualLink:
              node: VL1
          - virtualBinding:
              node: VDU1
      VL1:
        type: tosca.nodes.nfv.VL
        properties:
          network_name: my-private-network
          vendor: Tacker
      FIP1:
        type: tosca.nodes.network.FloatingIP
        properties:
          floating_network: public
        requirements:
          - link:
              node: CP1
  </code></pre>
  <p>I used this command to deploy VNFGG rule:</p>
  <pre><code>tacker vnffg-create --vnffgd-template vnffg_test.yaml forward_traffic
  </code></pre>
  <p>I do not know if the problem can come from the key I defined for VNF1 because I do not know what param0: key0 and param1: key1 used for and where are they?</p>
  <p>How can I resolve to make the VNF forward these packet.</p>