Summary
Conntrack VRF zone mapping is not applied when only firewall global-options state-policy is configured. The mapping is applied only after adding firewall filter rules using connection state (established/related).
Steps to Reproduce
Configure VRF and global state-policy, then establish an SSH session
set vrf name red table '2000' set interfaces ethernet eth1 address '192.0.2.1/24' set interfaces ethernet eth1 vrf 'red' set firewall global-options state-policy established action 'accept' set firewall global-options state-policy related action 'accept' set firewall ipv4 input filter default-action 'accept' set firewall ipv4 input filter rule 1 action 'accept' set firewall ipv4 input filter rule 1 inbound-interface name 'red' set service ssh vrf 'red'
VRF mapping is present, but the conntrack zone assignment rule (ct original zone set ...) is not installed:
$ sudo nft list table inet vrf_zones table inet vrf_zones { map ct_iface_map { typeof iifname : ct zone elements = { "red" : 2000, "eth1" : 2000 } } chain vrf_zones_ct_in { type filter hook prerouting priority raw; policy accept; } chain vrf_zones_ct_out { type filter hook output priority raw; policy accept; } }
Conntrack entries exist:
$ sudo conntrack -L -o extended | grep 192.0.2.2 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown. ipv4 2 tcp 6 431987 ESTABLISHED src=192.0.2.2 dst=192.0.2.1 sport=46164 dport=22 src=192.0.2.1 dst=192.0.2.2 sport=22 dport=46164 [ASSURED] mark=0 use=1
Filtering by zone returns no entries since conntrack VRF mapping is not applied to the traffic
$ sudo conntrack -L -o extended --orig-zone 2000 conntrack v1.4.7 (conntrack-tools): 0 flow entries have been shown.
Add a minimal firewall filter rule using connection state:
set firewall ipv4 input filter rule 1 action accept set firewall ipv4 input filter rule 1 state established set firewall ipv4 input filter rule 1 state related
The conntrack zone assignment rule (ct original zone set ...) is now installed
$ sudo nft list table inet vrf_zones table inet vrf_zones { map ct_iface_map { typeof iifname : ct zone elements = { "red" : 2000, "eth1" : 2000 } } chain vrf_zones_ct_in { type filter hook prerouting priority raw; policy accept; counter packets 0 bytes 0 ct original zone set iifname map @ct_iface_map } chain vrf_zones_ct_out { type filter hook output priority raw; policy accept; counter packets 0 bytes 0 ct original zone set oifname map @ct_iface_map } }
Conntrack entries now include zone
$ sudo conntrack -L -o extended --orig-zone 2000 ipv4 2 tcp 6 431993 ESTABLISHED src=192.0.2.2 dst=192.0.2.1 sport=37840 dport=22 zone-orig=2000 src=192.0.2.1 dst=192.0.2.2 sport=22 dport=37840 [ASSURED] mark=0 use=1
Please confirm whether this is expected behavior, or if global state-policy should also trigger conntrack VRF zone mapping.