Symptom
FMC is seen to remove rule with UDP port 6081 is removed after deployment(unrelated changes).
Snip of FMC transcript:
FMC >> access-list CSM_FW_ACL_ line 14 advanced permit udp ifc inside object-group FMC_INLINE_src_rule_268434453 ifc outside any eq 6081 rule-id 268434453
FMC >> no access-list CSM_FW_ACL_ advanced permit udp ifc inside object-group FMC_INLINE_src_rule_268434453 ifc outside any eq geneve rule-id 268434453
Rule before deployment:
access-list CSM_FW_ACL_ remark rule-id 268434453: ACCESS POLICY: bom-copy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268434453: L7 RULE: ruleone
access-list CSM_FW_ACL_ advanced permit tcp ifc inside object-group FMC_INLINE_src_rule_268434453 ifc outside any object-group FTP rule-id 268434453
access-list CSM_FW_ACL_ advanced permit udp ifc inside object-group FMC_INLINE_src_rule_268434453 ifc outside any eq geneve rule-id 268434453
Rule after deployment:
//line with geneve removed
access-list CSM_FW_ACL_ remark rule-id 268434453: ACCESS POLICY: bom-copy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268434453: L7 RULE: ruleone
access-list CSM_FW_ACL_ advanced permit tcp ifc inside object-group FMC_INLINE_src_rule_268434453 ifc outside any object-group FTP rule-id 268434453
Workaround
Create a custom port object for udp 6081 and refer the same to the required rules instead of directly adding udp/6081.
Example Lina(After deployment):
++ Port object
object-group service custom-geneve udp
port-object eq geneve
++ Access-list
access-list CSM_FW_ACL_ remark rule-id 268434453: ACCESS POLICY: bom-copy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268434453: L7 RULE: ruleone
access-list CSM_FW_ACL_ advanced permit tcp ifc inside object-group FMC_INLINE_src_rule_268434453 ifc outside any object-group FTP rule-id 268434453
access-list CSM_FW_ACL_ advanced permit udp ifc inside object-group FMC_INLINE_src_rule_268434453 ifc outside any object-group custom-geneve rule-id 268434453
