Firewall configuration on SAR-7705 issue

[dushanraman]

Hi Folks,

I recently tried to configure a VPRN firewall policy and followed these steps:
1) create a policy under security with using the default profile to match src-ip/dst-ip. in the entries.
2) create a vprn service and create a zone inside the VPRN
3) add the policy from 1) into the zone along with the interface.

However the firewall doesnt seem to work when I connect an IXIA tester to test traffic to dst-ip 10.20.100.10. I have tried for telnet/ssh ports as well and have had no luck. Note that when I have a default entry to match all protocols the services sessms to work ( behaving like a default policy). Could someone please enlighten on what the issue could be or whether I am missing some configuration. I have spent a few days trying to troubleshoot referring to the ALU documentation but no luck .

Configs as below:
*A:NS1634S1338>config>security# info
policy 10 create
entry 10 create
match
dst-ip 10.20.100.10
exit
limit
exit
action drop
exit
entry 20 create
description "TCP"
match
exit
limit
exit
action forward
exit
exit


*A:NS1634S1338>config>service# info
vprn 4000 customer 1 create
autonomous-system 64530
route-distinguisher 64530:4000
auto-bind mpls
vrf-target target:64530:4000
interface "lo" create
address 30.0.0.2/32
loopback
exit
interface "vprn-1-10.20.200.1" create
address 10.20.200.1/24
sap 1/2/1 create
exit
exit
grt-lookup
enable-grt-local-management-only
exit
zone 10 create
interface "vprn-1-10.20.200.1"
exit
nat
exit
policy "10"
inbound
limit
exit
exit
outbound
limit
exit
exit
commit
exit
no shutdown
exit