After Broadcom’s new license policy, where only edge clusters doing stateful services need to be licensed, Cloud Director implemented the feature to honor a stateless firewall setup in 10.6.1.
This gave you the possibility to choose clusters from the feature set that were needed. https://knowledge.broadcom.com/external/article/420629/creating-stateful-firewall-rule-with-clo.html
It also introduced a bug if you directly created an Edge gateway within a Datacenter Group, it would then make the Edge gateway with stateless firewall rules. If you decided to create an Edge gateway and then afterward import it into the Datacenter Group, it would be stateful.
This is all good, features are always welcome. But this also introduced a bug, where I need
The fix: instead of recreating the Edge with all the rules and config in Cloud Director, we can clone the rules in NSX Manager and then make the new policy, where the rules live, stateful.
Choosing a clone on the policy that Cloud Director has created. Marking the policy will also mark all the rules.
After it’s been cloned, you need to edit the cloned policy and make it stateful. The NSX ID for the policy will now become “copy_xxxxxx”.
For Cloud Director to be able to read and edit the policy in the future, we will have to delete the old non-stateful policy, then publish, so that it can be cloned again, but this time without the “copy of xxxx” in front of the policy, so that the stateful policy will get the original name and it can take its place from the non-statefull rule set.
For it to look the same in Cloud Director, we also need to remove all the prefixed rules that now say “Copy of Copy of”. After that, we can also mark the first “copy of” policy for deletion, then publish the config.
Conclusion
This is a workaround so you don’t have to create all the rules manually again, if they have been created as stateless firewall rules, due to a bug where Edge gateways created directly in a Cloud Director Datacenter Group, it would become stateless instead of stateful
