[VVP] updating ports.py to check str_replace params

allowed_address_pairs/ip_address can use CIDR format,
and is often done by using the intrinsic function str_replace.

This update will naively go through each param in a str_replace to
check if one is a valid allowed_address_pair/ip_address parameter.

Issue-ID: VVP-341
Signed-off-by: stark, steven <steven.stark@att.com>
Change-Id: I24e7ad6b74e5795b577d99468517287be46cd2b7

9 files changed, 177 insertions, 397 deletions

diff --git a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/fail/contrail/fail.yaml b/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/fail/contrail/fail.yaml
deleted file mode 100644
index 248f9ec..0000000
--- a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/fail/contrail/fail.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-heat_template_version: 2015-04-30
-
-description: fdsafsfsa
-
-parameters:
-
-  TESTDB_priv_floating_ips:
-   type: comma_delimited_list
-   description: asnfjl
-
-  TESTDB_int_priav_floating_ip:
-   type: string
-   description: asnfjl
-
-resources:
-
-  TESTDB_0_priv_vmi_0:
-    type: OS::ContrailV2::VirtualMachineInterface
-    properties:
-      virtual_machine_interface_properties:
-        virtual_machine_interface_properties_service_interface_type: {
-          "priv_interface_type" 
-        }
-      virtual_network_refs:
-        - get_param: priv_net_fqdn
-      virtual_machine_interface_allowed_address_pairs:
-        {
-          virtual_machine_interface_allowed_address_pairs_allowed_address_pair:
-            [{
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip:
-                {
-                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix: { get_param: [TESTDB_priv_floating_ip, 0] },
-                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix_len: "dsafasdF",
-                },
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_mac: "sdnfjkas",
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_address_mode: "sadfnjasdfknj",
-            }],
-        }
-
-
-  TESTDB_0_int_private_vmi_0:
-    type: OS::ContrailV2::VirtualMachineInterface
-    properties:
-      virtual_machine_interface_properties:
-        virtual_machine_interface_properties_service_interface_type: {
-          "priv_interface_type" 
-        }
-      virtual_network_refs:
-        - get_param: priv_net_fqdn
-      virtual_machine_interface_allowed_address_pairs:
-        {
-          virtual_machine_interface_allowed_address_pairs_allowed_address_pair:
-            [{
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip:
-                {
-                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix: { get_param: TESTDB_int_priav_floating_ip },
-                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix_len: "dsafasdF",
-                },
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_mac: "sdnfjkas",
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_address_mode: "sadfnjasdfknj",
-            }],
-        }
-
-  #testnlksadf:
-  #  type: http://www.google.com
diff --git a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/fail/contrail/vmi_fail.yaml b/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/fail/contrail/vmi_fail.yaml
deleted file mode 100644
index 5113bd4..0000000
--- a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/fail/contrail/vmi_fail.yaml
+++ /dev/null
@@ -1,61 +0,0 @@
-# -*- coding: utf8 -*-
-# ============LICENSE_START=======================================================
-# org.onap.vvp/validation-scripts
-# ===================================================================
-# Copyright © 2019 AT&T Intellectual Property. All rights reserved.
-# ===================================================================
-#
-# Unless otherwise specified, all software contained herein is licensed
-# under the Apache License, Version 2.0 (the "License");
-# you may not use this software except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#             http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-#
-#
-# Unless otherwise specified, all documentation contained herein is licensed
-# under the Creative Commons License, Attribution 4.0 Intl. (the "License");
-# you may not use this documentation except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#             https://creativecommons.org/licenses/by/4.0/
-#
-# Unless required by applicable law or agreed to in writing, documentation
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# ============LICENSE_END============================================
-#
-#
-
-heat_template_version: 2015-04-30
-
-description: fdsafsfsa
-
-parameters:
-
-  invalid_format:
-    type: string
-
-resources:
-
-  fw_0_oam_vmi_0:
-    type: OS::ContrailV2::VirtualMachineInterface
-    properties:
-      virtual_machine_interface_allowed_address_pairs:
-        virtual_machine_interface_allowed_address_pairs_allowed_address_pair:
-          [{
-             virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip:
-               {
-                 virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix: { get_param: invalid_format },
-               },
-           }]
diff --git a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/fail/neutron/fail.yaml b/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/fail/fail.yaml
index 4a3093b..81f0c00 100644
--- a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/fail/neutron/fail.yaml
+++ b/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/fail/fail.yaml
@@ -95,6 +95,22 @@ parameters:
     type: string
     description: lb_extanet_floating_ip
 
+  cidr:
+    type: string
+    description: naslfnsakl
+
+  badparameter:
+    type: string
+    description: naslfnsakl
+
+  TESTDB_int_priav_floating_ip:
+   type: string
+   description: asnfjl
+
+  TESTDB_priav_floating_ip:
+   type: string
+   description: asnfjl
+
 resources:
 
   lb_server_0:
@@ -137,3 +153,63 @@ resources:
           network: { get_param: extnet_net_name }
           allowed_address_pairs:
             - ip_address: { get_param: lb_extanet_floating_ip }
+
+  lb_0_extnet_port_0:
+        type: OS::Neutron::Port
+        properties:
+          network: { get_param: extnet_net_name }
+          allowed_address_pairs:
+            - ip_address:
+                str_replace:
+                  template: $IPADDR$CIDR
+                  params:
+                    $IPADDR: { get_param: lb_extanet_floating_ip }
+                    $CIDR: { get_param: cidr}
+
+  TESTDB_0_int_private_vmi_0:
+    type: OS::ContrailV2::VirtualMachineInterface
+    properties:
+      virtual_machine_interface_properties:
+        virtual_machine_interface_properties_service_interface_type: {
+          "priv_interface_type" 
+        }
+      virtual_network_refs:
+        - get_param: priv_net_fqdn
+      virtual_machine_interface_allowed_address_pairs:
+        {
+          virtual_machine_interface_allowed_address_pairs_allowed_address_pair:
+            [{
+              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip:
+                {
+                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix: { get_param: TESTDB_int_priav_floating_ip },
+                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix_len: "dsafasdF",
+                },
+              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_mac: "sdnfjkas",
+              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_address_mode: "sadfnjasdfknj",
+            }],
+        }
+
+
+  TESTDB_0_private_vmi_0:
+    type: OS::ContrailV2::VirtualMachineInterface
+    properties:
+      virtual_machine_interface_properties:
+        virtual_machine_interface_properties_service_interface_type: {
+          "priv_interface_type" 
+        }
+      virtual_network_refs:
+        - get_param: priv_net_fqdn
+      virtual_machine_interface_allowed_address_pairs:
+        {
+          virtual_machine_interface_allowed_address_pairs_allowed_address_pair:
+            [{
+              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip:
+                {
+                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix: { get_param: TESTDB_priav_floating_ip },
+                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix_len: "dsafasdF",
+                },
+              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_mac: "sdnfjkas",
+              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_address_mode: "sadfnjasdfknj",
+            }],
+        }
+
diff --git a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/contrail/pass.yaml b/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/contrail/pass.yaml
deleted file mode 100644
index df4ca00..0000000
--- a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/contrail/pass.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-heat_template_version: 2015-04-30
-
-description: fdsafsfsa
-
-parameters:
-
-  TESTDB_priv_floating_ip:
-   type: string
-   description: asnfjl
-
-  TESTDB_int_private_floating_ips:
-   type: comma_delimited_list
-   description: asnfjl
-
-resources:
-
-  TESTDB_0_priv_vmi_0:
-    type: OS::ContrailV2::VirtualMachineInterface
-    properties:
-      virtual_machine_interface_properties:
-        virtual_machine_interface_properties_service_interface_type: {
-          "priv_interface_type" 
-        }
-      virtual_network_refs:
-        - get_param: priv_net_fqdn
-      virtual_machine_interface_allowed_address_pairs:
-        {
-          virtual_machine_interface_allowed_address_pairs_allowed_address_pair:
-            [{
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip:
-                {
-                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix: { get_param: TESTDB_priv_floating_ip },
-                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix_len: "dsafasdF",
-                },
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_mac: "sdnfjkas",
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_address_mode: "sadfnjasdfknj",
-            }],
-        }
-
-
-  TESTDB_0_int_private_vmi_0:
-    type: OS::ContrailV2::VirtualMachineInterface
-    properties:
-      virtual_machine_interface_properties:
-        virtual_machine_interface_properties_service_interface_type: {
-          "priv_interface_type" 
-        }
-      virtual_network_refs:
-        - get_param: priv_net_fqdn
-      virtual_machine_interface_allowed_address_pairs:
-        {
-          virtual_machine_interface_allowed_address_pairs_allowed_address_pair:
-            [{
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip:
-                {
-                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix: { get_param: [TESTDB_int_private_floating_ips, 0] },
-                  virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix_len: "dsafasdF",
-                },
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_mac: "sdnfjkas",
-              virtual_machine_interface_allowed_address_pairs_allowed_address_pair_address_mode: "sadfnjasdfknj",
-            }],
-        }
-
-  #testnlksadf:
-  #  type: http://www.google.com
diff --git a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/contrail/vmi_pass.yaml b/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/contrail/vmi_pass.yaml
deleted file mode 100644
index 959c846..0000000
--- a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/contrail/vmi_pass.yaml
+++ /dev/null
@@ -1,61 +0,0 @@
-# -*- coding: utf8 -*-
-# ============LICENSE_START=======================================================
-# org.onap.vvp/validation-scripts
-# ===================================================================
-# Copyright © 2019 AT&T Intellectual Property. All rights reserved.
-# ===================================================================
-#
-# Unless otherwise specified, all software contained herein is licensed
-# under the Apache License, Version 2.0 (the "License");
-# you may not use this software except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#             http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-#
-#
-# Unless otherwise specified, all documentation contained herein is licensed
-# under the Creative Commons License, Attribution 4.0 Intl. (the "License");
-# you may not use this documentation except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#             https://creativecommons.org/licenses/by/4.0/
-#
-# Unless required by applicable law or agreed to in writing, documentation
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# ============LICENSE_END============================================
-#
-#
-
-heat_template_version: 2015-04-30
-
-description: fdsafsfsa
-
-parameters:
-
-  fw_oam_floating_ip:
-    type: string
-
-resources:
-
-  fw_0_oam_vmi_0:
-    type: OS::ContrailV2::VirtualMachineInterface
-    properties:
-      virtual_machine_interface_allowed_address_pairs:
-        virtual_machine_interface_allowed_address_pairs_allowed_address_pair:
-          [{
-             virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip:
-               {
-                 virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix: { get_param: fw_oam_floating_ip },
-               },
-           }]
diff --git a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/contrail/vmi_pass_exemption.yaml b/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/contrail/vmi_pass_exemption.yaml
deleted file mode 100644
index 2d9ca4a..0000000
--- a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/contrail/vmi_pass_exemption.yaml
+++ /dev/null
@@ -1,83 +0,0 @@
-# -*- coding: utf8 -*-
-# ============LICENSE_START=======================================================
-# org.onap.vvp/validation-scripts
-# ===================================================================
-# Copyright © 2019 AT&T Intellectual Property. All rights reserved.
-# ===================================================================
-#
-# Unless otherwise specified, all software contained herein is licensed
-# under the Apache License, Version 2.0 (the "License");
-# you may not use this software except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#             http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-#
-#
-# Unless otherwise specified, all documentation contained herein is licensed
-# under the Creative Commons License, Attribution 4.0 Intl. (the "License");
-# you may not use this documentation except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#             https://creativecommons.org/licenses/by/4.0/
-#
-# Unless required by applicable law or agreed to in writing, documentation
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# ============LICENSE_END============================================
-#
-#
-
-heat_template_version: 2015-04-30
-
-description: fdsafsfsa
-
-parameters:
-
-  other_format:
-    type: string
-
-  other_ips:
-    type: comma_delimited_list
-
-resources:
-
-  fw_0_oam_vmi_0:
-    type: OS::ContrailV2::VirtualMachineInterface
-    metadata:
-      aap_exempt:
-        - other_format
-    properties:
-      virtual_machine_interface_allowed_address_pairs:
-        virtual_machine_interface_allowed_address_pairs_allowed_address_pair:
-          [{
-             virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip:
-               {
-                 virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix: { get_param: other_format },
-               },
-           }]
-
-  fw_0_oam_vmi_1:
-    type: OS::ContrailV2::VirtualMachineInterface
-    metadata:
-      aap_exempt:
-        - other_format
-        - other_ips
-    properties:
-      virtual_machine_interface_allowed_address_pairs:
-        virtual_machine_interface_allowed_address_pairs_allowed_address_pair:
-          [{
-             virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip:
-               {
-                 virtual_machine_interface_allowed_address_pairs_allowed_address_pair_ip_ip_prefix: { get_param: [other_ips, 1] },
-               },
-           }]
\ No newline at end of file
diff --git a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/neutron/valid_template.yaml b/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/pass.yaml
index 58444b3..d7cbd54 100644
--- a/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/neutron/valid_template.yaml
+++ b/ice_validator/tests/fixtures/test_allowed_address_pairs_include_vm_type_network_role/pass/pass.yaml
@@ -87,37 +87,33 @@ parameters:
     type: string
     description: network id for the internal network intranet 
 
-  db_int_intranet_ip_0:
+  db_int_intranet_floating_ip:
     type: string
-    description: db_int_intranet_ip_0
+    description: db_int_intranet_floating_ip
 
-  db_int_intranet_v6_ip_0:
+  db_int_intranet_floating_v6_ip:
     type: string
-    description: db_int_intranet_v6_ip_0
+    description: db_int_intranet_floating_v6_ip
 
-  db_int_intranet_ips:
+  db_int_intranet_floating_ips:
     type: comma_delimited_list
-    description: db_int_intranet_ips
+    description: db_int_intranet_floating_ips
 
-  db_int_intranet_v6_ips:
+  db_int_intranet_floating_v6_ips:
     type: comma_delimited_list
-    description: db_int_intranet_v6_ips
+    description: db_int_intranet_floating_v6_ips
 
   db_int_intranet_floating_ip:
     type: string
     description: db_int_intranet_floating_ip
 
-  db_int_intranet_floating_v6_ip:
-    type: string
-    description: db_int_intranet_floating_v6_ip
-
-  lb_extnet_ip_0:
+  lb_extnet_floating_ip:
     type: string
-    description: lb_extnet_ip_0
+    description: lb_extnet_floating_ip
 
-  lb_extnet_v6_ip_0:
+  lb_extnet_floating_v6_ip:
     type: string
-    description: lb_extnet_v6_ip_0
+    description: lb_extnet_floating_v6_ip
 
   lb_extnet_ips:
     type: comma_delimited_list
@@ -131,9 +127,9 @@ parameters:
     type: string
     description: lb_extnet_floating_ip
 
-  lb_extnet_floating_v6_ip:
+  cidr:
     type: string
-    description: lb_extnet_floating_v6_ip
+    description: nafskldnaklsdf
 
 resources:
 
@@ -150,6 +146,7 @@ resources:
         - port: { get_resource: lb_3_extnet_0_port }
         - port: { get_resource: lb_4_extnet_0_port }
         - port: { get_resource: lb_5_extnet_0_port }  
+        - port: { get_resource: lb_6_extnet_0_port }  
       metadata:
         vnf_name: { get_param: vnf_name }
         vnf_id: { get_param: vnf_id }
@@ -173,86 +170,104 @@ resources:
         vnf_id: { get_param: vnf_id }
         vf_module_id: { get_param: vf_module_id }
 
-  db_0_int_intranet_0_port:
+  db_0_int_intranet_port_0:
         type: OS::Neutron::Port
         properties:
           network: { get_param: int_intranet_net_id }
           allowed_address_pairs:
-            - ip_address: { get_param: db_int_intranet_ip_0 }
+            - ip_address: { get_param: db_int_intranet_floating_ip }
 
-  db_1_int_intranet_0_port:
+  db_0_int_intranet_port_1:
         type: OS::Neutron::Port
         properties:
           network: { get_param: int_intranet_net_id }
           allowed_address_pairs:
-            - ip_address: { get_param: db_int_intranet_v6_ip_0 }
+            - ip_address: { get_param: db_int_intranet_floating_v6_ip }
 
-  db_2_int_intranet_0_port:
+  db_0_int_intranet_port_2:
         type: OS::Neutron::Port
         properties:
           network: { get_param: int_intranet_net_id }
           allowed_address_pairs:
-            - ip_address: { get_param: [db_int_intranet_ips, 0] }
+            - ip_address: { get_param: [db_int_intranet_floating_ips, 0] }
 
-  db_3_int_intranet_0_port:
+  db_0_int_intranet_port_3:
         type: OS::Neutron::Port
         properties:
           network: { get_param: int_intranet_net_id }
           allowed_address_pairs:
-            - ip_address: { get_param: [db_int_intranet_v6_ips, 0] }
+            - ip_address: { get_param: [db_int_intranet_floating_v6_ips, 0] }
 
-  db_4_int_intranet_0_port:
+  db_0_int_intranet_port_4:
         type: OS::Neutron::Port
         properties:
           network: { get_param: int_intranet_net_id }
           allowed_address_pairs:
             - ip_address: { get_param: db_int_intranet_floating_ip }
 
-  db_5_int_intranet_0_port:
+  db_0_int_intranet_port_5:
         type: OS::Neutron::Port
         properties:
           network: { get_param: int_intranet_net_id }
           allowed_address_pairs:
             - ip_address: { get_param: db_int_intranet_floating_v6_ip }
 
-  lb_0_extnet_0_port:
+  lb_0_extnet_port_0:
         type: OS::Neutron::Port
         properties:
           network: { get_param: extnet_net_name }
           allowed_address_pairs:
-            - ip_address: { get_param: lb_extnet_ip_0 }
-
-  lb_1_extnet_0_port:
-        type: OS::Neutron::Port
-        properties:
-          network: { get_param: extnet_net_id }
-          allowed_address_pairs:
-            - ip_address: { get_param: lb_extnet_v6_ip_0 }
+            - ip_address: { get_param: lb_extnet_floating_ip }
 
-  lb_2_extnet_0_port:
-        type: OS::Neutron::Port
-        properties:
-          network: { get_param: extnet_net_name }
-          allowed_address_pairs:
-            - ip_address: { get_param: [lb_extnet_ips, 0] }
+  lb_0_extnet_port_1:
+    type: OS::Neutron::Port
+    properties:
+      network: { get_param: extnet_net_id }
+      allowed_address_pairs:
+        - ip_address: { get_param: lb_extnet_floating_v6_ip }
 
-  lb_3_extnet_0_port:
-        type: OS::Neutron::Port
-        properties:
-          network: { get_param: extnet_net_id }
-          allowed_address_pairs:
-            - ip_address: { get_param: [lb_extnet_v6_ips, 0] }
+  lb_0_extnet_port_2:
+    type: OS::Neutron::Port
+    properties:
+      network: { get_param: extnet_net_name }
+      allowed_address_pairs:
+        - ip_address: { get_param: [lb_extnet_ips, 0] }
+    metadata:
+      aap_exempt:
+        - lb_extnet_ips
+
+  lb_0_extnet_port_3:
+    type: OS::Neutron::Port
+    properties:
+      network: { get_param: extnet_net_id }
+      allowed_address_pairs:
+        - ip_address: { get_param: [lb_extnet_v6_ips, 0] }
+    metadata:
+      aap_exempt:
+        - lb_extnet_v6_ips
+
+  lb_0_extnet_port_4:
+    type: OS::Neutron::Port
+    properties:
+      network: { get_param: extnet_net_name }
+      allowed_address_pairs:
+        - ip_address: { get_param: lb_extnet_floating_ip }
 
-  lb_4_extnet_0_port:
-        type: OS::Neutron::Port
-        properties:
-          network: { get_param: extnet_net_name }
-          allowed_address_pairs:
-            - ip_address: { get_param: lb_extnet_floating_ip }
+  lb_0_extnet_port_5:
+    type: OS::Neutron::Port
+    properties:
+      network: { get_param: extnet_net_id }
+      allowed_address_pairs:
+        - ip_address: { get_param: lb_extnet_floating_v6_ip }
 
-  lb_5_extnet_0_port:
-        type: OS::Neutron::Port
-        properties:
-          network: { get_param: extnet_net_id }
-          allowed_address_pairs:
-            - ip_address: { get_param: lb_extnet_floating_v6_ip }
+  lb_0_extnet_port_6:
+    type: OS::Neutron::Port
+    properties:
+      network: { get_param: extnet_net_id }
+      allowed_address_pairs:
+        ip_address:
+          str_replace:
+            template: $IPADDR$CIDR
+            params: 
+              $CIDR: { get_param: cidr }
+              $IPADDR: { get_param: lb_extnet_floating_v6_ip }
diff --git a/ice_validator/tests/fixtures/test_contrail_instance_ip_parameters/fail/fail_base.yaml b/ice_validator/tests/fixtures/test_contrail_instance_ip_parameters/fail/fail_base.yaml
index 7043cda..93924f2 100644
--- a/ice_validator/tests/fixtures/test_contrail_instance_ip_parameters/fail/fail_base.yaml
+++ b/ice_validator/tests/fixtures/test_contrail_instance_ip_parameters/fail/fail_base.yaml
@@ -41,6 +41,10 @@ description: fdsafsfsa
 
 parameters:
 
+  TESTDB_praivate_ips:
+   type: comma_delimited_list
+   description: asnfjl
+
   TESTDB_int_priav_ips:
    type: comma_delimited_list
    description: asnfjl
@@ -75,5 +79,13 @@ resources:
       instance_ip_address: { get_param: [TESTDB_private_ips, 1] }
       subnet_uuid: { get_param: privte_v6_subnet_id }
 
+  TESTDB_0_private_vmi_2_IP_0:
+    type: OS::ContrailV2::InstanceIp
+    properties:
+      virtual_machine_interface_refs: { get_resource: TESTDB_1_priv_vmi_0 }
+      virtual_network_refs: [{ get_param: priv_net_fqdn }]
+      instance_ip_address: { get_param: [TESTDB_praivate_ips, 1] }
+      subnet_uuid: { get_param: privte_v6_subnet_id }
+
   #testnlksadf:
   #  type: http://www.google.com
diff --git a/ice_validator/tests/fixtures/test_contrail_instance_ip_parameters/fail/fail_module.yaml b/ice_validator/tests/fixtures/test_contrail_instance_ip_parameters/fail/fail_module.yaml
index 66dd13d..def7b3d 100644
--- a/ice_validator/tests/fixtures/test_contrail_instance_ip_parameters/fail/fail_module.yaml
+++ b/ice_validator/tests/fixtures/test_contrail_instance_ip_parameters/fail/fail_module.yaml
@@ -49,6 +49,10 @@ parameters:
    type: string
    description: asnfjl
 
+  TESTDB_praivate_ips:
+   type: string
+   description: asnfjl
+
   priv_subnet_id:
    type: string
    description: asnfjl
@@ -75,8 +79,16 @@ resources:
       instance_ip_address: { get_param: [TESTDB_private_ips, 1] }
       subnet_uuid: { get_param: privte_v6_subnet_id }
 
+  TESTDB_0_private_vmi_1_IP_1:
+    type: OS::ContrailV2::InstanceIp
+    properties:
+      virtual_machine_interface_refs: { get_resource: TESTDB_1_priv_vmi_0 }
+      virtual_network_refs: [{ get_param: priv_net_fqdn }]
+      instance_ip_address: { get_param: [TESTDB_praivate_ips, 1] }
+      subnet_uuid: { get_param: privte_v6_subnet_id }
+
   other_0_int_priv_vmi_0_IP_0:
     type: OS::ContrailV2::InstanceIp
     properties:
       instance_ip_address: { get_param: [other_int_priv_ips, 0] }
-      subnet_uuid: { get_param: int_priv_subnet_id }
\ No newline at end of file
+      subnet_uuid: { get_param: int_priv_subnet_id }