As part of this PR#sonic-net/sonic-buildimage#4412

we have added ACCEPT rules for BGP packets as default. Because of this
iptable rule added by qos_sai.yml get ignored because of lower priority
and make test case fails since BGP packets impacts Buffer calcualtion
assumption of testcase.

Fix is to add iptable rule to Drop BGP Packet from test case as highest
priority.

Fix in py script also

ansible/roles/test/tasks/qos_sai.yml

@@ -66,12 +66,12 @@
       supervisorctl: state=stopped name=bgpd
       delegate_to: "{{ ansible_host }}_bgp"
 
-    - name: Add iptables rule to drop BGP SYN Packet from peer so that we do not ACK back
-      shell: "iptables -A INPUT -j DROP -p tcp --destination-port bgp"
+    - name: Add iptables rule to drop BGP SYN Packet from peer so that we do not ACK back. Add at top so existing rules don't have precedence over it.
+      shell: "iptables -I INPUT 1 -j DROP -p tcp --destination-port bgp"
       become: true
 
-    - name: Add ip6tables rule to drop BGP SYN Packet from peer so that we do not ACK back
-      shell: "ip6tables -A INPUT -j DROP -p tcp --destination-port bgp"
+    - name: Add ip6tables rule to drop BGP SYN Packet from peer so that we do not ACK back. Add at top so existing rules don't have precedence over it.
+      shell: "ip6tables -I INPUT 1 -j DROP -p tcp --destination-port bgp"
       become: true
 
     - meta: flush_handlers

tests/qos/qos_sai_base.py

@@ -377,14 +377,16 @@ def updateIptables(self, duthost, swapSyncd):
         def updateIptablesDropRule(duthost, ipVersion,  state='present'):
             duthost.iptables(
                 ip_version=ipVersion,
-                action="Append",
+                action="insert",
+                rule_num="1",
                 chain="INPUT",
                 jump="DROP",
                 protocol="tcp",
                 destination_port="bgp",
                 state=state
             )
 
+
         ipVersions  = [{"ipVersion": "ipv4"}, {"ipVersion": "ipv6"}]
 
         logger.info("Add ip[6]tables rule to drop BGP SYN Packet from peer so that we do not ACK back")