neutron ipsecvpn create step

admin

' w' s& P, z, t: S9 Q3 u
) E4 \# Y8 O1 B  i以下为手动编写这个文件:
cd /usr/share/openstack-dashboard/openstack_dashboard/enabled/
touch _7100_project_vpn_panel.py
( M& z. Y' f$ H9 Y. z6 Z文件内容如下:
[root@localhost enabled]# vim _7100_project_vpn_panel.py
% Y$ n7 D3 R1 b1 W8 ~# Licensed under the Apache License, Version 2.0 (the "License"); you may
( c6 ]' R8 v5 X) h# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
; o. V( O' o4 }' x, N# http://www.apache.org/licenses/LICENSE-2.0
% ^4 z  n: A* G# q7 k% s/ ~#
' Y+ z* T5 S2 X) V; y' B# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
0 t: p5 u2 @; m2 q: C# License for the specific language governing permissions and limitations
. O% p; g: g4 Y; a4 D$ D2 }# under the License.

3 l, J. y- d* Z  T# The slug of the panel to be added to HORIZON_CONFIG. Required.
PANEL = 'vpn'
! U" H, \6 Z$ W) \6 C- R# The slug of the dashboard the PANEL associated with. Required.
- s8 c1 r: _( j$ m0 }$ jPANEL_DASHBOARD = 'project'
& j% ?0 G* V+ Z6 }9 a# The slug of the panel group the PANEL is associated with.
: R' X& L4 W* f+ ^( }PANEL_GROUP = 'network'

5 x, l8 v  X5 H1 U; G) E& G# Python panel class of the PANEL to be added.
ADD_PANEL = 'neutron_vpnaas_dashboard.dashboards.project.vpn.panel.VPN'

# d1 c1 C5 T1 n3 X9 h" v( [ADD_INSTALLED_APPS = ["neutron_vpnaas_dashboard"]
1 |9 x9 l+ g, N( K: p1 H% t
  E: o5 ~/ w6 [- ~9 ~5 S0 v! P
4.1 vim /etc/neutron/neutron.conf
[DEFAULT]
! {, ~3 m" N! K1 P, Xservice_plugins = router,vpnaas

9 \5 i0 d6 H0 O% S+ j/ Z4.2 vim  /etc/neutron/neutron_vpnaas.conf
[service_providers]
6 @! h7 u- a6 W) a' [6 b! S# v5 {service_provider = VPN:strongswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
* g  H! S2 b& T
6 j6 s& {3 J/ M* ^$ B& [  P5 i4.3 vim /etc/neutron/l3_agent.ini
0 u1 v" U5 D* C5 A: u" H[agent]
7 G& t' p. E8 F9 y: h6 dextensions = vpnaas
% r" c, v/ s# S8 F; k8 h  ?' w% a[vpnagent]
9 }8 |) w& [/ T3 }8 l) ~vpn_device_driver = neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver

, i0 S) A5 Q* X3 h4.4 执行 neutron-db-manage --subproject neutron-vpnaas upgrade head
2 w9 D3 q! ?& @8 o3 o
$ U8 F  T  r$ T) ]" _5. 重启服务
, Q* g: W9 d& U" D/ Q3 p: ssystemctl restart neutron-server
systemctl restart neutron-l3-agent
systemctl restart apache2
---------------------


% J# j$ \/ e7 }  V3 I: f
* T: Y9 \/ @4 P: W8 t" CVirtual Private Network-as-a-Service (VPNaaS)
7 ]4 c, w$ R! l& Z  
- m3 ]9 d/ n  VTHIS PAGE LAST UPDATED:
Enabling VPNaaS¶
1 q  c2 @1 s0 |1 {' r& dThis section describes the setting for the reference implementation. Vendor plugins or drivers can have different setup procedure and perhaps they provide their version of manuals.
8 r2 b/ k2 n( x: \2 d1 fEnable the VPNaaS plug-in in the /etc/neutron/neutron.conf file by appending vpnaas to service_plugins in [DEFAULT]:
[DEFAULT]
# ...
% m$ D$ C' K6 o$ wservice_plugins = vpnaas
Note
0 l' C$ I1 c8 `( yvpnaas is just example of reference implementation. It depends on a plugin that you are going to use. Consider to set suitable plugin for your own deployment.
3 J2 V% W4 X8 I# YConfigure the VPNaaS service provider by creating the /etc/neutron/neutron_vpnaas.conf file as follows, strongswan used in Ubuntu distribution:
[service_providers]
: {. h! u/ _# F6 cservice_provider = VPN:strongswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
3 K9 T# N9 L: J# `$ p7 E Note
' F: M! |+ }  `6 {- y) bThere are several kinds of service drivers. Depending upon the Linux distribution, you may need to override this value. Select libreswan for RHEL/CentOS, the config will like this: service_provider = VPN:openswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default. Consider to use the appropriate one for your deployment.
; Q$ J* H+ ~. B4 CConfigure the VPNaaS plugin for the L3 agent by adding to /etc/neutron/l3_agent.ini the following section, StrongSwanDriver used in Ubuntu distribution:
" h- L  V+ h' c' ][AGENT]
' M; S0 p/ }) i* Z9 E, ~( pextensions = vpnaas
) z/ E6 ~$ w8 j( B5 S. A* P4 U; [[vpnagent]
/ f7 E4 p$ e- a' mvpn_device_driver = neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver
& h8 m$ X/ g0 y' f Note
4 d( o' w  W* I4 `3 t! uThere are several kinds of device drivers. Depending upon the Linux distribution, you may need to override this value. Select LibreSwanDriver for RHEL/CentOS, the config will like this: vpn_device_driver = neutron_vpnaas.services.vpn.device_drivers.libreswan_ipsec.LibreSwanDriver. Consider to use the appropriate drivers for your deployment.
! A; D: Q" [9 [- u; x5 E. {& VCreate the required tables in the database:
5 ^# U, p; G' f* D# neutron-db-manage --subproject neutron-vpnaas upgrade head
Note
5 }; }$ _* @$ kIn order to run the above command, you need to have neutron-vpnaas package installed on controller node.
7 \5 ], [4 g7 p) d/ ^, W$ B" J# DRestart the neutron-server in controller node to apply the settings.
Restart the neutron-l3-agent in network node to apply the settings.
) r& U5 R* j: `) t; h* JUsing VPNaaS with endpoint group (recommended)¶
1 p) k1 B! p& q! z* Q1 B8 p  aIPsec site-to-site connections will support multiple local subnets, in addition to the current multiple peer CIDRs. The multiple local subnet feature is triggered by not specifying a local subnet, when creating a VPN service. Backwards compatibility is maintained with single local subnets, by providing the subnet in the VPN service creation.
! d$ A- c& W* X( mTo support multiple local subnets, a new capability called “End Point Groups” has been added. Each endpoint group will define one or more endpoints of a specific type, and can be used to specify both local and peer endpoints for IPsec connections. The endpoint groups separate the “what gets connected” from the “how to connect” for a VPN service, and can be used for different flavors of VPN, in the future.
Refer Multiple Local Subnets for more detail.
Create the IKE policy, IPsec policy, VPN service, local endpoint group and peer endpoint group. Then, create an IPsec site connection that applies the above policies and service.
Create an IKE policy:
$ openstack vpn ike policy create ikepolicy
  +-------------------------------+----------------------------------------+
9 T3 s+ w& W7 r$ T/ v6 _; \  | Field                         | Value                                  |
; f8 t  q* c2 l# G3 {$ g9 Z  +-------------------------------+----------------------------------------+
  | Authentication Algorithm      | sha1                                   |
  | Description                   |                                        |
0 N0 v2 S* @" a  f/ C  | Encryption Algorithm          | aes-128                                |
: x& Q. a3 z6 `1 }8 ^, S$ T  | ID                            | 735f4691-3670-43b2-b389-f4d81a60ed56   |
  | IKE Version                   | v1                                     |
& d* O1 T. H/ T  D  | Lifetime                      | {u'units': u'seconds', u'value': 3600} |
  | Name                          | ikepolicy                              |
  | Perfect Forward Secrecy (PFS) | group5                                 |
$ [2 [4 j) S" y' d, K4 Q  | Phase1 Negotiation Mode       | main                                   |
  | Project                       | 095247cb2e22455b9850c6efff407584       |
1 c  x% E- k6 l1 G' ]9 |  | project_id                    | 095247cb2e22455b9850c6efff407584       |
* Z4 P- f6 n) I, {0 u' J" H  +-------------------------------+----------------------------------------+
Create an IPsec policy:
, g" M' h$ o, p8 Y, L+ u$ openstack vpn ipsec policy create ipsecpolicy
6 O: X' \+ w2 d- `( e' l  +-------------------------------+----------------------------------------+
+ k' i5 p! z4 v8 N2 W+ ~% s  | Field                         | Value                                  |
  +-------------------------------+----------------------------------------+
3 `4 \8 j4 R1 {- @. j+ |- l) A  | Authentication Algorithm      | sha1                                   |
. ^' o' N- n; V, u  I  | Description                   |                                        |
  | Encapsulation Mode            | tunnel                                 |
  | Encryption Algorithm          | aes-128                                |
' ^0 C, k6 G- k- A  | ID                            | 4f3f46fc-f2dc-4811-a642-9601ebae310f   |
; I/ C" b: z2 M7 s+ N' y7 y5 D  | Lifetime                      | {u'units': u'seconds', u'value': 3600} |
, R* E& x1 r4 T6 G0 B* f  | Name                          | ipsecpolicy                            |
( k0 i- H: y+ E4 M  | Perfect Forward Secrecy (PFS) | group5                                 |
, ?$ M) K; V: B# O  | Project                       | 095247cb2e22455b9850c6efff407584       |
  | Transform Protocol            | esp                                    |
4 I$ {1 H2 H, n! U# H  | project_id                    | 095247cb2e22455b9850c6efff407584       |
- N5 ]. F1 r+ T. I" T" b  +-------------------------------+----------------------------------------+
0 p* Y: I& ~! x9 ?* G( R; q( wCreate a VPN service:
) s5 O; x6 H0 X$ openstack vpn service create vpn \
  --router 9ff3f20c-314f-4dac-9392-defdbbb36a66
  +----------------+--------------------------------------+
  | Field          | Value                                |
' L+ t9 i2 o9 L  +----------------+--------------------------------------+
  | Description    |                                      |
0 U7 u! E: s* U9 p0 m  | Flavor         | None                                 |
  | ID             | 9f499f9f-f672-4ceb-be3c-d5ff3858c680 |
  | Name           | vpn                                  |
  | Project        | 095247cb2e22455b9850c6efff407584     |
, u' x5 P# j5 F# V! }  | Router         | 9ff3f20c-314f-4dac-9392-defdbbb36a66 |
+ K+ i/ r5 x- F$ e. s: O3 ~  | State          | True                                 |
  A0 F0 d1 Y9 i  | Status         | PENDING_CREATE                       |
  | Subnet         | None                                 |
1 Z2 {! F6 K+ ^4 C3 B+ X  | external_v4_ip | 192.168.20.7                         |
" h+ j) [4 e8 ]! s$ P3 C  | external_v6_ip | 2001:db8::7                          |
  | project_id     | 095247cb2e22455b9850c6efff407584     |
  +----------------+--------------------------------------+
5 z# x! k7 V6 T1 B1 i. A$ I Note
Please do not specify --subnet option in this case.
* J9 Q; @' K8 H4 ^* S9 IThe Networking openstackclient requires a router (Name or ID) and name.
Create local endpoint group:
! W% L9 D( ^/ X- x, ^$ a$ openstack vpn endpoint group create ep_subnet \
9 @6 h) b# T  V6 z  --type subnet \
" M/ N% o$ C8 a: b) M3 b  --value 1f888dd0-2066-42a1-83d7-56518895e47d
  +-------------+-------------------------------------------+
. H0 r* `4 M2 f. `) x3 `7 o  | Field       | Value                                     |
  +-------------+-------------------------------------------+
  | Description |                                           |
* [3 W  Q# G/ B  | Endpoints   | [u'1f888dd0-2066-42a1-83d7-56518895e47d'] |
$ D# O5 V2 X* M2 o  | ID          | 667296d0-67ca-4d0f-b676-7650cf96e7b1      |
7 }9 d8 s) X8 M" `- P# D  | Name        | ep_subnet                                 |
  | Project     | 095247cb2e22455b9850c6efff407584          |
  | Type        | subnet                                    |
! L9 q$ K; X5 y' Y: g% @  N7 s' c+ ~4 ~  | project_id  | 095247cb2e22455b9850c6efff407584          |
  +-------------+-------------------------------------------+
  r0 F( k$ l/ i3 F& v, L" e2 } Note
8 c# V/ `% y8 ]4 b& ?' q. |+ \+ NThe type of a local endpoint group must be subnet.
! B9 A, z2 q- A" BCreate peer endpoint group:
$ openstack vpn endpoint group create ep_cidr \
# }. ?1 R, G9 s! V9 e, C% w' m3 C  --type cidr \
  --value 192.168.1.0/24
% n: v- [; B, P( n9 X* c" w0 ^% H" g: B4 T  +-------------+--------------------------------------+
  | Field       | Value                                |
) s' Q9 q0 a7 Q# |  +-------------+--------------------------------------+
  | Description |                                      |
  | Endpoints   | [u'192.168.1.0/24']                  |
  | ID          | 5c3d7f2a-4a2a-446b-9fcf-9a2557cfc641 |
# |# X$ H4 z: t1 y0 H  | Name        | ep_cidr                              |
  | Project     | 095247cb2e22455b9850c6efff407584     |
/ C, x# x. v6 r8 `3 ]  | Type        | cidr                                 |
2 y4 A) h; ]" W" x- M. H8 B% {  E  | project_id  | 095247cb2e22455b9850c6efff407584     |
& k) M- \7 Z, }% Q: Z  g4 Z/ T  +-------------+--------------------------------------+
Note
The type of a peer endpoint group must be cidr.
% y% m2 J( _; }+ |6 g7 \8 X6 ICreate an ipsec site connection:
$ openstack vpn ipsec site connection create conn \
  --vpnservice vpn \
9 M: A4 O- j9 |2 l6 Y  --ikepolicy ikepolicy \
  --ipsecpolicy ipsecpolicy \
( _7 f2 Y1 ]9 \% D7 x* J  --peer-address 192.168.20.9 \
" l  H% s" S* G1 O; q  z9 d  --peer-id 192.168.20.9 \
  --psk secret \
6 s. v3 g" Q1 w5 G  --local-endpoint-group ep_subnet \
! m/ b* j8 X' u' p! I  --peer-endpoint-group ep_cidr
/ s3 e) [& z3 e5 x& J% K5 }  +--------------------------+--------------------------------------------------------+
& W7 s0 r) Z1 w7 I# J1 |  | Field                    | Value                                                  |
- m, B! b$ V" O+ s4 R8 }! y5 ?" i  +--------------------------+--------------------------------------------------------+
  | Authentication Algorithm | psk                                                    |
0 f% m! {' R5 u, T  | Description              |                                                        |
9 A3 C6 I6 B; z8 r" n' C0 d  | ID                       | 07e400b7-9de3-4ea3-a9d0-90a185e5b00d                   |
$ Z# k# l3 f4 M/ }3 i7 W  | IKE Policy               | 735f4691-3670-43b2-b389-f4d81a60ed56                   |
  | IPSec Policy             | 4f3f46fc-f2dc-4811-a642-9601ebae310f                   |
& n3 y# ?# d! Z: b3 ^# O1 v  | Initiator                | bi-directional                                         |
3 }  ~& ?$ H/ ~; u$ [; s" I4 j0 R  | Local Endpoint Group ID  | 667296d0-67ca-4d0f-b676-7650cf96e7b1                   |
  | Local ID                 |                                                        |
* D  Z% S7 `$ B' M1 `  | MTU                      | 1500                                                   |
$ b7 c, n" d+ A, T' |  | Name                     | conn                                                   |
  | Peer Address             | 192.168.20.9                                           |
  | Peer CIDRs               |                                                        |
  | Peer Endpoint Group ID   | 5c3d7f2a-4a2a-446b-9fcf-9a2557cfc641                   |
' d- e6 |+ K4 C0 V  y  | Peer ID                  | 192.168.20.9                                           |
  | Pre-shared Key           | secret                                                 |
  | Project                  | 095247cb2e22455b9850c6efff407584                       |
1 q/ }, {8 D- J+ r* j) I  | Route Mode               | static                                                 |
/ K4 a8 s# F1 d7 n0 Z5 z' q* f. A+ v" w  | State                    | True                                                   |
9 s* d* q* b$ c5 F+ Q  | Status                   | PENDING_CREATE                                         |
  | VPN Service              | 9f499f9f-f672-4ceb-be3c-d5ff3858c680                   |
  | dpd                      | {u'action': u'hold', u'interval': 30, u'timeout': 120} |
  | project_id               | 095247cb2e22455b9850c6efff407584                       |
. f, T3 n( H: m4 b& j# c  +--------------------------+--------------------------------------------------------+
' X" o& A  m8 Z6 Z Note
Please do not specify --peer-cidr option in this case. Peer CIDR(s) are provided by a peer endpoint group.
Configure VPNaaS without endpoint group (the legacy way)¶
Create the IKE policy, IPsec policy, VPN service. Then, create an ipsec site connection that applies the above policies and service.
; l1 c: L7 X6 N' ZCreate an IKE policy:
) ^3 h8 W9 d5 V  v$ openstack vpn ike policy create ikepolicy1
! f0 C4 }2 V& N: _" }  +-------------------------------+----------------------------------------+
% M+ L* P- x  z( k0 U. H  {  | Field                         | Value                                  |
, G& h1 M3 M/ L2 c  `/ t  +-------------------------------+----------------------------------------+
  | Authentication Algorithm      | sha1                                   |
: G8 O5 S! _  s( C9 A  | Description                   |                                        |
  | Encryption Algorithm          | aes-128                                |
" b( h' P& l) ^  N2 E% ^% Z  | ID                            | 99e4345d-8674-4d73-acb4-0e2524425e34   |
  | IKE Version                   | v1                                     |
  | Lifetime                      | {u'units': u'seconds', u'value': 3600} |
* }. [7 N/ b; c  O$ r: v' T. U  | Name                          | ikepolicy1                             |
& F* O1 M* o0 g: y2 j- w  | Perfect Forward Secrecy (PFS) | group5                                 |
  | Phase1 Negotiation Mode       | main                                   |
( m' X6 d* ?! w, i6 L) X! {  | Project                       | 095247cb2e22455b9850c6efff407584       |
  | project_id                    | 095247cb2e22455b9850c6efff407584       |
  +-------------------------------+----------------------------------------+
Create an IPsec policy:
! L6 a, o" f: ^5 J$ openstack vpn ipsec policy create ipsecpolicy1
1 K- {$ G! ?' p# K! S, J1 a( @  +-------------------------------+----------------------------------------+
3 c% Q  m, d* ?& z4 V  | Field                         | Value                                  |
6 p" E) t7 E/ _: {9 l; @  +-------------------------------+----------------------------------------+
: v* g8 [  F  z: j0 y: G" n  | Authentication Algorithm      | sha1                                   |
  | Description                   |                                        |
6 g, d- c1 Y- `% P; b0 |  | Encapsulation Mode            | tunnel                                 |
$ V6 y9 g( g4 u$ B* y  | Encryption Algorithm          | aes-128                                |
5 D/ @+ t6 O) S. s- p& e' p3 Z  | ID                            | e6f547af-4a1d-4c28-b40b-b97cce746459   |
  | Lifetime                      | {u'units': u'seconds', u'value': 3600} |
  | Name                          | ipsecpolicy1                           |
* F. u4 N( ^6 H4 `! [% q% B8 i0 ?  | Perfect Forward Secrecy (PFS) | group5                                 |
& {* Q- s  B$ X9 k- U1 N  | Project                       | 095247cb2e22455b9850c6efff407584       |
  | Transform Protocol            | esp                                    |
  | project_id                    | 095247cb2e22455b9850c6efff407584       |
  +-------------------------------+----------------------------------------+
Create a VPN service:
+ R2 n; N' g+ Q9 c; [$ openstack vpn service create vpn \
  --router 66ca673a-cbbd-48b7-9fb6-bfa7ee3ef724 \
  --subnet cdfb411e-e818-466a-837c-7f96fc41a6d9
6 m4 E9 _& z: s3 G/ A" S  +----------------+--------------------------------------+
  | Field          | Value                                |
0 M: N7 k, C& u3 E8 ~/ i4 ~  +----------------+--------------------------------------+
0 ~3 X( A  X% R! G& a' q$ f  | Description    |                                      |
: y4 j$ c9 p# O4 I  | Flavor         | None                                 |
, F1 |) ~7 t  w+ z3 V$ M9 f+ C  | ID             | 79ef6250-ddc3-428f-88c2-0ec8084f4e9a |
  | Name           | vpn                                  |
  | Project        | 095247cb2e22455b9850c6efff407584     |
  | Router         | 66ca673a-cbbd-48b7-9fb6-bfa7ee3ef724 |
+ Y4 N0 f; W. m( [6 @  | State          | True                                 |
  | Status         | PENDING_CREATE                       |
0 R) M  L. E5 g* l) x8 y  | Subnet         | cdfb411e-e818-466a-837c-7f96fc41a6d9 |
5 D0 o: Z! H( b' X% y  X& i( S, Y) P  | external_v4_ip | 192.168.20.2                         |
! Q$ M, L3 R% ^+ ~# U  | external_v6_ip | 2001:db8::d                          |
: A4 y3 [/ U) a/ @! \2 O  | project_id     | 095247cb2e22455b9850c6efff407584     |
9 d% u4 c0 h5 a$ G# W" ~  +----------------+--------------------------------------+
Note
The --subnet option is required in this scenario.
4 p* n% V4 D( Z$ W: I) s. I- eCreate an ipsec site connection:
( w( I- F, b3 D) d+ S! ^" H$ }$ openstack vpn ipsec site connection create conn \
  --vpnservice vpn \
% g  l- g& [. A6 }3 J  --ikepolicy ikepolicy1 \
  --ipsecpolicy ipsecpolicy1 \
- _2 s5 G4 }% g/ t6 I) j. ^  --peer-address 192.168.20.11 \
  --peer-id 192.168.20.11 \
  --peer-cidr 192.168.1.0/24 \
; w- c) J  D0 l/ x7 n: R  --psk secret
5 ]& n4 x4 j3 \- @( h7 x  +--------------------------+--------------------------------------------------------+
  | Field                    | Value                                                  |
+ r% l7 i0 A& f( w9 G+ O  +--------------------------+--------------------------------------------------------+
  | Authentication Algorithm | psk                                                    |
: W* r  ~( {4 X' d3 E* v3 L2 ~  | Description              |                                                        |
  | ID                       | 5b2935e6-b2f0-423a-8156-07ed48703d13                   |
  | IKE Policy               | 99e4345d-8674-4d73-acb4-0e2524425e34                   |
  | IPSec Policy             | e6f547af-4a1d-4c28-b40b-b97cce746459                   |
4 I7 e0 s' P/ F7 [% p, W+ u  | Initiator                | bi-directional                                         |
  | Local Endpoint Group ID  | None                                                   |
  | Local ID                 |                                                        |
1 L% Y- \( o$ K- q( l! D  | MTU                      | 1500                                                   |
  | Name                     | conn                                                   |
/ o; P) c  @, }  | Peer Address             | 192.168.20.11                                          |
& z6 {8 K2 t# o/ K& j( c  | Peer CIDRs               | 192.168.1.0/24                                         |
" B# j  X8 Q' k  \3 ?  A# W: o' ^  | Peer Endpoint Group ID   | None                                                   |
  | Peer ID                  | 192.168.20.11                                          |
  | Pre-shared Key           | secret                                                 |
; N  U( l  j# N2 N! ~& N  | Project                  | 095247cb2e22455b9850c6efff407584                       |
& a1 y. F9 P9 S! s0 W- d  | Route Mode               | static                                                 |
  | State                    | True                                                   |
( P" u8 z2 g8 I" ^: y9 Q  | Status                   | PENDING_CREATE                                         |
  | VPN Service              | 79ef6250-ddc3-428f-88c2-0ec8084f4e9a                   |
2 r! Z( U- C+ Q4 J0 z* ]% K  | dpd                      | {u'action': u'hold', u'interval': 30, u'timeout': 120} |
  | project_id               | 095247cb2e22455b9850c6efff407584                       |
  +--------------------------+--------------------------------------------------------+
+ k4 N. h& K6 [8 j( p5 D+ z Note
& p8 @# i- @' `3 EPlease do not specify --local-endpoint-group and --peer-endpoint-group options in this case.
7 q: H/ ]8 X1 _7 I$ ~5 B8 C

admin

Installation
In order to use Neutron-VPNaaS with devstack (http://devstack.org) a single node setup, you'll need the following settings in your local.conf (NEW: neutron-vpnaas plugin is added).

[[local|localrc]]

enable_plugin neutron-vpnaas https://git.openstack.org/openstack/neutron-vpnaas
6 ~4 n# H. r, t' Y( T3 }# w; K
1 e* ^4 ?1 q% P& D3 d0 ddisable_service n-net
enable_service q-svc
3 x1 n" t, Z) K+ M& \! B% m# c9 L% l! ~4 qenable_service q-agt
7 ]" ^- z9 q5 X# s& i% r0 Henable_service q-dhcp
: y0 Q; A( C/ P) J- h% L" Q. Wenable_service q-l3
enable_service q-meta
6 a$ @" I( {% Z5 z, v# Optional, to enable tempest configuration as part of devstack
enable_service tempest
* [& W$ p' Y# M! C9 `
+ W. c; L4 }6 n* @+ ?# IPSec driver to use. Optional, defaults to OpenSwan.
* r! E0 T  U# {! X4 \' R; y$ p; kIPSEC_PACKAGE="openswan"
- y2 q2 X9 [6 G- @Quick Test Script
http://paste.openstack.org/raw/44702/
  ?5 M$ G5 s: q* `3 d' q$ J
8 ~& D; o% w& Y3 A/ K9 m& YThis quick test script create two site with a router,a network and a subnet connected with public network. Then, connect both site via VPN.
* i/ {" _/ ?( T0 h1 R: L
: ^0 z6 f' [8 @# P/ mUsing Two DevStack Nodes for Testing
& o7 Z2 I% B4 Q3 gYou can use two DevStack nodes connected by a common "public" network to test VPNaaS. The second node can be set up with the same public network as the first node, except it will use a different gateway IP (and hence router IP). In this example, we'll assume we have two DevStack nodes (East and West), each running on hardware (you can do the same thing with multiple VM guests, if desired). (Note: you can also create similar topology using two virtual routers with one devstack)
* b2 G( q3 [  t5 Q5 x: _
5 E3 ^% |% @  g# w0 TExample Topology

A dedicated physical port can be used for the "public" network connection (e.g. eth2) interconnected by a physical switch. You'll need to add the port to the OVS bridge on each DevStack node (e.g. sudo ovs-vsctl add-port br-ex eth2).

      (10.1.0.0/24 - DevStack East)
              |
              |  10.1.0.1
     [Neutron Router]
              |  172.24.4.226
              |
7 u# F6 d1 B& j& b) A              |  172.24.4.225
     [Internet GW]
- x* }4 z* x+ |* l, v  H              |  
              |
6 {1 D0 W) v) v. r2 D+ z2 @     [Internet GW]
* ]. [( R) P9 F- ]              | 172.24.4.232
8 |1 l: k6 C8 R. P1 B              |
              | 172.24.4.233
! A" c( m2 a) H3 C# |% d4 O  f     [Neutron Router]
- o. H% l- F  S+ N6 ^2 w* q              |  10.2.0.1
              |
     (10.2.0.0/24 DevStack West)
+ s& l' X: n! g. eDevStack Configuration
8 E. w8 S$ h3 O* j
9 R& M' g: C( M9 {& q  Q! iFor East you can append these lines to the localrc, which will give you a private net of 10.1.0.0/24 and public network of 172.24.4.0/24
" O" X6 i7 Y9 d9 o3 ?$ z
# C$ |" g! m0 S. Y, ^4 r8 LPUBLIC_SUBNET_NAME=yoursubnet
PRIVATE_SUBNET_NAME=mysubnet
FIXED_RANGE=10.1.0.0/24
. n$ {% `3 l0 i4 Z) ]- [NETWORK_GATEWAY=10.1.0.1
PUBLIC_NETWORK_GATEWAY=172.24.4.225
Q_FLOATING_ALLOCATION_POOL=start=172.24.4.226,end=172.24.4.231
For West you can add these lines to localrc to use a different local network, public GW (and implicitly router) IP:

( l, z. Y( Q" j3 dPUBLIC_SUBNET_NAME=yoursubnet
PRIVATE_SUBNET_NAME=mysubnet
FIXED_RANGE=10.2.0.0/24
+ r( s* ]3 z0 t# e0 B5 V/ e1 ?  ]) |NETWORK_GATEWAY=10.2.0.1
# x7 R+ g- [' JPUBLIC_NETWORK_GATEWAY=172.24.4.232
Q_FLOATING_ALLOCATION_POOL=start=172.24.4.233,end=172.24.4.238
VPNaaS Configuration

# B, S' U+ H: A& m/ @2 |0 M4 vWith DevStack running on East and West and connectivity confirmed (make sure you can ping one router/GW from the other), you can perform these VPNaaS CLI commands.
+ _  U1 ?8 r4 _- Z+ p0 L+ `8 h
On East
3 t: x5 ?9 _2 C* o  m, q9 N( h* e
neutron vpn-ikepolicy-create ikepolicy1
neutron vpn-ipsecpolicy-create ipsecpolicy1
neutron vpn-service-create --name myvpn --description "My vpn service" router1 mysubnet
5 a; N' n+ h2 U6 A( K6 H+ tneutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.233 --peer-id 172.24.4.233 --peer-cidr 10.2.0.0/24 --psk secret
6 W3 ~$ R# p( F8 lOn West
4 w, T6 e. l; Y$ Z7 m" ]
neutron vpn-ikepolicy-create ikepolicy1
neutron vpn-ipsecpolicy-create ipsecpolicy1
' J7 |3 H0 k" Q  x5 j- P$ S3 Zneutron vpn-service-create --name myvpn --description "My vpn service" router1 mysubnet
, o( P! ]: h9 A- z% q/ U$ aneutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.226 --peer-id 172.24.4.226 --peer-cidr 10.1.0.0/24 --psk secret
% ]. L$ Y8 i; ?& `/ MNote: Please make sure setup security group (open icmp for vpn subnet etc)

8 q2 e; A- X! Y8 r' UVerification

' S5 P( Z( ^# e! R4 v6 t' t$ _4 A6 wYou can spin up VMs on each node, and then from the VM ping the far end router's public IP. With tcpdump running on one of the nodes, you can see that pings appear as encrypted packets (ESP). Note that BOOTP, IGMP, and the keepalive packets between the two nodes are not encrypted (nor are pings between the two external IP addresses).

Kilo Update
7 o8 @- R4 y6 r& H: {
For Kilo, the localrc contents was moved into local.conf. With (VirtualBox) VMs used as hosts, where eth0 was set up as NAT, and eth1 set up as Internal Network, the following configurations were used in local.conf:

   OVS_PHYSICAL_BRIDGE=br-ex
   PUBLIC_INTERFACE=eth1
: G8 x& a6 B1 HOnce stacked, VMs were created for testing, VPN IPSec commands used to establish connections between the nodes, and security group rules added to allow ICMP and SSH.

VPNaaS with Single DevStack and Two Routers
Simple instructions on how to setup a test environment where a VPNaaS IPSec connection can be established using the reference implementation (OpenSwan). This example uses VIrtualBox running on laptop to provide a VM for running DevStack. It assumes a Kilo release (post Juno).

7 G+ U' U: {7 y6 d  d' ~) L/ eThe idea here is to have a single OpenStack cloud created using DevStack, two routers (one created automatically), two private networks (one created automatically) -10.1.0.0/24 and 10.2.0.0/24, a VM in each private network, and establish a VPN connection between the two private nets, using the public network (172.24.4.0/24).
* }9 a8 H$ w6 I: p% F" b
Preparation
Create a VM (e.g. 7 GB RAM, 2 CPUs) running Ubuntu 14.04, with NAT I/F for access to the Internet. Clone a DevStack repo with latest (Kilo-1 used for this example).

5 E2 X* C6 Z  ?; [# B$ |0 @DevStack Configuration
* A. D1 ]/ e9 S2 c  E0 _7 V9 ^5 }For this example, the following local.conf is used:

   localrc
   GIT_BASE=https://github.com
! }6 |, c/ P+ k' Y) n   DEST=/opt/stack
5 }- S) H' e8 w   
4 G4 @/ s, h& d3 }" b' z  Z# E   disable_service n-net
6 `: v4 t9 I+ `# q0 M   enable_service q-svc
( ?2 Y$ o7 c+ i/ ^   enable_service q-agt
. W) I7 ^0 V& Q9 u3 S9 ^   enable_service q-dhcp
   enable_service q-l3
, N, f7 `+ ?0 c/ M/ w; t   enable_service q-meta
, L: n( m2 `6 u" v* e5 j1 |   enable_service neutron
   enable_plugin neutron-vpnaas https://git.openstack.org/openstack/neutron-vpnaas
7 o7 \9 O1 v/ j   
" q8 x' w9 j7 y4 q$ k* a   FIXED_RANGE=10.1.0.0/24
   FIXED_NETWORK_SIZE=256
; x4 D' u6 m0 z! R1 M   NETWORK_GATEWAY=10.1.0.1
   PRIVATE_SUBNET_NAME=privateA
- n- ]' l: z$ \7 G, q, c/ \/ V# i   
   PUBLIC_SUBNET_NAME=public-subnet
1 P  v, I. v$ w   FLOATING_RANGE=172.24.4.0/24
+ J1 ^8 B2 q0 [  d0 f   PUBLIC_NETWORK_GATEWAY=172.24.4.10
$ I- I" h* D6 u   Q_FLOATING_ALLOCATION_POOL="start=172.24.4.11,end=172.24.4.29"
   
4 ^8 k7 n3 N6 D5 n   LIBVIRT_TYPE=qemu
+ I7 y" `& Q* e+ h   
$ s4 \1 y! y8 e" c   IMAGE_URLS="http://cloud-images.ubuntu.com/releases/14.04.1/release/ubuntu-14.04-server-cloudimg-amd64.tar.gz,http://download.cirros-cloud.net ... 3-x86_64-uec.tar.gz"
   
   SCREEN_LOGDIR=/opt/stack/screen-logs
   SYSLOG=True
& }, @6 n) A( E2 r, P   LOGFILE=~/devstack/stack.sh.log
   
   ADMIN_PASSWORD=password
   MYSQL_PASSWORD=password
   RABBIT_PASSWORD=password
! j& m, ~; F! a   SERVICE_PASSWORD=password
   SERVICE_TOKEN=tokentoken
. d* o" o# N+ m" N   
   Q_USE_DEBUG_COMMAND=True
   
   # RECLONE=No
6 @9 F3 P% }- E. n% d( n   RECLONE=yes
   OFFLINE=False
) R7 s. }7 `3 C4 z( ~* oStart up the cloud using ./stack.sh and ensure it completes successfully. Once stacked, you can change RECLONE to No.
4 A5 P6 A" }, Z6 U0 u0 {2 p
$ q" k- f' p8 I5 N) ICloud Configuration
Once stacking is completed, you'll have a private network (10.1.0.0/24), and a router (router1). To prepare for establishing a VPN connection, a second network, subnet, and router needs to be created, and a VM spun up in each private network.
. ^1 ]+ B" o) a7 x0 @! B& `
6 h) A7 ]' `5 h+ J5 k   # Create second net, subnet, router
   source ~/devstack/openrc admin demo
3 P7 E& Y- O0 x& d" ?. v0 J0 V   neutron net-create privateB
. V# K3 W% \5 Y   neutron subnet-create --name subB privateB 10.2.0.0/24 --gateway 10.2.0.1
( d, b3 ?* {8 z! [5 h7 E& A   neutron router-create router2
3 z9 K+ D* W: o* M/ J5 K# L) ]0 G! g9 j. g   neutron router-interface-add router2 subB
% J0 P2 r) D3 h/ z# [6 r   neutron router-gateway-set router2 public
) S6 F3 O5 J+ D% ^   
) @. ~% J1 S- J+ G' J   # Start up a VM in the privateA subnet.
8 A- ?. b' D) K& p4 c7 @6 ?   PRIVATE_NET=`neutron net-list | grep 'private ' | cut -f 2 -d' '`
   nova boot --flavor 1 --image cirros-0.3.3-x86_64-uec --nic net-id=$PRIVATE_NET peter
   
6 Q9 i! }& A: G" A3 q   # Start up a VM in the privateB subnet
" _) {  ^. t9 `: ~   PRIVATE_NETB=`neutron net-list | grep privateB | cut -f 2 -d' '`
, f6 G- N4 [7 o' H   nova boot --flavor 1 --image cirros-0.3.3-x86_64-uec --nic net-id=$PRIVATE_NETB paul
/ J! G3 o' G6 {  r" j1 D; eAt this point, you can verify that you have basic connectivity. Note, DevStack will create a static route that will allow you to ping the private I/F IP of router1 from privateB network. You can remove the route, if desired.

8 q4 z$ G( l% N) m. BIPSec Site-to-site Connection Creation
The following commands will create the IPSec connection:

- |8 y+ B3 h' K   # Create VPN connections
   neutron vpn-ikepolicy-create ikepolicy
. L1 _1 u) }$ J   neutron vpn-ipsecpolicy-create ipsecpolicy
! T+ w" y+ u4 v* P  N4 B( F+ @, j   neutron vpn-service-create --name myvpn --description "My vpn service" router1 privateA
" q; `5 U. l- o6 P: p   
   neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn \
7 }. d' c4 w+ q$ o" \1 e; e+ y& H   --ikepolicy-id ikepolicy --ipsecpolicy-id ipsecpolicy --peer-address 172.24.4.13 \
   --peer-id 172.24.4.13 --peer-cidr 10.2.0.0/24 --psk secret
5 `& |1 u4 Z6 Z$ ?5 K& Z% z   
2 F0 z7 o2 Y! H) R   neutron vpn-service-create --name myvpnB --description "My vpn serviceB" router2 subB
' {' s, S( s! ?/ l9 |   
3 F+ J$ M4 P6 B& k: w8 K0 \   neutron ipsec-site-connection-create --name vpnconnection2 --vpnservice-id myvpnB \
   --ikepolicy-id ikepolicy --ipsecpolicy-id ipsecpolicy --peer-address 172.24.4.11 \
; n6 z1 G# r2 Z! I$ ]: e5 y   --peer-id 172.24.4.11 --peer-cidr 10.1.0.0/24 --psk secret
At this point (once the connections become active - which can take up to 30 seconds or so), you should be able to ping from the VM in the privateA network, to the VM in the privateB network. You'll see encrypted packets, if you tcpdump using the qg-# interface from one of the router namespaces. If you delete one of the connections, you'll see that the pings fail (if all works out correctly :).

Multiple Local Subnets
Early in Mitaka, IPSec site-to-site connections will support multiple local subnets, in addition to the current multiple peer CIDRs. The multiple local subnet feature is triggered by not specifying a local subnet, when creating a VPN service. Backwards compatibility is maintained with single local subnets, by providing the subnet in the VPN service creation.
1 o4 }" y7 o; T% w  }
To support multiple local subnets, a new capability has been provided (in Liberty), called "Endpoint Groups". Each endpoint group will define one or more endpoints of a specific type, and can be used to specify both local and peer endpoints for IPSec Connections. The Endpoint Groups separate the "what gets connected" from the "how to connect" for a VPN service, and can be used for different flavors of VPN, in the future. An example:
8 z8 }0 [6 F4 I- Q" K* g) B( }
   # Create VPN connections
   neutron vpn-ikepolicy-create ikepolicy
2 l' M5 g+ j, L- b- V   neutron vpn-ipsecpolicy-create ipsecpolicy
   neutron vpn-service-create --name myvpnC --description "My vpn service" router1
% i" f; C$ E8 b* ^  WTo prepare for an IPSec site-to-site, one would create an endpoint group for the local subnets, and an endpoint group for the peer CIDRs, like so:
: i' W' n, H/ I0 U
" V; a+ F0 |5 W" R! v6 o* r9 x   neutron vpn-endpoint-group-create --name my-locals --type subnet --value privateA --value privateA2
   neutron vpn-endpoint-group-create --name my-peers --type cidr --value 10.2.0.0/24 --value 20.2.0.0/24
where privateA and privateA2 are two local (private) subnets, and 10.2.0.0/24 and 20.2.0.0/24 are two CIDRs representing peer (private) subnets that will be used by a connection. Then, when creating the IPSec site-to-site connection, these endpoint group IDs would be specified, instead of the peer-cidrs attribute:

   neutron ipsec-site-connection-create --name vpnconnection3 --vpnservice-id myvpnC \
   --ikepolicy-id ikepolicy --ipsecpolicy-id ipsecpolicy --peer-address 172.24.4.11 \
   --peer-id 172.24.4.11 --local-ep-group my-locals --peer-ep-group my-peers --psk secret
1 U% `# _# |  Q+ G9 c* a; U* I& }Notes:
. o" l2 a' g* u2 Q) c$ B8 ^6 t: g
The validation logic makes sure that endpoint groups and peer CIDRs are not intermixed.
$ K5 z$ Q9 h+ r: ], ]2 _Endpoint group types are subnet, cidr, network, router, and vlan. However, only subnet and cidr are implemented (for IPSec use).
The endpoints in a group must be of the same type, although can mix IP versions.
. Y2 s! }9 m8 `2 Y7 r' XFor IPSec connections, validation currently enforces that the local and peer endpoints all use the same IP version.
3 m, `& G4 }4 [' j. ?IPSec connection validation requires that local endpoints are subnets, and peer endpoints are CIDRs.
1 x  f* `7 m+ `7 B2 l# IMigration will convert information for any existing VPN services and connections to endpoint groups.
$ k4 o" \$ U1 T- c6 H/ H1 b4 R" YThe original APIs will work for backward compatibility.
Horizon Support
Checkout Test branch
Horizon support has been merged.

Enable VPN section in Horizon
8 o/ e2 G% N# A3 VNote that ff q-vpn is enabled Horizon VPN support is enabled automatically.

$ x- s+ d  m) NOpen
5 w4 g( V5 X5 z! M, Y5 C/ k/opt/stack/horizon/openstack_dashboard/local/local_settings.py
! F+ J( i' \/ band replace

, `7 Q$ g3 T. t5 ]( WOPENSTACK_NEUTRON_NETWORK = {
0 n( A8 M6 |3 M$ l4 ^/ T- q' |    'enable_vpn': False,
}
with
7 }* ^: U, E* C3 J! e6 e# x# f
) e3 S8 l# _4 k: dOPENSTACK_NEUTRON_NETWORK = {
. {0 T7 ^  }5 c  N/ A3 Z( t    'enable_vpn': True,
}