Fail to create VPN IPSec Site connection with ML2 plugin

[Akihiro Motoki]

When I tried to create a IPSec Site connection with ML2 plugin, I got the following error.
http://paste.openstack.org/show/48282/
We now make ML2 the default plugin, so this means VPNaaS in Havana doesn't work with the reference implementation.
This error does not occur with OVS plugin, so it is related to L3 service plugin with ML2 plugin.

I used commit 18645314ea8687835436c52f937ede2b4ae9cbca with ML2 plugin.

[Sumit Naiksatam (snaiksat)]

I ran into the same issue, but I was thinking perhaps we do not support VPNaaS for ML2.

[Akihiro Motoki (amotoki)]

Thanks Sumit for testing.

IMO, this is the degrade of the migration from OVS plugin to ML2 plugin
because all features with OVS plugin are expected to be supported.
Since ML2 plugin depends on L3 router plugin for L3 feature,
L3 router plugin support is a part of the migration to ML2.

This is the reason I set the priority to High.

[Nachi Ueno (nati-ueno)]

I think ML2 supports service version of the Router.
so IMO, VPNaaS code should support service version of router.

so the following line should check if there is service version of router, then it should use it.
https://github.com/openstack/neutron/blob/master/neutron/services/vpn/service_drivers/ipsec.py#L75

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/51273

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/51273
Committed: http://github.com/openstack/neutron/commit/8eb573528551d4a74c146c9d171505f7d472bb6a
Submitter: Jenkins
Branch: master

commit 8eb573528551d4a74c146c9d171505f7d472bb6a
Author: Nachi Ueno <email address hidden>
Date: Fri Oct 11 11:46:32 2013 -0700

    Use L3 api from vpn ipsec driver via service plugin

    VPNaaS and ML2 plugin won't work, because ML2 plugin
    supports service version of L3.
    In this commit, we modify ipsec driver to use L3 plugin.
    This is also backward compatible change, because if L2 plugin
    supports L3 get_service_plugin API returns L2 plugin.

    Fixes bug 1238846

    Change-Id: I36e541bb2e3e1df2e01f73a74f3e9005af6c38b7
    Note: Exsiting unit test covers this change

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: milestone-proposed
Review: https://review.openstack.org/51331

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/51331
Committed: http://github.com/openstack/neutron/commit/8d8b27d3938b4b8a220d7e74ae4c051fc7e92bfc
Submitter: Jenkins
Branch: milestone-proposed

commit 8d8b27d3938b4b8a220d7e74ae4c051fc7e92bfc
Author: Nachi Ueno <email address hidden>
Date: Fri Oct 11 11:46:32 2013 -0700

    Use L3 api from vpn ipsec driver via service plugin

    VPNaaS and ML2 plugin won't work, because ML2 plugin
    supports service version of L3.
    In this commit, we modify ipsec driver to use L3 plugin.
    This is also backward compatible change, because if L2 plugin
    supports L3 get_service_plugin API returns L2 plugin.

    Fixes bug 1238846

    Change-Id: I36e541bb2e3e1df2e01f73a74f3e9005af6c38b7
    Note: Exsiting unit test covers this change
    (cherry picked from commit 8eb573528551d4a74c146c9d171505f7d472bb6a)