Updation of IKE Policy after the site creation fails

[Ashish Kumar Gupta]

Updating the IKE policy after the site creation fails stating ike policy in already in use
Updating IKEPolicy 07fc4f3b-1b44-4d5c-9949-5f7fa3bc6ae5

_PUT-REST: url: http://<controller_ip>:9696/v2.0/vpn/ikepolicies/07fc4f3b-1b44-4d5c-9949-5f7fa3bc6ae5
_PUT-REST: X-Auth-Token: 86c8be3ce0204aa8bdd1458021eacec4
_PUT-REST: data: {"ikepolicy":{"name": "IKE1","encryption_algorithm": "aes-256"}}

{u'NeutronError': {u'message': u'IKEPolicy 07fc4f3b-1b44-4d5c-9949-5f7fa3bc6ae5 is still in use', u'type': u'IKEPolicyInUse', u'detail': u''}}
None

[Riccardo Padovani (rpadovani)]

This bug isn't related to ubuntu-calculator-app.
I assign it to the project I think is referred to.

[Paul Michali (pcm)]

As far as I know, this is expected behavior. The IKE policy can be shared by multiple IPSec site-to-site connections, so it will not allow you to change the policy, if there are one or more uses of the policy.

[Ashish Kumar Gupta (ashish-kumar-gupta)]

Considering a scenario:
Site connection has be made with ike policy encryption algorithm as aes-128 and due to some security measures the user want to update the encryption algorithm aes-256 .
I thinks user should have an option to do so.

[Eugene Nikanorov (enikanorov)]

I think it should not be possible: you're updating the encryption on a live connection.
This would require update of both endpoints.

I suggest to change exception message for this case to be more clear, but preserve the behavior.

[Openstack Gerrit (openstack-gerrit)]

Fix proposed to branch: master
Review: https://review.openstack.org/92348

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/92348
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=14ebdbe77479a72ad1f324663ec795460e03e99a
Submitter: Jenkins
Branch: master

commit 14ebdbe77479a72ad1f324663ec795460e03e99a
Author: Eugene Nikanorov <email address hidden>
Date: Tue May 6 15:35:04 2014 +0400

    Make VPNaaS 'InUse' exception more clear

    In case IpSecPolicy or IKEPolicy is updated while VPN connection that uses it
    is already established, IPsecPolicyInUse or IKEPolicuInUse is raised.
    Need to clarify their messages to emphasize that policies can't be updated
    because they are used by established connection.

    Change-Id: I259f9b8bcff7f8ec13ac630285f6e881c6653309
    Closes-Bug: #1315809