Bug #1478778 “VPNaas: strongswan: cannnot add more than one subn...” : Bugs : neutron

Revision history for this message

Paul Michali (pcm) wrote on 2015-07-28: Re: [Bug 1478778] [NEW] VPNaas: strongswan: cannnot add more than one subnet to ipsec

#1

Download full text (5.3 KiB)

Please show the commands you are using for the IPSec connection. It sounds
like you are trying to create an IPSec connection with multiple subsets on
each end. Is that correct?
Currently, VPNaaS IPSec connections may have one or more peer subsets, but
only one local subnet. There is an bug out, to enhance this to support more
than one subnet (https://bugs.launchpad.net/neutron/+bug/1459423).
Regards,
PCM
On Tue, Jul 28, 2015 at 1:15 AM hanumanth jerbandi <email address hidden>
wrote:

> Public bug reported:
>
> I used this patch (VPNaaS: Fedora support for StrongSwan) for vpnaas on
> centos referring this bug
> https://bugs.launchpad.net/neutron/+bug/1441788
>
> 1. I used a single node with 2 routers, create ike/ipsec/vpn-service/site
> vpn, the tunnels came
> up fine
> kilo-vpnaas-centos71
>
>
> 10.10.10.x/24--------R1-------------R2-------------20.20.20.x/24
>
> R1 to R2 on 192.168.122.202, 192.168.122.203.
>
> 2. When i added one more interface to r1 and r2, 30.30.30.x and 40.40.40.x
> respectively, created
> ike/ipsec/vpn-service/site-vpn, it did not create a new conn in ipsec.conf
> file, rather, it
> over wrote the existing(10.10.10.x) conn in ipsec.conf file.
>
> [root@ceos71 ~]# cat
> /var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc/strongswan/ipsec.conf
> # Configuration for vpn10
> config setup
>
> conn %default
> ikelifetime=60m
> keylife=20m
> rekeymargin=3m
> keyingtries=1
> authby=psk
> mobike=no
>
> conn 221c6d37-e7a1-4afc-8d0f-4de32df3818b #### this for 10.10.10.x
> keyexchange=ikev2
> left=192.168.122.202
> leftsubnet=10.10.10.0/24
> leftid=192.168.122.202
> leftfirewall=yes
> right=192.168.122.203
> rightsubnet=20.20.20.0/24
> rightid=192.168.122.203
> auto=route
>
> ### added 1 more subnet 30.30.30.x
>
> [root@ceos71 ~]# cat
> /var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc/strongswan/ipsec.conf
> # Configuration for vpn30
> config setup
>
> conn %default
> ikelifetime=60m
> keylife=20m
> rekeymargin=3m
> keyingtries=1
> authby=psk
> mobike=no
>
> conn 7b57fc83-3581-4e86-a193-e14474eef295 ### this is for 30.30.30.x, it
> over wrote the 10.10.10.x conn
> keyexchange=ikev2
> left=192.168.122.202
> leftsubnet=30.30.30.0/24 <<<<<<<<<<<<<
> leftid=192.168.122.202
> leftfirewall=yes
> right=192.168.122.203
> rightsubnet=40.40.40.0/24
> rightid=192.168.122.203
> auto=route
>
> 3. My understanding is that, it should add new conn to ipsec.conf file,
> than overwriting the existing conn. am i right ???
>
> ** Affects: neutron
> Importance: Undecided
> Status: New
>
> --
> You received this bug notification because you are subscribed to
> neutron.
> Matching subscriptions: <email address hidden>
> https://bugs.launchpad.net/bugs/1478778
>
> Title:
> VPNaas: strongswan: cannnot add more than one subnet to ipsec
>
> Status in neutron:
> New
>
> Bug description:
> I used this patch (VPNaaS: Fedora support for StrongSwan) for vpnaas on
> centos referring this bug
> https://bugs.launchpad.net/neutron/+bug/1441788
>
> 1. I used a si...

Please show the commands you are using for the IPSec connection. It sounds
like you are trying to create an IPSec connection with multiple subsets on
each end. Is that correct?
Currently, VPNaaS IPSec connections may have one or more peer subsets, but
only one local subnet. There is an bug out, to enhance this to support more
than one subnet (https://bugs.launchpad.net/neutron/+bug/1459423).
Regards,
PCM
On Tue, Jul 28, 2015 at 1:15 AM hanumanth jerbandi <hanubgl@gmail.com>
wrote:

> Public bug reported:
>
> I used this patch (VPNaaS: Fedora support for StrongSwan) for vpnaas on
> centos referring this bug
> https://bugs.launchpad.net/neutron/+bug/1441788
>
> 1. I used a single node with 2 routers, create ike/ipsec/vpn-service/site
> vpn, the tunnels came
> up fine
> kilo-vpnaas-centos71
>
>
> 10.10.10.x/24--------R1-------------R2-------------20.20.20.x/24
>
> R1 to R2 on 192.168.122.202, 192.168.122.203.
>
> 2. When i added one more interface to r1 and r2, 30.30.30.x and 40.40.40.x
> respectively, created
> ike/ipsec/vpn-service/site-vpn, it did not create a new conn in ipsec.conf
> file, rather, it
> over wrote the existing(10.10.10.x) conn in ipsec.conf file.
>
> [root@ceos71 ~]# cat
> /var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc/strongswan/ipsec.conf
> # Configuration for vpn10
> config setup
>
> conn %default
>         ikelifetime=60m
>         keylife=20m
>         rekeymargin=3m
>         keyingtries=1
>         authby=psk
>         mobike=no
>
> conn 221c6d37-e7a1-4afc-8d0f-4de32df3818b  #### this for 10.10.10.x
>     keyexchange=ikev2
>     left=192.168.122.202
>     leftsubnet=10.10.10.0/24
>     leftid=192.168.122.202
>     leftfirewall=yes
>     right=192.168.122.203
>     rightsubnet=20.20.20.0/24
>     rightid=192.168.122.203
>     auto=route
>
> ### added 1 more subnet 30.30.30.x
>
> [root@ceos71 ~]# cat
> /var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc/strongswan/ipsec.conf
> # Configuration for vpn30
> config setup
>
> conn %default
>         ikelifetime=60m
>         keylife=20m
>         rekeymargin=3m
>         keyingtries=1
>         authby=psk
>         mobike=no
>
> conn 7b57fc83-3581-4e86-a193-e14474eef295 ### this is for 30.30.30.x, it
> over wrote the 10.10.10.x conn
>     keyexchange=ikev2
>     left=192.168.122.202
>     leftsubnet=30.30.30.0/24 <<<<<<<<<<<<<
>     leftid=192.168.122.202
>     leftfirewall=yes
>     right=192.168.122.203
>     rightsubnet=40.40.40.0/24
>     rightid=192.168.122.203
>     auto=route
>
> 3. My understanding is that, it should add new conn to ipsec.conf file,
> than overwriting the existing conn. am i right ???
>
> ** Affects: neutron
>      Importance: Undecided
>          Status: New
>
> --
> You received this bug notification because you are subscribed to
> neutron.
> Matching subscriptions: pcm@cisco.com
> https://bugs.launchpad.net/bugs/1478778
>
> Title:
>   VPNaas: strongswan: cannnot add more than one subnet to ipsec
>
> Status in neutron:
>   New
>
> Bug description:
>   I used this patch (VPNaaS: Fedora support for StrongSwan) for vpnaas on
> centos referring this bug
>   https://bugs.launchpad.net/neutron/+bug/1441788
>
>   1. I used a single node with 2 routers, create
> ike/ipsec/vpn-service/site vpn, the tunnels came
>   up fine
>   kilo-vpnaas-centos71
>
>
>   10.10.10.x/24--------R1-------------R2-------------20.20.20.x/24
>
>   R1 to R2 on 192.168.122.202, 192.168.122.203.
>
>   2. When i added one more interface to r1 and r2, 30.30.30.x and
> 40.40.40.x respectively, created
>   ike/ipsec/vpn-service/site-vpn, it did not create a new conn in
> ipsec.conf file, rather, it
>   over wrote the existing(10.10.10.x) conn in ipsec.conf file.
>
>   [root@ceos71 ~]# cat
> /var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc/strongswan/ipsec.conf
>   # Configuration for vpn10
>   config setup
>
>   conn %default
>           ikelifetime=60m
>           keylife=20m
>           rekeymargin=3m
>           keyingtries=1
>           authby=psk
>           mobike=no
>
>   conn 221c6d37-e7a1-4afc-8d0f-4de32df3818b  #### this for 10.10.10.x
>       keyexchange=ikev2
>       left=192.168.122.202
>       leftsubnet=10.10.10.0/24
>       leftid=192.168.122.202
>       leftfirewall=yes
>       right=192.168.122.203
>       rightsubnet=20.20.20.0/24
>       rightid=192.168.122.203
>       auto=route
>
>   ### added 1 more subnet 30.30.30.x
>
>   [root@ceos71 ~]# cat
> /var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc/strongswan/ipsec.conf
>   # Configuration for vpn30
>   config setup
>
>   conn %default
>           ikelifetime=60m
>           keylife=20m
>           rekeymargin=3m
>           keyingtries=1
>           authby=psk
>           mobike=no
>
>   conn 7b57fc83-3581-4e86-a193-e14474eef295 ### this is for 30.30.30.x, it
> over wrote the 10.10.10.x conn
>       keyexchange=ikev2
>       left=192.168.122.202
>       leftsubnet=30.30.30.0/24 <<<<<<<<<<<<<
>       leftid=192.168.122.202
>       leftfirewall=yes
>       right=192.168.122.203
>       rightsubnet=40.40.40.0/24
>       rightid=192.168.122.203
>       auto=route
>
>   3. My understanding is that, it should add new conn to ipsec.conf
>   file, than overwriting the existing conn. am i right ???
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/neutron/+bug/1478778/+subscriptions
>

Revision history for this message

hanumanth jerbandi (hanubgl) wrote on 2015-07-29:

#2

Download full text (32.3 KiB)

Hi

I have ike and ipsec policy as below
[root@ceos71 ~(keystone_admin)]# neutron vpn-ipsecpolicy-list
+--------------------------------------+--------+----------------+----------------------+--------+
| id | name | auth_algorithm | encryption_algorithm | pfs |
+--------------------------------------+--------+----------------+----------------------+--------+
| cac5e1df-4276-4163-af83-416df76319ff | ipsec1 | sha1 | aes-128 | group5 |
+--------------------------------------+--------+----------------+----------------------+--------+
[root@ceos71 ~(keystone_admin)]# neutron vpn-ikepolicy-list
+--------------------------------------+------+----------------+----------------------+-------------+--------+
| id | name | auth_algorithm | encryption_algorithm | ike_version | pfs |
+--------------------------------------+------+----------------+----------------------+-------------+--------+
| 908c3d3b-0d00-4e8d-9d62-6c45ecd361e5 | ike1 | sha1 | aes-128 | v2 | group5 |
+--------------------------------------+------+----------------+----------------------+-------------+--------+
[root@ceos71 ~(keystone_admin)]# neutron vpn-ikepolicy-show 908c3d3b-0d00-4e8d-9d62-6c45ecd361e5
+-------------------------+--------------------------------------+
| Field | Value |
+-------------------------+--------------------------------------+
| auth_algorithm | sha1 |
| description | |
| encryption_algorithm | aes-128 |
| id | 908c3d3b-0d00-4e8d-9d62-6c45ecd361e5 |
| ike_version | v2 |
| lifetime | {"units": "seconds", "value": 3600} |
| name | ike1 |
| pfs | group5 |
| phase1_negotiation_mode | main |
| tenant_id | 92f04cefdbb84b96bd961d8722ea9476 |
+-------------------------+--------------------------------------+
[root@ceos71 ~(keystone_admin)]# neutron vpn-ipsecpolicy-show cac5e1df-4276-4163-af83-416df76319ff
+----------------------+--------------------------------------+
| Field | Value |
+----------------------+--------------------------------------+
| auth_algorithm | sha1 |
| description | |
| encapsulation_mode | tunnel |
| encryption_algorithm | aes-128 |
| id | cac5e1df-4276-4163-af83-416df76319ff |
| lifetime | {"units": "seconds", "value": 3600} |
| name | ipsec1 |
| pfs | group5 |
| tenant_id | 92f04cefdbb84b96bd961d8722ea9476 |
| transform_protocol | esp |
+-------------------...

Hi

I have ike and ipsec policy as below
[root@ceos71 ~(keystone_admin)]# neutron vpn-ipsecpolicy-list 
+--------------------------------------+--------+----------------+----------------------+--------+
| id                                   | name   | auth_algorithm | encryption_algorithm | pfs    |
+--------------------------------------+--------+----------------+----------------------+--------+
| cac5e1df-4276-4163-af83-416df76319ff | ipsec1 | sha1           | aes-128              | group5 |
+--------------------------------------+--------+----------------+----------------------+--------+
[root@ceos71 ~(keystone_admin)]# neutron vpn-ikepolicy-list
+--------------------------------------+------+----------------+----------------------+-------------+--------+
| id                                   | name | auth_algorithm | encryption_algorithm | ike_version | pfs    |
+--------------------------------------+------+----------------+----------------------+-------------+--------+
| 908c3d3b-0d00-4e8d-9d62-6c45ecd361e5 | ike1 | sha1           | aes-128              | v2          | group5 |
+--------------------------------------+------+----------------+----------------------+-------------+--------+
[root@ceos71 ~(keystone_admin)]# neutron vpn-ikepolicy-show 908c3d3b-0d00-4e8d-9d62-6c45ecd361e5
+-------------------------+--------------------------------------+
| Field                   | Value                                |
+-------------------------+--------------------------------------+
| auth_algorithm          | sha1                                 |
| description             |                                      |
| encryption_algorithm    | aes-128                              |
| id                      | 908c3d3b-0d00-4e8d-9d62-6c45ecd361e5 |
| ike_version             | v2                                   |
| lifetime                | {"units": "seconds", "value": 3600}  |
| name                    | ike1                                 |
| pfs                     | group5                               |
| phase1_negotiation_mode | main                                 |
| tenant_id               | 92f04cefdbb84b96bd961d8722ea9476     |
+-------------------------+--------------------------------------+
[root@ceos71 ~(keystone_admin)]# neutron vpn-ipsecpolicy-show cac5e1df-4276-4163-af83-416df76319ff
+----------------------+--------------------------------------+
| Field                | Value                                |
+----------------------+--------------------------------------+
| auth_algorithm       | sha1                                 |
| description          |                                      |
| encapsulation_mode   | tunnel                               |
| encryption_algorithm | aes-128                              |
| id                   | cac5e1df-4276-4163-af83-416df76319ff |
| lifetime             | {"units": "seconds", "value": 3600}  |
| name                 | ipsec1                               |
| pfs                  | group5                               |
| tenant_id            | 92f04cefdbb84b96bd961d8722ea9476     |
| transform_protocol   | esp                                  |
+----------------------+--------------------------------------+
[root@ceos71 ~(keystone_admin)]#

## 2 routers created

10.10.10.x/24-+---------------------vpn1--------------------------vpn2-----------------------|-20.20.20.x/24
30.30.30.x/24+|                                                                                                             +--40.40.40.x/24

[root@ceos71 ~(keystone_admin)]# neutron router-list
+--------------------------------------+------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+
| id                                   | name | external_gateway_info                                                                                                                                                                       | distributed | ha    |
+--------------------------------------+------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+
| 21f9a7a4-2a3b-48aa-9e4c-88540255cb63 | vpn2 | {"network_id": "cf716851-a76c-4dd3-ae7f-1c4e55ef8eb5", "enable_snat": true, "external_fixed_ips": [{"subnet_id": "2816ac9b-a744-42d8-9921-e136ee61a6ba", "ip_address": "192.168.122.203"}]} | False       | False |
| 70e88c46-c6b2-4c8d-afad-76ebd77b55cb | vpn1 | {"network_id": "cf716851-a76c-4dd3-ae7f-1c4e55ef8eb5", "enable_snat": true, "external_fixed_ips": [{"subnet_id": "2816ac9b-a744-42d8-9921-e136ee61a6ba", "ip_address": "192.168.122.202"}]} | False       | False |
+--------------------------------------+------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+
[root@ceos71 ~(keystone_admin)]#

[root@ceos71 ~(keystone_admin)]# neutron subnet-list
+--------------------------------------+----------+------------------+--------------------------------------------------------+
| id                                   | name     | cidr             | allocation_pools                                       |
+--------------------------------------+----------+------------------+--------------------------------------------------------+
| b492aece-46b5-4bf3-ab94-5a2d43c3e0c2 | sb1      | 10.10.10.0/24    | {"start": "10.10.10.10", "end": "10.10.10.100"}        |
| f60ec7d8-5076-4dd1-8bde-c508c023745d | s2       | 20.20.20.0/24    | {"start": "20.20.20.10", "end": "20.20.20.100"}        |
| 6276b684-8b1b-4c83-b698-be980c5c5aac | sb4      | 40.40.40.0/24    | {"start": "40.40.40.10", "end": "40.40.40.100"}        |
| ad122473-7751-4df9-b64e-44c850cbd8c0 | sb3      | 30.30.30.0/24    | {"start": "30.30.30.10", "end": "30.30.30.100"}        |
| 2816ac9b-a744-42d8-9921-e136ee61a6ba | pub_sub1 | 192.168.122.0/24 | {"start": "192.168.122.200", "end": "192.168.122.254"} |
+--------------------------------------+----------+------------------+--------------------------------------------------------+
[root@ceos71 ~(keystone_admin)]#

## now create ipsec site connection for above 10.10.10.x and 20.20.20.x networks
[root@ceos71 ~(keystone_admin)]# neutron ipsec-site-connection-create --name sitevpn10 --vpnservice-id  vpn10 --ikepolicy-id  ike1 --ipsecpolicy-id ipsec1  --peer-address 192.168.122.230 --peer-id 192.168.122.230 --peer-cidr 20.20.20.0/24 --psk test123 --tenant-id 92f04cefdbb84b96bd961d8722ea9476
Created a new ipsec_site_connection:
+----------------+----------------------------------------------------+
| Field          | Value                                              |
+----------------+----------------------------------------------------+
| admin_state_up | True                                               |
| auth_mode      | psk                                                |
| description    |                                                    |
| dpd            | {"action": "hold", "interval": 30, "timeout": 120} |
| id             | b426cfa8-4607-4c4e-bcf1-3ce79fec6da0               |
| ikepolicy_id   | 908c3d3b-0d00-4e8d-9d62-6c45ecd361e5               |
| initiator      | bi-directional                                     |
| ipsecpolicy_id | cac5e1df-4276-4163-af83-416df76319ff               |
| mtu            | 1500                                               |
| name           | sitevpn10                                          |
| peer_address   | 192.168.122.230                                    |
| peer_cidrs     | 20.20.20.0/24                                      |
| peer_id        | 192.168.122.230                                    |
| psk            | test123                                            |
| route_mode     | static                                             |
| status         | PENDING_CREATE                                     |
| tenant_id      | 92f04cefdbb84b96bd961d8722ea9476                   |
| vpnservice_id  | a376e1f6-dcfc-4108-9d31-7e2cd65b3b5e               |
+----------------+----------------------------------------------------+
[root@ceos71 ~(keystone_admin)]#

## create for the other end

[root@ceos71 ~(keystone_admin)]# neutron ipsec-site-connection-create --name sitevpn20 --vpnservice-id  vpn20 --ikepolicy-id  ike1 --ipsecpolicy-id ipsec1  --peer-address 192.168.122.202 --peer-id 192.168.122.202 --peer-cidr 10.10.10.0/24 --psk test123 --tenant-id 92f04cefdbb84b96bd961d8722ea9476
Created a new ipsec_site_connection:
+----------------+----------------------------------------------------+
| Field          | Value                                              |
+----------------+----------------------------------------------------+
| admin_state_up | True                                               |
| auth_mode      | psk                                                |
| description    |                                                    |
| dpd            | {"action": "hold", "interval": 30, "timeout": 120} |
| id             | d3f050f8-e068-40f6-9405-8ea6a293dfde               |
| ikepolicy_id   | 908c3d3b-0d00-4e8d-9d62-6c45ecd361e5               |
| initiator      | bi-directional                                     |
| ipsecpolicy_id | cac5e1df-4276-4163-af83-416df76319ff               |
| mtu            | 1500                                               |
| name           | sitevpn20                                          |
| peer_address   | 192.168.122.202                                    |
| peer_cidrs     | 10.10.10.0/24                                      |
| peer_id        | 192.168.122.202                                    |
| psk            | test123                                            |
| route_mode     | static                                             |
| status         | PENDING_CREATE                                     |
| tenant_id      | 92f04cefdbb84b96bd961d8722ea9476                   |
| vpnservice_id  | a601d9e9-d164-4ad0-86ac-0f1cda270956               |
+----------------+----------------------------------------------------+
[root@ceos71 ~(keystone_admin)]#

[root@ceos71 ~(keystone_admin)]# /bin/neutron-rootwrap /etc/neutron/rootwrap.conf ip netns exec qrouter-21f9a7a4-2a3b-48aa-9e4c-88540255cb63 neutron-vpn-netns-wrapper --mount_paths=/etc:/var/lib/neutron/ipsec/21f9a7a4-2a3b-48aa-9e4c-88540255cb63/etc,/var/run:/var/lib/neutron/ipsec/21f9a7a4-2a3b-48aa-9e4c-88540255cb63/var/run --cmd=strongswan,statusall
Command: ['mount', '--bind', '/var/lib/neutron/ipsec/21f9a7a4-2a3b-48aa-9e4c-88540255cb63/etc', '/etc'] Exit code: 0 Stdout:  Stderr: Command: ['mount', '--bind', '/var/lib/neutron/ipsec/21f9a7a4-2a3b-48aa-9e4c-88540255cb63/var/run', '/var/run'] Exit code: 0 Stdout:  Stderr: Command: ['strongswan', 'statusall'] Exit code: 0 Stdout: Status of IKE charon daemon (strongSwan 5.2.0, Linux 3.10.0-229.7.2.el7.x86_64, x86_64):
  uptime: 61 seconds, since Jul 29 05:44:44 2015
  malloc: sbrk 2297856, mmap 0, used 420448, free 1877408
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0
  loaded plugins: charon curl aes des rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints acert pubkey pkcs1 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default farp stroke vici updown eap-identity eap-md5 eap-gtc eap-mschapv2 eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam xauth-noauth dhcp
Listening IP addresses:
  20.20.20.1
  40.40.40.1
  192.168.122.203
Connections:
d3f050f8-e068-40f6-9405-8ea6a293dfde:  192.168.122.203...192.168.122.202  IKEv2
d3f050f8-e068-40f6-9405-8ea6a293dfde:   local:  [192.168.122.203] uses pre-shared key authentication
d3f050f8-e068-40f6-9405-8ea6a293dfde:   remote: [192.168.122.202] uses pre-shared key authentication
d3f050f8-e068-40f6-9405-8ea6a293dfde:   child:  20.20.20.0/24 === 10.10.10.0/24 TUNNEL
Routed Connections:
d3f050f8-e068-40f6-9405-8ea6a293dfde{1}:  ROUTED, TUNNEL
d3f050f8-e068-40f6-9405-8ea6a293dfde{1}:   20.20.20.0/24 === 10.10.10.0/24 
Security Associations (0 up, 0 connecting):
  none

/bin/neutron-rootwrap /etc/neutron/rootwrap.conf ip netns exec qrouter-70e88c46-c6b2-4c8d-afad-76ebd77b55cb neutron-vpn-netns-wrapper --mount_paths=/etc:/var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc,/var/run:/var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/var/run --cmd=strongswan,statusall
Command: ['mount', '--bind', '/var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc', '/etc'] Exit code: 0 Stdout:  Stderr: Command: ['mount', '--bind', '/var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/var/run', '/var/run'] Exit code: 0 Stdout:  Stderr: Command: ['strongswan', 'statusall'] Exit code: 0 Stdout: Status of IKE charon daemon (strongSwan 5.2.0, Linux 3.10.0-229.7.2.el7.x86_64, x86_64):
  uptime: 4 minutes, since Jul 29 05:41:23 2015
  malloc: sbrk 2568192, mmap 0, used 432304, free 2135888
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0
  loaded plugins: charon curl aes des rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints acert pubkey pkcs1 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default farp stroke vici updown eap-identity eap-md5 eap-gtc eap-mschapv2 eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam xauth-noauth dhcp
Listening IP addresses:
  10.10.10.1
  30.30.30.1
  192.168.122.202
Connections:
3aaf5a06-d7a7-49a3-b780-79e09063dfca:  192.168.122.202...192.168.122.203  IKEv2
3aaf5a06-d7a7-49a3-b780-79e09063dfca:   local:  [192.168.122.202] uses pre-shared key authentication
3aaf5a06-d7a7-49a3-b780-79e09063dfca:   remote: [192.168.122.203] uses pre-shared key authentication
3aaf5a06-d7a7-49a3-b780-79e09063dfca:   child:  10.10.10.0/24 === 20.20.20.0/24 TUNNEL
82eb0aa4-4933-403c-bd14-8ced2c3f6faa:  192.168.122.202...192.168.122.230  IKEv2
82eb0aa4-4933-403c-bd14-8ced2c3f6faa:   local:  [192.168.122.202] uses pre-shared key authentication
82eb0aa4-4933-403c-bd14-8ced2c3f6faa:   remote: [192.168.122.230] uses pre-shared key authentication
82eb0aa4-4933-403c-bd14-8ced2c3f6faa:   child:  10.10.10.0/24 === 20.20.20.0/24 TUNNEL
Routed Connections:
3aaf5a06-d7a7-49a3-b780-79e09063dfca{5}:  ROUTED, TUNNEL
3aaf5a06-d7a7-49a3-b780-79e09063dfca{5}:   10.10.10.0/24 === 20.20.20.0/24 
Security Associations (0 up, 0 connecting):
  none
 Stderr: [root@ceos71 ~(keystone_admin)]#

### I do ping form 10.10.10.11 to 20.20.20.11 and tunnel is up

[root@ceos71 ~(keystone_admin)]# /bin/neutron-rootwrap /etc/neutron/rootwrap.conf ip netns exec qrouter-70e88c46-c6b2-4c8d-afad-76ebd77b55cb neutron-vpn-netns-wrapper --mount_paths=/etc:/var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc,/var/run:/var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/var/run --cmd=strongswan,statusall
Command: ['mount', '--bind', '/var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc', '/etc'] Exit code: 0 Stdout:  Stderr: Command: ['mount', '--bind', '/var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/var/run', '/var/run'] Exit code: 0 Stdout:  Stderr: Command: ['strongswan', 'statusall'] Exit code: 0 Stdout: Status of IKE charon daemon (strongSwan 5.2.0, Linux 3.10.0-229.7.2.el7.x86_64, x86_64):
  uptime: 6 minutes, since Jul 29 05:41:23 2015
  malloc: sbrk 2568192, mmap 0, used 455264, free 2112928
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 3
  loaded plugins: charon curl aes des rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints acert pubkey pkcs1 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default farp stroke vici updown eap-identity eap-md5 eap-gtc eap-mschapv2 eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam xauth-noauth dhcp
Listening IP addresses:
  10.10.10.1
  30.30.30.1
  192.168.122.202
Connections:
3aaf5a06-d7a7-49a3-b780-79e09063dfca:  192.168.122.202...192.168.122.203  IKEv2
3aaf5a06-d7a7-49a3-b780-79e09063dfca:   local:  [192.168.122.202] uses pre-shared key authentication
3aaf5a06-d7a7-49a3-b780-79e09063dfca:   remote: [192.168.122.203] uses pre-shared key authentication
3aaf5a06-d7a7-49a3-b780-79e09063dfca:   child:  10.10.10.0/24 === 20.20.20.0/24 TUNNEL
82eb0aa4-4933-403c-bd14-8ced2c3f6faa:  192.168.122.202...192.168.122.230  IKEv2
82eb0aa4-4933-403c-bd14-8ced2c3f6faa:   local:  [192.168.122.202] uses pre-shared key authentication
82eb0aa4-4933-403c-bd14-8ced2c3f6faa:   remote: [192.168.122.230] uses pre-shared key authentication
82eb0aa4-4933-403c-bd14-8ced2c3f6faa:   child:  10.10.10.0/24 === 20.20.20.0/24 TUNNEL
Routed Connections:
3aaf5a06-d7a7-49a3-b780-79e09063dfca{5}:  ROUTED, TUNNEL
3aaf5a06-d7a7-49a3-b780-79e09063dfca{5}:   10.10.10.0/24 === 20.20.20.0/24 
Security Associations (1 up, 0 connecting):
3aaf5a06-d7a7-49a3-b780-79e09063dfca[1]: ESTABLISHED 23 seconds ago, 192.168.122.202[192.168.122.202]...192.168.122.203[192.168.122.203]
3aaf5a06-d7a7-49a3-b780-79e09063dfca[1]: IKEv2 SPIs: cf65a49f1af24899_i* 40fec36f11bfb409_r, pre-shared key reauthentication in 52 minutes
3aaf5a06-d7a7-49a3-b780-79e09063dfca[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
3aaf5a06-d7a7-49a3-b780-79e09063dfca{5}:  INSTALLED, TUNNEL, ESP SPIs: c770df04_i c3439d03_o
3aaf5a06-d7a7-49a3-b780-79e09063dfca{5}:  AES_CBC_128/HMAC_SHA1_96, 252 bytes_i (3 pkts, 10s ago), 252 bytes_o (3 pkts, 10s ago), rekeying in 15 minutes
3aaf5a06-d7a7-49a3-b780-79e09063dfca{5}:   10.10.10.0/24 === 20.20.20.0/24 
 Stderr: [root@ceos71 ~(keystone_admin)]#

### ipsec.conf file for vpn10, as expected

[root@ceos71 ~(keystone_admin)]# cat /var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc/strongswan/ipsec.conf 
# Configuration for vpn10
config setup

conn %default
        ikelifetime=60m
        keylife=20m
        rekeymargin=3m
        keyingtries=1
        authby=psk
        mobike=no

conn 3aaf5a06-d7a7-49a3-b780-79e09063dfca
    keyexchange=ikev2
    left=192.168.122.202
    leftsubnet=10.10.10.0/24
    leftid=192.168.122.202
    leftfirewall=yes
    right=192.168.122.203
    rightsubnet=20.20.20.0/24
    rightid=192.168.122.203
    auto=route

# now  i create ipsec between 30.30.30.x to 40.40.40.x which are already present on vpn1 and vpn2 router.

### create ipsec site conn for 30.30.30.x to 40.40.40.x nw.
This is where the ipsec.conf file above is overwritten, instead of adding a new conn in ipsec.conf file

[root@ceos71 ~(keystone_admin)]# neutron ipsec-site-connection-create --name sitevpn30 --vpnservice-id  vpn30 --ikepolicy-id  ike1 --ipsecpolicy-id ipsec1  --peer-address 192.168.122.203 --peer-id 192.168.122.203 --peer-cidr 40.40.40.0/24 --psk test123 --tenant-id 92f04cefdbb84b96bd961d8722ea9476
Created a new ipsec_site_connection:
+----------------+----------------------------------------------------+
| Field          | Value                                              |
+----------------+----------------------------------------------------+
| admin_state_up | True                                               |
| auth_mode      | psk                                                |
| description    |                                                    |
| dpd            | {"action": "hold", "interval": 30, "timeout": 120} |
| id             | 6c3cdd7e-6482-4e29-ab93-90aa4d5e700a               |
| ikepolicy_id   | 908c3d3b-0d00-4e8d-9d62-6c45ecd361e5               |
| initiator      | bi-directional                                     |
| ipsecpolicy_id | cac5e1df-4276-4163-af83-416df76319ff               |
| mtu            | 1500                                               |
| name           | sitevpn30                                          |
| peer_address   | 192.168.122.203                                    |
| peer_cidrs     | 40.40.40.0/24                                      |
| peer_id        | 192.168.122.203                                    |
| psk            | test123                                            |
| route_mode     | static                                             |
| status         | PENDING_CREATE                                     |
| tenant_id      | 92f04cefdbb84b96bd961d8722ea9476                   |
| vpnservice_id  | 5ffb3bf3-a469-42a7-9324-ec8b864b72ef               |
+----------------+----------------------------------------------------+
[root@ceos71 ~(keystone_admin)]#

### This is where the ipsec.conf file above is overwritten, instead of addinfg a new conn in ipsec.conf file

[root@ceos71 ~(keystone_admin)]#  cat /var/lib/neutron/ipsec/70e88c46-c6b2-4c8d-afad-76ebd77b55cb/etc/strongswan/ipsec.conf 
# Configuration for vpn30  <<<<<<<<<<<<<
config setup

conn %default
        ikelifetime=60m
        keylife=20m
        rekeymargin=3m
        keyingtries=1
        authby=psk
        mobike=no

conn 6c3cdd7e-6482-4e29-ab93-90aa4d5e700a
    keyexchange=ikev2
    left=192.168.122.202
    leftsubnet=30.30.30.0/24  <<<<<<<<<<<<<<<<<<<
    leftid=192.168.122.202
    leftfirewall=yes
    right=192.168.122.203
    rightsubnet=40.40.40.0/24  <<<<<<<<<<<<<<<<<<<<<<<<
    rightid=192.168.122.203
    auto=route
[root@ceos71 ~(keystone_admin)]#

This should have created a new conn xxxxxx for 30.30.30.x towards 40.40.40.x

[root@ceos71 ~(keystone_admin)]# neutron ipsec-site-connection-show 6c3cdd7e-6482-4e29-ab93-90aa4d5e700a
+----------------+----------------------------------------------------+
| Field          | Value                                              |
+----------------+----------------------------------------------------+
| admin_state_up | True                                               |
| auth_mode      | psk                                                |
| description    |                                                    |
| dpd            | {"action": "hold", "interval": 30, "timeout": 120} |
| id             | 6c3cdd7e-6482-4e29-ab93-90aa4d5e700a               |
| ikepolicy_id   | 908c3d3b-0d00-4e8d-9d62-6c45ecd361e5               |
| initiator      | bi-directional                                     |
| ipsecpolicy_id | cac5e1df-4276-4163-af83-416df76319ff               |
| mtu            | 1500                                               |
| name           | sitevpn30                                          |
| peer_address   | 192.168.122.203                                    |
| peer_cidrs     | 40.40.40.0/24                                      |
| peer_id        | 192.168.122.203                                    |
| psk            | test123                                            |
| route_mode     | static                                             |
| status         | DOWN                                               |
| tenant_id      | 92f04cefdbb84b96bd961d8722ea9476                   |
| vpnservice_id  | 5ffb3bf3-a469-42a7-9324-ec8b864b72ef               |
+----------------+----------------------------------------------------+
[root@ceos71 ~(keystone_admin)]#

Revision history for this message

Paul Michali (pcm) wrote on 2015-08-25:

#3

The issue here is that there is a 1:1 correspondence between the VPN service and the router. There can only be one router for a service, and vice versa. The "bug" here, is that the VPN code does not enforce this condition, preventing you from creating another VPN service with the same router.

There is a separate effort under progress that will allow multiple local and peer subnets to be associated with a single VPN connection. This would allow you to have both 10.10.10.x/24 and 30.30.30.x/24 subnets associated with the connection (something that is not currently possible).

Changed in neutron:
status:	New → Confirmed

Revision history for this message

Paul Michali (pcm) wrote on 2015-10-06:

#4

Having multiple local subnets is being handled under this bug - https://bugs.launchpad.net/neutron/+bug/1459423.

Granted, once implemented, it'll need to be tested for all the *Swan flavors and platforms (the approach being taken may need different syntax on different flavors/platforms), and follow-up bugs created if needed.

Revision history for this message

Paul Michali (pcm) wrote on 2015-11-13:

#5

Mentioned feature is upstreamed. Could just mark this as duplicate, or if enthusiastic, could try the feature with all *Swan flavors.

Revision history for this message

Armando Migliaccio (armando-migliaccio) wrote on 2016-08-17:

#6

This bug is > 240 days without activity. We are unsetting assignee and milestone and setting status to Incomplete in order to allow its expiry in 60 days.

If the bug is still valid, then update the bug status.

Changed in neutron:
status:	Confirmed → Incomplete

Revision history for this message

Launchpad Janitor (janitor) wrote on 2016-10-17:

#7

[Expired for neutron because there has been no activity for 60 days.]

Changed in neutron:
status:	Incomplete → Expired

neutron

VPNaas: strongswan: cannnot add more than one subnet to ipsec

Bug Description

Other bug subscribers

Remote bug watches