VPN connection status stuck in PENDING_CREATE

[Sergey Kolekonov]

Ipsec site connection status stuck in PENDING_CREATE even after VMS were spawned and VPN connection was established.

Steps to reproduce:
- deploy Fuel 7.0 with VPNaaS plugin
- create IKE/Ipsec policies, two VPN services and VPN connections using 2 different networks with routers
- check Ipsec connection status: neutron ipsec-site-connection-list

Expected result:
Connection status is Active

Actual result:
Connection is in PENDING_CREATE status

[Roman Prykhodchenko (romcheg)]

I asked fuel-plugin guys to check whether this description is enough to find the root cause. However, logs would help here.

[Irina Povolotskaya (ipovolotskaya)]

Which version of VPNaaS plugin did you use? The one compatible with 6.1?
The plugin for 7.0 is under development now.

[Sergey Kolekonov (skolekonov)]

Irina, I'm using 7.0-compatible version which I'm working on right now. I'll attach logs from clean environment a bit later. The problem is on Neutron VPNaaS side I guess

[Sergey Kolekonov (skolekonov)]

It looks like this bug has been resolved by the latest code sync with upstream - the similar problem had been fixed in upstream by the following change - https://review.openstack.org/#/c/187542/. And I'm unable to reproduce the problem using latest MOS packages, so I think this bug can be marked as resolved by the following patch https://review.fuel-infra.org/#/c/10118/.

[Anna Babich (ababich)]

VERSION:
  feature_groups:
    - mirantis
  production: "docker"
  release: "7.0"
  openstack_version: "2015.1.0-7.0"
  api: "1.0"
  build_number: "252"
  build_id: "2015-08-29_17-24-57"
  nailgun_sha: "3189ccfb8c1dac888e351f535b03bdbc9d392406"
  python-fuelclient_sha: "9643fa07f1290071511066804f962f62fe27b512"
  fuel-agent_sha: "1e8f38bbb864ed99aa8fe862b6367e82afec3263"
  fuel-nailgun-agent_sha: "d7027952870a35db8dc52f185bb1158cdd3d1ebd"
  astute_sha: "53c86cba593ddbac776ce5a3360240274c20738c"
  fuel-library_sha: "f05b958ef318f70170fe0db71bffcbaadbc39ae4"
  fuel-ostf_sha: "83048d68609854324ceeaf04242e68d658cfb55d"
  fuelmain_sha: "0e54d68392b359bc122e5bbba9249c729eeaf579"

Verified on cluster: neutron+vxlan+vpn

Verification scenario
The VPN connection has been created between two different tenants' networks by the script: http://paste.openstack.org/show/449984/
The result is:
root@node-11:~# neutron ipsec-site-connection-list
+--------------------------------------+-----------------+----------------+--------------------+------------+-----------+--------+
| id | name | peer_address | peer_cidrs | route_mode | auth_mode | status |
+--------------------------------------+-----------------+----------------+--------------------+------------+-----------+--------+
| 5d9110d4-5ea0-4e05-8b46-32f3c8c734ed | test_connection | 172.18.171.152 | "192.168.111.0/24" | static | psk | ACTIVE |
| 646c9912-ac37-49f3-85df-3ef7e4c628b7 | test_connection | 172.18.171.154 | "172.16.1.0/24" | static | psk | ACTIVE |
+--------------------------------------+-----------------+----------------+--------------------+------------+-----------+--------+