neutron

Neutron Vpnaas

Asked by Marco Colombo

Hi all!
i'm trying to configure a VPN in Neutron. I'm using Ubuntu 12.04 and Cloud Archive Package.
I configured the VPN following this link :

https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall

root@:~# neutron vpn-service-list
+--------------------------------------+-------+--------------------------------------+--------+
| id | name | router_id | status |
+--------------------------------------+-------+--------------------------------------+--------+
| b47bdcbe-5339-41ac-b53b-329872586377 | MyVPN | 676e62ec-c58a-4d58-84e3-6a5c6a2aa732 | DOWN |
+--------------------------------------+-------+--------------------------------------+--------+

VPN stay down and in the log, i can find this trace.

2013-11-04 13:07:41.720 8115 TRACE neutron.services.vpn.device_drivers.ipsec
2013-11-04 13:07:41.887 8115 WARNING neutron.openstack.common.loopingcall [-] task run outlasted interval by 1.875024 sec
2013-11-04 13:10:13.830 10188 ERROR neutron.common.legacy [-] Skipping unknown group key: firewall_driver
2013-11-04 13:10:19.347 10188 ERROR neutron.services.vpn.device_drivers.ipsec [-] Failed to enable vpn process on router 676e62ec-c58a-4d58-84e3-6a5c6a2aa732
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec Traceback (most recent call last):
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec File "/usr/lib/python2.7/dist-packages/neutron/services/vpn/device_drivers/ipsec.py", line 241, in enable
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec self.start()
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec File "/usr/lib/python2.7/dist-packages/neutron/services/vpn/device_drivers/ipsec.py", line 382, in start
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec '--virtual_private', virtual_private
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec File "/usr/lib/python2.7/dist-packages/neutron/services/vpn/device_drivers/ipsec.py", line 311, in _execute
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec check_exit_code=check_exit_code)
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec File "/usr/lib/python2.7/dist-packages/neutron/agent/linux/ip_lib.py", line 458, in execute
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec check_exit_code=check_exit_code)
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec File "/usr/lib/python2.7/dist-packages/neutron/agent/linux/utils.py", line 62, in execute
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec raise RuntimeError(m)
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec RuntimeError:
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-676e62ec-c58a-4d58-84e3-6a5c6a2aa732', 'ipsec', 'pluto', '--ctlbase', '/var/lib/neutron/ipsec/676e62ec-c58a-4d58-84e3-6a5c6a2aa732/var/run/pluto', '--ipsecdir', '/var/lib/neutron/ipsec/676e62ec-c58a-4d58-84e3-6a5c6a2aa732/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/var/lib/neutron/ipsec/676e62ec-c58a-4d58-84e3-6a5c6a2aa732/etc/ipsec.secrets', '--virtual_private', '%v4:192.168.1.0/24,%v4:10.0.0.0/24']
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec Exit code: 99
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec Stdout: ''
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec Stderr: '/usr/bin/neutron-rootwrap: Unauthorized command: ip netns exec qrouter-676e62ec-c58a-4d58-84e3-6a5c6a2aa732 ipsec pluto --ctlbase /var/lib/neutron/ipsec/676e62ec-c58a-4d58-84e3-6a5c6a2aa732/var/run/pluto --ipsecdir /var/lib/neutron/ipsec/676e62ec-c58a-4d58-84e3-6a5c6a2aa732/etc --use-netkey --uniqueids --nat_traversal --secretsfile /var/lib/neutron/ipsec/676e62ec-c58a-4d58-84e3-6a5c6a2aa732/etc/ipsec.secrets --virtual_private %v4:192.168.1.0/24,%v4:10.0.0.0/24 (no filter matched)\n'
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec

These are the commands used for create the VPN

neutron vpn-ikepolicy-create ikepolicy1
neutron vpn-ipsecpolicy-create ipsecpolicy1
neutron vpn-service-create --name MyVPN --description "MyVPN" 676e62ec-c58a-4d58-84e3-6a5c6a2aa732 3abf342f-92d2-49b5-a756-7678aea73e39
neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address $vROUTER_REMOTE_IP --peer-id $vROUTER_REMOTE_IP --peer-cidr 10.0.0.0/24 --psk secret

and this is my configuration of /etc/neutron/vpn_agent.ini

[DEFAULT]
interface_driver = neutron.agent.linux.interface.OVSInterfaceDriver
[vpnagent]
vpn_device_driver=neutron.services.vpn.device_drivers.ipsec.OpenSwanDriver
[ipsec]
ipsec_status_check_interval=60

i don't find any misconfigurations and the vRouter can ping between them
Can anybody help me?

Thanks
Regards

Question information

Language:
English Edit question
Status:
Solved
For:
neutron Edit question
Assignee:
No assignee Edit question
Solved by:
yong sheng gong
Solved:
Last query:
Last reply:
Revision history for this message
Best yong sheng gong (gongysh) said : 		#1

it seems file vpnaas.filters is not under
/etc/neutron/rootwrap.d/

Revision history for this message
Jianyong Chen (jianyong-jychen) said : 		#2

2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec Exit code: 99
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec Stdout: ''
2013-11-04 13:10:19.347 10188 TRACE neutron.services.vpn.device_drivers.ipsec Stderr: '/usr/bin/neutron-rootwrap: Unauthorized command: ip netns exec qrouter-676e62ec-c58a-4d58-84e3-6a5c6a2aa732 ipsec pluto --ctlbase /var/lib/neutron/ipsec/676e62ec-c58a-4d58-84e3-6a5c6a2aa732/var/run/pluto --ipsecdir /var/lib/neutron/ipsec/676e62ec-c58a-4d58-84e3-6a5c6a2aa732/etc --use-netkey --uniqueids --nat_traversal --secretsfile /var/lib/neutron/ipsec/676e62ec-c58a-4d58-84e3-6a5c6a2aa732/etc/ipsec.secrets --virtual_private %v4:192.168.1.0/24,%v4:10.0.0.0/24 (no filter matched)\n'

The command to start ipsec pluto failed for unauthorized command. Were the operations all with root?

Revision history for this message
Marco Colombo (colo90) said : 		#3

Thanks yong sheng gong, that solved my question.

Revision history for this message
Marco Colombo (colo90) said : 		#4

Hi Guys,
sorry for delay. I've check and i don't have the file vpnaas.filters
It's so funny. I'm coming from oldest version of Havana.
I've create the file and now all works

Thanks!