Enable Neutron VPN as Service¶

Include the URL of your launchpad blueprint:

https://blueprints.launchpad.net/openstack-chef/+spec/neutron-vpnaas-enablement

Problem description¶

VPN service is a key feature provided by Neutron to enable Secured Private connection to OpenStack cloud. The reference VPN implementation in Neutron at this time is [IPSec] VPN, and the IPSec driver is [OPENSWAN].

Currently, there is no Chef cookbook support to configure and start Neutron VPN service.

Proposed change¶

Add a recipe, and related attribute/unit tests to cookbook-openstack-network to install, configure and start VPN service.

The packages need to be installed are:

Ubuntu: neutron-plugin-vpn-agent
RedHat: openstack-neutron
Suse: openstack-neutron-vpn-agent

The attributes need to be added includes:

A new attribute to decide if VPN agent or L3 agent should be started:
```
['openstack']['network']['enable_vpn']
```

New attributes for VPN configurations in /etc/neutron/vpn_agent.ini:

['openstack']['network']['vpn']['vpn_device_driver']
['openstack']['network']['vpn']['ipsec_status_check_interval']

The recipe will check if VPN service should be installed, configured and started, then uses the attribute value to configure VPN agent configuration file and start VPN service.

Alternatives¶

No alternatives at this time.

Data model impact¶

No Data model impact

REST API impact¶

No API change

Security impact¶

Right now only IKE with “PSK” (Pre-Shared Key) authentication mode is implemented in Neutron VPNaaS for simplicity. And the psk is a input of IPsec site connection establishment process.

For example, “secret” psk can be used in a new IPsec site connection:

neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn
--ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.233
--peer-id 172.24.4.233 --peer-cidr 10.2.0.0/24 --psk secret

Since the authentication and key exchange are not in the scope of starting and configuring VPN service, there should be no security impact of this Spec.

Notifications impact¶

No notification impact

Other end user impact¶

Performance Impact¶

Other deployer impact¶

Developer impact¶

Implementation¶

Assignee(s)¶

Primary assignee:

gekun@cn.ibm.com

Work Items¶

Add a new attribute value to decide if VPN agent or L3 agent should be started, since these two services cannot be started at the same time.
Add new attributes for VPN configurations in /etc/neutron/vpn_agent.ini and a new vpn template.
Add a new recipe to install the VPN packages, configure the [VPN_TEMPLATE] and start VPN service
Enable VPN support in Horizon [VPN_HORIZON] Configure /opt/stack/horizon/openstack_dashboard/local/local_settings.py:
```
OPENSTACK_NEUTRON_NETWORK = {
     'enable_vpn': True,
}
```
Add validations to ensure VPN service is up and running correctly.
Add unit tests
ref to ask openstack on this topic [HOW_TO_SETUP_VPN]

Dependencies¶

Testing¶

Add unit tests for the new recipe.
For function tests and CI integration tests, at least one node with three NICs is recommanded. One NIC is used for external network connection, one NIC is used for data network and the other is used for management network.

Documentation Impact¶

Configure attribute [‘openstack’][‘network’][‘enable_vpn’] = ‘True’ to enable VPN service.

Configure VPN related attributes, for example:

['openstack']['network']['vpn']['vpn_device_driver'] =
neutron.services.vpn.device_drivers.ipsec.OpenSwanDriver
['openstack']['network']['vpn']['ipsec_status_check_interval'] = 60

References¶

IPSec: Security Architecture for the Internet Protocol RFC
OPENSWAN: OpenSwan website
VPN_TEMPLATE: VPN template values
VPN_HORIZON: VPN support in Horizon
HOW_TO_SETUP_VPN: How to setup VPNaaS

Enable Neutron VPN as Service