← Back to team overview

yahoo-eng-team team mailing list archive

  1. yahoo-eng-team team
  2. Mailing list archive
  3. Message #24761

[Bug 1394890] [NEW] Can't add new VM to a router which has been used for vpn service

  Thread Previous • Date Previous • • Thread Next 
Public bug reported:

Hi, I tried to follow this guide to use VPNaas:
https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall

I have two openstack regions which has their own private net/subnet,
public net/subnet and router configured. Then I created two servers
individually at two regions with floatingip. After that, I can correctly
access those two VMs using both private ip address and floatingips.

Then I tried to create VPN connection between these two VMs:

Step1:  Create VPN service in RegionOne:
------------------
$ neutron vpn-ikepolicy-create ikepolicy1
$ neutron vpn-ipsecpolicy-create ipsecpolicy1
$ neutron vpn-service-create --name myvpn --description "My vpn service" router1 private-subnet
$ neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.133 --peer-id 172.24.4.133 --peer-cidr 10.2.0.0/24 --psk secret

Step2: Create VPN service in RegionTwo:
------------------
$ neutron vpn-ikepolicy-create ikepolicy1
$ neutron vpn-ipsecpolicy-create ipsecpolicy1
$ neutron vpn-service-create --name myvpn --description "My vpn service" router1 private-subnet
$ neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.26 --peer-id 172.24.4.26 --peer-cidr 10.1.0.0/24 --psk secret

After these two steps, I can successfully connect these two VMs through their private ip addresses.
e.g. VM1: 10.1.0.5, VM2: 10.2.0.5

When I tried to check the ipsec status, it was also correct:
-------------------
$ sudo service ipsec status
IPsec stopped
but...
An orphaned Pluto is active?

And I can found the process info in the following directory:
e.g. /opt/stack/data/neutron/ipsec/c39744d5-639a-4f59-b787-ca3797d22400/var/run/
Here, *c39744d5-639a-4f59-b787-ca3797d22400* is my router's id.

However, when I tried to create another VM in the same private net and allocate a floatingip address to it, I always got the following error from VPN-agent:
-------------------
2014-11-21 02:32:25.713 ERROR neutron.agent.linux.utils [-]
Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1', 'ipsec', 'pluto', '--ctlbase', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto', '--ipsecdir', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc/ipsec.secrets', '--virtual_private', '%v4:10.1.0.0/24,%v4:10.2.0.0/24']
Exit code: 10
Stdout: ''
Stderr: 'adjusting ipsec.d to /opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc\npluto: lock file "/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto.pid" already exists\n'
2014-11-21 02:32:25.714 ERROR neutron.services.vpn.device_drivers.ipsec [-] Failed to enable vpn process on router 2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Traceback (most recent call last):
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 243, in enable
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     self.restart()
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 343, in restart
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     self.start()
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 386, in start
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     '--virtual_private', virtual_private
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 315, in _execute
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     check_exit_code=check_exit_code)
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/agent/linux/ip_lib.py", line 550, in execute
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     check_exit_code=check_exit_code, extra_ok_codes=extra_ok_codes)
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/agent/linux/utils.py", line 84, in execute
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     raise RuntimeError(m)
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec RuntimeError:
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1', 'ipsec', 'pluto', '--ctlbase', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto', '--ipsecdir', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc/ipsec.secrets', '--virtual_private', '%v4:10.1.0.0/24,%v4:10.2.0.0/24']
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Exit code: 10
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Stdout: ''
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Stderr: 'adjusting ipsec.d to /opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc\npluto: lock file "/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto.pid" already exists\n'
2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec

Then the vpn service died and when I checked the ipsec service status, I got the following info:
$ sudo service ipsec status
IPsec stopped

In this case, I have to delete the ipsec-site-connection I created
before and then restart vpn-agent and recreat the ipsec-site-connection.
After that, the connection between two VMs will recover.

This error will not happen if I don't assign floatingip to the new VM
when create it.

What I'm using is a devstack environment built in 2014-11-20.  Thanks.

** Affects: neutron
     Importance: Undecided
         Status: New

** Description changed:

  Hi, I tried to follow this guide to use VPNaas:
  https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall
  
  I have two openstack regions which has their own private net/subnet,
  public net/subnet and router configured. Then I created two servers
  individually at two regions with floatingip. After that, I can correctly
  access those two VMs using both private ip address and floatingips.
  
  Then I tried to create VPN connection between these two VMs:
  
  Step1:  Create VPN service in RegionOne:
  ------------------
  $ neutron vpn-ikepolicy-create ikepolicy1
  $ neutron vpn-ipsecpolicy-create ipsecpolicy1
  $ neutron vpn-service-create --name myvpn --description "My vpn service" router1 private-subnet
  $ neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.133 --peer-id 172.24.4.133 --peer-cidr 10.2.0.0/24 --psk secret
  
  Step2: Create VPN service in RegionTwo:
  ------------------
  $ neutron vpn-ikepolicy-create ikepolicy1
  $ neutron vpn-ipsecpolicy-create ipsecpolicy1
  $ neutron vpn-service-create --name myvpn --description "My vpn service" router1 private-subnet
  $ neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.26 --peer-id 172.24.4.26 --peer-cidr 10.1.0.0/24 --psk secret
  
- After these two steps, now I can successfully connect these two VMs through their private ip addresses. 
+ After these two steps, I can successfully connect these two VMs through their private ip addresses.
  e.g. VM1: 10.1.0.5, VM2: 10.2.0.5
  
  When I tried to check the ipsec status, it was also correct:
  -------------------
  $ sudo service ipsec status
  IPsec stopped
  but...
  An orphaned Pluto is active?
  
  And I can found the process info in the following directory:
  e.g. /opt/stack/data/neutron/ipsec/c39744d5-639a-4f59-b787-ca3797d22400/var/run/
  Here, *c39744d5-639a-4f59-b787-ca3797d22400* is my router's id.
  
  However, when I tried to create another VM in the same private net and allocate a floatingip address to it, I always got the following error from VPN-agent:
  -------------------
  2014-11-21 02:32:25.713 ERROR neutron.agent.linux.utils [-]
  Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1', 'ipsec', 'pluto', '--ctlbase', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto', '--ipsecdir', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc/ipsec.secrets', '--virtual_private', '%v4:10.1.0.0/24,%v4:10.2.0.0/24']
  Exit code: 10
  Stdout: ''
  Stderr: 'adjusting ipsec.d to /opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc\npluto: lock file "/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto.pid" already exists\n'
  2014-11-21 02:32:25.714 ERROR neutron.services.vpn.device_drivers.ipsec [-] Failed to enable vpn process on router 2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Traceback (most recent call last):
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 243, in enable
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     self.restart()
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 343, in restart
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     self.start()
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 386, in start
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     '--virtual_private', virtual_private
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 315, in _execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     check_exit_code=check_exit_code)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/agent/linux/ip_lib.py", line 550, in execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     check_exit_code=check_exit_code, extra_ok_codes=extra_ok_codes)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/agent/linux/utils.py", line 84, in execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     raise RuntimeError(m)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec RuntimeError:
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1', 'ipsec', 'pluto', '--ctlbase', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto', '--ipsecdir', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc/ipsec.secrets', '--virtual_private', '%v4:10.1.0.0/24,%v4:10.2.0.0/24']
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Exit code: 10
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Stdout: ''
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Stderr: 'adjusting ipsec.d to /opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc\npluto: lock file "/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto.pid" already exists\n'
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec
  
- 
  Then the vpn service died and when I checked the ipsec service status, I got the following info:
  $ sudo service ipsec status
  IPsec stopped
  
  In this case, I have to delete the ipsec-site-connection I created first
  and then stop the vpn-agent and manually clean the
  */opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/*
  directory. Then after I restarted the vpn-agent and recreated the ipsec-
  site-connection, the connection between two VMs recovered.
  
  So is this the correct way to add VM when using VPNaaS or there is
  really a bug here? What I'm using is a devstack environment built in
  2014-11-20.  Thanks.

** Description changed:

  Hi, I tried to follow this guide to use VPNaas:
  https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall
  
  I have two openstack regions which has their own private net/subnet,
  public net/subnet and router configured. Then I created two servers
  individually at two regions with floatingip. After that, I can correctly
  access those two VMs using both private ip address and floatingips.
  
  Then I tried to create VPN connection between these two VMs:
  
  Step1:  Create VPN service in RegionOne:
  ------------------
  $ neutron vpn-ikepolicy-create ikepolicy1
  $ neutron vpn-ipsecpolicy-create ipsecpolicy1
  $ neutron vpn-service-create --name myvpn --description "My vpn service" router1 private-subnet
  $ neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.133 --peer-id 172.24.4.133 --peer-cidr 10.2.0.0/24 --psk secret
  
  Step2: Create VPN service in RegionTwo:
  ------------------
  $ neutron vpn-ikepolicy-create ikepolicy1
  $ neutron vpn-ipsecpolicy-create ipsecpolicy1
  $ neutron vpn-service-create --name myvpn --description "My vpn service" router1 private-subnet
  $ neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.26 --peer-id 172.24.4.26 --peer-cidr 10.1.0.0/24 --psk secret
  
  After these two steps, I can successfully connect these two VMs through their private ip addresses.
  e.g. VM1: 10.1.0.5, VM2: 10.2.0.5
  
  When I tried to check the ipsec status, it was also correct:
  -------------------
  $ sudo service ipsec status
  IPsec stopped
  but...
  An orphaned Pluto is active?
  
  And I can found the process info in the following directory:
  e.g. /opt/stack/data/neutron/ipsec/c39744d5-639a-4f59-b787-ca3797d22400/var/run/
  Here, *c39744d5-639a-4f59-b787-ca3797d22400* is my router's id.
  
  However, when I tried to create another VM in the same private net and allocate a floatingip address to it, I always got the following error from VPN-agent:
  -------------------
  2014-11-21 02:32:25.713 ERROR neutron.agent.linux.utils [-]
  Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1', 'ipsec', 'pluto', '--ctlbase', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto', '--ipsecdir', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc/ipsec.secrets', '--virtual_private', '%v4:10.1.0.0/24,%v4:10.2.0.0/24']
  Exit code: 10
  Stdout: ''
  Stderr: 'adjusting ipsec.d to /opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc\npluto: lock file "/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto.pid" already exists\n'
  2014-11-21 02:32:25.714 ERROR neutron.services.vpn.device_drivers.ipsec [-] Failed to enable vpn process on router 2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Traceback (most recent call last):
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 243, in enable
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     self.restart()
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 343, in restart
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     self.start()
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 386, in start
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     '--virtual_private', virtual_private
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 315, in _execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     check_exit_code=check_exit_code)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/agent/linux/ip_lib.py", line 550, in execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     check_exit_code=check_exit_code, extra_ok_codes=extra_ok_codes)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/agent/linux/utils.py", line 84, in execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     raise RuntimeError(m)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec RuntimeError:
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1', 'ipsec', 'pluto', '--ctlbase', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto', '--ipsecdir', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc/ipsec.secrets', '--virtual_private', '%v4:10.1.0.0/24,%v4:10.2.0.0/24']
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Exit code: 10
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Stdout: ''
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Stderr: 'adjusting ipsec.d to /opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc\npluto: lock file "/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto.pid" already exists\n'
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec
  
  Then the vpn service died and when I checked the ipsec service status, I got the following info:
  $ sudo service ipsec status
  IPsec stopped
  
- In this case, I have to delete the ipsec-site-connection I created first
- and then stop the vpn-agent and manually clean the
+ In this case, I have to delete the ipsec-site-connection I created
+ before and then stop the vpn-agent and manually clean the
  */opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/*
  directory. Then after I restarted the vpn-agent and recreated the ipsec-
  site-connection, the connection between two VMs recovered.
  
  So is this the correct way to add VM when using VPNaaS or there is
  really a bug here? What I'm using is a devstack environment built in
  2014-11-20.  Thanks.

** Description changed:

  Hi, I tried to follow this guide to use VPNaas:
  https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall
  
  I have two openstack regions which has their own private net/subnet,
  public net/subnet and router configured. Then I created two servers
  individually at two regions with floatingip. After that, I can correctly
  access those two VMs using both private ip address and floatingips.
  
  Then I tried to create VPN connection between these two VMs:
  
  Step1:  Create VPN service in RegionOne:
  ------------------
  $ neutron vpn-ikepolicy-create ikepolicy1
  $ neutron vpn-ipsecpolicy-create ipsecpolicy1
  $ neutron vpn-service-create --name myvpn --description "My vpn service" router1 private-subnet
  $ neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.133 --peer-id 172.24.4.133 --peer-cidr 10.2.0.0/24 --psk secret
  
  Step2: Create VPN service in RegionTwo:
  ------------------
  $ neutron vpn-ikepolicy-create ikepolicy1
  $ neutron vpn-ipsecpolicy-create ipsecpolicy1
  $ neutron vpn-service-create --name myvpn --description "My vpn service" router1 private-subnet
  $ neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.26 --peer-id 172.24.4.26 --peer-cidr 10.1.0.0/24 --psk secret
  
  After these two steps, I can successfully connect these two VMs through their private ip addresses.
  e.g. VM1: 10.1.0.5, VM2: 10.2.0.5
  
  When I tried to check the ipsec status, it was also correct:
  -------------------
  $ sudo service ipsec status
  IPsec stopped
  but...
  An orphaned Pluto is active?
  
  And I can found the process info in the following directory:
  e.g. /opt/stack/data/neutron/ipsec/c39744d5-639a-4f59-b787-ca3797d22400/var/run/
  Here, *c39744d5-639a-4f59-b787-ca3797d22400* is my router's id.
  
  However, when I tried to create another VM in the same private net and allocate a floatingip address to it, I always got the following error from VPN-agent:
  -------------------
  2014-11-21 02:32:25.713 ERROR neutron.agent.linux.utils [-]
  Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1', 'ipsec', 'pluto', '--ctlbase', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto', '--ipsecdir', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc/ipsec.secrets', '--virtual_private', '%v4:10.1.0.0/24,%v4:10.2.0.0/24']
  Exit code: 10
  Stdout: ''
  Stderr: 'adjusting ipsec.d to /opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc\npluto: lock file "/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto.pid" already exists\n'
  2014-11-21 02:32:25.714 ERROR neutron.services.vpn.device_drivers.ipsec [-] Failed to enable vpn process on router 2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Traceback (most recent call last):
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 243, in enable
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     self.restart()
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 343, in restart
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     self.start()
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 386, in start
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     '--virtual_private', virtual_private
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 315, in _execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     check_exit_code=check_exit_code)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/agent/linux/ip_lib.py", line 550, in execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     check_exit_code=check_exit_code, extra_ok_codes=extra_ok_codes)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/agent/linux/utils.py", line 84, in execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     raise RuntimeError(m)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec RuntimeError:
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1', 'ipsec', 'pluto', '--ctlbase', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto', '--ipsecdir', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc/ipsec.secrets', '--virtual_private', '%v4:10.1.0.0/24,%v4:10.2.0.0/24']
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Exit code: 10
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Stdout: ''
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Stderr: 'adjusting ipsec.d to /opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc\npluto: lock file "/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto.pid" already exists\n'
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec
  
  Then the vpn service died and when I checked the ipsec service status, I got the following info:
  $ sudo service ipsec status
  IPsec stopped
  
  In this case, I have to delete the ipsec-site-connection I created
- before and then stop the vpn-agent and manually clean the
- */opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/*
- directory. Then after I restarted the vpn-agent and recreated the ipsec-
- site-connection, the connection between two VMs recovered.
+ before and then restart vpn-agent and recreat the ipsec-site-connection.
+ After that, the connection between two VMs will recover.
  
  So is this the correct way to add VM when using VPNaaS or there is
  really a bug here? What I'm using is a devstack environment built in
  2014-11-20.  Thanks.

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1394890

Title:
  Can't add new VM to a router which has been used for vpn service

Status in OpenStack Neutron (virtual network service):
  New

Bug description:
  Hi, I tried to follow this guide to use VPNaas:
  https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall

  I have two openstack regions which has their own private net/subnet,
  public net/subnet and router configured. Then I created two servers
  individually at two regions with floatingip. After that, I can
  correctly access those two VMs using both private ip address and
  floatingips.

  Then I tried to create VPN connection between these two VMs:

  Step1:  Create VPN service in RegionOne:
  ------------------
  $ neutron vpn-ikepolicy-create ikepolicy1
  $ neutron vpn-ipsecpolicy-create ipsecpolicy1
  $ neutron vpn-service-create --name myvpn --description "My vpn service" router1 private-subnet
  $ neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.133 --peer-id 172.24.4.133 --peer-cidr 10.2.0.0/24 --psk secret

  Step2: Create VPN service in RegionTwo:
  ------------------
  $ neutron vpn-ikepolicy-create ikepolicy1
  $ neutron vpn-ipsecpolicy-create ipsecpolicy1
  $ neutron vpn-service-create --name myvpn --description "My vpn service" router1 private-subnet
  $ neutron ipsec-site-connection-create --name vpnconnection1 --vpnservice-id myvpn --ikepolicy-id ikepolicy1 --ipsecpolicy-id ipsecpolicy1 --peer-address 172.24.4.26 --peer-id 172.24.4.26 --peer-cidr 10.1.0.0/24 --psk secret

  After these two steps, I can successfully connect these two VMs through their private ip addresses.
  e.g. VM1: 10.1.0.5, VM2: 10.2.0.5

  When I tried to check the ipsec status, it was also correct:
  -------------------
  $ sudo service ipsec status
  IPsec stopped
  but...
  An orphaned Pluto is active?

  And I can found the process info in the following directory:
  e.g. /opt/stack/data/neutron/ipsec/c39744d5-639a-4f59-b787-ca3797d22400/var/run/
  Here, *c39744d5-639a-4f59-b787-ca3797d22400* is my router's id.

  However, when I tried to create another VM in the same private net and allocate a floatingip address to it, I always got the following error from VPN-agent:
  -------------------
  2014-11-21 02:32:25.713 ERROR neutron.agent.linux.utils [-]
  Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1', 'ipsec', 'pluto', '--ctlbase', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto', '--ipsecdir', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc/ipsec.secrets', '--virtual_private', '%v4:10.1.0.0/24,%v4:10.2.0.0/24']
  Exit code: 10
  Stdout: ''
  Stderr: 'adjusting ipsec.d to /opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc\npluto: lock file "/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto.pid" already exists\n'
  2014-11-21 02:32:25.714 ERROR neutron.services.vpn.device_drivers.ipsec [-] Failed to enable vpn process on router 2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Traceback (most recent call last):
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 243, in enable
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     self.restart()
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 343, in restart
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     self.start()
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 386, in start
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     '--virtual_private', virtual_private
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/services/vpn/device_drivers/ipsec.py", line 315, in _execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     check_exit_code=check_exit_code)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/agent/linux/ip_lib.py", line 550, in execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     check_exit_code=check_exit_code, extra_ok_codes=extra_ok_codes)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec   File "/opt/stack/neutron/neutron/agent/linux/utils.py", line 84, in execute
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec     raise RuntimeError(m)
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec RuntimeError:
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1', 'ipsec', 'pluto', '--ctlbase', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto', '--ipsecdir', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc', '--use-netkey', '--uniqueids', '--nat_traversal', '--secretsfile', '/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc/ipsec.secrets', '--virtual_private', '%v4:10.1.0.0/24,%v4:10.2.0.0/24']
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Exit code: 10
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Stdout: ''
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec Stderr: 'adjusting ipsec.d to /opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/etc\npluto: lock file "/opt/stack/data/neutron/ipsec/2cbf1df5-b8d3-46ea-bc09-009a6d1be5a1/var/run/pluto.pid" already exists\n'
  2014-11-21 02:32:25.714 TRACE neutron.services.vpn.device_drivers.ipsec

  Then the vpn service died and when I checked the ipsec service status, I got the following info:
  $ sudo service ipsec status
  IPsec stopped

  In this case, I have to delete the ipsec-site-connection I created
  before and then restart vpn-agent and recreat the ipsec-site-
  connection. After that, the connection between two VMs will recover.

  This error will not happen if I don't assign floatingip to the new VM
  when create it.

  What I'm using is a devstack environment built in 2014-11-20.  Thanks.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1394890/+subscriptions

Follow ups

References

  Thread Previous • Date Previous • • Thread Next