yahoo-eng-team team mailing list archive

[Launchpad Bug Tracker <1491679@xxxxxxxxxxxxxxxxxx>]

You have been subscribed to a public bug:

neutron vpn-service-create --name myvpnA --description "My vpnA service" routerA subA
neutron vpn-service-create --name myvpnB --description "My vpnB service" routerB subB

neutron ipsec-site-connection-create --name vpnconnectionA --vpnservice-id myvpnA \
--ikepolicy-id ikepolicy --ipsecpolicy-id ipsecpolicy --peer-address 172.24.4.102 \
--peer-id 172.24.4.102 --peer-cidr 10.2.0.0/24 --psk secret

neutron ipsec-site-connection-create --name vpnconnectionB --vpnservice-id myvpnB \
--ikepolicy-id ikepolicy --ipsecpolicy-id ipsecpolicy --peer-address 172.24.4.101 \
--peer-id 172.24.4.101 --peer-cidr 10.1.0.0/24 --psk secret

docker@ubuntu:~/devstack$ neutron ipsec-site-connection-list
+--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+
| id                                   | name           | peer_address | peer_cidrs    | route_mode | auth_mode | status |
+--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+
| 4ca689a5-180a-4661-bd5b-6182d9dad5e4 | vpnconnectionA | 172.24.4.102 | "10.2.0.0/24" | static     | psk       | ACTIVE |
| f65263bd-b5cf-46c5-a809-a376bec461d9 | vpnconnectionB | 172.24.4.101 | "10.1.0.0/24" | static     | psk       | ACTIVE |
+--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+

Now, change the admin_state_up as false for ipsec-site-connection -
vpnconnectionA.

docker@ubuntu:~/devstack$ neutron ipsec-site-connection-list
+--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+
| id                                   | name           | peer_address | peer_cidrs    | route_mode | auth_mode | status |
+--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+
| 4ca689a5-180a-4661-bd5b-6182d9dad5e4 | vpnconnectionA | 172.24.4.102 | "10.2.0.0/24" | static     | psk       | DOWN   |
| f65263bd-b5cf-46c5-a809-a376bec461d9 | vpnconnectionB | 172.24.4.101 | "10.1.0.0/24" | static     | psk       | ACTIVE |
+--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+

ping vm1 to vm2 does not work and ping vm2 and vm1 does not work ( this
is expected)

Change back the admin_state_up as True, the status is still shown as
DOWN, even the vpn-service for myvpnA is at DOWN

docker@ubuntu:~/devstack$ neutron ipsec-site-connection-show vpnconnectionA
+----------------+----------------------------------------------------+
| Field          | Value                                              |
+----------------+----------------------------------------------------+
| admin_state_up | True                                               |
| auth_mode      | psk                                                |
| description    |                                                    |
| dpd            | {"action": "hold", "interval": 30, "timeout": 120} |
| id             | 4ca689a5-180a-4661-bd5b-6182d9dad5e4               |
| ikepolicy_id   | d5112709-8909-4ce3-a7aa-99569474c812               |
| initiator      | bi-directional                                     |
| ipsecpolicy_id | 430ece29-8cf5-488a-b77d-798f0e7d455e               |
| mtu            | 1500                                               |
| name           | vpnconnectionA                                     |
| peer_address   | 172.24.4.102                                       |
| peer_cidrs     | 10.2.0.0/24                                        |
| peer_id        | 172.24.4.102                                       |
| psk            | secret                                             |
| route_mode     | static                                             |
| status         | DOWN                                               |
| tenant_id      | 7d0f12937859462bb7c1d5d012111dec                   |
| vpnservice_id  | 33311333-a6be-4b59-bedc-d3f1583459e7               |
+----------------+----------------------------------------------------+

docker@ubuntu:~/devstack$ neutron vpn-service-show myvpnA
+----------------+--------------------------------------+
| Field          | Value                                |
+----------------+--------------------------------------+
| admin_state_up | True                                 |
| description    | My vpnA service                      |
| external_v4_ip | 172.24.4.101                         |
| external_v6_ip |                                      |
| id             | 33311333-a6be-4b59-bedc-d3f1583459e7 |
| name           | myvpnA                               |
| router_id      | 3b4fab84-6bac-4a29-8bf2-65378e342dc4 |
| status         | DOWN                                 |
| subnet_id      | 63d99342-c9e0-41a9-993d-3c2a6e0256ad |
| tenant_id      | 7d0f12937859462bb7c1d5d012111dec     |
+----------------+--------------------------------------+

In-order to make it work, have to restart vpn-service ( meaning update
vpn-service for myvpnA's admin_state_up as True) and ipsite-connection
for vpnconnectionA's admin_state_up as True.

Is this expected behavior?

** Affects: neutron
     Importance: Undecided
         Status: New


** Tags: vpnaas
-- 
ipsec-site-connection-create is not back to ACTIVE state after updating admin_state_up as True -> False -> True
https://bugs.launchpad.net/bugs/1491679
You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to neutron.