<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">+1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">From nova parity perspective, we should implement [1] first.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Michael Shieh [mailto:michael@varmour.com]
<br>
<b>Sent:</b> Thursday, April 25, 2013 3:17 AM<br>
<b>To:</b> OpenStack Development Mailing List<br>
<b>Subject:</b> Re: [openstack-dev] [Networking] OpenStack Networking VPN first step<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Nachi,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I see these are 2 very different use cases:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">[1] is the VPN to support remote access users to connect to the Openstack networks. This would allow roaming users to connect with security policy defined by Openstack admin, without user intervene.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">[2] IPsec is used for site-to-site connection, a must for Amazon VPC type deployment. If Openstack networks are set up in the cloud for enterprise tenants, this would provide secure connectivities between Openstack networks and enterprise
networks. Security policies are agreed and configured by both sides. (In Amazon VPC, it can generate security policy for some firewall vendors to import into the firewall of enterprise networks to reduce the configuration complexity). IPsec could be used
for remote access as well (through Xauth or IKEv2) but it's not as simple as [1]. AFAIK, few companies deploy IPsec for remote access.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As [1] has been used in Nova while [2] is still new in Quantum, I vote for [1] so current users have a mechanism to connect to Openstack network to manage or share the resources. Besides, IPsec alone may not be enough for VPC deployment,
as most likely it needs dynamic routing support to detect the tunnel liveness.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Michael<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Wed, Apr 24, 2013 at 4:53 PM, Nachi Ueno <<a href="mailto:nachi@ntti3.com" target="_blank">nachi@ntti3.com</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">Hi folks<br>
<br>
I would like to ask your opinions.<br>
[1] Nova parity VPN (Cloudpipe) is OpenStack Networking VPN first step.<br>
Amazon VPC compatible api(*) is also great candidate to start.<br>
And it is using IPSec.<br>
The IPSec has more widely used than SSL-VPN in industry.<br>
so, How about start with IPSec?<br>
<br>
Currently, Cloudpipe is using SSL-VPN, However, Cloudpipe was intended to<br>
let users to access to the VLAN, so I tend to think any VPN method is<br>
OK if we can<br>
accomplish it.<br>
<br>
so if you want to start with SSL-VPN, please let us know.<br>
In that case, we will start with SSL-VPN.<br>
<br>
(*) may be not fully same API, but similer model<br>
<br>
[2] Generic VPN Service model<br>
It looks like there is no strong opinion to have "mode" attribute on<br>
Generic VPN Service.<br>
so we would like to remove this attribute.<br>
<br>
I registered the BP for Generic VPN service here.<br>
<a href="https://blueprints.launchpad.net/quantum/+spec/generic-vpn-service" target="_blank">https://blueprints.launchpad.net/quantum/+spec/generic-vpn-service</a><br>
<br>
Is this OK for you guys?<br>
<br>
Thanks<br>
Nachi<br>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>