<div dir="ltr">I agree, it is kind of odd to restrict vpn-service to one "private" tenant network. Particularly when the current VPN model does allow multiple remote peer CIDRs to connect to,<div><br></div><div><div><span style="color:rgb(0,0,0);text-align:-webkit-auto"><font face="monospace, monospace">neutron ipsec-site-connection-create --name ipsec0 --vpnservice-id vpnsvc0 --ikepolicy-id ike0 --ipsecpolicy-id esp0 --peer-address 192.168.110.21 --peer-id 192.168.110.21 --peer-cidr <b style="background-color:rgb(234,153,153)"><a href="http://13.1.0.0/24,14.1.0.0/24">13.1.0.0/24,14.1.0.0/24</a></b> --psk secret</font></span></div><div><br></div><div>Perhaps there is some history, may be Nachi might know? </div><div><br></div><div>- Sridhar<br><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 28, 2015 at 6:26 AM, Paul Michali <span dir="ltr"><<a href="mailto:pc@michali.net" target="_blank">pc@michali.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">I can try to comment on your questions... inline @PCM<div><br><div class="gmail_extra"><br clear="all"><div><div><div dir="ltr"><div><div dir="ltr">PCM (Paul Michali)</div><div dir="ltr"><div><br></div><div>IRC............ pc_m (<a href="http://irc.freenode.com" target="_blank">irc.freenode.com</a>)<br>Twitter....... @pmichali</div><div><br></div></div></div></div></div></div>
<br><div class="gmail_quote"><span class="">On Tue, Jan 27, 2015 at 9:45 PM, shihanzhang <span dir="ltr"><<a href="mailto:ayshihanzhang@126.com" target="_blank">ayshihanzhang@126.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="line-height:1.7;color:rgb(0,0,0);font-size:14px;font-family:Arial"><div>Hi Stacker:</div><div><span style="font-size:14px;line-height:1.7"><br></span></div><div><span style="font-size:14px;line-height:1.7"> </span><span style="font-size:14px;line-height:1.7">I am a novice, I want use Neutron VPNaas, through my preliminary understanding on this it, I have two questions about it:</span></div><div> (1) why a 'vpnservices' can just has one subnet?<span style="font-family:arial,sans-serif;font-size:small;line-height:normal;color:rgb(34,34,34)"> </span></div></div></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="line-height:1.7;color:rgb(0,0,0);font-size:14px;font-family:Arial"><div> (2) why the subnet of '<span style="font-size:14.3999996185303px;line-height:19.0399990081787px">vpnservices</span><span style="font-size:14px;line-height:1.7">' can't be changed?</span></div></div></blockquote><div><br></div></span><div>@PCM Currently, the VPN service is designed to setup a site to site connection between two private subnets. The service is associated 1:1 with (and applies the connection to) a Neutron router that has a interface on the private network, and an interface on the public network. Changing the subnet for the service would effectively change the router. One would have to delete and recreate the service to use a different router.</div><div><br></div><div>I don't know if the user can attach multiple "private" subnets to a router, and the VPN implementation assumes that there is only one private subnet.</div><span class=""><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="line-height:1.7;color:rgb(0,0,0);font-size:14px;font-family:Arial"><div> As I know, the OpenSwan does not has these limitations.</div><div> I've learned that there is a BP to do this:</div><div> <a href="https://blueprints.launchpad.net/neutron/+spec/vpn-multiple-subnet" target="_blank">https://blueprints.launchpad.net/neutron/+spec/vpn-multiple-subnet</a> </div><div><span style="font-size:14px;line-height:1.7"> </span><span style="font-size:14.3999996185303px;line-height:19.0399990081787px">but this BP has been no progress.</span></div></div></blockquote><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="line-height:1.7;color:rgb(0,0,0);font-size:14px;font-family:Arial"><div> I want to know whether this will do in next cycle or later, who can help me to explain? </div></div></blockquote><div><br></div></span><div>@PCM I don't know what happened with that BP, but it is effectively abandoned (even though status says 'new'). There has not been any activity on it for over a year, and since we are at a new release, a BP spec would have been required for Kilo. Also, the bug that drove the issue, has been placed into Invalid state by Mark McClain in March of last year.</div><div><br></div><div><a href="https://bugs.launchpad.net/neutron/+bug/1258375" target="_blank">https://bugs.launchpad.net/neutron/+bug/1258375</a><br></div><div><br></div><div><br></div><div>You could ask Mark for clarification, but I think it may be because the Neutron router doesn't support multiple subnets.</div><div><br></div><div>Regards.</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="line-height:1.7;color:rgb(0,0,0);font-size:14px;font-family:Arial"><div><p class="MsoNormal" style="font-family:Helvetica,'Microsoft Yahei',verdana;font-size:14.3999996185303px;line-height:18.659200668335px">Thanks.<span><font color="#888888"><u></u><u></u></font></span></p><span><font color="#888888"><p class="MsoNormal" style="font-family:Helvetica,'Microsoft Yahei',verdana;font-size:14.3999996185303px;line-height:18.659200668335px">-shihanzhang</p></font></span></div><div><br></div></div><br><br><span title="neteasefooter"><span></span></span><br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div></div></div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div></div></div></div>