<div dir="ltr">I've mostly run VPNaaS via devstack, and haven't worked with Juno in a long time...<div><br></div><div>See @PCM in-line...<div><br></div><div><br><br><div class="gmail_quote"><div dir="ltr">On Wed, Oct 7, 2015 at 1:37 PM James Denton <<a href="mailto:james.denton@rackspace.com">james.denton@rackspace.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>Hi Yngvi,</div><div><br></div><div>In my most recent experience with VPNaaS on Kilo, I did the following (all on the controller node):</div><div><br></div><div>1. Install VPN agent</div><div><font face="Courier"><br></font></div><div><font face="Courier">apt-get install neutron-vpnaas-agent</font><div><font face="Courier"><br></font></div><div>2. Edit /etc/neutron/vpn_agent.ini and add the following to configure the device driver:</div><div><font face="Courier"><br></font></div><div><font face="Courier">[vpnagent]</font></div><div>
<font face="Courier">vpn_device_driver = neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver</font></div></div></div></blockquote><div><br></div><div>@PCM Two points to consider here, Yngvi. First, do you want to run OpenSwan or StrongSwan based implementation? Second, I'm not sure how solid StrongSwan was in Juno (it came out in Juno and then after there were some fixes, like IPv6 support, etc).</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>
<div><div><font face="Courier"><br></font></div><div>3. Edit /etc/neutron/neutron.conf and add vpnaas to the list of service plugins:</div><div><font face="Courier"><br></font></div><div><font face="Courier">service_plugins = router,vpnaas</font></div></div></div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div><div><font face="Courier"><br></font></div><div>4. Edit /etc/neutron/neutron_vpnaas.conf and configure the service provider:</div><div><font face="Courier"><br></font></div><div><font face="Courier">[service_providers]</font></div><div><font face="Courier">service_provider = VPN:vpnaas:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default</font></div></div></div></div></blockquote><div><br></div><div>@PCM James, back in Juno there was no neutron_vpnaas.conf file, IIRC. This would go in neutron.conf</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div><div><p><font face="Courier"><u></u><u></u></font></p>
</div><div>5. Restart Neutron service:</div><div><font face="Courier"><br></font></div><div><font face="Courier">service neutron-server restart</font></div><div><font face="Courier"><br></font></div><div>6. Update AppArmor profile:</div><div><font face="Courier"><br></font></div><div><font face="Courier">sudo ln -sf /etc/apparmor.d/usr.lib.ipsec.charon
/etc/apparmor.d/disable/</font></div><div><font face="Courier">sudo ln -sf /etc/apparmor.d/usr.lib.ipsec.stroke
/etc/apparmor.d/disable/</font></div><div><font face="Courier">service apparmor restart</font></div></div></div></div></blockquote><div><br></div><div>@PCM Above is only needed for StrongSwan, and not OpenSwan</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div><div><font face="Courier"><br></font></div><div>7. Work around <a href="https://bugs.launchpad.net/neutron/+bug/1456335" target="_blank"><span style="color:red;text-decoration:none">https://bugs.launchpad.net/neutron/+bug/1456335</span></a></div>
<div><p><u></u><u></u></p>
</div><div>
<font face="Courier">cat
>> /usr/bin/neutron-vpn-netns-wrapper << EOF </font></div><div><font face="Courier">#!/usr/bin/python2</font></div><div><font face="Courier"><br></font></div><div><font face="Courier">import sys</font></div><div><font face="Courier"><br></font></div><div><font face="Courier">from neutron_vpnaas.services.vpn.common.netns_wrapper import main</font></div><div><font face="Courier"><br></font></div><div><font face="Courier">if __name__ == "__main__":</font></div><div><font face="Courier"> sys.exit(main()) </font></div><div><font face="Courier">EOF </font></div><div> <br></div></div></div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div><div><font face="Courier"></font></div><div>8. Set permissions:</div><div><font face="Courier"><br></font></div><div>
<font face="Courier">chmod
755 /usr/bin/neutron-vpn-netns-wrapper </font></div></div></div></div></blockquote><div><br></div><div>@PCM Steps 7 & 8 only for Strongswan, right?</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div><div><font face="Courier"><br></font></div><div>9. Restart VPN agent</div><div><font face="Courier"><br></font></div>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u>
<u></u></div></div></div></blockquote></div></div></div></div>