Hi Karl, I don't really have any good ideas, it's been years since I dealt with VPNaaS in OpenStack, probably Rocky or something. But maybe you could provide more details about this issue. Which OpenStack version are your running? Has it worked in other releases and now it doesn't anymore? Or does it work for some tunnels only or doesn't it work at all? Maybe you could also provide some network details as well. Regards, Eugen Zitat von Karl Kloppenborg <kkloppenborg@resetdata.com.au>:
Hi Teams,
Anyone able to give me a little time on this? I am also happy to pay for someone’s hourly rate to help in this matter.
Thanks, Karl.
From: Karl Kloppenborg <kkloppenborg@resetdata.com.au> Date: Sunday, 14 April 2024 at 6:57 am To: openstack-discuss@lists.openstack.org <openstack-discuss@lists.openstack.org> Subject: [Neutron] [VPNaaS] VMs unable to hit tunnel remote cidr Hi Neutron/VPNaaS teams.
We run an openstack which neutron runs on the following VPNaaS setup: service_provider: VPN:strongswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default L3-agent vpn_device_driver: neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver
With Neutron running the following service plugins: service_plugins: neutron_dynamic_routing.services.bgp.bgp_plugin.BgpPlugin,neutron.services.l3_router.l3_router_plugin.L3RouterPlugin,router,vpnaas,trunk,segments,bgp
And Ml2 config Openvswitch_agent -> Security Group -> firewall driver: openvswitch
We have an IPSec tunnel up between a remote site (Fortinet device) and us. Computers within the remote site can reach the VM’s internal IP’s on Openstack across the tunnel, however VM’s from openstack cannot reach the internal network on the remote side.
A traceroute from the VM to a known IP on the remote side shows the IP instead transiting out the router gateway.
Has anyone seen this before? It looks like something isn’t being picked up/a route not being set.
Any assistance would be greatly appreciated.
Thanks, Karl.