Hi Teams,

Anyone able to give me a little time on this?

I am also happy to pay for someone’s hourly rate to help in this matter.

Thanks,
Karl.

From: Karl Kloppenborg <kkloppenborg@resetdata.com.au>
Date: Sunday, 14 April 2024 at 6:57 am
To: openstack-discuss@lists.openstack.org <openstack-discuss@lists.openstack.org>
Subject: [Neutron] [VPNaaS] VMs unable to hit tunnel remote cidr

Hi Neutron/VPNaaS teams.

We run an openstack which neutron runs on the following VPNaaS setup:
service_provider: VPN:strongswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default

L3-agent vpn_device_driver: neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver

With Neutron running the following service plugins:
service_plugins: neutron_dynamic_routing.services.bgp.bgp_plugin.BgpPlugin,neutron.services.l3_router.l3_router_plugin.L3RouterPlugin,router,vpnaas,trunk,segments,bgp

And Ml2 config

Openvswitch_agent -> Security Group -> firewall driver: openvswitch

We have an IPSec tunnel up between a remote site (Fortinet device) and us.

Computers within the remote site can reach the VM’s internal IP’s on Openstack across the tunnel, however VM’s from openstack cannot reach the internal network on the remote side.

A traceroute from the VM to a known IP on the remote side shows the IP instead transiting out the router gateway.

Has anyone seen this before? It looks like something isn’t being picked up/a route not being set.

Any assistance would be greatly appreciated.

Thanks,
Karl.