Jump to: navigation, search

Difference between revisions of "Heat/Blueprints/VPaaS Support"

Line 90: Line 90:
 
             "encryption_algorithm" : "3des",
 
             "encryption_algorithm" : "3des",
 
             "phase1_negotiation_mode" : "main",
 
             "phase1_negotiation_mode" : "main",
−
             "lifetime_units" : "seconds",
+
             "lifetime" : {
−
            "lifetime_value" : 3600,
+
                "units" : "seconds",
 +
                "value" : 3600
 +
            },
 
             "pfs" : "group5",
 
             "pfs" : "group5",
 
             "ike_version" : "v1"
 
             "ike_version" : "v1"
Line 144: Line 146:
 
             "auth_algorithm" : "sha1",
 
             "auth_algorithm" : "sha1",
 
             "encryption_algorithm" : "3des",
 
             "encryption_algorithm" : "3des",
−
             "lifetime_units" : "seconds",
+
             "lifetime" : {
−
            "lifetime_value" : 3600,
+
                "units" : "seconds",
 +
                "value" : 3600
 +
            },
 
             "pfs" : "group5"
 
             "pfs" : "group5"
 
         }
 
         }
Line 208: Line 212:
 
             "peer_cidrs" : ["10.0.0.0/24"],
 
             "peer_cidrs" : ["10.0.0.0/24"],
 
             "mtu" : 1500,
 
             "mtu" : 1500,
−
             "dpd_actions" : "hold",
+
             "dpd" : {
−
            "dpd_interval" : 30,
+
              "actions" : "hold",
−
            "dpd_timeout" : 120,
+
              "interval" : 30,
 +
              "timeout" : 120
 +
            },
 
             "psk" : "secret",
 
             "psk" : "secret",
 
             "initiator" : "bi-directional",
 
             "initiator" : "bi-directional",

Revision as of 09:11, 13 August 2013

Summary

The point of this blueprint is to add VPNaaS components to resources supported by Heat.

VPNaaS componets to add:

  • VPNService
  • IKEPolicy
  • IPsecPolicy
  • IPsecSiteConnection

Components

VPNServices

Property Description
name Name of the VPN Service.
description Description of the VPN Service.
admin_state_up Administrative state of vpnservice. If false (down), port does not forward packets.
subnet_id Subnet id in which the tenant wants the vpn service.
router_id Router id to which the vpn service is inserted.

Example: 

...
"Resources" : {
    ...
    "VPNService" : {
        "Type" : "OS::Neutron::VPNService",
        "Properties" : {
            "name" : "My VPN",
            "description" : "My new VPN",
            "admin_state_up" : True,
            "subnet_Id" : { "Ref" : "Subnet" },
            "router_Id" : { "Ref" : "Router" }
        }
    }
    ...
},
...

IKEPolicy

Property Description
name Friendly name for the IKE policy.
description Description of the IKE policy.
auth_algorithm Authentication Hash algorithms "sha1".
encryption_algorithm Encryption Algorithms "3des", "aes-128", "aes-256", "aes-192" etc.
phase1_negotiation_mode IKE mode "main".
pfs Perfect Forward Secrecy (group2, group5, group14).
ike_version v1 or v2 version.
lifetime
units Lifetime of the SA unit in "seconds" or "kilobytes".
value Lifetime value in seconds or kilobytes.

Example: 

...
"Resources" : {
    ...
    "IKEPolicy" : {
        "Type" : "OS::Neutron::IKEPolicy",
        "Properties" : {
            "name" : "My IKEPolicy",
            "description" : "My new IKE policy",
            "auth_algorithm" : "sha1",
            "encryption_algorithm" : "3des",
            "phase1_negotiation_mode" : "main",
            "lifetime" : {
                "units" : "seconds",
                "value" : 3600
            },
            "pfs" : "group5",
            "ike_version" : "v1"
        }
    }
    ...
},
...

IPsecPolicy

Property Description
name Friendly name for the IPsec policy.
description Description of the IPsec policy.
transform_protocol Transform Protocol used such as "esp" or "ah" or "ah-esp".
encapsulation_mode Encapsulation mode either "tunnel" mode or "transport" mode.
auth_algorithm Authentication Hash algorithms "sha1".
encryption_algorithm Encryption Algorithms "3des", "aes-128", "aes-256", "aes-192" etc.
pfs Perfect Forward Secrecy (group2, group5, group14).
lifetime
units Lifetime of the SA unit in "seconds" or "kilobytes".
value Lifetime value in seconds or kilobytes.

Example: 

...
"Resources" : {
    ...
    "IPsecPolicy" : {
        "Type" : "OS::Neutron::IPsecPolicy",
        "Properties" : {
            "name" : "My IKEPolicy",
            "description" : "My new IKE policy",
            "transform_protocol": "esp",
            "encapsulation_mode" : "tunnel",
            "auth_algorithm" : "sha1",
            "encryption_algorithm" : "3des",
            "lifetime" : {
                "units" : "seconds",
                "value" : 3600
            },
            "pfs" : "group5"
        }
    }
    ...
},
...

IPsecSiteConnection

Property Description
name Friendly Name for the IPsec site connection.
description Description of the IPsec site connection.
peer_address Remote branch router public IPv4 address or IPv6 address or FQDN.
peer_id Remote branch router identity.
peer_cidrs Peer private cidrs.
mtu Maximum transmission unit to address fragmentation.
psk Pre-shared-key any string.
initiator Whether this VPN can only respond to connections or can initiate as well ("bi-directional", "response-only").
admin_state_up Administrative state of vpn connection. If false (down), VPN connection does not forward packets.
ikepolicy_id UUID id of IKE policy.
ipsecpolicy_id UUID id of IPsec policy.
vpnservice_id UUID id of VPN service.
dpd
actions DPD actions controls the use of Dead Peer Detection Protocol. ("clear", "hold", "restart", "disabled", "restart-by-peer").
interval Number of seconds for DPD delay.
timeout Number of seconds for DPD timeout.

Example: 

...
"Resources" : {
    ...
    "VPNConnection" : {
        "Type" : "OS::Neutron::VPNConnection",
        "Properties" : {
            "name" : "My VPN connection",
            "description" : "My new VPN connection",
            "peer_address" : "10.0.0.1",
            "peer_id" : "peer",
            "peer_cidrs" : ["10.0.0.0/24"],
            "mtu" : 1500,
            "dpd" : {
               "actions" : "hold",
               "interval" : 30,
               "timeout" : 120
            },
            "psk" : "secret",
            "initiator" : "bi-directional",
            "admin_state_up" : True,
            "ikepolicy_id" : { "Ref" : "IKEPolicy" },
            "ipsecpolicy_Id" : { "Ref" : "IPsecPolicy" },
            "vpnservice_id" : { "Ref" : "VPNService" }
        }
    }
    ...
},
...

Dependencies & References

Appendix

VPNaaS.template

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "Creates one sided VPN connection between to different regions",

  "Parameters" : {
    
    "ExternalNetworkId" : {
      "Description" : "External network id",
      "Type" : "String",
      "ConstraintDescription" : "must be a uuid of existing external network"
    },
    
    "ExternalGatewayIPAddress" : {
      "Description" : "External Gateway IP address",
      "Type" : "String",
      "Default" : "172.24.4.233",
      "ConstraintDescription" : "must be an IP address of external gateway"
    }

  },

  "Resources" : {
  
    "Network": {
      "Type": "OS::Quantum::Net",
      "Properties": {
        "name": "My Network"
      }
    },

    "Subnet": {
      "Type": "OS::Quantum::Subnet",
      "Properties": {
        "name": "My Subnet",
        "network_id": { "Ref" : "Network" },
        "ip_version": 4,
        "cidr": "10.1.0.0/24",
        "allocation_pools": [ {
          "start": "10.1.0.10",
          "end": "10.1.0.200"
          }
        ]
      }
    },

    "Router": {
      "Type": "OS::Quantum::Router",
      "Properties": {
        "name": "My Router"
      }
    },

    "RouterInterface": {
      "Type": "OS::Quantum::RouterInterface",
      "Properties": {
        "router_id": { "Ref" : "Router" },
        "subnet_id": { "Ref" : "Subnet" }
      }
    },
    
    "RouterGateway": {
      "Type": "OS::Quantum::RouterGateway",
      "Properties": {
        "router_id": { "Ref" : "Router" },
        "network_id": { "Ref" : "ExternalNetworkId" }
      }
    },
  
    "VPNService" : {
      "Type" : "OS::Quantum::VPNService",
      "Properties" : {
        "name" : "VPNService",
        "description" : "My new VPN service",
        "router_id" : { "Ref" : "Router" },
        "subnet_id" : { "Ref" : "Subnet" }
      }
    },

   "IKEPolicy" : {
      "Type" : "OS::Quantum::IKEPolicy",
      "Properties" : {
        "name" : "IKEPolicy",
        "description" : "My new IKE policy"
      }
    },

    "IPsecPolicy" : {
      "Type" : "OS::Quantum::IPsecPolicy",
      "Properties" : {
        "name" : "IPsecPolicy",
        "description" : "My new IPsec policy"
      }
    },

    "IPsecSiteConnection" : {
      "Type" : "OS::Quantum::IPsecSiteConnection",
      "Properties" : {
        "name" : "IPsecSiteConnection",
        "description" : "My new IPsec site connection",
        "peer_address" : { "Ref" : "ExternalGatewayIPAddress" },
        "peer_id" : { "Ref" : "ExternalGatewayIPAddress" },
        "peer_cidrs" : [ "10.2.0.0/24" ],
        "psk" : "secret",
        "ikepolicy_id" : { "Ref" : "IKEPolicy" },
        "ipsecpolicy_id" : { "Ref" : "IPsecPolicy" },
        "vpnservice_id" : { "Ref" : "VPNService" }
      }
    }
  }
}
NTTI3
Retrieved from "https://wiki.openstack.org/w/index.php?title=Heat/Blueprints/VPaaS_Support&oldid=27979"