Difference between revisions of "Heat/Blueprints/VPaaS Support"

Latest revision as of 11:03, 13 August 2013

Summary

The point of this blueprint is to add VPNaaS components to resources supported by Heat.

VPNaaS componets to add:

VPNService
IKEPolicy
IPsecPolicy
IPsecSiteConnection

Components

VPNServices

Property	Description
name	Name of the VPN Service.
description	Description of the VPN Service.
admin_state_up	Administrative state of vpnservice. If false (down), port does not forward packets.
subnet_id	Subnet id in which the tenant wants the vpn service.
router_id	Router id to which the vpn service is inserted.

Example:

...
"Resources" : {
    ...
    "VPNService" : {
        "Type" : "OS::Neutron::VPNService",
        "Properties" : {
            "name" : "My VPN",
            "description" : "My new VPN",
            "admin_state_up" : True,
            "subnet_Id" : { "Ref" : "Subnet" },
            "router_Id" : { "Ref" : "Router" }
        }
    }
    ...
},
...

IKEPolicy

Property	Description
name	Friendly name for the IKE policy.
description	Description of the IKE policy.
auth_algorithm	Authentication Hash algorithms "sha1".
encryption_algorithm	Encryption Algorithms "3des", "aes-128", "aes-256", "aes-192" etc.
phase1_negotiation_mode	IKE mode "main".
pfs	Perfect Forward Secrecy (group2, group5, group14).
ike_version	v1 or v2 version.
lifetime
units	Lifetime of the SA unit in "seconds" or "kilobytes".
value	Lifetime value in seconds or kilobytes.

Example:

...
"Resources" : {
    ...
    "IKEPolicy" : {
        "Type" : "OS::Neutron::IKEPolicy",
        "Properties" : {
            "name" : "My IKEPolicy",
            "description" : "My new IKE policy",
            "auth_algorithm" : "sha1",
            "encryption_algorithm" : "3des",
            "phase1_negotiation_mode" : "main",
            "lifetime" : {
                "units" : "seconds",
                "value" : 3600
            },
            "pfs" : "group5",
            "ike_version" : "v1"
        }
    }
    ...
},
...

IPsecPolicy

Property	Description
name	Friendly name for the IPsec policy.
description	Description of the IPsec policy.
transform_protocol	Transform Protocol used such as "esp" or "ah" or "ah-esp".
encapsulation_mode	Encapsulation mode either "tunnel" mode or "transport" mode.
auth_algorithm	Authentication Hash algorithms "sha1".
encryption_algorithm	Encryption Algorithms "3des", "aes-128", "aes-256", "aes-192" etc.
pfs	Perfect Forward Secrecy (group2, group5, group14).
lifetime
units	Lifetime of the SA unit in "seconds" or "kilobytes".
value	Lifetime value in seconds or kilobytes.

Example:

...
"Resources" : {
    ...
    "IPsecPolicy" : {
        "Type" : "OS::Neutron::IPsecPolicy",
        "Properties" : {
            "name" : "My IKEPolicy",
            "description" : "My new IKE policy",
            "transform_protocol": "esp",
            "encapsulation_mode" : "tunnel",
            "auth_algorithm" : "sha1",
            "encryption_algorithm" : "3des",
            "lifetime" : {
                "units" : "seconds",
                "value" : 3600
            },
            "pfs" : "group5"
        }
    }
    ...
},
...

IPsecSiteConnection

Property	Description
name	Friendly Name for the IPsec site connection.
description	Description of the IPsec site connection.
peer_address	Remote branch router public IPv4 address or IPv6 address or FQDN.
peer_id	Remote branch router identity.
peer_cidrs	Peer private cidrs.
mtu	Maximum transmission unit to address fragmentation.
psk	Pre-shared-key any string.
initiator	Whether this VPN can only respond to connections or can initiate as well ("bi-directional", "response-only").
admin_state_up	Administrative state of vpn connection. If false (down), VPN connection does not forward packets.
ikepolicy_id	UUID id of IKE policy.
ipsecpolicy_id	UUID id of IPsec policy.
vpnservice_id	UUID id of VPN service.
dpd
actions	DPD actions controls the use of Dead Peer Detection Protocol. ("clear", "hold", "restart", "disabled", "restart-by-peer").
interval	Number of seconds for DPD delay.
timeout	Number of seconds for DPD timeout.

Example:

...
"Resources" : {
    ...
    "VPNConnection" : {
        "Type" : "OS::Neutron::VPNConnection",
        "Properties" : {
            "name" : "My VPN connection",
            "description" : "My new VPN connection",
            "peer_address" : "10.0.0.1",
            "peer_id" : "peer",
            "peer_cidrs" : ["10.0.0.0/24"],
            "mtu" : 1500,
            "dpd" : {
               "actions" : "hold",
               "interval" : 30,
               "timeout" : 120
            },
            "psk" : "secret",
            "initiator" : "bi-directional",
            "admin_state_up" : True,
            "ikepolicy_id" : { "Ref" : "IKEPolicy" },
            "ipsecpolicy_Id" : { "Ref" : "IPsecPolicy" },
            "vpnservice_id" : { "Ref" : "VPNService" }
        }
    }
    ...
},
...

Dependencies & References

BL: VPN as a Service providing IPsec VPN with Static routing (UNDER REVIEW)

Appendix

VPNaaS.template

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "",

  "Parameters" : {

    "ExternalNetworkId" : {
      "Description" : "External network id",
      "Type" : "String",
      "ConstraintDescription" : "must be a id of existing external network"
    },

    "ExternalGatewayIPAddress" : {
      "Description" : "External Gateway IP address",
      "Type" : "String",
      "ConstraintDescription" : "must be an IP address of external gateway"
    },

    "SubnetCidr" : {
      "Description" : "Subnet cidr",
      "Type" : "String",
      "ConstraintDescription" : "must be a cidr"
    },

    "SubnetPoolStart" : {
      "Description" : "Start of allocation pool for subnet",
      "Type" : "String",
      "ConstraintDescription" : "must be a valid IP address"
    },

    "SubnetPoolEnd" : {
      "Description" : "End of allocation pool for subnet",
      "Type" : "String",
      "ConstraintDescription" : "must be a valid IP address"
    },
    
    "VPNPeerCidr" : {
      "Description" : "Cidr for VPN peer",
      "Type" : "String",
      "ConstraintDescription" : "must be a valid cidr"
    }

  },
  
  "Resources" : {
  
    "Network": {
      "Type": "OS::Quantum::Net",
      "Properties": {
        "name": "My Network"
      }
    },

    "Subnet": {
      "Type": "OS::Quantum::Subnet",
      "Properties": {
        "name": "My Subnet",
        "network_id": { "Ref" : "Network" },
        "ip_version": 4,
        "cidr": { "Ref" : "SubnetCidr" },
        "dns_nameservers": ["8.8.8.8"],
        "allocation_pools": [ {
          "start": { "Ref" : "SubnetPoolStart" },
          "end": { "Ref" : "SubnetPoolEnd" }
          }
        ]
      }
    },

    "Router": {
      "Type": "OS::Quantum::Router",
      "Properties": {
        "name": "My Router"
      }
    },

    "RouterInterface": {
      "Type": "OS::Quantum::RouterInterface",
      "Properties": {
        "router_id": { "Ref" : "Router" },
        "subnet_id": { "Ref" : "Subnet" }
      }
    },
    
    "RouterGateway": {
      "Type": "OS::Quantum::RouterGateway",
      "Properties": {
        "router_id": { "Ref" : "Router" },
        "network_id": { "Ref" : "ExternalNetworkId" }
      }
    },

    "VPNService" : {
      "Type" : "OS::Neutron::VPNService",
      "Properties" : {
        "name" : "VPNService",
        "description" : "My new VPN service",
        "admin_state_up" : true,
        "router_id" : { "Ref" : "Router" },
        "subnet_id" : { "Ref" : "Subnet" }
      }
    },

    "IKEPolicy" : {
      "Type" : "OS::Neutron::IKEPolicy",
      "Properties" : {
        "name" : "IKEPolicy",
        "description" : "My new IKE policy",
        "auth_algorithm" : "sha1",
        "encryption_algorithm" : "3des",
        "phase1_negotiation_mode" : "main",
        "lifetime" : {
            "units" : "seconds",
            "value" : 3600
        },
        "pfs" : "group5",
        "ike_version" : "v1"
      }
    },

    "IPsecPolicy" : {
      "Type" : "OS::Neutron::IPsecPolicy",
      "Properties" : {
        "name" : "IPsecPolicy",
        "description" : "My new IPsec policy",
        "transform_protocol": "esp",
        "encapsulation_mode" : "tunnel",
        "auth_algorithm" : "sha1",
        "encryption_algorithm" : "3des",
        "lifetime" : {
            "units" : "seconds",
            "value" : 3600
        },
        "pfs" : "group5"
      }
    },

    "IPsecSiteConnection" : {
      "Type" : "OS::Neutron::VPNConnection",
      "Properties" : {
        "name" : "VPNConnection",
        "description" : "My new VPN connection",
        "peer_address" : { "Ref" : "ExternalGatewayIPAddress" },
        "peer_id" : { "Ref" : "ExternalGatewayIPAddress" },
        "peer_cidrs" : [ { "Ref" : "VPNPeerCidr" } ],
        "mtu" : 1500,
        "dpd" : { 
            "actions" : "hold",
            "interval" : 30,
            "timeout" : 120
        },
        "psk" : "secret",
        "initiator" : "bi-directional",
        "admin_state_up" : true,
        "ikepolicy_id" : { "Ref" : "IKEPolicy" },
        "ipsecpolicy_id" : { "Ref" : "IPsecPolicy" },
        "vpnservice_id" : { "Ref" : "VPNService" }
      }
    }
  }
}

NTTI3

@@ Line 69: / Line 69: @@
 | ike_version || v1 or v2 version.
 |-
-lifetime ||
+| lifetime ||
 |-
 | units || Lifetime of the  SA unit in "seconds" or "kilobytes".
@@ Line 90: / Line 90: @@
              "encryption_algorithm" : "3des",
              "phase1_negotiation_mode" : "main",
-             "lifetime_units" : "seconds",
+             "lifetime" : {
-            "lifetime_value" : 3600,
+                "units" : "seconds",
+                "value" : 3600
+            },
              "pfs" : "group5",
              "ike_version" : "v1"
@@ Line 119: / Line 121: @@
 | encryption_algorithm || Encryption Algorithms "3des", "aes-128", "aes-256", "aes-192" etc.
 |-
-| lifetime_units || Lifetime of the  SA unit in "seconds" or "kilobytes".
+| pfs || Perfect Forward Secrecy  (group2, group5, group14).
 |-
-| lifetime_value || Lifetime value in seconds or kilobytes.
+| lifetime ||
+|-
+| units || Lifetime of the SA unit in "seconds" or "kilobytes".
+|-
+| value || Lifetime value in seconds or kilobytes.
 |-
-| pfs || Perfect Forward Secrecy  (group2, group5, group14).
 |}
@@ Line 141: / Line 146: @@
              "auth_algorithm" : "sha1",
              "encryption_algorithm" : "3des",
-             "lifetime_units" : "seconds",
+             "lifetime" : {
-            "lifetime_value" : 3600,
+                "units" : "seconds",
+                "value" : 3600
+            },
              "pfs" : "group5"
          }
@@ Line 168: / Line 175: @@
 |-
 | mtu || Maximum transmission unit to address fragmentation.
-|-
-| dpd_actions || DPD actions controls the use of Dead Peer Detection Protocol. ("clear", "hold", "restart", "disabled", "restart-by-peer").
-|-
-| dpd_interval || Number of seconds for DPD delay.
-|-
-| dpd_timeout || Number of seconds for DPD timeout.
 |-
 | psk || Pre-shared-key any string.
@@ Line 186: / Line 187: @@
 |-
 | vpnservice_id || UUID id of VPN service.
+|-
+| dpd ||
+|-
+| actions || DPD actions controls the use of Dead Peer Detection Protocol. ("clear", "hold", "restart", "disabled", "restart-by-peer").
+|-
+| interval || Number of seconds for DPD delay.
+|-
+| timeout || Number of seconds for DPD timeout.
 |}
@@ Line 203: / Line 212: @@
              "peer_cidrs" : ["10.0.0.0/24"],
              "mtu" : 1500,
-             "dpd_actions" : "hold",
+             "dpd" : {
-            "dpd_interval" : 30,
+               "actions" : "hold",
-            "dpd_timeout" : 120,
+               "interval" : 30,
+               "timeout" : 120
+            },
              "psk" : "secret",
              "initiator" : "bi-directional",
@@ Line 235: / Line 246: @@
    "AWSTemplateFormatVersion" : "2010-09-09",
-   "Description" : "Creates one sided VPN connection between to different regions",
+   "Description" : "",
    "Parameters" : {
      "ExternalNetworkId" : {
        "Description" : "External network id",
        "Type" : "String",
-       "ConstraintDescription" : "must be a uuid of existing external network"
+       "ConstraintDescription" : "must be a id of existing external network"
      },
      "ExternalGatewayIPAddress" : {
        "Description" : "External Gateway IP address",
        "Type" : "String",
-      "Default" : "172.24.4.233",
        "ConstraintDescription" : "must be an IP address of external gateway"
+    },
+    "SubnetCidr" : {
+      "Description" : "Subnet cidr",
+      "Type" : "String",
+      "ConstraintDescription" : "must be a cidr"
+    },
+    "SubnetPoolStart" : {
+      "Description" : "Start of allocation pool for subnet",
+      "Type" : "String",
+      "ConstraintDescription" : "must be a valid IP address"
+    },
+    "SubnetPoolEnd" : {
+      "Description" : "End of allocation pool for subnet",
+      "Type" : "String",
+      "ConstraintDescription" : "must be a valid IP address"
+    },
+    "VPNPeerCidr" : {
+      "Description" : "Cidr for VPN peer",
+      "Type" : "String",
+      "ConstraintDescription" : "must be a valid cidr"
      }
    },
    "Resources" : {
@@ Line 269: / Line 303: @@
          "network_id": { "Ref" : "Network" },
          "ip_version": 4,
-         "cidr": "10.1.0.0/24",
+         "cidr": { "Ref" : "SubnetCidr" },
+        "dns_nameservers": ["8.8.8.8"],
          "allocation_pools": [ {
-           "start": "10.1.0.10",
+           "start": { "Ref" : "SubnetPoolStart" },
-           "end": "10.1.0.200"
+           "end": { "Ref" : "SubnetPoolEnd" }
            }
          ]
@@ Line 300: / Line 335: @@
        }
      },
      "VPNService" : {
-       "Type" : "OS::Quantum::VPNService",
+       "Type" : "OS::Neutron::VPNService",
        "Properties" : {
          "name" : "VPNService",
          "description" : "My new VPN service",
+        "admin_state_up" : true,
          "router_id" : { "Ref" : "Router" },
          "subnet_id" : { "Ref" : "Subnet" }
@@ Line 311: / Line 347: @@
      },
-   "IKEPolicy" : {
+    "IKEPolicy" : {
-       "Type" : "OS::Quantum::IKEPolicy",
+       "Type" : "OS::Neutron::IKEPolicy",
        "Properties" : {
          "name" : "IKEPolicy",
-         "description" : "My new IKE policy"
+         "description" : "My new IKE policy",
+        "auth_algorithm" : "sha1",
+        "encryption_algorithm" : "3des",
+        "phase1_negotiation_mode" : "main",
+        "lifetime" : {
+            "units" : "seconds",
+            "value" : 3600
+        },
+        "pfs" : "group5",
+        "ike_version" : "v1"
        }
      },
      "IPsecPolicy" : {
-       "Type" : "OS::Quantum::IPsecPolicy",
+       "Type" : "OS::Neutron::IPsecPolicy",
        "Properties" : {
          "name" : "IPsecPolicy",
-         "description" : "My new IPsec policy"
+         "description" : "My new IPsec policy",
+        "transform_protocol": "esp",
+        "encapsulation_mode" : "tunnel",
+        "auth_algorithm" : "sha1",
+        "encryption_algorithm" : "3des",
+        "lifetime" : {
+            "units" : "seconds",
+            "value" : 3600
+        },
+        "pfs" : "group5"
        }
      },
      "IPsecSiteConnection" : {
-       "Type" : "OS::Quantum::IPsecSiteConnection",
+       "Type" : "OS::Neutron::VPNConnection",
        "Properties" : {
-         "name" : "IPsecSiteConnection",
+         "name" : "VPNConnection",
-         "description" : "My new IPsec site connection",
+         "description" : "My new VPN connection",
          "peer_address" : { "Ref" : "ExternalGatewayIPAddress" },
          "peer_id" : { "Ref" : "ExternalGatewayIPAddress" },
-         "peer_cidrs" : [ "10.2.0.0/24" ],
+         "peer_cidrs" : [ { "Ref" : "VPNPeerCidr" } ],
+        "mtu" : 1500,
+        "dpd" : {
+            "actions" : "hold",
+            "interval" : 30,
+            "timeout" : 120
+        },
          "psk" : "secret",
+        "initiator" : "bi-directional",
+        "admin_state_up" : true,
          "ikepolicy_id" : { "Ref" : "IKEPolicy" },
          "ipsecpolicy_id" : { "Ref" : "IPsecPolicy" },

Difference between revisions of "Heat/Blueprints/VPaaS Support"

Latest revision as of 11:03, 13 August 2013

Contents

Summary

Components

VPNServices

IKEPolicy

IPsecPolicy

IPsecSiteConnection

Dependencies & References

Appendix

VPNaaS.template