Heat/Blueprints/VPaaS Support
Contents
Summary
The point of this blueprint is to add VPNaaS components to resources supported by Heat.
VPNaaS componets to add:
- VPNService
- IKEPolicy
- IPsecPolicy
- IPsecSiteConnection
Components
VPNServices
Property | Description |
---|---|
name | Name of the VPN Service. |
description | Description of the VPN Service. |
admin_state_up | Administrative state of vpnservice. If false (down), port does not forward packets. |
subnet_id | Subnet id in which the tenant wants the vpn service. |
router_id | Router id to which the vpn service is inserted. |
Example:
... "Resources" : { ... "VPNService" : { "Type" : "OS::Quantum::VPNService", "Properties" : { "name" : "My VPN", "description" : "My new VPN", "admin_state_up" : True, "subnet_Id" : { "Ref" : "Subnet" }, "router_Id" : { "Ref" : "Router" } } } ... }, ...
IKEPolicy
Property | Description |
---|---|
name | Friendly name for the IKE policy. |
description | Description of the IKE policy. |
auth_algorithm | Authentication Hash algorithms "sha1". |
encryption_algorithm | Encryption Algorithms "3des", "aes-128", "aes-256", "aes-192" etc. |
phase1_negotiation_mode | IKE mode "main". |
lifetime_units | Lifetime of the SA unit in "seconds" or "kilobytes". |
lifetime_value | Lifetime value in seconds or kilobytes. |
pfs | Perfect Forward Secrecy (group2, group5, group14). |
ike_version | v1 or v2 version. |
Example:
... "Resources" : { ... "IKEPolicy" : { "Type" : "OS::Quantum::IKEPolicy", "Properties" : { "name" : "My IKEPolicy", "description" : "My new IKE policy", "auth_algorithm" : "sha1", "encryption_algorithm" : "3des", "phase1_negotiation_mode" : "main", "lifetime_units" : "seconds", "lifetime_value" : 3600, "pfs" : "group5", "ike_version" : "v1" } } ... }, ...
IPsecPolicy
Property | Description |
---|---|
name | Friendly name for the IPsec policy. |
description | Description of the IPsec policy. |
transform_protocol | Transform Protocol used such as "esp" or "ah" or "ah-esp". |
encapsulation_mode | Encapsulation mode either "tunnel" mode or "transport" mode. |
auth_algorithm | Authentication Hash algorithms "sha1". |
encryption_algorithm | Encryption Algorithms "3des", "aes-128", "aes-256", "aes-192" etc. |
lifetime_units | Lifetime of the SA unit in "seconds" or "kilobytes". |
lifetime_value | Lifetime value in seconds or kilobytes. |
pfs | Perfect Forward Secrecy (group2, group5, group14). |
Example:
... "Resources" : { ... "IPsecPolicy" : { "Type" : "OS::Quantum::IPsecPolicy", "Properties" : { "name" : "My IKEPolicy", "description" : "My new IKE policy", "transform_protocol": "esp", "encapsulation_mode" : "tunnel", "auth_algorithm" : "sha1", "encryption_algorithm" : "3des", "lifetime_units" : "seconds", "lifetime_value" : 3600, "pfs" : "group5" } } ... }, ...
IPsecSiteConnection
Property | Description |
---|---|
name | Friendly Name for the IPsec site connection. |
description | Description of the IPsec site connection. |
peer_address | Remote branch router public IPv4 address or IPv6 address or FQDN. |
peer_id | Remote branch router identity. |
peer_cidrs | Peer private cidrs. |
mtu | Maximum transmission unit to address fragmentation. |
dpd_actions | DPD actions controls the use of Dead Peer Detection Protocol. ("clear", "hold", "restart", "disabled", "restart-by-peer"). |
dpd_interval | Number of seconds for DPD delay. |
dpd_timeout | Number of seconds for DPD timeout. |
psk | Pre-shared-key any string. |
initiator | Whether this VPN can only respond to connections or can initiate as well ("bi-directional", "response-only"). |
admin_state_up | Administrative state of vpn connection. If false (down), VPN connection does not forward packets. |
ikepolicy_id | UUID id of IKE policy. |
ipsecpolicy_id | UUID id of IPsec policy. |
vpnservice_id | UUID id of VPN service. |
Example:
... "Resources" : { ... "VPNConnection" : { "Type" : "OS::Quantum::VPNConnection", "Properties" : { "name" : "My VPN connection", "description" : "My new VPN connection", "peer_address" : "10.0.0.1", "peer_id" : "peer", "peer_cidrs" : ["10.0.0.0/24"], "mtu" : 1500, "dpd_actions" : "hold", "dpd_interval" : 30, "dpd_timeout" : 120, "psk" : "secret", "initiator" : "bi-directional", "admin_state_up" : True, "ikepolicy_id" : { "Ref" : "IKEPolicy" }, "ipsecpolicy_Id" : { "Ref" : "IPsecPolicy" }, "vpnservice_id" : { "Ref" : "VPNService" } } } ... }, ...
Dependencies & References
- BL: VPN as a Service providing IPsec VPN with Static routing (UNDER REVIEW)
Appendix
VPNaaS.template
{ "AWSTemplateFormatVersion" : "2010-09-09", "Description" : "Creates one sided VPN connection between to different regions", "Parameters" : { "ExternalNetworkId" : { "Description" : "External network id", "Type" : "String", "ConstraintDescription" : "must be a uuid of existing external network" }, "ExternalGatewayIPAddress" : { "Description" : "External Gateway IP address", "Type" : "String", "Default" : "172.24.4.233", "ConstraintDescription" : "must be an IP address of external gateway" } }, "Resources" : { "Network": { "Type": "OS::Quantum::Net", "Properties": { "name": "My Network" } }, "Subnet": { "Type": "OS::Quantum::Subnet", "Properties": { "name": "My Subnet", "network_id": { "Ref" : "Network" }, "ip_version": 4, "cidr": "10.1.0.0/24", "allocation_pools": [ { "start": "10.1.0.10", "end": "10.1.0.200" } ] } }, "Router": { "Type": "OS::Quantum::Router", "Properties": { "name": "My Router" } }, "RouterInterface": { "Type": "OS::Quantum::RouterInterface", "Properties": { "router_id": { "Ref" : "Router" }, "subnet_id": { "Ref" : "Subnet" } } }, "RouterGateway": { "Type": "OS::Quantum::RouterGateway", "Properties": { "router_id": { "Ref" : "Router" }, "network_id": { "Ref" : "ExternalNetworkId" } } }, "VPNService" : { "Type" : "OS::Quantum::VPNService", "Properties" : { "name" : "VPNService", "description" : "My new VPN service", "router_id" : { "Ref" : "Router" }, "subnet_id" : { "Ref" : "Subnet" } } }, "IKEPolicy" : { "Type" : "OS::Quantum::IKEPolicy", "Properties" : { "name" : "IKEPolicy", "description" : "My new IKE policy" } }, "IPsecPolicy" : { "Type" : "OS::Quantum::IPsecPolicy", "Properties" : { "name" : "IPsecPolicy", "description" : "My new IPsec policy" } }, "IPsecSiteConnection" : { "Type" : "OS::Quantum::IPsecSiteConnection", "Properties" : { "name" : "IPsecSiteConnection", "description" : "My new IPsec site connection", "peer_address" : { "Ref" : "ExternalGatewayIPAddress" }, "peer_id" : { "Ref" : "ExternalGatewayIPAddress" }, "peer_cidrs" : [ "10.2.0.0/24" ], "psk" : "secret", "ikepolicy_id" : { "Ref" : "IKEPolicy" }, "ipsecpolicy_id" : { "Ref" : "IPsecPolicy" }, "vpnservice_id" : { "Ref" : "VPNService" } } } } }