Heat/Blueprints/VPaaS Support
< Heat
Contents
Summary
The point of this blueprint is to add VPNaaS components to resources supported by Heat.
VPNaaS componets to add:
- VPNService
- IKEPolicy
- IPsecPolicy
- IPsecSiteConnection
Components
VPNServices
Property | Description |
---|---|
name | Name of the VPN Service. |
description | Description of the VPN Service. |
admin_state_up | Administrative state of vpnservice. If false (down), port does not forward packets. |
subnet_id | Subnet id in which the tenant wants the vpn service. |
router_id | Router id to which the vpn service is inserted. |
Example:
... "Resources" : { ... "VPNService" : { "Type" : "OS::Neutron::VPNService", "Properties" : { "name" : "My VPN", "description" : "My new VPN", "admin_state_up" : True, "subnet_Id" : { "Ref" : "Subnet" }, "router_Id" : { "Ref" : "Router" } } } ... }, ...
IKEPolicy
Property | Description |
---|---|
name | Friendly name for the IKE policy. |
description | Description of the IKE policy. |
auth_algorithm | Authentication Hash algorithms "sha1". |
encryption_algorithm | Encryption Algorithms "3des", "aes-128", "aes-256", "aes-192" etc. |
phase1_negotiation_mode | IKE mode "main". |
pfs | Perfect Forward Secrecy (group2, group5, group14). |
ike_version | v1 or v2 version. |
lifetime | |
units | Lifetime of the SA unit in "seconds" or "kilobytes". |
value | Lifetime value in seconds or kilobytes. |
Example:
... "Resources" : { ... "IKEPolicy" : { "Type" : "OS::Neutron::IKEPolicy", "Properties" : { "name" : "My IKEPolicy", "description" : "My new IKE policy", "auth_algorithm" : "sha1", "encryption_algorithm" : "3des", "phase1_negotiation_mode" : "main", "lifetime" : { "units" : "seconds", "value" : 3600 }, "pfs" : "group5", "ike_version" : "v1" } } ... }, ...
IPsecPolicy
Property | Description |
---|---|
name | Friendly name for the IPsec policy. |
description | Description of the IPsec policy. |
transform_protocol | Transform Protocol used such as "esp" or "ah" or "ah-esp". |
encapsulation_mode | Encapsulation mode either "tunnel" mode or "transport" mode. |
auth_algorithm | Authentication Hash algorithms "sha1". |
encryption_algorithm | Encryption Algorithms "3des", "aes-128", "aes-256", "aes-192" etc. |
pfs | Perfect Forward Secrecy (group2, group5, group14). |
lifetime | |
units | Lifetime of the SA unit in "seconds" or "kilobytes". |
value | Lifetime value in seconds or kilobytes. |
Example:
... "Resources" : { ... "IPsecPolicy" : { "Type" : "OS::Neutron::IPsecPolicy", "Properties" : { "name" : "My IKEPolicy", "description" : "My new IKE policy", "transform_protocol": "esp", "encapsulation_mode" : "tunnel", "auth_algorithm" : "sha1", "encryption_algorithm" : "3des", "lifetime" : { "units" : "seconds", "value" : 3600 }, "pfs" : "group5" } } ... }, ...
IPsecSiteConnection
Property | Description |
---|---|
name | Friendly Name for the IPsec site connection. |
description | Description of the IPsec site connection. |
peer_address | Remote branch router public IPv4 address or IPv6 address or FQDN. |
peer_id | Remote branch router identity. |
peer_cidrs | Peer private cidrs. |
mtu | Maximum transmission unit to address fragmentation. |
psk | Pre-shared-key any string. |
initiator | Whether this VPN can only respond to connections or can initiate as well ("bi-directional", "response-only"). |
admin_state_up | Administrative state of vpn connection. If false (down), VPN connection does not forward packets. |
ikepolicy_id | UUID id of IKE policy. |
ipsecpolicy_id | UUID id of IPsec policy. |
vpnservice_id | UUID id of VPN service. |
dpd | |
actions | DPD actions controls the use of Dead Peer Detection Protocol. ("clear", "hold", "restart", "disabled", "restart-by-peer"). |
interval | Number of seconds for DPD delay. |
timeout | Number of seconds for DPD timeout. |
Example:
... "Resources" : { ... "VPNConnection" : { "Type" : "OS::Neutron::VPNConnection", "Properties" : { "name" : "My VPN connection", "description" : "My new VPN connection", "peer_address" : "10.0.0.1", "peer_id" : "peer", "peer_cidrs" : ["10.0.0.0/24"], "mtu" : 1500, "dpd" : { "actions" : "hold", "interval" : 30, "timeout" : 120 }, "psk" : "secret", "initiator" : "bi-directional", "admin_state_up" : True, "ikepolicy_id" : { "Ref" : "IKEPolicy" }, "ipsecpolicy_Id" : { "Ref" : "IPsecPolicy" }, "vpnservice_id" : { "Ref" : "VPNService" } } } ... }, ...
Dependencies & References
- BL: VPN as a Service providing IPsec VPN with Static routing (UNDER REVIEW)
Appendix
VPNaaS.template
{ "AWSTemplateFormatVersion" : "2010-09-09", "Description" : "", "Parameters" : { "ExternalNetworkId" : { "Description" : "External network id", "Type" : "String", "ConstraintDescription" : "must be a id of existing external network" }, "ExternalGatewayIPAddress" : { "Description" : "External Gateway IP address", "Type" : "String", "ConstraintDescription" : "must be an IP address of external gateway" }, "SubnetCidr" : { "Description" : "Subnet cidr", "Type" : "String", "ConstraintDescription" : "must be a cidr" }, "SubnetPoolStart" : { "Description" : "Start of allocation pool for subnet", "Type" : "String", "ConstraintDescription" : "must be a valid IP address" }, "SubnetPoolEnd" : { "Description" : "End of allocation pool for subnet", "Type" : "String", "ConstraintDescription" : "must be a valid IP address" }, "VPNPeerCidr" : { "Description" : "Cidr for VPN peer", "Type" : "String", "ConstraintDescription" : "must be a valid cidr" } }, "Resources" : { "Network": { "Type": "OS::Quantum::Net", "Properties": { "name": "My Network" } }, "Subnet": { "Type": "OS::Quantum::Subnet", "Properties": { "name": "My Subnet", "network_id": { "Ref" : "Network" }, "ip_version": 4, "cidr": { "Ref" : "SubnetCidr" }, "dns_nameservers": ["8.8.8.8"], "allocation_pools": [ { "start": { "Ref" : "SubnetPoolStart" }, "end": { "Ref" : "SubnetPoolEnd" } } ] } }, "Router": { "Type": "OS::Quantum::Router", "Properties": { "name": "My Router" } }, "RouterInterface": { "Type": "OS::Quantum::RouterInterface", "Properties": { "router_id": { "Ref" : "Router" }, "subnet_id": { "Ref" : "Subnet" } } }, "RouterGateway": { "Type": "OS::Quantum::RouterGateway", "Properties": { "router_id": { "Ref" : "Router" }, "network_id": { "Ref" : "ExternalNetworkId" } } }, "VPNService" : { "Type" : "OS::Neutron::VPNService", "Properties" : { "name" : "VPNService", "description" : "My new VPN service", "admin_state_up" : true, "router_id" : { "Ref" : "Router" }, "subnet_id" : { "Ref" : "Subnet" } } }, "IKEPolicy" : { "Type" : "OS::Neutron::IKEPolicy", "Properties" : { "name" : "IKEPolicy", "description" : "My new IKE policy", "auth_algorithm" : "sha1", "encryption_algorithm" : "3des", "phase1_negotiation_mode" : "main", "lifetime" : { "units" : "seconds", "value" : 3600 }, "pfs" : "group5", "ike_version" : "v1" } }, "IPsecPolicy" : { "Type" : "OS::Neutron::IPsecPolicy", "Properties" : { "name" : "IPsecPolicy", "description" : "My new IPsec policy", "transform_protocol": "esp", "encapsulation_mode" : "tunnel", "auth_algorithm" : "sha1", "encryption_algorithm" : "3des", "lifetime" : { "units" : "seconds", "value" : 3600 }, "pfs" : "group5" } }, "IPsecSiteConnection" : { "Type" : "OS::Neutron::VPNConnection", "Properties" : { "name" : "VPNConnection", "description" : "My new VPN connection", "peer_address" : { "Ref" : "ExternalGatewayIPAddress" }, "peer_id" : { "Ref" : "ExternalGatewayIPAddress" }, "peer_cidrs" : [ { "Ref" : "VPNPeerCidr" } ], "mtu" : 1500, "dpd" : { "actions" : "hold", "interval" : 30, "timeout" : 120 }, "psk" : "secret", "initiator" : "bi-directional", "admin_state_up" : true, "ikepolicy_id" : { "Ref" : "IKEPolicy" }, "ipsecpolicy_id" : { "Ref" : "IPsecPolicy" }, "vpnservice_id" : { "Ref" : "VPNService" } } } } }