Updated StrongSwan VPN Implementation by swill · Pull Request #1741 · apache/cloudstack

swill · 2016-10-27T13:15:27Z

This PR is a merge of @jayapalu changes in #872 and the changes I had to make to get the functionality working.

I have done pretty extensive testing of this code so far and we are looking to be in pretty good shape. One thing to note is that a Diffie-Hellman group is required in order for this feature to work correctly. It is not highlighted in the tests below, but I have shown that the PFS is not required for this feature to work. In #872 I have shown a more exhaustive set of tests of this code, but I have limited this set of tests to a recommended IKE and ESP configuration in order to reduce the noise and test the other areas of functionality.

Test Results
I am testing this functionality by creating two VPCs with VMs in each and creating a S2S VPN connection between the two VPCs. Then I SSH into a VM in one VPC and I ping the private IP of a VM in the other VPC. Then I tear it down and try a different configuration.

Setup

VPC 1 VPC 2 ===== ===== VPN Gateway VPN Gateway VPN Customer Gateway VPN Customer Gateway
VPN Connection <---> VPN Connection
- Passive = True - Passive = False

Legend
SKIP => At least one of the VPN Connections did not come up, so no test was run.
OK => The ping test was successful over the S2S VPN connection.
FAIL => The ping test failed over the S2S VPN connection.

Passive => Specifies if either the <vpc_1> : <vpc_2> sides of the VPN Connection is set to passive.
Conn State => Specifies the connection status of the <vpc_1> : <vpc_2> VPN Connection in the UI.
Requires Reset => If the ping test does not result in an OK, then a VPN Connection Reset is performed on either <vpc_1> : <vpc_2> sides of the VPN Connection based on which side is not showing Connected. The results in the Status column is the final result after the reset is performed.

Results

+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| Status | IKE & ESP | DPD | Encap | IKE Life | ESP Life | Passive | Conn State | Requires Reset |
+========+======================+=======+=======+==========+==========+===============+=============================+================+
| OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | True | 86400 | 3600 | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | | 3600 | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | 86400 | | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | | | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : False | Connected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : False | Connected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| SKIP | aes128-sha1 | True | False | 86400 | 3600 | True : False | Disconnected : Error | True : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| SKIP | aes128-sha1 | False | False | 86400 | 3600 | True : False | Disconnected : Error | True : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| FAIL | aes128-sha1 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | True : True |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| SKIP | aes128-sha1 | True | False | 86400 | 3600 | False : False | Connected : Error | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+

swill · 2016-10-27T16:52:20Z

@rhtyd & @jburwell this PR requires a new System VM template to function. I have a XenServer test environment which I have been using where I deploy RPMs and the System VM which I build with Jenkins for this PR. My current test setup is not implemented in Marvin, but instead uses my csapi library. Is there a way to run Marvin tests against an ACS environment which is installed using RPMs? I would probably have to create a Marvin config file to match the existing configuration, but can this be done?

The current status of this PR is:

Remote Access VPN seems to be working for our tests so far.

Mac : Working without the need for any modifications.
Windows : Working, but requires a change to the registry to set AssumeUDPEncapsulationContextOnSendRule = 2.
Ubuntu : Untested so far...

Site-to-Site VPN seems to be working quite well so far.

A Diffie-Hellman group is currently required in order for a connection to be established.

How do you guys recommend we get this PR through the official testing and validation process? I should be able to setup a modified Bubble environment that uses my System VM in order to do the current Marvin tests against KVM. Can BlueO test PRs that require a new System VM?

Cheers...

yadvr · 2016-10-28T06:23:15Z

@swill we had lost our Jenkins setup, while I've built all I could not get a systemvmbuilder job setup yet, so let me do that first so we can build systemvmtemplates once again. blueorangutan acts like a translator that in the background kicks a Jenkins-trillian job, Trillian is general purpose and can accept a custom systemvmtemplate option (in Jenkins but not via the github bot). Can you write tests using Marvin, as it could be easier to run them instead of setup something new. You may modify Marvin to include more dependencies etc. I'll keep you posted once I'm able to build systemvmtemplates.

yadvr · 2016-10-28T08:07:26Z

@blueorangutan package

blueorangutan · 2016-10-28T08:08:02Z

@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

yadvr · 2016-10-28T08:18:43Z

@swill I've kicked new systemvmtemplate build jobs based on your PR, I've also included @wido 's systemvm template to include qemu-guest-agent from #1545 : https://github.com/shapeblue/cloudstack/commits/strongswan-sysvm

blueorangutan · 2016-10-28T08:44:56Z

Packaging result: ✔centos6 ✔centos7 ✔debian. JID-111

yadvr · 2016-10-28T09:42:13Z

I've built systemvm templates with strongswan here: http://hydra.scale.ninja/strongswan
The links/server may be taken down in few weeks.

jayapalu · 2016-10-28T09:55:34Z

@swill I will test with latest template in the coming week

swill · 2016-10-28T11:15:13Z

Thanks guys. :)

swill · 2016-10-28T14:32:39Z

I am troubleshooting an issue right now behaves as follows.

I create a VR and connect with the Remote Access VPN and everything works.
I create a Port Forwarding rule on that VR, Remote Access VPN still works.
I reboot that VR, now the PF rule works, but Remote Access VPN will no longer connect.

I will keep you guys posted with the details. I have noted that the PF IP is now the main IP on the eth1 instead of the Source NAT IP. Maybe that is the problem, but I have not been able to confirm it yet.

swill · 2016-11-02T18:53:42Z

I have isolated and fixed the issue where the reboot through the API results in the Remote Access VPN no longer working if either a PF rule or Static NAT rule is defined. The problem existed because the public IPs on eth1 were getting reversed, so the Source NAT IP was no longer the primary IP. Because of this, the Remote Access VPN would stop working after an API VR reboot if there were other public IPs configured on that VR.

I have done basic testing to verify this fixes the problem. We are doing more extensive testing now...

jburwell · 2016-11-03T00:26:47Z

@murali-reddy did you also fix some issues around source NAT?

murali-reddy · 2016-11-03T04:45:17Z

@jburwell No, I have fixed issue with static nat on any public IP associated in case of multiple public interfaces.

@swill Is there any possibility of public IP going out of order for non-VPC case as well on reboot?

swill · 2016-11-03T11:17:14Z

@murali-reddy I will check isolated guest networks today.

swill · 2016-11-03T20:38:38Z

@murali-reddy I have tested with Isolated Guest Networks. The problem that we experienced with the SourceNAT IP not being primary on the public nic if more than one public IP exists does not exist for Isolated Guest Networks. I have tested my change to the cs_ip.py file with Isolated Guest Networks and it does not change the functionality and still works in that case. That cs_ip.py change is looking good so far in our testing.

We are currently going through the l2tp.conf and ipsec.conf files and removing everything that is now deprecated for StrongSwan 5.x so the configuration is cleaner and does not include old legacy options that are not required anymore.

I am also going to see if I can upgrade the IKE policy to IKEv2 instead of IKEv1 for Remote Access VPN since it provides better security. I am also looking to see if I can change the hashing algorithm from sha1 to something like sha256 for Remote Access VPN, also to improve security.

I will not be able to make these change for S2S VPN initially because the configuration fields are different enough between IKEv1 and IKEv2 in that case that I would have to go through and modify a lot more code. That will have to wait for phase two of this implementation.

We are continuing to test and improve the implementation, but it is looking pretty good so far.

apache#1741 Updated StrongSwan VPN Implementation -- (partial merge)

yadvr · 2016-12-02T06:57:20Z

@swill @jayapalu thanks for your work, can you rebase against latest master, fix the conflicts. Also use the JIRA id in the git commit summary. Can you also share, what's lacking and what's working as PR's current state.

jayapalu · 2016-12-06T10:45:52Z

@rhtyd
While testing this feature public ip order change on reboot issue blocked this.
My suggestion is that public ip out of order is different issue. If vpn functionalities working except the reboot with multiple ips then we will go ahead with this PR.

kiwiflyer · 2016-12-06T13:57:24Z

@jayapalu Can you expand on your findings regarding public ip order? Did you pull in the latest PR with the fixes from @swill?

swill · 2016-12-06T16:46:01Z

Rebased against master and fixed merge conflicts...

swill · 2016-12-07T19:47:28Z

Rebased again because changes in #1659 caused the fixes to systemvm/patches/debian/config/opt/cloud/bin/cs_ip.py to conflict...

swill · 2016-12-07T20:01:50Z

@jayapalu were you working off the latest version of my PR? I have fixed the issue of the IP being out of order on reboot in this PR.

swill · 2016-12-09T17:58:55Z

We are running this PR as well as #1706 in production and the merge conflict for merging the two PRs together is quite complicated. Because we had to do the merge conflict for our production of these two PRs, I decided to add it to this PR so other people who don't have an environment to test against don't have to be responsible for figuring out the merge conflict.

This PR now includes:

StrongSwan upgrade from OpenSwan.
Fixes the reversing of public IPs on eth1 when the VR is rebooted.
CLOUDSTACK-9500: remove the IP from the databag if it is not used #1706 - Cleans up public IPs from the databag when they are removed via ACS. (Edit: This has been removed from this PR. We are using Fix public IPs not being removed from the VR when deprovisioned #1907 in production instead, but it is not included in this PR anymore).

swill · 2017-02-02T21:20:10Z

Rebased against current master to try to fix new issues with tomcat.

borisstoyanov · 2017-02-06T14:45:17Z

@swill blueorangutan package builds a yum repo from the PR, but it doesn't build new system vms, we'll need to build them manually, build an env with the packages, update the ssvm and kick the tests manually AFAIK.

swill · 2017-02-06T15:10:13Z

@borisstoyanov thanks. Yes, that explains why there are failures. When I ran my tests, I did it with a system VM built from this PR: #1741 (comment)

Is it possible to manually build the system VM template and specify it when testing with Trillian. I can see if I can build and expose publicly templates for Xen and KVM if that helps.

DaanHoogland · 2017-02-08T07:35:32Z

@blueorangutan package

blueorangutan · 2017-02-08T07:36:24Z

@DaanHoogland a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

blueorangutan · 2017-02-08T07:58:27Z

Packaging result: ✔centos6 ✔centos7 ✔debian. JID-474

DaanHoogland · 2017-02-08T09:09:28Z

@blueorangutan test

blueorangutan · 2017-02-08T09:10:25Z

@DaanHoogland a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

swill · 2017-02-08T15:58:05Z

@DaanHoogland I don't think this will work. I think you have to manually specify a SystemVM template built from this PR in order for the tests to work. I don't think a SystemVM from this PR is used by default.

swill · 2017-02-09T14:15:34Z

CI RESULTS

Tests Run: 87
Skipped: 1
Failed: 4
Errors: 0
Duration: 9h 13m 51s

Summary of the problem(s):

FAIL: Create a redundant VPC with 1 Tier, 1 VM, 1 ACL, 1 PF and test Network GC Nics
----------------------------------------------------------------------
Traceback (most recent call last):
File "/data/git/cs1/cloudstack/test/integration/smoke/test_vpc_redundant.py", line 635, in test_04_rvpc_network_garbage_collector_nics
self.do_vpc_test(False)
File "/data/git/cs1/cloudstack/test/integration/smoke/test_vpc_redundant.py", line 727, in do_vpc_test
self.check_ssh_into_vm(vm.get_vm(), vm.get_ip(), expectFail=expectFail, retries=retries)
File "/data/git/cs1/cloudstack/test/integration/smoke/test_vpc_redundant.py", line 571, in check_ssh_into_vm
self.fail("Failed to SSH into VM - %s" % (public_ip.ipaddress.ipaddress))
AssertionError: Failed to SSH into VM - 192.168.23.5
----------------------------------------------------------------------
Additional details in: /tmp/MarvinLogs/test_network_23KW40/results.txt

FAIL: test_02_vpc_privategw_static_routes (integration.smoke.test_privategw_acl.TestPrivateGwACL)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/data/git/cs1/cloudstack/test/integration/smoke/test_privategw_acl.py", line 271, in test_02_vpc_privategw_static_routes
self.performVPCTests(vpc_off)
File "/data/git/cs1/cloudstack/test/integration/smoke/test_privategw_acl.py", line 362, in performVPCTests
self.check_pvt_gw_connectivity(vm1, public_ip_1, [vm2.nic[0].ipaddress, vm1.nic[0].ipaddress])
File "/data/git/cs1/cloudstack/test/integration/smoke/test_privategw_acl.py", line 724, in check_pvt_gw_connectivity
"Ping to VM on Network Tier N from VM in Network Tier A should be successful at least for 2 out of 3 VMs"
AssertionError: Ping to VM on Network Tier N from VM in Network Tier A should be successful at least for 2 out of 3 VMs
----------------------------------------------------------------------
Additional details in: /tmp/MarvinLogs/test_network_23KW40/results.txt

FAIL: test_03_vpc_privategw_restart_vpc_cleanup (integration.smoke.test_privategw_acl.TestPrivateGwACL)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/data/git/cs1/cloudstack/test/integration/smoke/test_privategw_acl.py", line 283, in test_03_vpc_privategw_restart_vpc_cleanup
self.performVPCTests(vpc_off, restart_with_cleanup = True)
File "/data/git/cs1/cloudstack/test/integration/smoke/test_privategw_acl.py", line 362, in performVPCTests
self.check_pvt_gw_connectivity(vm1, public_ip_1, [vm2.nic[0].ipaddress, vm1.nic[0].ipaddress])
File "/data/git/cs1/cloudstack/test/integration/smoke/test_privategw_acl.py", line 724, in check_pvt_gw_connectivity
"Ping to VM on Network Tier N from VM in Network Tier A should be successful at least for 2 out of 3 VMs"
AssertionError: Ping to VM on Network Tier N from VM in Network Tier A should be successful at least for 2 out of 3 VMs
----------------------------------------------------------------------
Additional details in: /tmp/MarvinLogs/test_network_23KW40/results.txt

FAIL: test_04_rvpc_privategw_static_routes (integration.smoke.test_privategw_acl.TestPrivateGwACL)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/data/git/cs1/cloudstack/test/integration/smoke/test_privategw_acl.py", line 295, in test_04_rvpc_privategw_static_routes
self.performVPCTests(vpc_off)
File "/data/git/cs1/cloudstack/test/integration/smoke/test_privategw_acl.py", line 362, in performVPCTests
self.check_pvt_gw_connectivity(vm1, public_ip_1, [vm2.nic[0].ipaddress, vm1.nic[0].ipaddress])
File "/data/git/cs1/cloudstack/test/integration/smoke/test_privategw_acl.py", line 724, in check_pvt_gw_connectivity
"Ping to VM on Network Tier N from VM in Network Tier A should be successful at least for 2 out of 3 VMs"
AssertionError: Ping to VM on Network Tier N from VM in Network Tier A should be successful at least for 2 out of 3 VMs
----------------------------------------------------------------------
Additional details in: /tmp/MarvinLogs/test_network_23KW40/results.txt

Associated Uploads

/tmp/MarvinLogs/DeployDataCenter__Feb_08_2017_21_26_59_GVX6SA:

/tmp/MarvinLogs/test_network_23KW40:

/tmp/MarvinLogs/test_vpc_routers_UDAZ23:

Uploads will be available until 2017-04-11 02:00:00 +0200 CEST

Comment created by upr comment.

swill · 2017-02-09T14:21:51Z

Here is the CI run for this PR using my KVM Bubble environment. This CI run is using a SystemVM built from this PR branch (required for a valid test) and since we have not been able to do that with Trillian (so far), only my CI runs are actually testing this functionality correctly (so far).

The failures listed are not associated with my PR. Historically, I have had some trouble with consistency with connectivity inside a bubble CI run, so it is possible that could be coming into play as well.

I think this PR is ready. We have been running this PR in production for two months now and it fixes a lot of problems. Can I please get some LGTM on this so we can get it into 4.10?

DaanHoogland · 2017-02-09T15:39:05Z

I started a build yesterday but am not at my computer today. I'll look at the results later. Biligual auto correct use. Read at your own risico

…

On 8 Feb 2017 4:58 pm, "Will Stevens" ***@***.***> wrote: @DaanHoogland <https://github.com/DaanHoogland> I don't think this will work. I think you have to manually specify a SystemVM template built from this PR in order for the tests to work. I don't think a SystemVM from this PR is used by default. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1741 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACXysTl0u14tUk1K6hyzSfJpgR07rG7gks5raeYPgaJpZM4KiVbU> .

swill · 2017-02-09T17:29:41Z

@DaanHoogland did you make the test run in Trillian install a SystemVM built from this PR? If you didn't it won't actually be a valid test run...

DaanHoogland · 2017-02-09T17:34:19Z

@swill I know and work needs done. On the other hand, you mentioned you wanted to see this run in trillian. You still want that? Else I will skip and just review the code tomorrow. Biligual auto correct use. Read at your own risico

…

On 9 Feb 2017 6:29 pm, "Will Stevens" ***@***.***> wrote: @DaanHoogland <https://github.com/DaanHoogland> did you make the test run in Trillian install a SystemVM built from this PR? If you didn't it won't actually be a valid test run... — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1741 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACXysUVYKVbIJIXDlnrSXhez12lK23GKks5ra00HgaJpZM4KiVbU> .

swill · 2017-02-09T17:52:14Z

@DaanHoogland: yes, I want it run in Trillian, but my understanding is that manual steps need to be taken in the test setup for Trillian in order to first build the SystemVM from this PR and then use that SystemVM in the Trillian test run. That has not been done, and any test done by Trillian without that done is not a valid test of the PR. Make sense?

So yes, I would like to have this run against Trillian, but it is only valid if the run includes the SystemVM from this PR.

jayapalu · 2017-02-10T08:26:34Z

@swill I have tested this PR with systemvm template with strongswan installed long back. The s2s vpn worked fine.
LGTM from my side.

asfbot · 2017-02-10T10:10:47Z

Rajani Karuturi on dev@cloudstack.apache.org replies:
I planning to create first RC end of feb(in 20 days).

~ Rajani

http://cloudplatform.accelerite.com/

On February 10, 2017 at 2:24 PM, Daan Hoogland(daan.hoogland@shapeblue.com) wrote:

sorry to keep you guys waiting, I am struggling my way back in
and am working on this (and a lot) will keep you posted. @rajani,
what is the ETA that I must meet to get this in 4.10?

daan.hoogland@shapeblue.com
www.shapeblue.com ( http://www.shapeblue.com )
53 Chandos Place, Covent Garden, Utrecht Utrecht 3531
VENetherlands
@shapeblue

swill · 2017-02-10T18:09:08Z

Here is another set of tests run to validate all the settings (in addition to the normal tests).

+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| Status | IKE | ESP | DPD | Encap | IKE Life | ESP Life | Passive | Conn State | Requires Reset |
+========+========================+========================+=======+=======+==========+==========+===============+=============================+================+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : False | Disconnected : Connected | True : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | True | True | 86400 | 3600 | True : False | Disconnected : Connected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | True | False | | 3600 | True : False | Disconnected : Connected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | True | False | 86400 | | True : False | Disconnected : Connected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | True | False | | | True : False | Disconnected : Connected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : False | Connected : Connected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : False | Connected : Connected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | aes128-sha1 | True | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha256;modp3072 | aes128-sha384;modp2048 | True | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha384;modp4096 | aes128-sha512;modp6144 | True | False | 86400 | 3600 | True : False | Disconnected : Connected | True : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha512;modp8192 | aes128-sha384;modp8192 | True | False | 86400 | 3600 | True : False | Disconnected : Connected | True : False |
+--------+------------------------+------------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+

Still looking for one more review...

deepthimachiraju · 2017-02-14T06:46:06Z

@swill Would do some basic testing of the PR and update the results.

swill · 2017-02-14T12:25:41Z

@deepthimachiraju remember that you need a new system vm built from this PR for this functionality to work.

karuturi · 2017-02-14T12:28:26Z

It has required LGTMs and tests. I am merging this.

@jayapalu

yadvr · 2017-02-15T05:46:39Z

Thanks @swill @jayapalu for the work. I'll build a new systemvmtemplate to use with upcoming Trilian tests on master/4.10+.

swill · 2017-02-15T06:01:53Z

thank you sir. :)

@jayapalu

swill mentioned this pull request Oct 27, 2016
Strongswan vpn feature #872
Closed

swill changed the title ~~Updated StrongSwanVPN Implementation~~Updated StrongSwan VPN ImplementationOct 27, 2016

nathanejohnson added a commit to myENA/cloudstack that referenced this pull request Nov 9, 2016
EC-1171 Pull in cs_ip.py portion of PR 1741
82a9aa0
apache#1741 Updated StrongSwan VPN Implementation -- (partial merge)

nathanejohnson mentioned this pull request Nov 10, 2016
Update release/ENA-4.8 with selected PRs myENA/cloudstack#20
Merged

swill force-pushed the strongswanvpn branch from bffc54d to 153b688Compare December 6, 2016 16:45

swill force-pushed the strongswanvpn branch from 153b688 to 6de4d93Compare December 7, 2016 19:43

swill force-pushed the strongswanvpn branch from 6de4d93 to 8b5625cCompare December 9, 2016 17:44

swill mentioned this pull request Dec 9, 2016
CLOUDSTACK-9500: remove the IP from the databag if it is not used #1706
Closed

swill force-pushed the strongswanvpn branch 2 times, most recently from 28262cd to f045d65Compare February 2, 2017 21:19

asfgit merged commit f045d65 into apache:masterFeb 14, 2017

swill mentioned this pull request Feb 24, 2017
CLOUDSTACK-9801: IPSec VPN does not work after vRouter reboot or recreate #1966
Merged

swill mentioned this pull request Mar 15, 2017
CLOUDSTACK-9811: fixed an issue if the dev is not in the databag #2003
Merged

Uh oh!

Conversation

swill commented Oct 27, 2016• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

swill commented Oct 27, 2016

Uh oh!

yadvr commented Oct 28, 2016

Uh oh!

yadvr commented Oct 28, 2016

Uh oh!

blueorangutan commented Oct 28, 2016

Uh oh!

yadvr commented Oct 28, 2016

Uh oh!

blueorangutan commented Oct 28, 2016

Uh oh!

yadvr commented Oct 28, 2016

Uh oh!

jayapalu commented Oct 28, 2016

Uh oh!

swill commented Oct 28, 2016

Uh oh!

swill commented Oct 28, 2016

Uh oh!

swill commented Nov 2, 2016

Uh oh!

jburwell commented Nov 3, 2016

Uh oh!

murali-reddy commented Nov 3, 2016

Uh oh!

swill commented Nov 3, 2016

Uh oh!

swill commented Nov 3, 2016

Uh oh!

yadvr commented Dec 2, 2016• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jayapalu commented Dec 6, 2016

Uh oh!

kiwiflyer commented Dec 6, 2016

Uh oh!

swill commented Dec 6, 2016

Uh oh!

swill commented Dec 7, 2016

Uh oh!

swill commented Dec 7, 2016

Uh oh!

swill commented Dec 9, 2016• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

swill commented Feb 2, 2017

Uh oh!

borisstoyanov commented Feb 6, 2017

Uh oh!

swill commented Feb 6, 2017

Uh oh!

DaanHoogland commented Feb 8, 2017

Uh oh!

blueorangutan commented Feb 8, 2017

Uh oh!

blueorangutan commented Feb 8, 2017

Uh oh!

DaanHoogland commented Feb 8, 2017

Uh oh!

blueorangutan commented Feb 8, 2017

Uh oh!

swill commented Feb 8, 2017

Uh oh!

swill commented Feb 9, 2017

CI RESULTS

Uh oh!

swill commented Feb 9, 2017

Uh oh!

DaanHoogland commented Feb 9, 2017 via email

Uh oh!

swill commented Feb 9, 2017

Uh oh!

DaanHoogland commented Feb 9, 2017 via email

Uh oh!

swill commented Oct 27, 2016•
edited
Loading

yadvr commented Dec 2, 2016•
edited
Loading

swill commented Dec 9, 2016•
edited
Loading