blob: 86dda9130cdcd47e8cef193e3aa0cef75a064d9c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
#!/usr/bin/env bash
# Script originally copied from https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall
WEST_SUBNET='192.168.10.0/24'
EAST_SUBNET='192.168.20.0/24'
function setup_site(){
local site_name=$1
local cidr=$2
echo ">>> Creating network and subnet for site '$site_name'..."
openstack network create net_$site_name
openstack subnet create --network net_$site_name --subnet-range $cidr subnet_$site_name
echo ">>> Creating router '$site_name' with external gateway 'public1'..."
openstack router create --external-gateway public1 router_$site_name
openstack router add subnet router_$site_name subnet_$site_name
echo ">>> Creating VPN service for site '$site_name'..."
openstack vpn service create vpn_$site_name --router router_$site_name
echo ">>> Creating local endpoint group for site '$site_name'..."
openstack vpn endpoint group create ${site_name}-local-epg --type subnet --value subnet_$site_name
}
function get_external_ip(){
openstack vpn service show -f value -c ext_v4_ip $1
}
function clean_site(){
local site_name=$1
echo ">>> Cleaning configuration for site '$site_name'..."
openstack vpn ipsec site connection delete conn_$site_name || true
openstack vpn service delete vpn_$site_name || true
openstack vpn endpoint group delete ${site_name}-local-epg || true
openstack router remove subnet router_$site_name subnet_$site_name || true
openstack router unset --external-gateway router_$site_name || true
openstack router delete router_$site_name || true
openstack subnet delete subnet_$site_name || true
openstack network delete net_$site_name || true
}
function setup(){
echo ">>> Creating IKE policy..."
openstack vpn ike policy create ikepolicy --ike-version v2 --auth-algorithm sha256 --encryption-algorithm aes-256 --pfs group14
echo ">>> Creating IPSec policy..."
openstack vpn ipsec policy create ipsecpolicy --auth-algorithm sha256 --encryption-algorithm aes-256 --pfs group14
echo ">>> Configuring WEST site..."
setup_site west $WEST_SUBNET
echo ">>> Creating peer endpoint group for WEST..."
openstack vpn endpoint group create west-peer-epg --type cidr --value $EAST_SUBNET
WEST_IP=$(get_external_ip vpn_west)
echo ">>> VPN WEST external IP: $WEST_IP"
echo ">>> Configuring EAST site..."
setup_site east $EAST_SUBNET
echo ">>> Creating peer endpoint group for EAST..."
openstack vpn endpoint group create east-peer-epg --type cidr --value $WEST_SUBNET
EAST_IP=$(get_external_ip vpn_east)
echo ">>> VPN EAST external IP: $EAST_IP"
echo ">>> Creating VPN connection 'conn_east'..."
openstack vpn ipsec site connection create conn_east --vpnservice vpn_east --ikepolicy ikepolicy \
--ipsecpolicy ipsecpolicy --local-endpoint-group east-local-epg --peer-address $WEST_IP \
--peer-id $WEST_IP --peer-endpoint-group east-peer-epg --psk secret
echo ">>> Creating VPN connection 'conn_west'..."
openstack vpn ipsec site connection create conn_west --vpnservice vpn_west --ikepolicy ikepolicy \
--ipsecpolicy ipsecpolicy --local-endpoint-group west-local-epg --peer-address $EAST_IP \
--peer-id $EAST_IP --peer-endpoint-group west-peer-epg --psk secret
echo ">>> Waiting for VPN connections to become ACTIVE..."
wait_for_vpn_active conn_east
wait_for_vpn_active conn_west
echo ">>> All VPN connections are ACTIVE!"
}
function wait_for_vpn_active(){
local conn_name=$1
local timeout=300
local interval=10
local elapsed=0
echo ">>> Checking VPN status for $conn_name every $interval seconds (timeout: $timeout seconds)..."
while true; do
STATUS=$(openstack vpn ipsec site connection show $conn_name -f value -c status)
if [ "$STATUS" == "ACTIVE" ]; then
echo ">>> VPN connection $conn_name is ACTIVE"
break
fi
if [ $elapsed -ge $timeout ]; then
echo ">>> Timeout waiting for VPN connection $conn_name to become ACTIVE"
exit 1
fi
sleep $interval
elapsed=$((elapsed + interval))
done
}
function cleanup(){
echo ">>> Cleaning all VPN configurations..."
clean_site west
clean_site east
openstack vpn endpoint group delete west-peer-epg || true
openstack vpn endpoint group delete east-peer-epg || true
openstack vpn ike policy delete ikepolicy || true
openstack vpn ipsec policy delete ipsecpolicy || true
}
function check() {
if [ -z ${OS_USERNAME} ]; then
echo ">>> Keystone credentials not found. Try: source /etc/kolla/admin-openrc.sh"
exit 1
fi
}
check
cleanup
setup
echo ">>> Displaying current VPN connections:"
openstack vpn ipsec site connection list
echo ">>> VPN setup completed successfully."
|
