Versions Compared

Old Version 3

changes.mady.by.user Jayapal

Saved on

compared with

New Version 4

changes.mady.by.user Jayapal

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

 

Introduction

Currently VR is using openSwan ipsec vpn. This is an opensource ipsec vpn package that provides the Site-to-Site as well as Remote Access VPN in cloudstack VR.

This feature will replace OpenSwan ipsec with the StrongSwan ipsec vpn.

Motivation

Features of strongswan over openswan is:

  1. Openswan is currently not maintained.  Strongswan project is maintained by debian. 
  2. Strongswan ipsec supports the latest version  of OS X clients.

Ticket

 

Use cases:

There are no use case changes w.r.t openswan ipsec.

Strongswan ipsec vpn configurations

Strongswan supports below vpn models as openswan.

  1. Remote access VPN (isolated network and VPC )
  2. Site to Site VPN (VPC).

 

Template changes:

Installing the StrongSwan

VR template is installed with the StrongSwan U4.5.2 package.

  1. VRs deployed in cloudstack version will be come with the new template which is having strongswan.
  2. If there are already VRs running, on reboot from cloudstack will pick up the new template.

Upgrade:

After upgrade if there existing vpn tunnels then these tunnels works with opnswan ipsec untill the VR is upgraded.

Once the VR is upgraded existing/new vpn tunnel will use the strongswan ipsec tunnel.

Bring up pre upgrade vpn tunnels with strongswan

For existing tunnels to come up strongswan ipsec daemon, VR needs to be upgraded.

...

Once the VRs are restarted, previously existing VPN connections will be broken. Once the VR rebooted successfully  then VPN clients can re-establish the tunnels strongswan ipsec.

 

UI

 

N/A

 

API

 

N/A

 

 

Configuration examples

Remote access VPN:

ipsec.conf:
# ipsec.conf - strongSwan IPsec configuration file
# basic configuration
config setup
     nat_traversal=yes
     charonstart=yes
     plutostart=yes
     #virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
# Add connections here.
conn %default
        keyingtries=1
        authby=psk
conn L2TP_PSK
     #left
     left=10.147.52.223
     leftprotoport=17/1701
    
     #right
     right=%any
     rightprotoport=17/%any
     rightsubnetwithin=10.1.2.0/8
   
     leftnexthop=%defaultroute
     #ipsec
     pfs=no
     auto=add    
     keyexchange=ikev1
     forceencaps=yes
     #leftfirewall=yes
include /var/lib/strongswan/ipsec.conf.inc
#include /etc/ipsec.d/l2tp.conf

S2S VPN ipsec.conf:

r-31-VM -------------------r-33-VM
r-31-VM : vpc1 : 10.147.52.204: cidr 192.168.0.0/16
r-33-VM: vpc2: 10.147.52.205: cidr: 10.3.0.0/16
Example configuration on VR
==============strongswan s2s conf -==============
 
 
root@r-315-QA:/etc/ipsec.d# cat cat /etc/ipsec.conf conf

# Manual: ipsec.conf - strongSwan IPsec configuration file.5
version 2.0# basic configuration
config setup
    charonstart plutodebug=yescontrol
    plutostart=yes charonstart=noinclude /var/lib/strongswan/ipsec.conf.inc
include /etc/ipsec.d/*.conf

 

root@r-315-QA:/etc/ipsec.d# cat cat ipsec.vpn-10.147.52.205174.conf
#config file#vpn
conn vpn-10.147.52.205174
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
authby=secret
left=10.147.52.204173
leftsubnet=19210.16810.0.0/16
leftnexthop #leftid=10@10.147.52.1173
leftid=@moon
leftfirewall=yes
right=10.147.52.205174
rightsubnet=10.320.0.0/16
type=tunnel
authby=secret
keyexchange=ike
ike=3des-md5
ikelifetime=24h
esp=3des-md5

lifetime=1h
pfs=no
keyingtries=2
auto=add

 
root@r-31-QA:~# cat /etc/ipsec.secrets
10.147.52.204 10.147.52.205 : PSK "123456789"
 

#rightid=@10.147.52.174
rightid=@sun
auto=add

 

root@r-

33

5-QA:/etc/ipsec.d# cat /etc/ipsec.

conf
# ipsec.conf - strongSwan IPsec configuration file

#basic configuration

config setup

    charonstart=yes
    plutostart=yes

include

secrets
#include /var/lib/

strongswan

openswan/ipsec.

conf

secrets.inc

include

#include /etc/ipsec.d

/*.conf

root@r-33-QA:/etc/ipsec.d# cat ipsec.vpn-10.147.52.204.conf
#config file

conn vpn-10.147.52.204
left=10.147.52.205
leftsubnet=10.3.0.0/16
leftnexthop=10.147.52.1
right=10.147.52.204
rightsubnet=192.168.0.0/16
type=tunnel
authby=secret
keyexchange=ike
ike=3des-md5
ikelifetime=24h
esp=3des-md5
lifetime=1h
pfs=no
keyingtries=2
auto=add

 
root@r-33-QA:~# cat /etc/ipsec.secrets
# /etc/ipsec.secrets - strongSwan IPsec secrets file
10.147.52.205 10.147.52.204

/ipsec.*.secrets
@moon @sun : PSK "123456789"