DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
Page History
...
1. Objectives
In SDN solutions, some networking services are provided by the SDN itself, for example
- Source NAT
- Static NAT
- Load Balancer
- Port forwarding
- Network ACL (VPC)
- Firewall rules (Isolated network)
...
- Dhcp (supported by some SDN providers)
- Dns (supported by some SDN providers)
- UserData (it is unsupported Not supported by SDN providers)
- Vpn (S2S and user)
In this case, the CloudStack VR is used for to provide Dhcp/, Dns /and Userdata services to the vm instances. It is not in the path of the traffic, it acts VM instances, while remaining out of the data path, acting as a helper vmVM
The goal of this feature is to support VPNs in Cloudstack VRto support VPN access from the Cloudstack VR when its out of the data path, thus supporting:
- Remote access VPN for SDN networks
- Site-to-Site VPN for SDN networks
Please note, this supports VPC only. Isolated networks is not supported
2. High Level Design
As the first stepa pre-requisite, the CloudStack VR needs to be provided with a public IP (via static natStatic NAT).
For Remote access vpn, the diagram is as below
...
For Site-to-Site VPN, the diagram is as below
In both cases, as the last step, static routes need to be create injected by cloudstack and configured in SDNCloudStack in the SND fabric.
3. Implementation
This described some details of the implementation
3.1 database change
...
- A new column
...
- has been added to the table
user_ip_addressfor public ip address, which
...
- indicates if the ip is
...
- used for 1:1 NAT to the VPC VR.
`for_router` tinyint(1) DEFAULT '0' COMMENT 'True if the ip address is used by Domain Router to expose services',tinyint(1) DEFAULT '0' COMMENT 'True if the ip address is used by Domain Router to expose services',
- A new column has been added to the table
static_routes, which saves the next hop of static routes.
`next_hop`varchar(50) COMMENT "next hop of the static route" AFTER `vpc_gateway_id`
3.2 ipsec configuration for Remote access VPN
...
To create a VPC, please refer to https://docs.cloudstack.apache.org/en/4.19.1.0/adminguide/networking_and_traffic.html#configuring-a-virtual-private-cloud
4.1 Remote Access VPN
Remote In SDN networks, remote access VPN is not supported by on the Source NAT for SDN networksIP.
(1) acquire a Public IP
Please use an IP address which is not in the subnet of Source NAT of VPC VR (not Netris)VPN fabric.
(2) Enable Remote Access VPN
...
Please refer to https://docs.cloudstack.apache.org/en/4.19.1.0/adminguide/networking/using_remote_access.html#microsoft-windows-8
Remember Reminder, For for Windows clients,
Allow these protocols → Enable MSCHAP-v2
- Update the registry to support L2TP server behind NAT.
- REG ADD HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 0x2 /f
- Restart the server machine
- Please refer to https://forum.netgate.com/topic/151427/solved-ipsec-doesn-t-work-if-behind-nat/4?_=1734534474834
...
If remote access VPN is enabled, it gets the the same IP
Otherwise, public IP is used, otherwise CloudStack automatically assign assigns a Public IP.
(2) Create customer gateway
...
(3) Create VPN connection
5. Test plan
Before testing
- Create VPC offering
- Create Network offering
- Add Vpn Users
5.1 Create VPC, VPC tier and VM
...
Test VPC tier deletion (first tier) | |
|
|
|
|
|
|
|
|
|
|
...
Test VPC tier deletion (from last tier) | |||||||||
|
| ||||||||
|
| ||||||||
|
| ||||||||
|
| ||||||||
|
|
|
| Should fail
|
| Remove VPC
|
|
| Should work |
Overview
Content Tools