Bug Reference

https://issues.apache.org/jira/browse/CLOUDSTACK-730

Branch

MASTER, target for 4.3 release.

Purpose

Add ability to site-to-site VPN to connect between CloudStack virtual routers.

References

https://cwiki.apache.org/confluence/display/CLOUDSTACK/Site-to-Site+VPN+2.0

Feature Specifications

• Basically we need to add a "passive" mode for our s2s VPN, in order to not initiate the connection after adding VPN setup.
• It's hypervisor independent feature, supported all hypervisors.

Use cases

1. User creates VPC A and VPC B.
2. User enables VPN gateway on VPC A, and VPC B.
3. User creates VPN customer gateway for VPC A and VPC B.
4. User enables VPN connection on VPC A with customer gateway pointed to VPC B, as "passive". The VPN connection would be shown in "Disconnected" state.
5. User enables VPN connection on VPC B with customer gateway pointed to VPC A, thus initiate VPN connection.
6. Both VPN connection would show "Connected" after a while(in 30 seconds by default).

Architecture and Design description

• For the openswan we're using, we would only need to execute the "add", and don't bring the connection "up" would be fine.

Web Services APIs

CreateVpnConnection API:

• Add one parameter:
  • passive: boolean. If create VPN connection in passive mode.

UI flow

Add one checkbox "Passive" when creating VPN connection.