Mailing-List: contact dev-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cloudstack.apache.org
MIME-Version: 1.0
Sender: williamstevens@gmail.com
In-Reply-To: <DB6PR0701MB3016BC5874F41CBE31F0037CB21F0@DB6PR0701MB3016.eurprd07.prod.outlook.com>
References: <61D5D0F0-3D9D-4CE1-BBAB-C19F871759A7@schubergphilis.com>
 <CAC2panqPfY91Ja2FW3yroJTNQ8gf11jJ0zmuwmWakhCGgxyPoQ@mail.gmail.com>
 <CAC2panqngDtNUeWacAXQmTjbUtCUZvguCfW0tm23WH+1qoQ=+Q@mail.gmail.com>
 <CAC2panorASiGu+BJCLyBO0HGUsT3PUA-Fict10HkiM+afjOqCw@mail.gmail.com> <DB6PR0701MB3016BC5874F41CBE31F0037CB21F0@DB6PR0701MB3016.eurprd07.prod.outlook.com>
From: Will Stevens <wstevens@cloudops.com>
Date: Mon, 24 Apr 2017 16:28:34 -0400
Message-ID: <CAC2panp95QAVAODKYJqY7gXH10wPdUJ3JtkA4Te=YSqtYnRsiA@mail.gmail.com>
Subject: Re: [4.10] VPN disconnected while network changes taken
To: "dev@cloudstack.apache.org" <dev@cloudstack.apache.org>
Content-Type: multipart/alternative; boundary=001a113ce4128a803d054def7306
archived-at: Mon, 24 Apr 2017 20:28:46 -0000

--001a113ce4128a803d054def7306
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Fair enough.  Well you will have a fix if people start to complain.  :P

*Will STEVENS*
Lead Developer

<https://goo.gl/NYZ8KK>

On Mon, Apr 24, 2017 at 4:21 PM, Remi Bergsma <RBergsma@schubergphilis.com>
wrote:

> I dont think the remote access feature is used a lot in our deploys, so I
> would assume it has the same issue. We mainly use s2s.
>
> Regards, Remi
> ________________________________
> From: Will Stevens <williamstevens@gmail.com>
> Sent: Monday, April 24, 2017 8:00:25 PM
> To: dev@cloudstack.apache.org
> Subject: Re: [4.10] VPN disconnected while network changes taken
>
> @remi, judging from your configure.py, I am assuming that any network
> change, like adding a PF rule, will drop the Remote Access VPN connection
> as well.  Is that the case?  Or am I missing something?
>
> On Mon, Apr 24, 2017 at 1:49 PM, Will Stevens <williamstevens@gmail.com>
> wrote:
>
> > I am trying to find a way to remove this explicit down and still be abl=
e
> > to keep the VPN connection up.
> >
> > https://github.com/apache/cloudstack/blob/master/
> systemvm/patches/debian/
> > config/opt/cloud/bin/configure.py#L638
> >
> > On Mon, Apr 24, 2017 at 1:41 PM, Will Stevens <williamstevens@gmail.com=
>
> > wrote:
> >
> >> @remi yes, I think you are right that we should change that for the
> >> site2site config. I will check that after.
> >>
> >> The issue referred to in this thread is in reference to the remote
> access
> >> VPN dropping when other networking is configured.
> >>
> >> In this case it is not a mystery why it is going down since we actuall=
y
> >> call a down on it when it gets reconfigured. I have been trying to get
> it
> >> to handle network config changes without taking down the VPN.
> >>
> >> I have obviously removed the explicit down and am trying to find a
> >> working configuration, but when xl2tpd is stopped, it goes down hard a=
nd
> >> when it comes back up it can't find the same tunnel, so the tunnel is
> >> dropped.
> >>
> >> I will review your config to see how you are handling this.
> >>
> >> Thanks for the support.
> >>
> >> On Apr 24, 2017 1:02 PM, "Remi Bergsma" <RBergsma@schubergphilis.com>
> >> wrote:
> >>
> >>> Hi all,
> >>>
> >>> While I haven=E2=80=99t investigated this issue, it does sound simila=
r to what
> I
> >>> fixed in Cosmic (our fork) last month.
> >>>
> >>> This code does a down/up of the VPN connection:
> >>> https://github.com/apache/cloudstack/blob/master/systemvm/pa
> >>> tches/debian/config/opt/cloud/bin/configure.py#L547-L548
> >>>
> >>> We found that to be impacting. Since we have auto=3Dstart in the conf=
ig
> >>> file already, we only have to reload the config and ipsec will take
> care of
> >>> the rest on its own. Fast & easy! Most of all, no more unneeded
> restarts.
> >>>
> >>> Simply put: just remove the stop/start lines as it is not needed.
> >>> The code is also hit when non-VPN changes are made, so that=E2=80=99s=
 probably
> >>> why people report that another change causes it to disconnect.
> >>>
> >>> This is how we fixed it:
> >>> https://github.com/MissionCriticalCloud/cosmic/pull/339/comm
> >>> its/5ee5e70894a321f4d633c836e0bacef481b2b9af
> >>>
> >>> Hope this gives some inspiration and a possible solution.
> >>>
> >>> Regards, Remi
> >>>
> >>>
> >>>
> >>> On 24/04/2017, 17:50, "williamstevens@gmail.com on behalf of Will
> >>> Stevens" <williamstevens@gmail.com on behalf of wstevens@cloudops.com=
>
> >>> wrote:
> >>>
> >>>     Working on it now, I will let you know when I have a fix.
> >>>
> >>>     *Will STEVENS*
> >>>     Lead Developer
> >>>
> >>>     <https://goo.gl/NYZ8KK>
> >>>
> >>>     On Mon, Apr 24, 2017 at 11:34 AM, Haijiao <18602198181@163.com>
> >>> wrote:
> >>>
> >>>     > Hi Will
> >>>     >
> >>>     > Any progress about this issue ?
> >>>     >
> >>>     > tks
> >>>     >
> >>>     >
> >>>     > Sent from my mobile
> >>>     >
> >>>     > --------- =E8=BD=AC=E5=8F=91=E7=9A=84=E9=82=AE=E4=BB=B6 -------=
--
> >>>     > =E5=8F=91=E4=BB=B6=E4=BA=BA=EF=BC=9A Haijiao <18602198181@163.c=
om>
> >>>     > =E5=8F=91=E9=80=81=E6=97=A5=E6=9C=9F=EF=BC=9A 2017=E5=B9=B404=
=E6=9C=8814=E6=97=A5 23:21
> >>>     > =E6=94=B6=E4=BB=B6=E4=BA=BA=EF=BC=9A dev <dev@cloudstack.apache=
.org>
> >>>     > =E6=8A=84=E9=80=81=E4=BA=BA=EF=BC=9A
> >>>     > =E4=B8=BB=E9=A2=98=EF=BC=9A Re:Re: [4.10] VPN disconnected whil=
e network changes taken
> >>>     > Sure, Karuturi
> >>>     >
> >>>     > Logged a bug in Jira,  thanks!
> >>>     >
> >>>     > CLOUDSTACK-9878 Remote Access VPN that losing connection when n=
ew
> >>> network
> >>>     > configs are introduced
> >>>     > https://issues.apache.org/jira/browse/CLOUDSTACK-9878
> >>>     >
> >>>     >
> >>>     >
> >>>     > =E5=9C=A82017=E5=B9=B404=E6=9C=8814 13=E6=97=B614=E5=88=86, "Ra=
jani Karuturi"<rajani@apache.org>=E5=86=99=E9=81=93:
> >>>     >
> >>>     >
> >>>     > Hi Haijiao,
> >>>     >
> >>>     > Thanks for testing. Can you log a bug for this please? It can b=
e
> >>>     > a blocker for 4.10.
> >>>     >
> >>>     > @Will,
> >>>     >
> >>>     > Did you get a chance to take a look at this issue?
> >>>     >
> >>>     > Thanks,
> >>>     >
> >>>     > ~ Rajani
> >>>     >
> >>>     > http://cloudplatform.accelerite.com/
> >>>     >
> >>>     > On April 12, 2017 at 7:12 AM, Will Stevens
> >>>     > (wstevens@cloudops.com) wrote:
> >>>     >
> >>>     > Thanks, I will have a look.
> >>>     >
> >>>     > *Will STEVENS*
> >>>     > Lead Developer
> >>>     >
> >>>     > <https://goo.gl/NYZ8KK>
> >>>     >
> >>>     > On Tue, Apr 11, 2017 at 8:58 PM, Haijiao <18602198181@163.com>
> >>>     > wrote:
> >>>     >
> >>>     > HI, Will
> >>>     > It's a Remote Access VPN that losing connection while new
> >>>     > network configs
> >>>     > introduced.
> >>>     > Thanks !
> >>>     >
> >>>     > =E5=9C=A82017=E5=B9=B404=E6=9C=8812 02=E6=97=B626=E5=88=86, "Wi=
ll Stevens"<wstevens@cloudops.com>=E5=86=99=E9=81=93:
> >>>     >
> >>>     > Is this a Site-to-Site VPN connection or the Remote Access VPN
> >>>     > that is
> >>>     > losing connection when new network configs are introduced?
> >>>     >
> >>>     > Thanks,
> >>>     >
> >>>     > *Will STEVENS*
> >>>     > Lead Developer
> >>>     >
> >>>     > <https://goo.gl/NYZ8KK>
> >>>     >
> >>>     > On Sat, Apr 8, 2017 at 12:49 AM, Haijiao <18602198181@163.com>
> >>>     > wrote:
> >>>     >
> >>>     > Hi,
> >>>     >
> >>>     > We built and tested the ACS 4.10 from the latest master (Apr.7,
> >>>     > 2017)
> >>>     >
> >>>     > Our environment is,
> >>>     > - ACS: 4.10.0.0-SNAPSHOT
> >>>     > - Management Server: Centos7.2 1151
> >>>     > - Host: Centos7.2 1151
> >>>     > - System VM: systemvm64template-master-4.10.0-kvm.qcow2.bz2
> >>>     > - Network: Isolated Network
> >>>     > - Network Offering: Offering for Isolated networks with Source
> >>>     > Nat
> >>>     >
> >>>     > service
> >>>     >
> >>>     > enabled
> >>>     >
> >>>     > We can successfully setup VPN and it works as expected. However=
,
> >>>     > once
> >>>     >
> >>>     > we
> >>>     >
> >>>     > take any network changes below, the VPN connnection will be
> >>>     > immediately
> >>>     > disconnected.
> >>>     >
> >>>     > - Update firewall rules (add/change)
> >>>     > - Update port fowarding
> >>>     > - Update LB
> >>>     > - Add one more VPN account
> >>>     >
> >>>     > Is there some configuration we missed ? Or it's due to the new
> >>>     > VPN
> >>>     > component (StrongSWAN) introcuced in 4.10 ?
> >>>     >
> >>>     >
> >>>     >
> >>>     >
> >>>     >
> >>>     >
> >>>     >
> >>>
> >>>
> >>>
> >>>
> >>>
> >
>

--001a113ce4128a803d054def7306--