]> review.fuel-infra Code Review - openstack-build/neutron-build.git/commit
Cisco VPN with in-band CSR (interim solution)
authorPaul Michali <pcm@cisco.com>
Thu, 14 Aug 2014 13:51:40 +0000 (09:51 -0400)
committerPaul Michali <pcm@cisco.com>
Tue, 26 Aug 2014 23:36:40 +0000 (19:36 -0400)
commit41cf1f0a6abfa65f952c20c6c84e2f0941d509ef
tree7aef8e862001c774d958f67da034659ba12258f3
parent3f16a695442d3e7eef152285c030e02c50ff63ec
Cisco VPN with in-band CSR (interim solution)

Currently, the Cisco VPN drivers use two routers for the proof of concept
solution. A Neutron router provides access to the public and private
subnets, and a Cisco CSR (out-of-band) provides the VPN tunneling.

The end goal is to integrate the Cisco VPN drivers with the Cisco L3
routing plugin being developed (as a separate blueprint), allowing an
in-band CSR to be used as a Neutron router for VPN functionality.

This commit provides an incremental approach to that goal, by modifying
the Cisco VPN drivers to be able to dynamically obtain CSR info from
an INI file, instead of statically reading the INI file at start-up.

A CSR VM can be created out-of-band (or in-band using Nova) and the INI
file can be updated with the router info. Then, the Cisco VPN driver
can use that information (dynamically) to create IPSec connections.

Once the Cisco L3 router plugin is available, the INI file will be
removed, and two calls to the plugin will be used to obtain the needed
router information, for an integrated solution.

The main advantages are:
    - Dynamically use the CSR for VPN.
    - Less manual intervention and setup.
    - Easy migration to final solution.
    - No dependency on the Cisco L3 router plugin implementation.

Note 1: The INI unit tests are moved from device driver to service
        driver and modified.

Note 2: I added a unit test for deleting IPSec site-to-site connection,
        which was missing (pass).

Note 3: For more details on the change, you can view this Google Doc:
        http://goo.gl/DXir8c

Change-Id: I307fc79952e3e12a0f77679ac1fc2b314fa63684
Partially-Implements: blueprint cisco-vpnaas-with-cisco-csr-router
etc/neutron/plugins/cisco/cisco_vpn_agent.ini
neutron/services/vpn/device_drivers/cisco_csr_rest_client.py
neutron/services/vpn/device_drivers/cisco_ipsec.py
neutron/services/vpn/service_drivers/__init__.py
neutron/services/vpn/service_drivers/cisco_cfg_loader.py [new file with mode: 0644]
neutron/services/vpn/service_drivers/cisco_ipsec.py
neutron/services/vpn/service_drivers/ipsec.py
neutron/tests/unit/services/vpn/device_drivers/notest_cisco_csr_rest.py
neutron/tests/unit/services/vpn/device_drivers/test_cisco_ipsec.py
neutron/tests/unit/services/vpn/service_drivers/test_cisco_config_loader.py [new file with mode: 0644]
neutron/tests/unit/services/vpn/service_drivers/test_cisco_ipsec.py