Skip to content

IPSEC VPN

This guide describes how to configure an IPSEC VPN site-to-site connection in OpenStack Horizon.

Prerequisites

  • A router connected to a private network (see Setup Network).
  • The VPN configuration must match on both sides (OpenStack and the remote peer).

For the IPSEC VPN connection to work, the configuration on both sides must match. The following steps describe the OpenStack side.

1. Create IKE Policy (Phase 1)

  1. Navigate to Network Topology.
  2. Click +Add IKE Policy in the top right.

image

  1. Enter the required information and click Add.

image

The IKE policy is created and listed.

image

2. Create IPsec Policy (Phase 2)

  1. Switch to the IPsec Policies tab.
  2. Click +Add IPsec Policy.

image

  1. Enter the information and click Add.

image

Important

Currently, only the Transform Protocols esp and ah are supported.

image

3. Add VPN Service

Here you specify the network information from the OpenStack side (Router and Subnet).

Warning

A maximum of one VPN Service per virtual Router is supported. However, multiple IPsec Site Connections are allowed per router, as long as they use the same VPN Service.

  1. Switch to the VPN Service tab.
  2. Click +Add VPN Service.
  3. Enter the information and click Add.

image

4. Add Endpoint Groups

Here you specify the network information for A) OpenStack (local subnet) and B) the VPN peer (remote CIDR).

A) Local Endpoint Group

  1. Switch to the Endpoint Groups tab.
  2. Click +Add Endpoint Group.
  3. Enter a name, select Subnet (for local systems) as the type, and select your local subnet.
  4. Click Add.

image

B) Remote Endpoint Group

  1. Click +Add Endpoint Group.
  2. Enter a name, select CIDR (for external Systems) as the type, and enter the peer network.
  3. Click Add.

image

5. Add IPsec Site-to-Site Connection

  1. Switch to the IPsec Site-to-Site Connections tab.
  2. Click +Add IPsec Site-to-Site Connection.
  3. Select the previously configured parameters from the dropdown menus.
  4. Click Add.

image

If everything is configured correctly, the IPSEC VPN connection is listed with status Active (the IPSEC tunnel comes up).

image

Important

If the settings are incorrect, the status remains Pending until the negotiation (Phase 1 and 2) matches the remote side. In this case, delete the Site Connection and recreate it with the correct parameters.