WONTFIX unless upstream limitations are overcome. ** Changed in: neutron Status: Incomplete => Won't Fix
-- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to neutron. https://bugs.launchpad.net/bugs/1491679 Title: ipsec-site-connection is not back to ACTIVE state after updating admin_state_up from True -> False -> True Status in neutron: Won't Fix Bug description: neutron vpn-service-create --name myvpnA --description "My vpnA service" routerA subA neutron vpn-service-create --name myvpnB --description "My vpnB service" routerB subB neutron ipsec-site-connection-create --name vpnconnectionA --vpnservice-id myvpnA \ --ikepolicy-id ikepolicy --ipsecpolicy-id ipsecpolicy --peer-address 172.24.4.102 \ --peer-id 172.24.4.102 --peer-cidr 10.2.0.0/24 --psk secret neutron ipsec-site-connection-create --name vpnconnectionB --vpnservice-id myvpnB \ --ikepolicy-id ikepolicy --ipsecpolicy-id ipsecpolicy --peer-address 172.24.4.101 \ --peer-id 172.24.4.101 --peer-cidr 10.1.0.0/24 --psk secret docker@ubuntu:~/devstack$ neutron ipsec-site-connection-list +--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+ | id | name | peer_address | peer_cidrs | route_mode | auth_mode | status | +--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+ | 4ca689a5-180a-4661-bd5b-6182d9dad5e4 | vpnconnectionA | 172.24.4.102 | "10.2.0.0/24" | static | psk | ACTIVE | | f65263bd-b5cf-46c5-a809-a376bec461d9 | vpnconnectionB | 172.24.4.101 | "10.1.0.0/24" | static | psk | ACTIVE | +--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+ Now, change the admin_state_up as false for ipsec-site-connection - vpnconnectionA. docker@ubuntu:~/devstack$ neutron ipsec-site-connection-list +--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+ | id | name | peer_address | peer_cidrs | route_mode | auth_mode | status | +--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+ | 4ca689a5-180a-4661-bd5b-6182d9dad5e4 | vpnconnectionA | 172.24.4.102 | "10.2.0.0/24" | static | psk | DOWN | | f65263bd-b5cf-46c5-a809-a376bec461d9 | vpnconnectionB | 172.24.4.101 | "10.1.0.0/24" | static | psk | ACTIVE | +--------------------------------------+----------------+--------------+---------------+------------+-----------+--------+ ping vm1 to vm2 does not work and ping vm2 and vm1 does not work ( this is expected) Change back the admin_state_up as True, the status is still shown as DOWN, even the vpn-service for myvpnA is at DOWN docker@ubuntu:~/devstack$ neutron ipsec-site-connection-show vpnconnectionA +----------------+----------------------------------------------------+ | Field | Value | +----------------+----------------------------------------------------+ | admin_state_up | True | | auth_mode | psk | | description | | | dpd | {"action": "hold", "interval": 30, "timeout": 120} | | id | 4ca689a5-180a-4661-bd5b-6182d9dad5e4 | | ikepolicy_id | d5112709-8909-4ce3-a7aa-99569474c812 | | initiator | bi-directional | | ipsecpolicy_id | 430ece29-8cf5-488a-b77d-798f0e7d455e | | mtu | 1500 | | name | vpnconnectionA | | peer_address | 172.24.4.102 | | peer_cidrs | 10.2.0.0/24 | | peer_id | 172.24.4.102 | | psk | secret | | route_mode | static | | status | DOWN | | tenant_id | 7d0f12937859462bb7c1d5d012111dec | | vpnservice_id | 33311333-a6be-4b59-bedc-d3f1583459e7 | +----------------+----------------------------------------------------+ docker@ubuntu:~/devstack$ neutron vpn-service-show myvpnA +----------------+--------------------------------------+ | Field | Value | +----------------+--------------------------------------+ | admin_state_up | True | | description | My vpnA service | | external_v4_ip | 172.24.4.101 | | external_v6_ip | | | id | 33311333-a6be-4b59-bedc-d3f1583459e7 | | name | myvpnA | | router_id | 3b4fab84-6bac-4a29-8bf2-65378e342dc4 | | status | DOWN | | subnet_id | 63d99342-c9e0-41a9-993d-3c2a6e0256ad | | tenant_id | 7d0f12937859462bb7c1d5d012111dec | +----------------+--------------------------------------+ In-order to make it work, have to restart vpn-service ( meaning update vpn-service for myvpnA's admin_state_up as True) and ipsite-connection for vpnconnectionA's admin_state_up as True. Is this expected behavior? To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1491679/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp