Find the VPN server and the relevant router UUID
# get VPN connection ID openstack vpn ipsec site connection list | grep foo openstack vpn ipsec site connection list --long | grep <project_id> VPN_CONNECTION_ID=142dc25f-13bb-4fda-b093-edf13df98ed8 openstack vpn ipsec site connection show ${VPN_CONNECTION_ID} VPN_SERVICE_ID=$(openstack vpn ipsec site connection show ${VPN_CONNECTION_ID} -c 'VPN Service' -f value) openstack vpn service show ${VPN_SERVICE_ID} # get router ID ROUTER_ID=$(openstack vpn service show ${VPN_SERVICE_ID} -c Router -f value) echo "ROUTER_ID=${ROUTER_ID}"
Find the ctl Node where the active router is running
openstack port list --device-owner network:router_gateway -f value -c binding_host_id --router ${ROUTER_ID} # OR run on all ctl nodes run ip netns exec qrouter-<router_id> ip a s
Connect to that ctl node and "jump" in its neutron-l3-agent docker container
ssh ${CONTROL_NODE} docker exec -u root -ti neutron_l3_agent bash
4. Enable file logging in strongswan configuration
ROUTER_ID=b7ed736e-8f38-4be6-8ce4-644c5c7bfedf cp /var/lib/neutron/ipsec/${ROUTER_ID}/etc/strongswan.d/charon-logging.conf{,.org} sed -i "s|# <filename> {|/var/log/charon-${ROUTER_ID}.log {|g" /var/lib/neutron/ipsec/${ROUTER_ID}/etc/strongswan.d/charon-logging.conf sed -i "s|# append = yes|append = no|g" /var/lib/neutron/ipsec/${ROUTER_ID}/etc/strongswan.d/charon-logging.conf sed -i "s|# default = 1|default = 2|g" /var/lib/neutron/ipsec/${ROUTER_ID}/etc/strongswan.d/charon-logging.conf sed -i "s|# ike_name = no|ike_name = yes|g" /var/lib/neutron/ipsec/${ROUTER_ID}/etc/strongswan.d/charon-logging.conf sed -i "s|# time_add_ms = no|time_add_ms = yes|g" /var/lib/neutron/ipsec/${ROUTER_ID}/etc/strongswan.d/charon-logging.conf sed -i "s|# time_format =|time_format = %b %e %T|g" /var/lib/neutron/ipsec/${ROUTER_ID}/etc/strongswan.d/charon-logging.conf sed -i '0,/# }/s/# }/}/' /var/lib/neutron/ipsec/${ROUTER_ID}/etc/strongswan.d/charon-logging.conf
Restart the strongswan connection
ip netns exec qrouter-${ROUTER_ID} neutron-vpn-netns-wrapper --mount_paths="/etc:/var/lib/neutron/ipsec/${ROUTER_ID}/etc,/var/run:/var/lib/neutron/ipsec/${ROUTER_ID}/var/run" --cmd="ipsec,restart"
Debug VPN logs
# read log inside IP namespace tail -f /var/log/charon-${ROUTER_ID}.log # read log on crontrol node ROUTER_ID=b7ed736e-8f38-4be6-8ce4-644c5c7bfedf tail -f /var/lib/docker/overlay2/*/merged/var/log/charon-${ROUTER_ID}.log
Cleanup
# disable file logging mv /var/lib/neutron/ipsec/${ROUTER_ID}/etc/strongswan.d/charon-logging.conf{.org,} # restart strongswan again ip netns exec qrouter-${ROUTER_ID} neutron-vpn-netns-wrapper --mount_paths="/etc:/var/lib/neutron/ipsec/${ROUTER_ID}/etc,/var/run:/var/lib/neutron/ipsec/${ROUTER_ID}/var/run" --cmd="ipsec,restart" # delete logfile rm /var/log/charon-${ROUTER_ID}.log
Miscellaneous
SERVER_ID=$(openstack server list --all-project -f json | jq -r '.[] | select(."Name" == "'develop'") | .ID'); declare -p SERVER_ID NETWORK_ID=$(openstack port list --server ${SERVER_ID} -c network_id -f value); declare -p NETWORK_ID ROUTER_ID=$(openstack port list --network ${NETWORK_ID} --device-owner network:ha_router_replicated_interface -c device_id -f value); declare -p ROUTER_ID openstack router show "$ROUTER_ID" -f json PROJECT_ID=$(openstack router show "$ROUTER_ID" -f json | jq -r '.project_id') #list SUBNETS: openstack subnet list --project "PROJECT_ID" -c ID -f value | while read i; do openstack subnet show $i -c id -c name -c cidr -f json | jq -c .; done #list VPN SERVICES: openstack vpn service list --long -c ID -c Project -f value | awk "\$2 == \"PROJECT_ID\" {print \$1}" | while read i; do openstack vpn service show $i -c ID -c Name -c Router -c State -c Status -f json | jq -c .; done #list VPN ENDPOINT GROUPS: openstack vpn endpoint group list --long -c ID -c Project -f value | awk "\$2 == \"PROJECT_ID\" {print \$1}" | while read i; do openstack vpn endpoint group show $i -c ID -c Name -c Endpoints -f json | jq -c .; done #list VPN IPSEC SITE CONNECTIONS: openstack vpn ipsec site connection list --long -c ID -c Project -f value | awk "\$2 == \"PROJECT_ID\" {print \$1}" | while read i; do openstack vpn ipsec site connection show $i -c ID -c Name -c "Local Endpoint Group ID" -c "Peer Endpoint Group ID" -c "Peer Address" -c "Peer ID" -c State -c Status -f json | jq -c .; done #list L3 AGENTS: neutron l3-agent-list-hosting-router "$ROUTER_ID" #list IP ROUTES: pdsh -l root -w ctl[1-3] "ip netns exec qrouter-$ROUTER_ID ip r && ip a" | dshbak -c #list IPTABLES: pdsh -l root -w ctl[1-3] "ip netns exec qrouter-$ROUTER_ID iptables-save | sed -e 's/[\[0-9:\]*]//'" | dshbak -c