On Tue, Feb 14, 2023 at 6:40 PM Gavin McKee via discuss <ovs-discuss@openvswitch.org> wrote: > > Hi Numan, > > I'd be happy to start with static routes , as long as I can get the > connectivity in place i.e. be able to connect a VM on a logical switch to a > VM in a public cloud via IPSEC tunnel.
so you're trying to connect an OVN deployment on one end and a public cloud on the other. Looks to me you may need to establish an IPSEC tunnel yourself. One end of the tunnel should be your gateway node in OVN deployment and other end your public cloud. For North/South gateway traffic to work with OVN, you need to configure ovn-bridge-mappings on the gateway node. OVN will create a patch port from br-int to the provider ovs bridge (lets say br-ex). And it is expected that br-ex would be attached with a physical nic which would provide connectivity to the external. Seems to me you need to establish the IPSEC tunnel in br-ex as this is out of OVN's scope. Thanks Numan > > Gav > > On Tue, Feb 14, 2023 at 3:28 PM Numan Siddique <num...@ovn.org> wrote: >> >> Looks like this would require BGP to exchange the routes ? >> >> I'm not sure. I may be wrong. Adding @Daniel Alvarez Sanchez if he >> has any comments as he worked on supporting BGP in Openstack with OVN. >> >> Thanks >> Numan >> >> >> On Tue, Feb 14, 2023 at 1:50 PM Gavin McKee via discuss >> <ovs-discuss@openvswitch.org> wrote: >> > >> > Satish, >> > >> > We are using the Mellanox Connect X6 card / possibly we can use bluefield2 >> > card to do IPSEC hardware offload . So somehow we could build a tunnel to >> > a server with StrongSwan IPSEC . The key thing is to tie this IPSEC >> > interface into the OVN/OVS setup and somehow associate it with a >> > customer's virtual router. >> > >> > Am I even thinking off this the correct way? >> > >> > Gav >> > >> > >> > On Tue, Feb 14, 2023 at 7:15 AM Satish Patel <satish....@gmail.com> wrote: >> >> >> >> Seems like OVN does support IPsec tunnel based on doc but may need to >> >> figure out how to integrate with your use case [1] >> >> >> >> [1] https://docs.ovn.org/en/latest/tutorials/ovn-ipsec.html >> >> >> >> On Tue, Feb 14, 2023 at 8:20 AM Gavin McKee via discuss >> >> <ovs-discuss@openvswitch.org> wrote: >> >>> >> >>> Hi , >> >>> >> >>> Is it possible to connect an IPSEC tunnel from a Public cloud provider >> >>> such as Azure, AWS / GCP to an OVN logical router ? >> >>> >> >>> I need to be able to route between a subnet in Azure / GCP and a subnet >> >>> in OVN? >> >>> >> >>> Has anyone been able to achieve this , and if so can you provide an >> >>> example configuration ? >> >>> >> >>> Gav >> >>> >> >>> >> >>> Disclaimer >> >>> >> >>> The information contained in this communication from the sender is >> >>> confidential. It is intended solely for use by the recipient and others >> >>> authorized to receive it. If you are not the recipient, you are hereby >> >>> notified that any disclosure, copying, distribution or taking action in >> >>> relation of the contents of this information is strictly prohibited and >> >>> may be unlawful. >> >>> >> >>> _______________________________________________ >> >>> discuss mailing list >> >>> disc...@openvswitch.org >> >>> https://mail.openvswitch.org/mailman/listinfo/ovs-discuss >> > >> > >> > >> > Disclaimer >> > >> > The information contained in this communication from the sender is >> > confidential. It is intended solely for use by the recipient and others >> > authorized to receive it. If you are not the recipient, you are hereby >> > notified that any disclosure, copying, distribution or taking action in >> > relation of the contents of this information is strictly prohibited and >> > may be unlawful. >> > >> > _______________________________________________ >> > discuss mailing list >> > disc...@openvswitch.org >> > https://mail.openvswitch.org/mailman/listinfo/ovs-discuss > > > > Disclaimer > > The information contained in this communication from the sender is > confidential. It is intended solely for use by the recipient and others > authorized to receive it. If you are not the recipient, you are hereby > notified that any disclosure, copying, distribution or taking action in > relation of the contents of this information is strictly prohibited and may > be unlawful. > > _______________________________________________ > discuss mailing list > disc...@openvswitch.org > https://mail.openvswitch.org/mailman/listinfo/ovs-discuss _______________________________________________ discuss mailing list disc...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-discuss
