title: Openstack how to properly activate vpnaas log?
body: <p>We have an openstack cluster build with openstack ansible, we are very happy with it. Actually i am trying to set an VPN. We have activate all necessary thing and tried successfully between our openstack and a sonicwall. We are trying now with a customer unfortunately the connection don't come up and i am looking to find some log but it seems that's nothing is logged.</p>
  <p>We are on Openstack Ussuri and Ubuntu 20.04</p>
  <p>We have activate Strongswan</p>
  <p>Below some config file:</p>
  <p>Controller-node:
  /etc/neutron/neutron.conf</p>
  <pre><code>[DEFAULT]
  # Disable stderr logging
  use_stderr = false
  debug = true
  publish_errors = true
  fatal_deprecations = False
  use_journal = True
  ## Rpc all
  executor_thread_pool_size = 64
  rpc_response_timeout = 60
  transport_url = hide
  # Domain to use for building hostnames
  dns_domain = openstacklocal
  # Agent
  
  [agent]
  polling_interval = 5
  report_interval = 60
  root_helper = sudo /openstack/venvs/neutron-21.0.0/bin/neutron-rootwrap 
  /etc/neutron/rootwrap.conf
  root_helper_daemon = sudo /openstack/venvs/neutron-21.0.0/bin/neutron- 
  rootwrap-daemon /etc/neutron/rootwrap.conf
  # Messaging
  
  [oslo_messaging_rabbit]
  ssl = True
  rpc_conn_pool_size = 30
  # Notifications
  
  [oslo_messaging_notifications]
  topics = notifications
  driver = messagingv2
  transport_url = hide
  # Concurrency (locking mechanisms)
  
  [oslo_concurrency]
  lock_path = /var/lock/neutron
  </code></pre>
  <p>/etc/neutron/l3_agent.ini:</p>
  <pre><code>[DEFAULT]
  debug = True
  # Drivers
  interface_driver = linuxbridge
  agent_mode = legacy
  # Conventional failover
  allow_automatic_l3agent_failover = True
  # HA failover
  ha_confs_path = /var/lib/neutron/ha_confs
  ha_vrrp_advert_int = 2
  ha_vrrp_auth_password = hide
  ha_vrrp_auth_type = PASS
  # Metadata
  enable_metadata_proxy = True
  # L3 plugins
  # VPNaaS
  
  [vpnagent]
  vpn_device_driver = neutron_vpnaas.services.vpn.device_drivers.strongswan_ipsec.StrongSwanDriver
  
  [AGENT]
  extensions = vpnaas
  </code></pre>
  <p>/etc/neutron/neutron_vpnaas.conf:</p>
  <pre><code>[service_providers]
  service_provider = VPN:strongswan:neutron_vpnaas.services.vpn.service_drivers.ipsec.IPsecVPNDriver:default
  </code></pre>
  <p>/etc/neutron/rootwrap.conf:</p>
  <pre><code>[DEFAULT]
  # List of directories to load filter definitions from (separated by ',').
  # These directories MUST all be only writeable by root !
  # List of directories to search executables in, in case filters do not
  # explicitely specify a full path (separated by ',')
  # If not specified, defaults to system PATH environment variable.
  # These directories MUST all be only writeable by root !
  # Enable logging to syslog
  # Default value is False
  use_syslog = False
  # Which syslog facility to use.
  # Valid values include auth, authpriv, syslog, local0, local1...
  # Default value is 'syslog'
  syslog_log_facility = syslog
  # Which messages to log.
  # INFO means log all usage
  # ERROR means only log unsuccessful attempts
  syslog_log_level = ERROR
  # Rootwrap daemon exits after this seconds of inactivity
  daemon_timeout = 600
  filters_path = /etc/neutron/rootwrap.d,/usr/share/neutron/rootwrap
  exec_dirs = /openstack/venvs/neutron- 21.0.0/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin
  
  [xenapi]
  # XenAPI configuration is only required by the L2 agent if it is to
  # target a XenServer/XCP compute host's dom0.
  xenapi_connection_url = &lt;None&gt;
  xenapi_connection_username = root
  xenapi_connection_password = &lt;None&gt;
  </code></pre>
  <p>/openstack/venvs/neutron-21.0.0/lib/python3.8/site-packages/neutron_vpnaas/services/vpn/device_drivers/template/strongswan/ipsec.conf.template:</p>
  <pre><code># Configuration for {{vpnservice.id}}
  config setup
    charondebug=&quot;ike 4, knl 4,net 4,enc 4,chd 4,esp 4,cfg 2,dmn 4,mgr 4,asn 4&quot;
  conn %default
          keylife=20m
          rekeymargin=3m
          keyingtries=1
          authby=psk
          mobike=no
  {% for ipsec_site_connection in vpnservice.ipsec_site_connections%}
  conn {{ipsec_site_connection.id}}
      keyexchange={{ipsec_site_connection.ikepolicy.ike_version}}
      left={{ipsec_site_connection.external_ip}}
      leftsubnet={{ipsec_site_connection['local_cidrs']|join(',')}}
      leftid={{ipsec_site_connection.local_id}}
      leftfirewall=yes
      right={{ipsec_site_connection.peer_address}}
      rightsubnet={{ipsec_site_connection['peer_cidrs']|join(',')}}
      rightid={{ipsec_site_connection.peer_id}}
      auto=route
      dpdaction={{ipsec_site_connection.dpd_action}}
      dpddelay={{ipsec_site_connection.dpd_interval}}s
      dpdtimeout={{ipsec_site_connection.dpd_timeout}}s
      ike={{ipsec_site_connection.ikepolicy.encryption_algorithm}}-{{ipsec_site_connection.ikepolicy.auth_algorithm}}-{{ipsec_site_connection.ikepolicy.pfs}}
      ikelifetime={{ipsec_site_connection.ikepolicy.lifetime_value}}s
      {%- if ipsec_site_connection.ipsecpolicy.transform_protocol == &quot;ah&quot; %}
      ah={{ipsec_site_connection.ipsecpolicy.auth_algorithm}}-{{ipsec_site_connection.ipsecpolicy.pfs}}
      {%- else %}
      esp={{ipsec_site_connection.ipsecpolicy.encryption_algorithm}}-{{ipsec_site_connection.ipsecpolicy.auth_algorithm}}-{{ipsec_site_connection.ipsecpolicy.pfs}}
      {%- endif %}
      lifetime={{ipsec_site_connection.ipsecpolicy.lifetime_value}}s
      type={{ipsec_site_connection.ipsecpolicy.encapsulation_mode}}
  {% endfor %}
  </code></pre>
  <p>If someone can help me to activate log that's will be great</p>
  <p>Thanks</p>