Errors — neutron-vpnaas — branch stable/2026.2
Branch
stable/2026.2@6ce5da102cf1— repository https://opendev.org/openstack/neutron-vpnaas — analysed on 2026-10-29.neutron-lib:= neutron-libstable/2026.2@1ee72052251a;neutron:= neutronstable/2026.2@eef1a0f7ee36.
Exception → HTTP translation
neutron-vpnaas defines few exceptions of its own; most come from neutron-lib:neutron_lib/exceptions/vpn.py. All derive from NeutronException. Neutron's resource wrapper maps them with FAULT_MAP (neutron-lib:neutron_lib/api/faults.py:19-29): NotFound → 404, Conflict → 409, **InUse → 409**, BadRequest (and InvalidInput) → 400, ServiceUnavailable → 503, NotAuthorized and PolicyNotAuthorized → 403, netaddr.AddrFormatError → 400. Anything else (AttributeError, DB errors, oslo_policy check failures) becomes a 500 with a generic message.
The body is always:
{"NeutronError": {"type": "<exception class name>", "message": "<formatted message>", "detail": ""}}type is the class name (or HTTPBadRequest for attribute-map validation, PolicyNotAuthorized for a policy refusal, HTTPNotFound when the policy hides a resource). Every row marked observed below was produced by _rewrite/tools/vpnaas_capture.py through the real WSGI pipeline; the full list with messages is _rewrite/observed-errors_stable-2026.2.md.
Policy refusals: a create/update/delete refused by policy → 403 PolicyNotAuthorized (rule:create_ikepolicy is disallowed by policy, observed); a get of a resource of another project, or by a user without the member role, → 404 (the resource is hidden; observed for a reader).
Catalogue
Validation errors produced by the attribute map (400)
| Message (template) | Situation | Raised at | Seen by the client as |
|---|---|---|---|
Invalid input for <attr>. Reason: <value> is not in valid_values. | value outside the effective lists (01 § Effective attribute validation), e.g. sha1, 3des, **aes-128-ctr**, group1 | neutron-lib:neutron_lib/api/definitions/vpn_no_sha1_3des.py:44-89 (lists), neutron:neutron/api/v2/base.py (check) | 400 HTTPBadRequest (observed) |
Invalid input for lifetime. Reason: '59' is too small - must be at least '60'. | lifetime.value < 60 | neutron-lib:neutron_lib/api/definitions/vpn.py:228 | 400 (observed) |
Invalid input for lifetime. Reason: kilobytes is not in valid_values. | lifetime.units other than seconds (the DB enum also has kilobytes, neutron_vpnaas/db/vpn/vpn_models.py:79-81) | neutron-lib:neutron_lib/api/definitions/vpn.py:129-131 | 400 (observed) |
Unrecognized attribute(s) '<name>' | unknown key in the body | Neutron base controller | 400 (observed) |
Cannot update read-only attribute <attr> | PUT of endpoints, type, router_id, vpnservice_id, policies' ids… | attribute map allow_put: false | 400 (observed) |
VPN exceptions (neutron-lib)
| Exception | HTTP | Message (template) | Situation | Raised at | Seen by the client as |
|---|---|---|---|---|---|
| VPNServiceNotFound | 404 | VPNService %(vpnservice_id)s could not be found | the service does not exist or belongs to another project (GET/PUT/DELETE, or vpnservice_id of a new connection) | neutron_vpnaas/db/vpn/vpn_db.py:81 | 404 |
| IPsecSiteConnectionNotFound | 404 | ipsec_site_connection %(ipsec_site_conn_id)s not found | same for connections | neutron_vpnaas/db/vpn/vpn_db.py:72 | 404 |
| IKEPolicyNotFound | 404 | IKEPolicy %(ikepolicy_id)s could not be found | unknown or foreign IKE policy, also ikepolicy_id of a new connection | neutron_vpnaas/db/vpn/vpn_db.py:76 | 404 (observed) |
| IPsecPolicyNotFound | 404 | IPsecPolicy %(ipsecpolicy_id)s could not be found | same for IPsec policies | neutron_vpnaas/db/vpn/vpn_db.py:78 | 404 |
| VPNEndpointGroupNotFound | 404 | Endpoint group %(endpoint_group_id)s could not be found | unknown group (GET/PUT/DELETE, or referenced by a connection) | neutron_vpnaas/db/vpn/vpn_db.py:83 | 404 |
| IPsecSiteConnectionDpdIntervalValueError | 400 | ipsec_site_connection %(attr)s is equal to or less than dpd_interval | dpd.timeout ≤ dpd.interval | neutron_vpnaas/db/vpn/vpn_validator.py:59 | 400 (observed) |
| IPsecSiteConnectionMtuError | 400 | ipsec_site_connection MTU %(mtu)d is too small for ipv%(version)s | MTU < 68 (IPv4) or < 1280 (IPv6) | neutron_vpnaas/db/vpn/vpn_validator.py:64 | 400 (observed) |
| IPsecSiteConnectionPeerCidrError | 400 | ipsec_site_connection peer cidr %(peer_cidr)s is invalid CIDR | legacy mode, a peer_cidrs entry is not a CIDR (normally caught earlier by the attribute map) | neutron_vpnaas/db/vpn/vpn_validator.py:145 | 400 |
| IKEPolicyInUse | 409 | IKEPolicy %(ikepolicy_id)s is in use by existing IPsecSiteConnection and can't be updated or deleted | PUT or DELETE of an IKE policy referenced by a connection | neutron_vpnaas/db/vpn/vpn_db.py:351, neutron_vpnaas/db/vpn/vpn_db.py:368 | 409 (observed) |
| IPsecPolicyInUse | 409 | IPsecPolicy %(ipsecpolicy_id)s is in use by existing IPsecSiteConnection and can't be updated or deleted | same for IPsec policies | neutron_vpnaas/db/vpn/vpn_db.py:435, neutron_vpnaas/db/vpn/vpn_db.py:453 | 409 (observed) |
| VPNServiceInUse | 409 | VPNService %(vpnservice_id)s is still in use | DELETE of a service that still has connections | neutron_vpnaas/db/vpn/vpn_db.py:542 | 409 (observed) |
| SubnetInUseByVPNService | 409 | Subnet %(subnet_id)s is used by VPNService %(vpnservice_id)s | remove_router_interface of the subnet a legacy service is bound to | neutron_vpnaas/db/vpn/vpn_db.py:583 (callback neutron_vpnaas/db/vpn/vpn_db.py:779-781) | 409 on PUT /v2.0/routers/{id}/remove_router_interface (observed) |
| SubnetInUseByIPsecSiteConnection | 409 | Subnet %(subnet_id)s is used by ipsec site connection %(ipsec_site_connection_id)s | remove_router_interface of a subnet listed in a connection's local endpoint group | neutron_vpnaas/db/vpn/vpn_db.py:606 | 409 on the router API (observed) |
| SubnetInUseByEndpointGroup | 409 | Subnet %(subnet_id)s is used by endpoint group %(group_id)s | DELETE /v2.0/subnets/{id} of a subnet in a subnet endpoint group | neutron_vpnaas/db/vpn/vpn_db.py:622 (callback neutron_vpnaas/db/vpn/vpn_db.py:793-799) | wrapped by Neutron into 409 SubnetInUse Unable to complete operation on subnet …: Callback neutron_vpnaas.db.vpn.vpn_db.subnet_callback-<n> failed with "…" (observed) |
| VPNStateInvalidToUpdate | 400 | Invalid state %(state)s of vpnaas resource %(id)s for updating | PUT of a service or connection in PENDING_CREATE (or any PENDING_*) | neutron_vpnaas/db/vpn/vpn_db.py:92 | 400 (observed, service and connection) |
| DeviceDriverImportError | 500 | Can not load driver :%(device_driver)s | agent start: a [vpnagent] vpn_device_driver class cannot be imported | neutron_vpnaas/services/vpn/vpn_service.py:44 | agent fails to start (log) |
| SubnetIsNotConnectedToRouter | 400 | Subnet %(subnet_id)s is not connected to Router %(router_id)s | service subnet_id, or a local endpoint-group subnet, has no port on the router | neutron_vpnaas/db/vpn/vpn_validator.py:287 | 400 (observed) |
| RouterIsNotExternal | 400 | Router %(router_id)s has no external network gateway set | POST vpnservice on a router without gateway | neutron_vpnaas/db/vpn/vpn_validator.py:278 | 400 (observed) |
| VPNPeerAddressNotResolved | 400 | Peer address %(peer_address)s cannot be resolved | peer_address is neither an IP nor a resolvable FQDN on the API server | neutron_vpnaas/db/vpn/vpn_validator.py:92 | 400 (observed) |
| VPNPeerAddressNotResolved (agent) | — | same | Libreswan _get_nexthop would set the connection ERROR and raise when the FQDN cannot be resolved — but no code calls _get_nexthop (dead code) | neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py:274 | never |
| ExternalNetworkHasNoSubnet | 400 | Router's %(router_id)s external network has no %(ip_version)s subnet | the router gateway has no fixed IP of the peer's IP version | neutron_vpnaas/db/vpn/vpn_validator.py:78 | 400 (observed) |
| InvalidEndpointInEndpointGroup | 400 | Endpoint '%(endpoint)s' is invalid for group type '%(group_type)s': %(why)s | duplicate endpoint (Endpoints have to be unique), invalid CIDR (Invalid CIDR), non-UUID subnet (Invalid UUID) | neutron_vpnaas/db/vpn/vpn_validator.py:352, neutron_vpnaas/db/vpn/vpn_validator.py:310, neutron_vpnaas/db/vpn/vpn_validator.py:319 | 400 (observed for the first two) |
| MissingEndpointForEndpointGroup | 400 | No endpoints specified for endpoint group '%(group)s' | empty endpoints; %(group)s is the whole request dict | neutron_vpnaas/db/vpn/vpn_validator.py:337 | 400 (observed) |
| NonExistingSubnetInEndpointGroup | 400 | Subnet %(subnet)s in endpoint group does not exist | a subnet endpoint is not a visible subnet | neutron_vpnaas/db/vpn/vpn_validator.py:325 | 400 (observed) |
| MixedIPVersionsForIPSecEndpoints | 400 | Endpoints in group %(group)s do not have the same IP version, as required for IPSec site-to-site connection | a local or peer group mixes IPv4 and IPv6 | neutron_vpnaas/db/vpn/vpn_validator.py:123, neutron_vpnaas/db/vpn/vpn_validator.py:136 | 400 |
| MixedIPVersionsForPeerCidrs | 400 | Peer CIDRs do not have the same IP version, as required for IPSec site-to-site connection | legacy peer_cidrs mix versions | neutron_vpnaas/db/vpn/vpn_validator.py:154 | 400 |
| MixedIPVersionsForIPSecConnection | 400 | IP versions are not compatible between peer and local endpoints | local side and peer side differ | neutron_vpnaas/db/vpn/vpn_validator.py:164 | 400 (observed) |
| InvalidEndpointGroup | 400 | Endpoint group%(suffix)s %(which)s cannot be specified, when VPN Service has subnet specified | endpoint group given for a legacy (subnet) service | neutron_vpnaas/db/vpn/vpn_validator.py:190 | 400 |
| WrongEndpointGroupType | 400 | Endpoint group %(which)s type is '%(group_type)s' and should be '%(expected)s' | local group not subnet, or peer group not cidr | neutron_vpnaas/db/vpn/vpn_validator.py:100, neutron_vpnaas/db/vpn/vpn_validator.py:109 | 400 (observed) |
| PeerCidrsInvalid | 400 | Peer CIDRs cannot be specified, when using endpoint groups | peer_cidrs given for an endpoint-group service (POST or PUT) | neutron_vpnaas/db/vpn/vpn_validator.py:194 | 400 (observed) |
| MissingPeerCidrs | 400 | Missing peer CIDRs for IPsec site-to-site connection | legacy service, no peer_cidrs | neutron_vpnaas/db/vpn/vpn_validator.py:181 | 400 (observed) |
| MissingRequiredEndpointGroup | 400 | Missing endpoint group%(suffix)s %(which)s for IPSec site-to-site connection | endpoint-group service, a group missing | neutron_vpnaas/db/vpn/vpn_validator.py:203 | 400 (observed) |
| EndpointGroupInUse | 400 | Endpoint group %(group_id)s is in use and cannot be deleted | DELETE of a group referenced by a connection — a BadRequest, unlike the other "in use" errors (409) | neutron_vpnaas/db/vpn/vpn_db.py:693 | 400 (observed) |
| IpsecValidationFailure | 400 | IPSec does not support %(resource)s attribute %(key)s with value '%(value)s' | legacy driver: connection with an ah-esp IPsec policy. Raised from the local class neutron_vpnaas/services/vpn/service_drivers/ipsec_validator.py:21, not the neutron-lib one (neutron-lib:neutron_lib/exceptions/vpn.py:174) | neutron_vpnaas/services/vpn/service_drivers/ipsec_validator.py:37 | 400 (observed, legacy); never on OVN |
| FlavorsPluginNotLoaded / NoProviderFoundForFlavor (neutron-lib copies) | 404 | — | not raised: neutron-vpnaas raises its own copies, below | neutron-lib:neutron_lib/exceptions/vpn.py:165-170 | — |
Exceptions defined in neutron-vpnaas
| Exception | HTTP | Message (template) | Situation | Raised at | Seen by the client as |
|---|---|---|---|---|---|
RouteInUseByVPN (InUse) | 409 | Route(s) to %(destinations)s are used for VPN | OVN: router update or remove_extraroutes that removes a route whose destination is a VPN peer CIDR (PRECOMMIT_UPDATE callback) | neutron_vpnaas/services/vpn/service_drivers/ovn_ipsec.py:154 (class neutron_vpnaas/extensions/vpnaas.py:29) | 409 on the router API (observed) |
VPNGatewayNotReady (BadRequest) | (retried) | VPN gateway not ready | OVN: another request is creating or deleting the router's VPN gateway; wrapped in RetryRequest, so oslo.db retries the transaction (neutron_vpnaas/services/vpn/service_drivers/ovn_ipsec.py:369) | class neutron_vpnaas/extensions/vpnaas.py:37 | normally invisible; 400 after the retries are exhausted [inferred] |
VPNGatewayInError (Conflict) | 409 | VPN gateway is in ERROR state. Please remove all errored VPN services and try again. | OVN: the router's vpn_ext_gws row is ERROR (a previous gateway setup or cleanup failed) | neutron_vpnaas/services/vpn/service_drivers/ovn_ipsec.py:363 | 409; the service row is kept with ERROR |
NoVPNAgentAvailable (ServiceUnavailable) | 503 | No VPN agent available | OVN: the scheduler returned None (another server bound the router concurrently) | neutron_vpnaas/services/vpn/service_drivers/ovn_ipsec.py:377 | 503; service row kept with ERROR |
RouterIsNotVPNExternal (BadRequest) | 400 | Router %(router_id)s has no VPN external network gateway set | OVN: the VPN gateway has no gateway port / fixed IPs when the service IPs are computed | neutron_vpnaas/services/vpn/service_drivers/ovn_ipsec.py:332 (class neutron_vpnaas/db/vpn/vpn_ext_gw_db.py:41) | 400, service row kept with ERROR |
RouterHasVPNExternal (BadRequest) | 400 | Router %(router_id)s already has VPN external network gateway | never raised (dead code) | neutron_vpnaas/db/vpn/vpn_ext_gw_db.py:45 | — |
VPNNetworkInUse (NetworkInUse → InUse) | 409 | Network %(network_id)s is used by VPN service | OVN: DELETE /v2.0/networks/{id} of a transit network still referenced by an active VPN gateway | neutron_vpnaas/db/vpn/vpn_ext_gw_db.py:165 | 409 on the network API |
| ServicePortInUse (neutron-lib) | 409 | Port %(port_id)s cannot be deleted directly via the port API: %(reason)s with reason has device owner network:vpn_router_gateway / network:vpn_namespace | OVN: DELETE /v2.0/ports/{id} of a VPN gateway or namespace port | neutron_vpnaas/db/vpn/vpn_ext_gw_db.py:138 | 409 (observed) |
| SubnetInUse (neutron-lib) | 409 | Unable to complete operation on subnet …: Subnet is used by VPN service | OVN: DELETE /v2.0/subnets/{id} of a transit subnet | neutron_vpnaas/db/vpn/vpn_ext_gw_db.py:152 | 409 |
| RouterInUse (neutron-lib l3) | 409 | Router %(router_id)s is currently used by VPN service%(plural)s (%(services)s) | legacy only: clearing the router gateway (ROUTER_GATEWAY BEFORE_DELETE) or migrating the router (ROUTER BEFORE_UPDATE) while a VPN service uses it. On OVN check_router_in_use is a no-op (neutron_vpnaas/services/vpn/ovn_plugin.py:53-54) and the gateway can be cleared (observed 200) | neutron_vpnaas/db/vpn/vpn_db.py:571 | 409 legacy (observed) |
FlavorsPluginNotLoaded (NotFound) | 404 | Flavors plugin not found | flavor_id given but the flavors plugin is absent | neutron_vpnaas/services/vpn/plugin.py:132 (class neutron_vpnaas/extensions/vpn_flavors.py:23) | 404 |
| InvalidServiceType (neutron-lib) | 400 | Invalid service type %(service_type)s. | the flavor is not a VPN flavor | neutron_vpnaas/services/vpn/plugin.py:136 | 400 |
| FlavorDisabled (neutron-lib) | 503 | Flavor is not enabled. | the flavor is disabled | neutron_vpnaas/services/vpn/plugin.py:139 | 503 |
NoProviderFoundForFlavor (NotFound) | 404 | No service provider found for flavor %(flavor_id)s | the flavor's first provider is not a configured VPN driver | neutron_vpnaas/services/vpn/plugin.py:144 (class neutron_vpnaas/extensions/vpn_flavors.py:27) | 404 |
| FlavorNotFound (neutron-lib, via the flavors plugin) | 404 | Flavor %(flavor_id)s could not be found. | unknown flavor_id | flavors plugin get_flavor (called at neutron_vpnaas/services/vpn/plugin.py:134) | 404 (observed) |
InvalidVPNAgent (AgentNotFound) | 404 | Agent %(id)s is not a VPN Agent or has been disabled | POST /agents/{id}/vpn-routers with a non-VPN agent | neutron_vpnaas/db/vpn/vpn_agentschedulers_db.py:139 (class neutron_vpnaas/extensions/vpn_agentschedulers.py:145) | 404 (observed) |
RouterHostedByVPNAgent (Conflict) | 409 | The VPN service of router %(router_id)s has been already hosted by the VPN Agent %(agent_id)s. | manual binding of a router already hosted by another agent | neutron_vpnaas/db/vpn/vpn_agentschedulers_db.py:160 | 409 |
RouterSchedulingFailed (Conflict) | 409 | Failed scheduling router %(router_id)s to the VPN Agent %(agent_id)s. | manual binding: INSERT failed (duplicate or router deleted concurrently) | neutron_vpnaas/db/vpn/vpn_agentschedulers_db.py:203 | 409 |
RouterReschedulingFailed (Conflict) | 409 | Failed rescheduling router %(router_id)s: No eligible VPN agent found. | (a) OVN POST vpnservices with no live VPN agent; (b) dead-agent rescheduling with no candidate; (c) vpnservice_added_to_agent failed after a reschedule | neutron_vpnaas/scheduler/vpn_agent_scheduler.py:114, neutron_vpnaas/db/vpn/vpn_agentschedulers_db.py:283 | (a) 409 + service kept with ERROR (observed); (b, c) log only |
| PolicyCheckError (oslo.policy, via Neutron) | 500 | Failed to check policy project_id:%(project_id)s because Unable to verify match:%(project_id)s as the parent resource: project was not found. | non-admin calls a vpn-routers/vpn-agents operation: no rule registered, default = admin_or_owner evaluated on an empty target | neutron_vpnaas/extensions/vpn_agentschedulers.py:52 | 500 (observed) instead of 403 |
| HTTPInternalServerError | 500 | Request Failed: internal server error while processing your request. | the six scheduler routes generated by Routes without a controller method (01 § Summary) | neutron_vpnaas/extensions/vpn_agentschedulers.py:40 (controller without show/update) | 500 (observed) |
AttributeError (vpnaas.VPNStateInvalidToUpdate) | 500 | — | set_vpnservice_status on a pending service without updated_pending_status refers to a class that does not exist in neutron_vpnaas.extensions.vpnaas | neutron_vpnaas/db/vpn/vpn_db.py:522 | 500 [inferred: unreachable with the current single caller] |
| SystemExit | — | Delete associated vpnservices %(vpnservices)s before removing providers %(providers)s. | server start: a VPN service is associated with a provider that is no longer configured | neutron_vpnaas/services/vpn/plugin.py:111 | neutron-server does not start |
Asynchronous errors
These never reach the API caller; they show up as statuses, logs or missing tunnels.
| Situation | Where | Visible as |
|---|---|---|
The agent cannot render or start the daemon (RuntimeError from a command) | neutron_vpnaas/services/vpn/device_drivers/ipsec.py:342-364 | LOG.exception("Failed to enable vpn process on router %s"); the status stays as reported (usually DOWN) |
ipsec status / whack --status exits 1 or 3 (daemon not running) | neutron_vpnaas/services/vpn/device_drivers/ipsec.py:388-390 (Libreswan pattern), neutron_vpnaas/services/vpn/device_drivers/strongswan_ipsec.py:196-198 | every connection DOWN, service DOWN |
| A connection disappears from the daemon output (admin down, deleted) while the cache knew it | neutron_vpnaas/services/vpn/device_drivers/ipsec.py:738-752 | that connection reported DOWN with updated_pending_status=True |
update_status RPC fails (server down, timeout) | neutron_vpnaas/services/vpn/device_drivers/ipsec.py:808-811 | MessagingTimeout after rpc_response_timeout in the looping call; the local cache was already updated before the call (neutron_vpnaas/services/vpn/device_drivers/ipsec.py:801-806), so the change is not re-sent unless the status changes again [inferred from the order of statements] |
update_status for a deleted service | neutron_vpnaas/db/vpn/vpn_db.py:753-759 | LOG.warning('vpnservice %s in db is already deleted'), ignored |
update_status for a deleted connection | neutron_vpnaas/db/vpn/vpn_db.py:293-296 | silently ignored |
| Dead VPN agent with no live replacement (OVN) | neutron_vpnaas/db/vpn/vpn_agentschedulers_db.py:106-113 | LOG.exception("Failed to reschedule vpn services for router %s"); binding already deleted, router unhosted [inferred: reschedule_router deletes the binding before scheduling, inside one transaction rolled back by the exception] |
| Any exception in the rescheduling loop | neutron_vpnaas/db/vpn/vpn_agentschedulers_db.py:114-118 | LOG.exception("Exception encountered during vpn service rescheduling."); retried next period |
| OVN VPN gateway creation fails (port, subnet, router interface) | neutron_vpnaas/services/vpn/service_drivers/ovn_ipsec.py:390-401 | vpn_ext_gws.status = ERROR, service ERROR, API error returned; blocks later services on that router (VPNGatewayInError) |
| OVN VPN gateway cleanup fails | neutron_vpnaas/services/vpn/service_drivers/ovn_ipsec.py:418-423 | LOG.exception("Cleanup of VPN gateway for router %s failed."), gateway ERROR |
| OVN agent cannot plug a port | neutron_vpnaas/services/vpn/device_drivers/ovn_ipsec.py:136-138, neutron_vpnaas/services/vpn/device_drivers/ovn_ipsec.py:169-171 | LOG.exception('plug external port %s failed') / ('plug internal port %s failed'); the sync continues without the interface [inferred: tunnel DOWN] |
| netns wrapper refuses a command | neutron_vpnaas/services/vpn/common/netns_wrapper.py:106-109 | exit code EPERM (1), Unauthorized command: … (no filter matched); the agent sees RuntimeError |
| netns wrapper run outside a namespace | neutron_vpnaas/services/vpn/common/netns_wrapper.py:136-139 | exit EINVAL, Cannot run without netns, exiting |
vpnservice_added_to_agent call fails twice | neutron_vpnaas/api/rpc/agentnotifiers/vpn_rpc_agent_api.py:50-52 | manual binding: exception → 500 [inferred]; reschedule: binding removed + RouterReschedulingFailed |
Key log messages
| Level | Message | Situation | Where |
|---|---|---|---|
| ERROR (exception) | Delete associated vpnservices %(vpnservices)s before removing providers %(providers)s. | provider removed from config | neutron_vpnaas/services/vpn/plugin.py:110 |
| INFO | VPN plugin using service drivers: %(service_drivers)s, default: %(default_driver)s | server start | neutron_vpnaas/services/vpn/plugin.py:70 |
| INFO | Associating VPN services %(unasso_vpnservices)s to default provider %(default_provider)s. | upgrade from an old schema | neutron_vpnaas/services/vpn/plugin.py:119 |
| WARNING | vpnservice %s in db is already deleted | status report for a deleted service | neutron_vpnaas/db/vpn/vpn_db.py:757 |
| ERROR (exception) | Setting up the VPN gateway for router %s failed. | OVN create failure | neutron_vpnaas/services/vpn/service_drivers/ovn_ipsec.py:429 |
| ERROR (exception) | Cleanup of VPN gateway for router %s failed. | OVN delete failure | neutron_vpnaas/services/vpn/service_drivers/ovn_ipsec.py:419 |
| WARNING | Rescheduling vpn services for router %(router)s from agent %(agent)s because the agent is not alive. | dead OVN VPN agent | neutron_vpnaas/db/vpn/vpn_agentschedulers_db.py:101 |
| ERROR (exception) | Failed to reschedule vpn services for router %s | reschedule failure | neutron_vpnaas/db/vpn/vpn_agentschedulers_db.py:112 |
| WARNING | No active VPN agents | scheduling with no candidate | neutron_vpnaas/scheduler/vpn_agent_scheduler.py:90 |
| WARNING | No unscheduled routers compatible with VPN agent configuration on host %s | AZ scheduler auto-schedule | neutron_vpnaas/scheduler/vpn_agent_scheduler.py:79 |
| ERROR (exception) | Failed to enable vpn process on router %s / Failed to disable vpn process on router %s | agent command failure | neutron_vpnaas/services/vpn/device_drivers/ipsec.py:351, neutron_vpnaas/services/vpn/device_drivers/ipsec.py:361 |
| WARNING | Server appears to still be running, restart of router %s may fail | Libreswan restart, pluto still alive after the retries | neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py:256 |
| ERROR | Process %(pid)s exists with command line %(cmd_line)s. | Libreswan, pluto still running (logged at ERROR although informational) | neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py:194 |
| INFO | Connection to OVSDB established, doing a full sync | OVN agent: own Chassis_Private re-created (ovn-controller restart / reconnection) | neutron_vpnaas/agent/ovn/vpn/agent.py:61 |
| INFO | process %s is destroyed | OVN agent destroys a namespace | neutron_vpnaas/services/vpn/device_drivers/ovn_ipsec.py:264 |
| ERROR | Unauthorized command: %(cmd)s (no filter matched) | netns wrapper rootwrap filter | neutron_vpnaas/services/vpn/common/netns_wrapper.py:107 |
| INFO / ERROR | %(new_path)s has been bind-mounted in %(path)s / Failed to bind-mount %(new_path)s in %(path)s | netns wrapper | neutron_vpnaas/services/vpn/common/netns_wrapper.py:149, neutron_vpnaas/services/vpn/common/netns_wrapper.py:153 |
Errors that are not exceptions
- **
ipsecbinary exit codes**:ipsec status(strongSwan) andipsec whack --status(Libreswan) are run withextra_ok_codes=[1, 3](neutron_vpnaas/services/vpn/device_drivers/strongswan_ipsec.py:196-198,neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py:239-241); the netns wrapper printsCommand: … Exit code: N …(neutron_vpnaas/services/vpn/common/netns_wrapper.py:66-71), and that line is matched bySTATUS_NOT_RUNNING_REto mean "daemon not running". Any other non-zero code raisesRuntimeErrorin the agent. - Resource statuses:
ERRORon services (OVN create failure); connections only getERRORif an agent reports it, which no reachable code path does (neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py:272is in dead code);DOWNfor every non-established tunnel. - Timeouts:
vpnservice_added_to_agentis acallretried twice (neutron_vpnaas/api/rpc/agentnotifiers/vpn_rpc_agent_api.py:21-23), so a dead agent blocks the API request up to ~2 ×rpc_response_timeout(60 s by default). The agent'sget_vpn_services_on_hostandupdate_statuscalls raiseMessagingTimeoutafter the same timeout.
Source: reverse-spec-neutron-vpnaas/02-errors_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.