I'm trying to establish a VTI using strongSwan as an initiator, and am running
into some trouble. I've been able to use VTI's with strongSwan acting as a
responder (using a Cisco router as an initiator).
I'm running strongSwan 5.4.0 on Ubuntu 15.10 (Kernel 4.2.0-36-generic).
My ipsec.conf is configured as follows:
conn %default
authby=secret
keyexchange=ikev2
mobike=no
conn initiator
leftupdown=/usr/local/etc/vti.sh
authby=secret
keyexchange=ikev1
aggressive=yes
left=192.168.73.145
[email protected]
right=192.168.131.130
rightid=%any
ike=3des-md5-modp1024
esp=null-md5-noesn!
auto=add
For test purposes, I'm just bringing up the tunnel manually (ipsec up
initiator) and I'm using NULL encryption for easier debugging for now.
My /usr/local/etc/vti.sh up/down script looks as follows. I'm forcing the vti
name to be vti1 for consistency between tests:
#!/bin/bash
# VTI Interface gets name based on the unique ID passed in from strongSwan
#VTI_IF="vti${PLUTO_UNIQUEID}"
# Force it to use VTI1
VTI_IF="vti1"
# Private subnet
PRIVATE_SUBNET="10.1.1.0/24"
debug=/tmp/debug.txt
echo "PLUTO_VERB ${PLUTO_VERB}" > "$debug"
echo "VTI_IF ${VTI_IF}" >> "$debug"
echo "PLUTO_MARK_OUT ${PLUTO_MARK_OUT%%/*}" >> "$debug"
echo "PLUTO_MARK_IN ${PLUTO_MARK_IN%%/*}" >> "$debug"
echo "PLUTO_ME ${PLUTO_ME}" >> "$debug"
echo "PLUTO_PEER ${PLUTO_PEER}" >> "$debug"
case "${PLUTO_VERB}" in
up-host)
echo "up-host" >> "$debug"
# Create the tunnel from us to the peer using a "key" of the mark
from mark=<value> in ipsec.conf
#ip link add "${VTI_IF}" type vti key "${PLUTO_MARK_OUT%%/*}" local
"${PLUTO_ME}" remote "${PLUTO_PEER}" >> "$debug"
ip link add "${VTI_IF}" type vti local "${PLUTO_ME}" remote
"${PLUTO_PEER}" >> "$debug"
ip link set "${VTI_IF}" up >> "$debug"
ip addr add "${PLUTO_ME}" dev "${VTI_IF}" >> "$debug"
# Add any desired routes over the tunnel
ip route add "${PRIVATE_SUBNET}" dev "${VTI_IF}"
# Disable policy checks for this interface, otherwise the Kernel
will drop the traffic after decryption.
sysctl -w "net.ipv4.conf.${VTI_IF}.disable_policy=1" >> "$debug"
# Disable RP filter for the tunnel interface
sysctl -w "net.ipv4.conf.${VTI_IF}.rp_filter=0" >> "$debug"
;;
down-host)
ip link del "${VTI_IF}" >> "$debug"
ip route del "${PRIVATE_SUBNET}" >& /dev/null
;;
esac
I had to remove the "key" piece of the "ip link add" command, as the
PLUTO_MARK_OUT and
PLUTO_MARK_IN variables (which get set when responder) are not set.
My debug output shows the following variables getting set by strongSwan:
root@testclient:/tmp# more debug.txt
PLUTO_VERB up-host
VTI_IF vti1
PLUTO_MARK_OUT
PLUTO_MARK_IN
PLUTO_ME 192.168.73.145
PLUTO_PEER 192.168.131.130
up-host
net.ipv4.conf.vti1.disable_policy = 1
net.ipv4.conf.vti1.rp_filter = 0
With the above script and configuration, everything seems to come up just fine,
but I can't actually pass any traffic through the VTI. I see the error count
increment on the Linux interface:
vti1 Link encap:IPIP Tunnel HWaddr
inet addr:192.168.73.145 P-t-P:192.168.73.145
Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MTU:1332 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:7 dropped:0 overruns:0 carrier:7
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
What am I missing?
/Ryan
_______________________________________________
Users mailing list
[email protected]
https://lists.strongswan.org/mailman/listinfo/users
