<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Many thanks guys:<br><br>I was too exited and I've loaded my setup again. Now I can ping my linux from the Cisco router. <br>It's exciting to have a VTI working on linux, it's the best way of setting up VPN's since we can easily setup a routing protocol on the overlay.<br><br><br><br>Indeed turning on the martian logs have revealed:<br><br>manowar python # tail -f /var/log/messages <br>Dec 19 09:51:32 manowar kernel: IPv4: martian source 10.0.0.1 from 10.0.0.2, on dev vti0<br>Dec 19 09:51:32 manowar kernel: ll header: 00000000: 52 83 87 99 0b d6 aa bb cc 00 65 00 08 00 45 00 R.........e...E.<br>Dec 19 09:51:32 manowar kernel: ll header: 00000010: 00 64 05 33 00 00 ff 01 a2 63 0a 00 00 02 0a 00 .d.3.....c......<br>Dec 19 09:51:32 manowar kernel: ll header: 00000020: 00 01 08 00 92 41 00 1c 00 33 00 00 00 00 05 79 .....A...3.....y<br>Dec 19 09:51:32 manowar kernel: ll header: 00000030: e6 40 ab cd <br><br>After that I did<br><br>manowar python # echo "0" > /proc/sys/net/ipv4/conf/vti0/rp_filter <br><br>Then I saw the traffic from 10.0.0.1 to 10.0.0.2 was in fact going in clear via my netio0 interface<br><br>I guess I was using <br><br>manowar strongswan_ikev2_vti # ip route list table 220<br>default via 10.1.1.254 dev netio0 proto static <br><br>Then I did <br><br>ip route del table 220 default<br><br><u><b>Question:</b></u> what is the use of that table 220? Do we have a CLI to avoid Strongswan installing that route? It's not necessary in case of VTI. It would be very nice to be able controlling it.<br><br>As of this stage I can ping from my Cisco router the linux box.<br><br>R101-HUB#clear crypto sa counters <br>R101-HUB#ping 10.0.0.1 repeat 100 <br>Type escape sequence to abort.<br>Sending 100, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:<br>!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!<br>!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!<br>Success rate is 100 percent (100/100), round-trip min/avg/max = 1/5/6 ms<br>R101-HUB#sh crypto session detail <br>Crypto session current status<br><br>Code: C - IKE Configuration mode, D - Dead Peer Detection <br>K - Keepalives, N - NAT-traversal, T - cTCP encapsulation <br>X - IKE Extended Authentication, F - IKE Fragmentation<br>R - IKE Auto Reconnect<br><br>Interface: Tunnel0<br>Profile: linux<br>Uptime: 00:30:28<br>Session status: UP-ACTIVE <br>Peer: 10.1.1.1 port 4500 fvrf: (none) ivrf: (none)<br> Phase1_id: 10.1.1.1<br> Desc: (none)<br> Session ID: 7 <br> IKEv2 SA: local 10.1.1.254/4500 remote 10.1.1.1/4500 Active <br> Capabilities:(none) connid:1 lifetime:23:29:32<br> IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0 <br> Active SAs: 2, origin: crypto map<br> Inbound: #pkts dec'ed 100 drop 0 life (KB/Sec) 4224917/1772<br> Outbound: #pkts enc'ed 100 drop 0 life (KB/Sec) 4224785/1772<br><br>Out of interest I did:<br><br>1) Create the VTI interface with mark32<br><br>ip tunnel add vti0 mode vti local 10.1.1.1 remote 10.1.1.254 okey 32 ikey 32<br>ip link set vti0 up<br>ip addr add 10.0.0.1/30 remote 10.0.0.2/30 dev vti0<br><br><br>2) Configure strongswan<br><br>conn VTI<br> keyexchange=ikev2<br> ike=aes256-sha1-modp1024<br> esp=aes256-sha1!<br> left=10.1.1.1<br> leftid=10.1.1.1<br> leftauth=psk<br> leftsubnet=0.0.0.0/0<br> rightauth=psk<br> right=10.1.1.254<br> rightid=10.1.1.254<br> rightsubnet=0.0.0.0/0<br> auto=start<br> mark=32<br> <br>3) Disable RP_filters on the vti0 intf <br><br> echo "0" > /proc/sys/net/ipv4/conf/vti0/rp_filter <br><br>4) Erase the default in the table 220 <br><br>ip route del table 220 default<br><br><br><br><br>Merry Xmas and Happy new year!<br><br>Olivier Pelerin<br><br><div><hr id="stopSpelling">From: olivier_pelerin@hotmail.com<br>To: schwarz@gaertner.de<br>Date: Fri, 19 Dec 2014 13:28:16 +0100<br>CC: users@lists.strongswan.org<br>Subject: Re: [strongSwan] Strongswan using VTI<br><br>
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">Interesting!<br><br>Let me try that out after Christmas!<br><br>Regards<br><br><div>> Date: Thu, 18 Dec 2014 17:15:07 +0100<br>> From: schwarz@gaertner.de<br>> To: olivier_pelerin@hotmail.com<br>> CC: avalentin@marcant.net; users@lists.strongswan.org<br>> Subject: Re: [strongSwan] Strongswan using VTI<br>> <br>> Hi,<br>> >>>>> "OP" == Olivier PELERIN <olivier_pelerin@hotmail.com> writes:<br>> <br>> OP> Tried to follow this kernel commit - it does not work<br>> <br>> OP> https://lists.ubuntu.com/archives/kernel-team/2013-November/034116.html<br>> <br>> OP> It seems utterly broken<br>> <br>> OP> From: olivier_pelerin@hotmail.com<br>> OP> To: avalentin@marcant.net; users@lists.strongswan.org<br>> OP> Date: Thu, 18 Dec 2014 10:11:23 +0100<br>> OP> Subject: Re: [strongSwan] Strongswan using VTI<br>> <br>> OP> Will try it out<br>> <br>> OP> When I strace my ping I'm getting (Resource temporarily unavailable) when we receive the echo-reply<br>> <br>> OP> sendmsg(3, {msg_name(16)={sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("10.0.0.2")}, msg_iov(1)=[{"\10\0\312\350Y\362\00096\231\222T\0\0\0\0K+\0\0\0\0\0\0\20\21\22\23\24\25\26\27"..., 64}], msg_controllen=32, {cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=, ...}, msg_flags=0}, 0) = 64<br>> OP> recvmsg(3, 0x7fff93401680, 0) = -1 EAGAIN (Resource temporarily unavailable)<br>> OP> gettimeofday({1418893623, 10985}, NULL) = 0<br>> OP> gettimeofday({1418893623, 11029}, NULL) = 0<br>> <br>> check your kernel parameter xfrm4_gc_thresh with:<br>> <br>> cat /proc/sys/net/ipv4/xfrm4_gc_thresh<br>> <br>> if you see 1024 or even 2048 as the result, it's way to low. bump it<br>> up with:<br>> <br>> echo 262144 > /proc/sys/net/ipv4/xfrm4_gc_thresh<br>> <br>> and check your ping/traceroute again. if you succseed, make your<br>> setting permanet and add<br>> <br>> net.ipv4.xfrm4_gc_thresh = 262144<br>> <br>> to /etc/sysctl.conf.<br>> kind regards, schwarz<br>> <br>> -- <br>> Gärtner Datensysteme GmbH & Co. KG Komplementärin:<br>> Gärtner Datensysteme<br>> Hamburger Str. 273a Tel. (0531) 2 33 55 55 Verwaltungs GmbH<br>> 38114 Braunschweig Fax (0531) 2 33 55 56<br>> Amtsgericht Braunschweig<br>> Amtsgericht Braunschweig HRA 200 848 HRB 202 115<br>> <br>> GmbH-Geschäftsführung:<br>> Christine Müller Martin Neitzel Ulrich Schwarz Dr. Stefan Gärtner<br></div> </div>
<br>_______________________________________________
Users mailing list
Users@lists.strongswan.org
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br><br><br></div> </div></body>
</html>