<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Any ideas why ipv6 GRE is sent in clear?<br><br><div><hr id="stopSpelling">From: olivier_pelerin@hotmail.com<br>To: users@lists.strongswan.org<br>Date: Fri, 19 Dec 2014 13:27:16 +0100<br>Subject: [strongSwan] ipv6 GRE sent in clear instead of getting encrypted<br><br>
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">Hello Strongswan Alias,<br><br>I've the following problem: <br><br>Trafffic from a remote device is properly decrypted [ transport is GREipv6 / overlay is ipv6]. Encrypted packet leave the ubuntu box un-encrypted.<br><br>Either xfrm policies and state are looking right.<br><br> ip xfrm policy<br>src 2b00:d31:e7e4:1b::1:201/128 dst 2b00:c31:e7e2:17::2:12/128 proto gre<br>dir fwd priority 1026<br>tmpl src 2b00:d31:e7e4:1b::1:201 dst 2b00:c31:e7e2:17::2:12<br>proto esp reqid 2687 mode tunnel<br>src 2b00:d31:e7e4:1b::1:201/128 dst 2b00:c31:e7e2:17::2:12/128 proto gre<br>dir in priority 1026<br>tmpl src 2b00:d31:e7e4:1b::1:201 dst 2b00:c31:e7e2:17::2:12<br>proto esp reqid 2687 mode tunnel<br>src 2b00:c31:e7e2:17::2:12/128 dst 2b00:d31:e7e4:1b::1:201/128 proto gre<br>dir out priority 1026<br>tmpl src 2b00:c31:e7e2:17::2:12 dst 2b00:d31:e7e4:1b::1:201<br>proto esp reqid 2687 mode tunnel<br>src 0.0.0.0/0 dst 0.0.0.0/0<br>socket in priority 0<br>src 0.0.0.0/0 dst 0.0.0.0/0<br>socket out priority 0<br>src 0.0.0.0/0 dst 0.0.0.0/0<br>socket in priority 0<br>src 0.0.0.0/0 dst 0.0.0.0/0<br>socket out priority 0<br>src ::/0 dst ::/0<br>socket in priority 0<br>src ::/0 dst ::/0<br>socket out priority 0<br>src ::/0 dst ::/0<br>socket in priority 0<br>src ::/0 dst ::/0<br>socket out priority 0<br><br>root@zg-nccf-1a-hr:/home/localadmin# ip xfrm state<br>src 2b00:c31:e7e2:17::2:12 dst 2b00:d31:e7e4:1b::1:201<br>proto esp spi 0xb173226b reqid 2687 mode tunnel<br>replay-window 32 flag af-unspec<br>auth-trunc hmac(sha1) 0x630d4dae250e28a9dfd1184b20dfd0e33cda1665 96<br>enc cbc(aes) 0x3dc58789ace1be5fccdb4b2c42b3aa23<br>src 2b00:d31:e7e4:1b::1:201 dst 2b00:c31:e7e2:17::2:12<br>proto esp spi 0xccbc90f5 reqid 2687 mode tunnel<br>replay-window 32 flag af-unspec<br>auth-trunc hmac(sha1) 0xd7e81acb481eb00c2389bdfdc2e7fdc1ca0b6417 96<br>enc cbc(aes) 0x9e7d10c82aa14b562c541482d6b5933b<br><br><br>ipsec statusall<br>Status of IKE charon daemon (strongSwan 5.1.2, Linux 3.13.0-32-generic, x86_64):<br> uptime: 7 minutes, since Dec 19 12:12:26 2014<br> malloc: sbrk 2568192, mmap 0, used 358352, free 2209840<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 2<br> loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pkcs1 pkcs7 pkcs8 pkcs12 pem openssl xcbc cmac hmac ctr ccm gcm attr kernel-netlink resolve socket-default stroke updown eap-identity addrblock<br>Listening IP addresses:<br> 2a00:c31:7fe2:17::1:11<br> ....<br> 2001::2<br>Connections:<br> CSR1000V: %any...2b00:d31:e7e4:1b::1:201 IKEv2<br> CSR1000V: local: [....] uses pre-shared key authentication<br> CSR1000V: remote: [....] uses pre-shared key authentication<br> CSR1000V: child: 2b00:c31:e7e2:17::2:12/128[gre] === 2b00:d31:e7e4:1b::1:201/128[gre] TUNNEL<br>Security Associations (1 up, 0 connecting):<br> CSR1000V[1]: ESTABLISHED 7 minutes ago, 2b00:c31:e7e2:17::2:12[]...2b00:d31:e7e4:1b::1:201[]<br> CSR1000V[1]: IKEv2 SPIs: db2eec9fddaea13f_i* 5b0acc0ed25bced5_r, pre-shared key reauthentication in 23 hours<br> CSR1000V[1]: IKE proposal: AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024<br> CSR1000V{1}: INSTALLED, TUNNEL, ESP SPIs: c673e3d6_i 1e5da7b9_o<br> CSR1000V{1}: AES_CBC_128/HMAC_SHA1_96, 4512 bytes_i (34 pkts, 333s ago), 0 bytes_o, rekeying in 34 minutes<br> CSR1000V{1}: 2b00:c31:e7e2:17::2:12/128[gre] === 2b00:d31:e7e4:1b::1:201/128[gre]<br>root@zg-nccf-1a-hr:/home/localadmin#<br><br>conn CSR1000V<br> keyexchange=ikev2<br> ikelifetime=1440m<br> keylife=60m<br> leftauth=psk<br> rightauth=psk<br> leftid=....<br> rightid=....<br> right=2b00:d31:e7e4:1b::1:201<br> leftsubnet=2b00:c31:e7e2:17::2:12/128[47]<br> rightsubnet=2b00:d31:e7e4:1b::1:201/128[47]<br> auto=start<br><br>I've tried on my lab gentoo machine and there it works. Why GRE is not encrypted on this linux box?<br><br>Regards,<br> </div>
<br>_______________________________________________
Users mailing list
Users@lists.strongswan.org
https://lists.strongswan.org/mailman/listinfo/users</div> </div></body>
</html>