<div dir="ltr">I have referred to following links and configured strongSwan to establish a route-based VPN tunnel between 2 Linux <span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0);font-family:Menlo;font-size:18px">4.4.57</span> boxes.<div><a href="https://wiki.strongswan.org/projects/strongswan/wiki/RouteBasedVPN" target="_blank">https://wiki.strongswan.org/<wbr>projects/strongswan/wiki/<wbr>RouteBasedVPN</a><br></div><div><a href="https://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges" target="_blank">https://wiki.strongswan.org/<wbr>projects/strongswan/wiki/<wbr>ReducedPrivileges</a><br></div><div><br></div><div>The data path used to work perfectly fine when both sides are using strongSwan v5.5.1. After upgrading same setup to v5.5.2, tunnel gets established but ping between the VTI interfaces doesn't work. If we ping from host running v5.5.2, no ESP packet is sent out. If we ping form host running v5.5.1 to host running v5.5.2, ESP packet goes out, but host running v5.5.2 doesn't send ESP in response.<br></div><div><br></div><div>My ipsec.conf file is as follows (install_route=no is added in strongswan.conf):</div><div><div>conn 10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0</div><div> left=10.160.229.241</div><div> leftid=10.160.229.241</div><div> rightid=10.160.229.240</div><div> leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div><div> right=10.160.229.240</div><div> rightsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div><div> authby=secret</div><div> keyexchange = ikev2</div><div> mark = 1</div><div> auto = start</div><div> esp=aes128-sha1-modp2048</div><div> ike=aes128-sha1-modp2048!</div></div><div><br></div><div>Tunnel establishment works fine, there is nothing suspicious in logs, and the output of 'ipsec statusall' is as follows:</div><div><br></div><div><div>Status of IKE charon daemon (strongSwan 5.5.2, Linux 4.4.57, x86_64):</div><div> uptime: 18 days, since Aug 18 10:58:17 2017</div><div> malloc: sbrk 1477008, mmap 0, used 357360, free 1119648</div><div> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 6</div><div> loaded plugins: charon aes des rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf xcbc cmac hmac attr kernel-netlink resolve socket-default stroke vici updown xauth-generic</div><div>Listening IP addresses:</div><div> 10.160.229.241</div><div>Connections:</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0: 10.160.229.241...10.160.229.<wbr>240 IKEv2, dpddelay=30s</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0: local: [10.160.229.241] uses pre-shared key authentication</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0: remote: [10.160.229.240] uses pre-shared key authentication</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0: child: <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> === <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> TUNNEL, dpdaction=restart</div><div>Routed Connections:</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0{253}: ROUTED, TUNNEL, reqid 6</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0{253}: <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> === <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div><div>Security Associations (1 up, 0 connecting):</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0[30]: ESTABLISHED 6 hours ago, 10.160.229.241[10.160.229.241]<wbr>...10.160.229.240[10.160.229.<wbr>240]</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0[30]: IKEv2 SPIs: 066c631f67deb19d_i 009d1bbbed44b77a_r*, pre-shared key reauthentication in 91 minutes</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0[30]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_<wbr>HMAC_SHA1/MODP_2048</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0{263}: INSTALLED, TUNNEL, reqid 6, ESP SPIs: cc9cecd6_i ce4575a3_o</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0{263}: AES_CBC_128/HMAC_SHA1_96/<wbr>MODP_2048, 0 bytes_i (0 pkts, 1556478s ago) ( 0 integrity_failed_errors) (0 replay_errors) (0 decryption_failures) (0 sa_expired_error) (0 recv_errors), 0 bytes_o (0 pkts, 1556478s ago) (0 encryption_failures)(0 spi_overflow_error)(0 send_errors), rekeying in 35 minutes</div><div>10.160.229.241_0.0.0.0/0-10.<wbr>160.229.240_0.0.0.0/0{263}: <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> === <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div></div><div><br></div><div>The SA & SP downloaded in kernel are as follows:</div><div><br></div><div># ip x s s</div><div>src 10.160.229.241 dst 10.160.229.240</div><div><span style="white-space:pre-wrap"> </span>proto esp spi 0xce4575a3 reqid 6 mode tunnel</div><div><span style="white-space:pre-wrap"> </span>replay-window 0 flag af-unspec</div><div><span style="white-space:pre-wrap"> </span>mark 0x1/0xffffffff</div><div><span style="white-space:pre-wrap"> </span>auth-trunc hmac(sha1) 0x542da7b70b7a0ad1ba0814a6bf54<wbr>4eb96a5826ab 96</div><div><span style="white-space:pre-wrap"> </span>enc cbc(aes) 0xedf587dc5374762dcb6330ccd495<wbr>eecb</div><div><span style="white-space:pre-wrap"> </span>anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</div><div>src 10.160.229.240 dst 10.160.229.241</div><div><span style="white-space:pre-wrap"> </span>proto esp spi 0xcc9cecd6 reqid 6 mode tunnel</div><div><span style="white-space:pre-wrap"> </span>replay-window 32 flag af-unspec</div><div><span style="white-space:pre-wrap"> </span>auth-trunc hmac(sha1) 0xcc345e738d8969334d8c4e6588c9<wbr>8ca43029fd8a 96</div><div><span style="white-space:pre-wrap"> </span>enc cbc(aes) 0x9867e41aa23002f9cdd1b5b17cfd<wbr>e26c</div><div><span style="white-space:pre-wrap"> </span>anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</div><div># ip x p s</div><div>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> </div><div><span style="white-space:pre-wrap"> </span>dir fwd priority 399999 ptype main </div><div><span style="white-space:pre-wrap"> </span>mark 0x1/0xffffffff</div><div><span style="white-space:pre-wrap"> </span>tmpl src 10.160.229.240 dst 10.160.229.241</div><div><span style="white-space:pre-wrap"> </span>proto esp reqid 6 mode tunnel</div><div>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> </div><div><span style="white-space:pre-wrap"> </span>dir in priority 399999 ptype main </div><div><span style="white-space:pre-wrap"> </span>mark 0x1/0xffffffff</div><div><span style="white-space:pre-wrap"> </span>tmpl src 10.160.229.240 dst 10.160.229.241</div><div><span style="white-space:pre-wrap"> </span>proto esp reqid 6 mode tunnel</div><div>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> </div><div><span style="white-space:pre-wrap"> </span>dir out priority 399999 ptype main </div><div><span style="white-space:pre-wrap"> </span>mark 0x1/0xffffffff</div><div><span style="white-space:pre-wrap"> </span>tmpl src 10.160.229.241 dst 10.160.229.240</div><div><span style="white-space:pre-wrap"> </span>proto esp reqid 6 mode tunnel</div><div>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> </div><div><span style="white-space:pre-wrap"> </span>socket in priority 0 ptype main </div><div>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> </div><div><span style="white-space:pre-wrap"> </span>socket out priority 0 ptype main </div><div>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> </div><div><span style="white-space:pre-wrap"> </span>socket in priority 0 ptype main </div><div>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> </div><div><span style="white-space:pre-wrap"> </span>socket out priority 0 ptype main </div><div><br></div><div>The corresponding VTI is configured as follows:</div><div><br></div><div>ip link add vti-1 type vti key 1 local 10.160.229.241 remote 10.160.229.240</div><div>ip link set vti-1 up</div><div>ip addr add <a href="http://1.1.1.1/24" target="_blank">1.1.1.1/24</a> dev vti-1</div><div><br></div><div><div># ip link show vti-1</div><div>17: vti-1@NONE: <POINTOPOINT,NOARP,UP,LOWER_<wbr>UP> mtu 1428 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1</div><div> link/ipip 10.160.229.241 peer 10.160.229.240</div><div># ip tunnel show vti-1</div><div>vti-1: ip/ip remote 10.160.229.240 local 10.160.229.241 ttl inherit nopmtudisc key 1</div><div>#</div></div><div><br></div><div>Similarly vti-1 on the VPN peer is configured with IP address 1.1.1.1. </div><div>However ping between the VTI addresses doesn't work: </div><div>ping 1.1.1.1 <span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0);font-family:Menlo;font-size:18px">-I vti-1 -c 1</span> </div><div><div>PING 1.1.1.1 (1.1.1.1) from 1.1.1.2 vti-1: 56(84) bytes of data.</div><div>^C</div><div>--- 1.1.1.1 ping statistics ---</div><div>1 packets transmitted, 0 received, 100% packet loss, time 0ms</div></div><div><br></div><div>There is no ESP packet going out of the system. TX error count & carrier count increase in output of ifconfig after this. <span class="gmail-m_8370434661814813912gmail-s1">Also the </span>NoRoute Error counter in VTI stat gets incremented after ping is attempted.</div><div><br></div><div>What can be the reason for this? </div><div><br></div><div><div># ifconfig vti-1<br></div><div><div>vti-1 Link encap:UNSPEC HWaddr 0A-A0-E5-F1-00-00-02-00-00-00-<wbr>00-00-00-00-00-00 </div><div> inet addr:1.1.1.2 P-t-P:1.1.1.2 Mask:255.255.255.0</div><div> UP POINTOPOINT RUNNING NOARP MTU:1428 Metric:1</div><div> RX packets:0 errors:0 dropped:0 overruns:0 frame:0</div><div> TX packets:0 errors:1 dropped:0 overruns:0 carrier:1</div><div> collisions:0 txqueuelen:1 </div><div> RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)</div></div></div><div>
<p class="gmail-m_8370434661814813912gmail-p1">[root@NSX-edge-2-0 ~]# ip -s tunnel show </p><p class="gmail-m_8370434661814813912gmail-p1">ip_vti0: ip/ip remote any local any ttl inherit nopmtudisc key 0</p><p class="gmail-m_8370434661814813912gmail-p1">RX: Packets Bytes Errors CsumErrs OutOfSeq Mcasts</p><p class="gmail-m_8370434661814813912gmail-p1"> 0 0 0 0 0 0 </p><p class="gmail-m_8370434661814813912gmail-p1">TX: Packets Bytes Errors DeadLoop NoRoute NoBufs</p><p class="gmail-m_8370434661814813912gmail-p1"> 0 0 0 0 0 0 </p><p class="gmail-m_8370434661814813912gmail-p1">vti-1: ip/ip remote 10.160.229.240 local 10.160.229.241 ttl inherit nopmtudisc key 1</p><p class="gmail-m_8370434661814813912gmail-p1">RX: Packets Bytes Errors CsumErrs OutOfSeq Mcasts</p><p class="gmail-m_8370434661814813912gmail-p1"> 0 0 0 0 0 0 </p><p class="gmail-m_8370434661814813912gmail-p1">TX: Packets Bytes Errors DeadLoop NoRoute NoBufs</p><p class="gmail-m_8370434661814813912gmail-p1"> 0 0 1 0 1 0 </p><p class="gmail-m_8370434661814813912gmail-p1"><span class="gmail-m_8370434661814813912gmail-s1"></span></p><p class="gmail-m_8370434661814813912gmail-p1">[root@NSX-edge-2-0 ~]#</p><p class="gmail-m_8370434661814813912gmail-p1"><span class="gmail-m_8370434661814813912gmail-s1">None of the error counters in /proc/net/xfrm_stat<span class="gmail-m_8370434661814813912gmail-Apple-converted-space"> got incremented after this. </span></span></p><p class="gmail-m_8370434661814813912gmail-p1"><span class="gmail-m_8370434661814813912gmail-s1"><span class="gmail-m_8370434661814813912gmail-Apple-converted-space">The routing table seems to be sufficient for the traffic to flow between VTIs and there are no duplicate routes.</span></span></p><p class="gmail-m_8370434661814813912gmail-p1"><span class="gmail-m_8370434661814813912gmail-s1"><span class="gmail-m_8370434661814813912gmail-Apple-converted-space">There are no firewall rules which block the traffic for <a href="http://1.1.1.0/24" target="_blank">1.1.1.0/24</a> network in either direction.<br></span></span></p></div><div><div># route -n</div><div>Kernel IP routing table</div><div>Destination Gateway Genmask Flags Metric Ref Use Iface</div><div>0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 eth0</div><div>1.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 vti-1</div></div><div>#</div><div><br></div><div>If the 5.5.1 peer sends ping, then ESP is received at 5.5.2 host and vti stats show Rx count incrementing correctly, but Tx count doesn't increment which means system didn't attempt to ICMP response back via VTI/tunnel. </div><div><br></div><div>Things are working with the same setup/configuration when both hosts are using v5.5.1. Has anyone faced similar issue when using route-based vpn after upgrading to v5.5.2? Any pointers to debug the issue are appreciated.</div><div><br></div><div>In wiki found this issue <a href="https://wiki.strongswan.org/issues/2404">https://wiki.strongswan.org/issues/2404</a> where a change is mentioned as "That's the case since 5.5.2 or 067fd2c6." Could this change be the culprit? Or are there any other route-based VPN related changes which are done after 5.5.1?</div><div><br></div><div>Thanks,</div><div>Sandesh</div><div><br></div></div>