[strongSwan] FW: Traffic dropped when IKE initiation happen between two nodes simultaneously.

Krishna G, Suhas (NSN - IN/Bangalore) suhas.krishna_g at nsn.com
Tue Feb 3 11:05:50 CET 2015


Hi,

I am testing a simple scenario using ikev2. The setup is as follows:

(Traffic generator2)30.0.0.1-------(30.0.0.2)node2(20.0.0.1)----------(20.0.0.2)node1(40.0.0.1)------------40.0.0.2(Traffic generator1)
                                                      eth2                                                       eth3                                                           eth2
                                                                                                                  (vlan201)

Node1:
# ipsec.conf

config setup
        charonstart=yes
        plutostart=no
        uniqueids=no
        charondebug="knl 0,enc 0,net 0"
conn %default
        auto=route
        keyexchange=ikev2
        reauth=no
conn r2~v2
        rekeymargin=150
        rekeyfuzz=100%
        left=20.0.0.2
        right=20.0.0.1
        leftsubnet=40.0.0.2/32
        rightsubnet=30.0.0.1/32
        authby=secret
        leftid=20.0.0.2
        rightid=%any
        ike=aes128-sha1-modp1024!
        esp=aes128-sha1!
        type=tunnel
        ikelifetime=2000s
        keylife=1500s
        mobike=no
        auto=route
        reauth=no

addresses configured:
1.  vlan201 at eth3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether 00:30:64:26:2f:5f brd ff:ff:ff:ff:ff:ff
    inet 20.0.0.2/24 brd 20.0.0.255 scope global vlan201
    inet6 fe80::30:6400:a26:2f5f/64 scope link
       valid_lft forever preferred_lft forever

2.  eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:30:64:26:2f:5e brd ff:ff:ff:ff:ff:ff
    inet 40.0.0.1/24 brd 40.0.0.255 scope global eth2
    inet6 fe80::30:6400:426:2f5e/64 scope link
       valid_lft forever preferred_lft forever


routes:
40.0.0.0/24 dev eth2  proto kernel  scope link  src 40.0.0.1
20.0.0.0/24 dev vlan201  proto kernel  scope link  src 20.0.0.2
30.0.0.0/24 via 20.0.0.1 dev vlan201  proto gated



Node2 :
# ipsec.conf

config setup
        charonstart=yes
        plutostart=no
        uniqueids=no
        charondebug="knl 0,enc 0,net 0"
conn %default
        auto=route
        keyexchange=ikev2
        reauth=no
conn r2~v2
        rekeymargin=150
        rekeyfuzz=100%
        left=20.0.0.1
        right=20.0.0.2
        leftsubnet=30.0.0.1/32
        rightsubnet=40.0.0.2/32
        authby=secret
        leftid=20.0.0.1
        rightid=%any
        ike=aes128-sha1-modp1024!
        esp=aes128-sha1!
        type=tunnel
        ikelifetime=2000s
        keylife=1500s
        dpdaction=clear
        dpddelay=20
        mobike=no
        auto=route
        reauth=no


addresses configured:
1.  vlan201 at eth3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether 00:30:64:26:32:02 brd ff:ff:ff:ff:ff:ff
    inet 20.0.0.1/24 brd 20.0.0.255 scope global vlan201
    inet6 fe80::30:6400:a26:3202/64 scope link
       valid_lft forever preferred_lft forever


2.  eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:30:64:26:32:01 brd ff:ff:ff:ff:ff:ff
    inet 30.0.0.2/24 brd 30.0.0.255 scope global eth2
    inet6 fe80::30:6400:426:3201/64 scope link
       valid_lft forever preferred_lft forever


routes:
40.0.0.0/24 via 20.0.0.2 dev vlan201  proto gated
20.0.0.0/24 dev vlan201  proto kernel  scope link  src 20.0.0.1
30.0.0.0/24 dev eth2  proto kernel  scope link  src 30.0.0.2


In my setup, I am pumping traffic from both ends simultaneously. I see that IKE initiations happen simultaneously from both ends and two pair of SAs are formed instead of one as shown below:

20.0.0.2 20.0.0.1
        esp mode=tunnel spi=3303990082(0xc4eee342) reqid=1(0x00000001)
        E: aes-cbc  2d2d6603 aa9bc830 1c3ee36a d964b1f1
        A: hmac-sha1  3889f511 69cd3c4e 6f416739 e5c685cc 3f316067
        seq=0x00000000 replay=64 flags=0x00000000 state=mature
        created: Jan 23 20:22:13 2015   current: Jan 23 20:22:37 2015
        diff: 24(s)     hard: 300(s)    soft: 268(s)
        last: Jan 23 20:22:13 2015      hard: 0(s)      soft: 0(s)
        current: 285648670(bytes)       hard: 0(bytes)  soft: 0(bytes)
        allocated: 283945       hard: 0 soft: 0
        sadb_seq=1 pid=24064 refcnt=0
20.0.0.1 20.0.0.2
        esp mode=tunnel spi=3422609051(0xcc00de9b) reqid=1(0x00000001)
        E: aes-cbc  37be21d3 79d00867 968bcc4e 21c3a5c8
        A: hmac-sha1  f46a45e7 c3b90b4e 20e3e68e 782a8b48 5d2d7758
        seq=0x00000000 replay=64 flags=0x00000000 state=mature
        created: Jan 23 20:22:13 2015   current: Jan 23 20:22:37 2015
        diff: 24(s)     hard: 300(s)    soft: 265(s)
        last:                           hard: 0(s)      soft: 0(s)
        current: 0(bytes)       hard: 0(bytes)  soft: 0(bytes)
        allocated: 0    hard: 0 soft: 0
        sadb_seq=2 pid=24064 refcnt=0
20.0.0.2 20.0.0.1
        esp mode=tunnel spi=3272081281(0xc307ff81) reqid=2(0x00000002)
        E: aes-cbc  6c9cbd30 0aa302bb 9741ca7f 231ce550
        A: hmac-sha1  9c21160b a03990f5 a07d2c29 a18d8b7f 02c020a7
        seq=0x00000000 replay=64 flags=0x00000000 state=mature
        created: Jan 23 20:22:13 2015   current: Jan 23 20:22:37 2015
        diff: 24(s)     hard: 300(s)    soft: 264(s)
        last: Jan 23 20:22:13 2015      hard: 0(s)      soft: 0(s)
        current: 20120(bytes)   hard: 0(bytes)  soft: 0(bytes)
        allocated: 20   hard: 0 soft: 0
        sadb_seq=3 pid=24064 refcnt=0
20.0.0.1 20.0.0.2
        esp mode=tunnel spi=3466205953(0xce9a1b01) reqid=2(0x00000002)
        E: aes-cbc  465a0a5f 454ffbcc d4a63bf7 f3f102e5
        A: hmac-sha1  36cefc1d 6c9729fe 4a142a0d 66033097 4b6e9d3a
        seq=0x00000000 replay=64 flags=0x00000000 state=mature
        created: Jan 23 20:22:13 2015   current: Jan 23 20:22:37 2015
        diff: 24(s)     hard: 300(s)    soft: 261(s)
        last: Jan 23 20:22:13 2015      hard: 0(s)      soft: 0(s)
        current: 285656718(bytes)       hard: 0(bytes)  soft: 0(bytes)
        allocated: 283953       hard: 0 soft: 0
        sadb_seq=0 pid=24064 refcnt=0


Due to this there is a 100% traffic drop seen at both ends. I referred to a similar query posted - https://lists.strongswan.org/pipermail/users/2012-October/003765.html but no conclusion was drawn out of that.

According to my investigation, the two nodes are using different set of SAs for communication resulting in the problem. tcpdump of the packets flowing is as below:

20:23:48.400585 IP 20.0.0.2 > 20.0.0.1: ESP(spi=0xc4eee342,seq=0x11556a), length 1044
20:23:48.400629 IP 20.0.0.1 > 20.0.0.2: ESP(spi=0xce9a1b01,seq=0x115573), length 1044
20:23:48.400669 IP 20.0.0.2 > 20.0.0.1: ESP(spi=0xc4eee342,seq=0x11556b), length 1044
20:23:48.400713 IP 20.0.0.1 > 20.0.0.2: ESP(spi=0xce9a1b01,seq=0x115574), length 1044
20:23:48.400752 IP 20.0.0.2 > 20.0.0.1: ESP(spi=0xc4eee342,seq=0x11556c), length 1044
20:23:48.400796 IP 20.0.0.1 > 20.0.0.2: ESP(spi=0xce9a1b01,seq=0x115575), length 1044
20:23:48.400836 IP 20.0.0.2 > 20.0.0.1: ESP(spi=0xc4eee342,seq=0x11556d), length 1044
20:23:48.400881 IP 20.0.0.1 > 20.0.0.2: ESP(spi=0xce9a1b01,seq=0x115576), length 1044
20:23:48.400919 IP 20.0.0.2 > 20.0.0.1: ESP(spi=0xc4eee342,seq=0x11556e), length 1044
20:23:48.400963 IP 20.0.0.1 > 20.0.0.2: ESP(spi=0xce9a1b01,seq=0x115577), length 1044
20:23:48.401003 IP 20.0.0.2 > 20.0.0.1: ESP(spi=0xc4eee342,seq=0x11556f), length 1044
20:23:48.401047 IP 20.0.0.1 > 20.0.0.2: ESP(spi=0xce9a1b01,seq=0x115578), length 1044


Is there any fix to this issue. The scenario of simultaneous ike initiations happening for the first time when tunnel is being established is something which is not addressed I feel.


Regards
Suhas Krishna

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20150203/768acc0c/attachment-0001.html>


More information about the Users mailing list