[strongSwan] Continuous loss/retransmission using IPv6 in IPv4 tunnel.

[Adam Bishop]

I have a road warrior deployment, which works perfectly for IPv4 on all (Windows, Linux, OS X) clients. The tunnel is dual stacked, and hands out a private, nat'd v4 address and a public v6 address.

IPv6 traffic though experiences massive loss coming from somewhere. I've tested with iperf in the clear, reaching ~750mbit between a client and the strongSwan server with negligible loss, so I'm reasonably confident it's not the network at fault.

Dumping traffic from the strongSwan side shows TCP retransmits accounting for ~75% of the traffic. I can share this packet capture off-list if desired. I've restricted the MSS to 1300 bytes, so the loss shouldn't be down to MTU.

I'm not really sure how to diagnose this further - I don't think it's a client issue because it occurs on clients of more than one platform OS X (Native) and Linux (strongSwan).

swanctl.conf follows at the end of this message. The system is running CentOS 7, with strongSwan 5.6.1 built directly from Git yesterday morning (5.3.3 also affected).

Regards,

Adam Bishop

  gpg: E75B 1F92 6407 DFDF 9F1C  BF10 C993 2504 6609 D460

jisc.ac.uk

pools {
    dns_pool4 {
        addrs = 10.0.0.0/24
       	dns = <v4dnsaddr1,v4dnsaddr2>
    }

    dns_pool6 {
       	addrs = 2001::/112
        dns = <v6dnsaddr1,v6dnsaddr2>
    }
}
connections {
    TENANT-DNS {
        version = 2

        local_addrs = publicv4,publicv6
	remote_addrs = %any                                     # default

        local_port = 500                                        # default
        remote_port = 500                                       # default

        proposals = aes128-sha256-modp1024-prfsha256,aes256-sha256-modp1024-prfsha256,aes128-sha256-modp2048-prfsha256,aes256-sha256-modp2048-prfsha256,aes128-sha256-modp3072-prfsha256,aes256-sha256-modp3072-prfsha256,aes128-sha256-modp4096-prfsha256,aes256-sha256-modp40$

        pull = yes                                              # default
        encap = no                                              # default
        mobike = yes                                            # default
        dpd_delay = 10s
        fragmentation = yes                                     # default

        send_certreq = no
        send_cert = always                                      # default

        keyingtries = 3
       	unique = no                                             # default
       	reauth_time = 0s                                        # default

       	rekey_time = 1h

        # Corresponds to a unique pool entry after connections {}
        pools = dns_pool4,dns_pool6

        local {
            cacerts = ca.pem
            certs = server.pem
            auth = pubkey
            id = my.ike.id
        }

	remote {
            id = %any

            # Causes segfault on 5.3.3, do not enable until debugged
            #cert_policy = 1.3.6.1.5.5.7.3.2

            auth = eap-radius
        }

	children {
            child {
               	esp_proposals = aes128-sha256-modp1024,aes256-sha256-modp1024,aes128-sha256-modp2048,aes256-sha256-modp2048,aes128-sha256-modp3072,aes256-sha256-modp3072,aes128-sha256-modp4096,aes256-sha256-modp4096,aes128-sha256-modp6144,aes256-sha256-modp6144,aes128-sh$

                # Update these with the desired split subnets
               	local_ts = <~8 IPv4 and ~5 IPv6 subnets go here>
               	remote_ts = dynamic

               	rekey_time = 1h                                 # default

               	# Trigger a rekey after 1GiB of data has been encrypted
               	rekey_bytes = 1073741824

                # updown =

               	mode = tunnel
               	interface = ens192

               	replay_window = 32
       	    }
       	}
    }
}

Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.