[strongSwan] Multicast between networks / PIM-SM

Victor Medina vittico at gmail.com
Wed Nov 14 14:48:06 CET 2018


I am trying to get two networks to flow Multicast traffic. I built a custom
Strongswan using the latest version: 5.7.1. Tunnels is up and working but
still no multicast traffic.

My ipsec statusall

Status of IKE charon daemon (strongSwan 5.7.1, Linux 4.15.0-1027-aws,
x86_64):

  uptime: 36 minutes, since Nov 14 12:55:58 2018

  malloc: sbrk 4796416, mmap 532480, used 3212832, free 1583584

  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0,
scheduled: 3

  loaded plugins: charon unbound pkcs11 aesni aes des blowfish rc2 sha2
sha3 sha1 md4 md5 mgf1 rdrand random nonce x509 revocation constraints
acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey dnscert ipseckey
pem openssl af-alg fips-prf gmp curve25519 agent chapoly xcbc cmac hmac ctr
ccm gcm ntru newhope bliss files attr kernel-pfkey kernel-netlink resolve
socket-default socket-dynamic bypass-lan connmark forecast farp stroke vici
updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp eap-aka-3gpp2
eap-simaka-pseudonym eap-simaka-reauth eap-md5 eap-gtc eap-mschapv2
eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap
xauth-pam xauth-noauth dhcp p-cscf whitelist lookip error-notify certexpire
led duplicheck radattr addrblock unity counters

Listening IP addresses:

  10.77.0.104

Connections:

multicast-conn:  10.77.0.104...xxxxxxx  IKEv2, dpddelay=30s

multicast-conn:   local:  [yyyyyyyy] uses pre-shared key authentication

multicast-conn:   remote: [xxxxxxxx] uses pre-shared key authentication

multicast-conn:   child:  10.77.0.96/28 224.10.0.0/16 239.1.0.0/23 ===
10.50.10.0/25 224.10.0.0/16 239.1.0.0/23 TUNNEL, dpdaction=hold

Shunted Connections:

Bypass LAN 10.77.0.96/28:  10.77.0.96/28 === 10.77.0.96/28 PASS

Bypass LAN 10.77.0.97/32:  10.77.0.97/32 === 10.77.0.97/32 PASS

Bypass LAN fe80::/64:  fe80::/64 === fe80::/64 PASS

Routed Connections:

multicast-conn{1}:  ROUTED, TUNNEL, reqid 1

multicast-conn{1}:   10.77.0.96/28 224.10.0.0/16 239.1.0.0/23 ===
10.50.10.0/25 224.10.0.0/16 239.1.0.0/23

Security Associations (1 up, 0 connecting):

multicast-conn[1]: ESTABLISHED 36 minutes ago,
10.77.0.104[100.24.163.130]...xxxxxxx[xxxxxxxx]

multicast-conn[1]: IKEv2 SPIs: e52d72342f2f6068_i 0e26010c583bd313_r*,
pre-shared key reauthentication in 23 hours

multicast-conn[1]: IKE proposal:
AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024

multicast-conn{2}:  INSTALLED, TUNNEL, reqid 2, ESP SPIs: c43bcd7c_i
b7177b76_o

multicast-conn{2}:  AES_CBC_256/HMAC_SHA1_96, 2782 bytes_i, 110544 bytes_o
(1316 pkts, 0s ago), rekeying in 7 hours

multicast-conn{2}:   10.77.0.96/28 224.10.0.0/16 239.1.0.0/23 ===
10.50.10.0/25 224.10.0.0/16 239.1.0.0/23

My ipsec config:

config setup

       # charondebug="ike 4, knl 4, cfg 4, net 4, esp 4, dmn 4,  mgr 4"

       charondebug="cfg 2, esp 2"

conn config setup

       # charondebug="ike 4, knl 4, cfg 4, net 4, esp 4, dmn 4,  mgr 4"

       charondebug="cfg 2, esp 2"

conn seedcx-etale-aws

       keyexchange=ikev2

       authby=secret

# My network

       left=10.77.0.104

       leftsubnet=10.77.0.96/28,224.10.0.0/16,239.1.1.0/23

       leftid=yyyyyyyyyyyy

       leftfirewall=yes

# Peer  Network

       right=xxxxxxxxxxx

       rightid=xxxxxxxxx

       rightsubnet=10.50.10.0/25,224.10.0.0/16,239.1.1.0/23

# CIPHERS

       ike=aes256-sha-modp1024

       esp=aes256-sha

# REKEYING

       ikelifetime=86400

       lifetime=28800

       rekeymargin=3m

       keyingtries=3

# CONTROL

       lefthostaccess=yes

       #righthostaccess=yes

       dpdaction=hold

       mark=%unique

       auto=route

       keyexchange=ikev2

       authby=secret



My forecast conf

forecast {


    # Multicast groups to join locally, allowing forwarding of them.

    groups = 224.10.0.0/16,239.1.1.0/23



    # Local interface to listen for broadcasts to forward.

    interface =  eth0


    # Whether to load the plugin. Can also be an integer to increase the

    # priority of this plugin.

    load = yes


    # CHILD_SA configurations names to perform multi/broadcast reinjection.

    # reinject =


}

My iptables -L

hain INPUT (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  239.1.0.0/23         239.1.0.0/23         policy match
dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        239.1.0.0/23         policy match
dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  ip-10-50-10-0.ppp.internal/25  239.1.0.0/23         policy
match dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  239.1.0.0/23         224.10.0.0/16        policy match
dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        224.10.0.0/16        policy match
dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  ip-10-50-10-0.ppp.internal/25  224.10.0.0/16        policy
match dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  239.1.0.0/23         ip-10-77-0-96.ec2.internal/28  policy
match dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        ip-10-77-0-96.ec2.internal/28  policy
match dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  ip-10-50-10-0.ppp.internal/25
ip-10-77-0-96.ec2.internal/28  policy match dir in pol ipsec reqid 2 proto
esp


Chain FORWARD (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  239.1.0.0/23         239.1.0.0/23         policy match
dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  239.1.0.0/23         239.1.0.0/23         policy match
dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        239.1.0.0/23         policy match
dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  239.1.0.0/23         224.10.0.0/16        policy match
dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  ip-10-50-10-0.ppp.internal/25  239.1.0.0/23         policy
match dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  239.1.0.0/23         ip-10-50-10-0.ppp.internal/25  policy
match dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  239.1.0.0/23         224.10.0.0/16        policy match
dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        239.1.0.0/23         policy match
dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        224.10.0.0/16        policy match
dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        224.10.0.0/16        policy match
dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  ip-10-50-10-0.ppp.internal/25  224.10.0.0/16        policy
match dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        ip-10-50-10-0.ppp.internal/25  policy
match dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  239.1.0.0/23         ip-10-77-0-96.ppp.internal/28  policy
match dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  ip-10-77-0-96.ppp.internal/28  239.1.0.0/23         policy
match dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        ip-10-77-0-96.ppp.internal/28  policy
match dir in pol ipsec reqid 2 proto esp

ACCEPT     all  --  ip-10-77-0-96.ppp.internal/28  224.10.0.0/16        policy
match dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  ip-10-50-10-0.ppp.internal/25
ip-10-77-0-96.ppp.internal/28  policy match dir in pol ipsec reqid 2 proto
esp

ACCEPT     all  --  ip-10-77-0-96.ppp.internal/28
ip-10-50-10-0.ppp.internal/25  policy match dir out pol ipsec reqid 2 proto
esp


Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  239.1.0.0/23         239.1.0.0/23         policy match
dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  239.1.0.0/23         224.10.0.0/16        policy match
dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  239.1.0.0/23         ip-10-50-10-0.ppp.internal/25  policy
match dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        239.1.0.0/23         policy match
dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        224.10.0.0/16        policy match
dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  224.10.0.0/16        ip-10-50-10-0.ppp.internal/25  policy
match dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  ip-10-77-0-96.ppp.internal/28  239.1.0.0/23         policy
match dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  ip-10-77-0-96.ppp.internal/28  224.10.0.0/16        policy
match dir out pol ipsec reqid 2 proto esp

ACCEPT     all  --  ip-10-77-0-96.ppp.internal/28
ip-10-50-10-0.ppp.internal/25  policy match dir out pol ipsec reqid 2 proto
esp

The network admin on the other side mentioned this:

I have enabled PIM Sparse mode on my end of the VPN tunnel. Here is the
Certification info:

RP 10.50.10.1 groups 239.1.1.0/23 ... so on a normal networking device
(cisco, arista) you would add the statements:
ip pim rp-address 10.50.10.1 224.10.0.0/16
ip pim rp-address 10.50.10.1 239.1.1.0/23

Is there any way to configure this on Stronswan? Should I kindly ask him to
change something on their side in order to make it work?



Victor Medina
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20181114/89338cc4/attachment-0001.html>


More information about the Users mailing list