[strongSwan] xfrm & dynamic routing

Volodymyr Litovka doka.ua at gmx.com
Thu Sep 17 17:50:38 CEST 2020

Hi colleagues,

I'm using XFRM on SSwan side in shared mode for multiple clients (using
same if_id):

3: xfrm0 at lo: <NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
     inet brd scope global xfrm0
        valid_lft forever preferred_lft forever

like this:

             xfrm (if_id=9, x.x.x.1/24)
         |              |                |
      client1        client2     ...   clientN
    (x.x.x.2/24)   (x.x.x.3/24)  ... (x.x.x.N/24)

having, e.g. the following SA:

ikev2-eap: #41, ESTABLISHED, IKEv2, 36739cd0b0eab71f_i 57d9f123408cdea5_r*
   local  'local_id' @ local_ip[4500]
   remote 'remote_id' @ remote_ip[4500] EAP: 'remote_eap_id' []
   established 1547s ago, rekeying in 8357s
   eap-child: #37, reqid 31, INSTALLED, TUNNEL-in-UDP, ESP:AES_GCM_16-128
     [ ... ]

according to the configuration:

connections {
   ikev2-eap {
     pools = radius
     remote {
       auth = eap-radius
       id = %any
       eap_id = %any
     children {
       eap-child {
         local_ts =
         remote_ts = dynamic
         mode = tunnel

wiki's RouteBasedVPN says the following: "After creating the device it
has to be enabled and then routes may be installed (routing protocols
may also be used)." and I tried to implement dynamic routing to route
between remote LANs, receiving additional subnets over BGP between peers
(e.g. x.x.x.1 <-> x.x.x.2):

server# ip route
[ ... ]
**  nhid 20 via dev xfrm0*proto bgp*  metric 20

but, actually, I can not access remote BGP-learned LAN:

server# ping -I
PING ( from : 56(84) bytes of data.
 From icmp_seq=1 Destination Host Unreachable
 From icmp_seq=2 Destination Host Unreachable

On the other hand, the wiki says (for VTI mode, though, while I'm using
XFRM) such issue happens due to the fact that these networks aren't
mentioned in traffic selector thus there is no matching policy and
traffic is rejected: "only traffic that matches these traffic selectors
will then actually be forwarded, other packets routed to the VTI device
will be rejected with an ICMP error message (destination
unreachable/destination host unreachable)."

So, the question - what I'm doing wrong? Are there ways to use dynamic
routing with shared XFRM device?

Note: remote peers can be behind the same NAT, so having same external
IP address.

Thank you.

Volodymyr Litovka
   "Vision without Execution is Hallucination." -- Thomas Edison

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20200917/73fa1990/attachment.html>

More information about the Users mailing list