after a reboot I no longer have the road to ipsec VTI



  • HI,

    after a reboot I no longer have the road to ipsec VTI, as a workaround I have to revalidate the gateway System -> Routing -> Gateways -> Edit VTI Gateway -> Save -> Apply .

    netstat -rn | egrep '(ipsec2|10.8.222)'
    10.8.222.1         link#12            UH     ipsec200
    10.8.222.2         link#12            UHS         lo0
    fe80::%ipsec2000/64               link#12                       U      ipsec200
    fe80::20c:29ff:fe2c:fe96%ipsec2000 link#12                      UHS         lo0
    
    • Apply workaround
    netstat -rn | egrep '(ipsec2|10.8.222)'
    10.8.222.1         link#12            UH     ipsec200
    10.8.222.2         link#12            UHS         lo0
    10.60.0.0/16       10.8.222.1         UGS    ipsec200
    fe80::%ipsec2000/64               link#12                       U      ipsec200
    fe80::20c:29ff:fe2c:fe96%ipsec2000 link#12                      UHS         lo0
    

    My config HOST1 :

    <phase2>
    			<ikeid>2</ikeid>
    			<uniqid>5ba8fe2dee739</uniqid>
    			<mode>vti</mode>
    			<reqid>1</reqid>
    			<localid>
    				<type>network</type>
    				<address>10.8.222.2</address>
    				<netbits>30</netbits>
    			</localid>
    			<remoteid>
    				<type>address</type>
    				<address>10.8.222.1</address>
    			</remoteid>
    			<protocol>esp</protocol>
    			<encryption-algorithm-option>
    				<name>aes128gcm</name>
    				<keylen>128</keylen>
    			</encryption-algorithm-option>
    			<hash-algorithm-option>hmac_sha256</hash-algorithm-option>
    			<pfsgroup>14</pfsgroup>
    			<lifetime>7200</lifetime>
    			<pinghost></pinghost>
    			<descr></descr>
    		</phase2>
    		
    			<opt5>
    			<descr><![CDATA[IPsecVTI]]></descr>
    			<if>ipsec2000</if>
    			<enable></enable>
    			<spoofmac></spoofmac>
    		</opt5>
    		
    			<staticroutes>
    		<route>
    			<network>10.60.0.0/16</network>
    			<gateway>IPSECVTI_VTIV4</gateway>
    			<descr><![CDATA[Route VTI]]></descr>
    		</route>
    		
    		<gateway_item>
    			<interface>opt5</interface>
    			<gateway>dynamic</gateway>
    			<name>IPSECVTI_VTIV4</name>
    			<weight>1</weight>
    			<ipprotocol>inet</ipprotocol>
    			<interval>10000</interval>
    			<alert_interval>11000</alert_interval>
    			<descr><![CDATA[Interface IPSECVTI_VTIV4 Gateway]]></descr>
    		
    	conn con2000
    	reqid = 2000
    	fragmentation = yes
    	keyexchange = ikev2
    	reauth = yes
    	forceencaps = yes
    	mobike = no
    
    	rekey = yes
    	installpolicy = no
    
    	dpdaction = restart
    	dpddelay = 10s
    	dpdtimeout = 110s
    	auto = start
    	left = 172.31.255.12
    	right = 212.xxx.xxx.xxx
    	leftid = t9KxdF87
    	ikelifetime = 28800s
    	lifetime = 7200s
    	ike = aes128gcm128-sha256-modp2048!
    	esp = aes128gcm128-sha256-modp2048!
    	leftauth = psk
    	rightauth = psk
    	rightid = H87gcP9n
    	rightsubnet = 10.8.222.1
    	leftsubnet = 10.8.222.2/30
    		
    		
    		Status of IKE charon daemon (strongSwan 5.6.3, FreeBSD 11.2-RELEASE-p3, amd64):
      uptime: 76 minutes, since Sep 26 14:28:44 2018
      worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 5
      loaded plugins: charon unbound aes des blowfish rc2 sha2 sha1 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey ipseckey pem openssl fips-prf curve25519 xcbc cmac hmac curl attr kernel-pfkey kernel-pfroute resolve socket-default stroke vici updown eap-identity eap-sim eap-md5 eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap whitelist addrblock counters
    Listening IP addresses:
      172.31...
      ....
      10.8.222.2
    Connections:
         con2000:  172.31.255.12...212.xxx.xxx.xxx  IKEv2, dpddelay=10s
         con2000:   local:  [t9KxdF87] uses pre-shared key authentication
         con2000:   remote: [H87gcP9n] uses pre-shared key authentication
         con2000:   child:  10.8.222.0/30|/0 === 10.8.222.1/32|/0 TUNNEL, dpdaction=restart
    Security Associations (1 up, 0 connecting):
         con2000[1]: ESTABLISHED 76 minutes ago, 172.31.255.12[t9KxdF87]...212.129.54.15[H87gcP9n]
         con2000[1]: IKEv2 SPIs: e31d60fa6eb764fa_i* 01e6388a49940b8b_r, pre-shared key reauthentication in 6 hours
         con2000[1]: IKE proposal: AES_GCM_16_128/PRF_HMAC_SHA2_256/MODP_2048
         con2000{1}:  INSTALLED, TUNNEL, reqid 2000, ESP in UDP SPIs: c694082c_i cd9fea01_o
         con2000{1}:  AES_GCM_16_128, 5754109 bytes_i, 2030276 bytes_o, rekeying in 30 minutes
         con2000{1}:   10.8.222.2/32|/0 === 10.8.222.1/32|/0
    

    My config HOST2 :

    <phase2>
    			<ikeid>3</ikeid>
    			<uniqid>5ba8fc6c97355</uniqid>
    			<mode>vti</mode>
    			<reqid>5</reqid>
    			<localid>
    				<type>network</type>
    				<address>10.8.222.1</address>
    				<netbits>30</netbits>
    			</localid>
    			<remoteid>
    				<type>address</type>
    				<address>10.8.222.2</address>
    			</remoteid>
    			<protocol>esp</protocol>
    			<encryption-algorithm-option>
    				<name>aes128gcm</name>
    				<keylen>128</keylen>
    			</encryption-algorithm-option>
    			<hash-algorithm-option>hmac_sha256</hash-algorithm-option>
    			<pfsgroup>14</pfsgroup>
    			<lifetime>7200</lifetime>
    			<pinghost></pinghost>
    			<descr></descr>
    		</phase2>
    		
    	conn con3000
    	reqid = 3000
    	fragmentation = yes
    	keyexchange = ikev2
    	reauth = yes
    	forceencaps = yes
    	mobike = no
    
    	rekey = yes
    	installpolicy = no
    
    	dpdaction = restart
    	dpddelay = 10s
    	dpdtimeout = 110s
    	auto = start
    	left = 212.xxx.xxx.xxx
    	right = 90.xxx.xxx.xxx
    	leftid = H87gcP9n
    	ikelifetime = 28800s
    	lifetime = 7200s
    	ike = aes128gcm128-sha256-modp2048!
    	esp = aes128gcm128-sha256-modp2048!
    	leftauth = psk
    	rightauth = psk
    	rightid = t9KxdF87
    	rightsubnet = 10.8.222.2
    	leftsubnet = 10.8.222.1/30
    
    
    
    Status of IKE charon daemon (strongSwan 5.6.3, FreeBSD 11.2-RELEASE-p3, amd64):
      uptime: 6 hours, since Sep 26 09:24:15 2018
      worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 130
      loaded plugins: charon unbound aes des blowfish rc2 sha2 sha1 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey ipseckey pem openssl fips-prf curve25519 xcbc cmac hmac curl attr kernel-pfkey kernel-pfroute resolve socket-default stroke vici updown eap-identity eap-sim eap-md5 eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap whitelist addrblock unity counters
    Listening IP addresses:
      172....
      ....
      10.8.222.1
    Connections:
         con3000:  212.xxx.xxx.xxx...90.xxx.xxx.xxx  IKEv2, dpddelay=10s
         con3000:   local:  [H87gcP9n] uses pre-shared key authentication
         con3000:   remote: [t9KxdF87] uses pre-shared key authentication
         con3000:   child:  10.8.222.0/30|/0 === 10.8.222.2/32|/0 TUNNEL, dpdaction=restart
    Security Associations (4 up, 0 connecting):
         con3000[51]: ESTABLISHED 74 minutes ago, 212.129.54.15[H87gcP9n]...90.65.71.187[t9KxdF87]
         con3000[51]: IKEv2 SPIs: e31d60fa6eb764fa_i 01e6388a49940b8b_r*, pre-shared key reauthentication in 6 hours
         con3000[51]: IKE proposal: AES_GCM_16_128/PRF_HMAC_SHA2_256/MODP_2048
         con3000{53}:  INSTALLED, TUNNEL, reqid 3000, ESP in UDP SPIs: cd9fea01_i c694082c_o
         con3000{53}:  AES_GCM_16_128, 1163251 bytes_i, 7292564 bytes_o, rekeying in 27 minutes
         con3000{53}:   10.8.222.1/32|/0 === 10.8.222.2/32|/0
    

    The logs :

    Sep 26 16:17:41 jr charon: 11[NET] <con2000|1> received packet: from 212.129.54.15[4500] to 172.31.255.12[4500] (57 bytes)
    Sep 26 16:17:41 jr charon: 11[ENC] <con2000|1> parsed INFORMATIONAL request 7 [ ]
    Sep 26 16:17:41 jr charon: 11[ENC] <con2000|1> generating INFORMATIONAL response 7 [ ]
    Sep 26 16:17:41 jr charon: 11[NET] <con2000|1> sending packet: from 172.31.255.12[4500] to 212.129.54.15[4500] (57 bytes)
    Sep 26 16:17:41 jr charon: 04[NET] sending packet: from 172.31.255.12[4500] to 212.129.54.15[4500]
    Sep 26 16:17:41 jr charon: 11[KNL] <con2000|1> querying policy 10.8.222.1/32|/0 === 10.8.222.2/32|/0 in failed, not found
    Sep 26 16:17:51 jr charon: 11[KNL] <con2000|1> querying policy 10.8.222.1/32|/0 === 10.8.222.2/32|/0 in failed, not found
    Sep 26 16:17:51 jr charon: 11[IKE] <con2000|1> sending DPD request
    

    Thanks for the helps

    fred


  • Rebel Alliance Developer Netgate

    Where do you have the route set for 10.60.0.0/16? Is it a static route, handled by a routing protocol (OSPF or BGP) or what?



  • @jimp said in after a reboot I no longer have the road to ipsec VTI:

    Where do you have the route set for 10.60.0.0/16

    Hi Jimp,

    Yes add static route

    	<staticroutes>
    		<route>
    			<network>10.60.0.0/16</network>
    			<gateway>IPSECVTI_VTIV4</gateway>
    			<descr><![CDATA[Route VTI]]></descr>
    		</route>
    		
    		<gateway_item>
    			<interface>opt5</interface>
    			<gateway>dynamic</gateway>
    			<name>IPSECVTI_VTIV4</name>
    			<weight>1</weight>
    			<ipprotocol>inet</ipprotocol>
    			<interval>10000</interval>
    			<alert_interval>11000</alert_interval>
    			<descr><![CDATA[Interface IPSECVTI_VTIV4 Gateway]]></descr>
    

  • Rebel Alliance Developer Netgate

    Hmm, I just checked the setups I have here with VTI and static routes and they all apply at boot time.

    Did you make manual changes to the VTI gateway? Try removing the VTI gateway settings (click the trash can) -- that will not actually delete the gateway since it is dynamic, only its custom settings. Then reboot and see if it works.



  • Jimp,

    Yes problem is resolv, after deleted route static, removing the VTI gateway and reboot.

    Thanks for the helps

    fred