diff options
Diffstat (limited to 'docs/usecases/vpp_resp_sswan_init.md')
| -rw-r--r-- | docs/usecases/vpp_resp_sswan_init.md | 197 |
1 files changed, 0 insertions, 197 deletions
diff --git a/docs/usecases/vpp_resp_sswan_init.md b/docs/usecases/vpp_resp_sswan_init.md deleted file mode 100644 index 613a4b69cf6..00000000000 --- a/docs/usecases/vpp_resp_sswan_init.md +++ /dev/null @@ -1,197 +0,0 @@ -VPP as IKEv2 responder and strongSwan as initiator -================================================== - - -Prerequisites -------------- - -To make the examples easier to configure ``docker`` it is required to pull strongSwan docker image. The networking is done using Linux' veth interfaces and namespaces. - -Setup ------ - -First a topology: - -``` -192.168.3.2 192.168.5.2 - + loopback - | + -+----+----+ 192.168.10.2 +-----+----+ -| VPP | |initiator | -|responder+----------------------+strongSwan| -+---------+ +----------+ - 192.168.10.1 -``` - -Create veth interfaces and namespaces and configure them: - -``` -sudo ip link add gw type veth peer name swanif -sudo ip link set dev gw up - -sudo ip netns add ns -sudo ip link add veth_priv type veth peer name priv -sudo ip link set dev priv up -sudo ip link set dev veth_priv up netns ns - -sudo ip netns exec ns \ - bash -c " - ip link set dev lo up - ip addr add 192.168.3.2/24 dev veth_priv - ip route add 192.168.5.0/24 via 192.168.3.1" -``` - - -Create directory with strongswan configs that will be mounted to the docker container -``` -mkdir /tmp/sswan -``` - -Create the ``ipsec.conf`` file in the ``/tmp/sswan`` directory with following content: -``` -config setup - strictcrlpolicy=no - -conn initiator - mobike=no - auto=add - type=tunnel - keyexchange=ikev2 - ike=aes256gcm16-prfsha256-modp2048! - esp=aes256gcm16-esn! - - # local: - leftauth=psk - leftid=@roadwarrior.vpn.example.com - leftsubnet=192.168.5.0/24 - - # remote: (vpp gateway) - rightid=@vpp.home - right=192.168.10.2 - rightauth=psk - rightsubnet=192.168.3.0/24 -``` - -``/tmp/sswan/ipsec.secrets`` -``` -: PSK 'Vpp123' -``` - -``/tmp/sswan/strongswan.conf`` -``` -charon { - load_modular = yes - plugins { - include strongswan.d/charon/*.conf - } - filelog { - /tmp/charon.log { - time_format = %b %e %T - ike_name = yes - append = no - default = 2 - flush_line = yes - } - } -} -include strongswan.d/*.conf -``` - -Start docker container with strongSwan: - -``` - docker run --name sswan -d --privileged --rm --net=none \ - -v /tmp/sswan:/conf -v /tmp/sswan:/etc/ipsec.d philplckthun/strongswan -``` - -Finish configuration of initiator's private network: - -``` -pid=$(docker inspect --format "{{.State.Pid}}" sswan) -sudo ip link set netns $pid dev swanif - -sudo nsenter -t $pid -n ip addr add 192.168.10.1/24 dev swanif -sudo nsenter -t $pid -n ip link set dev swanif up - -sudo nsenter -t $pid -n ip addr add 192.168.5.2/32 dev lo -sudo nsenter -t $pid -n ip link set dev lo up -``` - -Start VPP ... - -``` -sudo /usr/bin/vpp unix { \ - cli-listen /tmp/vpp.sock \ - gid $(id -g) } \ - api-segment { prefix vpp } \ - plugins { plugin dpdk_plugin.so { disable } } -``` - -... and configure it: - -``` -create host-interface name gw -set interface ip addr host-gw 192.168.10.2/24 -set interface state host-gw up - -create host-interface name priv -set interface ip addr host-priv 192.168.3.1/24 -set interface state host-priv up - -ikev2 profile add pr1 -ikev2 profile set pr1 auth shared-key-mic string Vpp123 -ikev2 profile set pr1 id local fqdn vpp.home -ikev2 profile set pr1 id remote fqdn roadwarrior.vpn.example.com - -ikev2 profile set pr1 traffic-selector local ip-range 192.168.3.0 - 192.168.3.255 port-range 0 - 65535 protocol 0 -ikev2 profile set pr1 traffic-selector remote ip-range 192.168.5.0 - 192.168.5.255 port-range 0 - 65535 protocol 0 - -create ipip tunnel src 192.168.10.2 dst 192.168.10.1 -ikev2 profile set pr1 tunnel ipip0 -ip route add 192.168.5.0/24 via 192.168.10.1 ipip0 -set interface unnumbered ipip0 use host-gw -``` - -Initiate the IKEv2 connection: - -``` -$ sudo docker exec sswan ipsec up initiator - -... -CHILD_SA initiator{1} established with SPIs c320c95f_i 213932c2_o and TS 192.168.5.0/24 === 192.168.3.0/24 -connection 'initiator' established successfully -``` - -``` -vpp# show ikev2 sa details - -iip 192.168.10.1 ispi 7849021d9f655f1b rip 192.168.10.2 rspi 5a9ca7469a035205 - encr:aes-gcm-16 prf:hmac-sha2-256 dh-group:modp-2048 - nonce i:692ce8fd8f1c1934f63bfa2b167c4de2cff25640dffe938cdfe01a5d7f6820e6 - r:3ed84a14ea8526063e5aa762312be225d33e866d7152b9ce23e50f0ededca9e3 - SK_d 9a9b896ed6c35c78134fcd6e966c04868b6ecacf6d5088b4b2aee8b05d30fdda - SK_e i:00000000: 1b1619788d8c812ca5916c07e635bda860f15293099f3bf43e8d88e52074b006 - 00000020: 72c8e3e3 - r:00000000: 89165ceb2cef6a6b3319f437386292d9ef2e96d8bdb21eeb0cb0d3b92733de03 - 00000020: bbc29c50 - SK_p i:fe35fca30985ee75e7c8bc0d7bc04db7a0e1655e997c0f5974c31458826b6fef - r:0dd318662a96a25fcdf4998d8c6e4180c67c03586cf91dab26ed43aeda250272 - identifier (i) id-type fqdn data roadwarrior.vpn.example.com - identifier (r) id-type fqdn data vpp.home - child sa 0:encr:aes-gcm-16 esn:yes - spi(i) c320c95f spi(r) 213932c2 - SK_e i:2a6c9eae9dbed202c0ae6ccc001621aba5bb0b01623d4de4d14fd27bd5185435 - r:15e2913d39f809040ca40a02efd27da298b6de05f67bd8f10210da5e6ae606fb - traffic selectors (i):0 type 7 protocol_id 0 addr 192.168.5.0 - 192.168.5.255 port 0 - 65535 - traffic selectors (r):0 type 7 protocol_id 0 addr 192.168.3.0 - 192.168.3.255 port 0 - 65535 - -``` - -Now we can generate some traffic between responder's and initiator's private networks and see it works. - -``` -$ sudo ip netns exec ns ping 192.168.5.2 -PING 192.168.5.2 (192.168.5.2) 56(84) bytes of data. -64 bytes from 192.168.5.2: icmp_seq=1 ttl=63 time=1.02 ms -64 bytes from 192.168.5.2: icmp_seq=2 ttl=63 time=0.599 ms -``` |