summaryrefslogtreecommitdiffstats
path: root/docs/usecases/ikev2/vpp_resp_sswan_init.rst
blob: 9f3c7e7cbaf5ffa8eea89e68dd76779fa2bc007f (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
VPP as IKEv2 responder and strongSwan as initiator
==================================================

Prerequisites
-------------

To make the examples easier to configure ``docker`` it is required to
pull strongSwan docker image. The networking is done using Linux’ veth
interfaces and namespaces.

Setup
-----

First a topology:

::

   192.168.3.2                      192.168.5.2
        +                           loopback
        |                                 +
   +----+----+ 192.168.10.2         +-----+----+
   |  VPP    |                      |initiator |
   |responder+----------------------+strongSwan|
   +---------+                      +----------+
                        192.168.10.1

Create veth interfaces and namespaces and configure them:

::

   sudo ip link add gw type veth peer name swanif
   sudo ip link set dev gw up

   sudo ip netns add ns
   sudo ip link add veth_priv type veth peer name priv
   sudo ip link set dev priv up
   sudo ip link set dev veth_priv up netns ns

   sudo ip netns exec ns \
     bash -c "
       ip link set dev lo up
       ip addr add 192.168.3.2/24 dev veth_priv
       ip route add 192.168.5.0/24 via 192.168.3.1"

Create directory with strongswan configs that will be mounted to the
docker container

::

   mkdir /tmp/sswan

Create the ``ipsec.conf`` file in the ``/tmp/sswan`` directory with
following content:

::

   config setup
    strictcrlpolicy=no

   conn initiator
    mobike=no
    auto=add
    type=tunnel
    keyexchange=ikev2
    ike=aes256gcm16-prfsha256-modp2048!
    esp=aes256gcm16-esn!

    # local:
    leftauth=psk
    leftid=@roadwarrior.vpn.example.com
    leftsubnet=192.168.5.0/24

    # remote: (vpp gateway)
    rightid=@vpp.home
    right=192.168.10.2
    rightauth=psk
    rightsubnet=192.168.3.0/24

``/tmp/sswan/ipsec.secrets``

::

   : PSK 'Vpp123'

``/tmp/sswan/strongswan.conf``

::

   charon {
     load_modular = yes
     plugins {
       include strongswan.d/charon/*.conf
     }
     filelog {
       /tmp/charon.log {
         time_format = %b %e %T
         ike_name = yes
         append = no
         default = 2
         flush_line = yes
       }
     }
   }
   include strongswan.d/*.conf

Start docker container with strongSwan:

::

    docker run --name sswan -d --privileged --rm --net=none \
     -v /tmp/sswan:/conf -v /tmp/sswan:/etc/ipsec.d philplckthun/strongswan

Finish configuration of initiator’s private network:

::

   pid=$(docker inspect --format "{{.State.Pid}}" sswan)
   sudo ip link set netns $pid dev swanif

   sudo nsenter -t $pid -n ip addr add 192.168.10.1/24 dev swanif
   sudo nsenter -t $pid -n ip link set dev swanif up

   sudo nsenter -t $pid -n ip addr add 192.168.5.2/32 dev lo
   sudo nsenter -t $pid -n ip link set dev lo up

Start VPP …

::

   sudo /usr/bin/vpp unix { \
         cli-listen /tmp/vpp.sock \
         gid $(id -g) } \
         api-segment { prefix vpp } \
         plugins { plugin dpdk_plugin.so { disable } }

… and configure it:

::

   create host-interface name gw
   set interface ip addr host-gw 192.168.10.2/24
   set interface state host-gw up

   create host-interface name priv
   set interface ip addr host-priv 192.168.3.1/24
   set interface state host-priv up

   ikev2 profile add pr1
   ikev2 profile set pr1 auth shared-key-mic string Vpp123
   ikev2 profile set pr1 id local fqdn vpp.home
   ikev2 profile set pr1 id remote fqdn roadwarrior.vpn.example.com

   ikev2 profile set pr1 traffic-selector local ip-range 192.168.3.0 - 192.168.3.255 port-range 0 - 65535 protocol 0
   ikev2 profile set pr1 traffic-selector remote ip-range 192.168.5.0 - 192.168.5.255 port-range 0 - 65535 protocol 0

   create ipip tunnel src 192.168.10.2 dst 192.168.10.1
   ikev2 profile set pr1 tunnel ipip0
   ip route add 192.168.5.0/24 via 192.168.10.1 ipip0
   set interface unnumbered ipip0 use host-gw

Initiate the IKEv2 connection:

::

   $ sudo docker exec sswan ipsec up initiator

   ...
   CHILD_SA initiator{1} established with SPIs c320c95f_i 213932c2_o and TS 192.168.5.0/24 === 192.168.3.0/24
   connection 'initiator' established successfully

::

   vpp# show ikev2 sa details

   iip 192.168.10.1 ispi 7849021d9f655f1b rip 192.168.10.2 rspi 5a9ca7469a035205
    encr:aes-gcm-16 prf:hmac-sha2-256  dh-group:modp-2048
    nonce i:692ce8fd8f1c1934f63bfa2b167c4de2cff25640dffe938cdfe01a5d7f6820e6
          r:3ed84a14ea8526063e5aa762312be225d33e866d7152b9ce23e50f0ededca9e3
    SK_d    9a9b896ed6c35c78134fcd6e966c04868b6ecacf6d5088b4b2aee8b05d30fdda
    SK_e  i:00000000: 1b1619788d8c812ca5916c07e635bda860f15293099f3bf43e8d88e52074b006
            00000020: 72c8e3e3
          r:00000000: 89165ceb2cef6a6b3319f437386292d9ef2e96d8bdb21eeb0cb0d3b92733de03
            00000020: bbc29c50
    SK_p  i:fe35fca30985ee75e7c8bc0d7bc04db7a0e1655e997c0f5974c31458826b6fef
          r:0dd318662a96a25fcdf4998d8c6e4180c67c03586cf91dab26ed43aeda250272
    identifier (i) id-type fqdn data roadwarrior.vpn.example.com
    identifier (r) id-type fqdn data vpp.home
      child sa 0:encr:aes-gcm-16  esn:yes
       spi(i) c320c95f spi(r) 213932c2
       SK_e  i:2a6c9eae9dbed202c0ae6ccc001621aba5bb0b01623d4de4d14fd27bd5185435
             r:15e2913d39f809040ca40a02efd27da298b6de05f67bd8f10210da5e6ae606fb
       traffic selectors (i):0 type 7 protocol_id 0 addr 192.168.5.0 - 192.168.5.255 port 0 - 65535
       traffic selectors (r):0 type 7 protocol_id 0 addr 192.168.3.0 - 192.168.3.255 port 0 - 65535

Now we can generate some traffic between responder’s and initiator’s
private networks and see it works.

::

   $ sudo ip netns exec ns ping 192.168.5.2
   PING 192.168.5.2 (192.168.5.2) 56(84) bytes of data.
   64 bytes from 192.168.5.2: icmp_seq=1 ttl=63 time=1.02 ms
   64 bytes from 192.168.5.2: icmp_seq=2 ttl=63 time=0.599 ms