blob: 40da137cbd2d38ae31474384a3456830c17335ff (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
|
VPP as IKEv2 initiator and strongSwan as responder
==================================================
Prerequisites
-------------
To make the examples easier to configure ``docker`` it is required to pull strongSwan docker image. The networking is done using Linux' veth interfaces and namespaces.
Setup
-----
First a topology:
```
192.168.3.2 192.168.5.2
+ loopback
| +
+----+----+ 192.168.10.2 +-----+----+
| VPP | |strongSwan|
|initiator+----------------------+responder |
+---------+ +----------+
192.168.10.1
```
Create veth interfaces and namespaces and configure them:
```
sudo ip link add gw type veth peer name swanif
sudo ip link set dev gw up
sudo ip netns add ns
sudo ip link add veth_priv type veth peer name priv
sudo ip link set dev priv up
sudo ip link set dev veth_priv up netns ns
sudo ip netns exec ns \
bash -c "
ip link set dev lo up
ip addr add 192.168.3.2/24 dev veth_priv
ip route add 192.168.5.0/24 via 192.168.3.1"
```
Create directory with strongswan configs that will be mounted to the docker container
```
mkdir /tmp/sswan
```
Create the ``ipsec.conf`` file in the ``/tmp/sswan`` directory with following content:
```
config setup
strictcrlpolicy=no
conn initiator
mobike=no
auto=add
type=tunnel
keyexchange=ikev2
ike=aes256gcm16-prfsha256-modp2048!
esp=aes256gcm16-esn!
# local:
leftauth=psk
leftid=@sswan.vpn.example.com
leftsubnet=192.168.5.0/24
# remote: (gateway)
rightid=@roadwarrior.vpp
right=192.168.10.2
rightauth=psk
rightsubnet=192.168.3.0/24
```
``/tmp/sswan/ipsec.secrets``
```
: PSK 'Vpp123'
```
``/tmp/sswan/strongswan.conf``
```
charon {
load_modular = yes
plugins {
include strongswan.d/charon/*.conf
}
filelog {
/tmp/charon.log {
time_format = %b %e %T
ike_name = yes
append = no
default = 2
flush_line = yes
}
}
}
include strongswan.d/*.conf
```
Start docker container with strongSwan:
```
docker run --name sswan -d --privileged --rm --net=none \
-v /tmp/sswan:/conf -v /tmp/sswan:/etc/ipsec.d philplckthun/strongswan
```
Finish configuration of initiator's private network:
```
pid=$(docker inspect --format "{{.State.Pid}}" sswan)
sudo ip link set netns $pid dev swanif
sudo nsenter -t $pid -n ip addr add 192.168.10.1/24 dev swanif
sudo nsenter -t $pid -n ip link set dev swanif up
sudo nsenter -t $pid -n ip addr add 192.168.5.2/32 dev lo
sudo nsenter -t $pid -n ip link set dev lo up
```
Start VPP ...
```
sudo /usr/bin/vpp unix { \
cli-listen /tmp/vpp.sock \
gid $(id -g) } \
api-segment { prefix vpp } \
plugins { plugin dpdk_plugin.so { disable } }
```
... and configure it:
```
create host-interface name gw
set interface ip addr host-gw 192.168.10.2/24
set interface state host-gw up
create host-interface name priv
set interface ip addr host-priv 192.168.3.1/24
set interface state host-priv up
ikev2 profile add pr1
ikev2 profile set pr1 auth shared-key-mic string Vpp123
ikev2 profile set pr1 id local fqdn roadwarrior.vpp
ikev2 profile set pr1 id remote fqdn sswan.vpn.example.com
ikev2 profile set pr1 traffic-selector local ip-range 192.168.3.0 - 192.168.3.255 port-range 0 - 65535 protocol 0
ikev2 profile set pr1 traffic-selector remote ip-range 192.168.5.0 - 192.168.5.255 port-range 0 - 65535 protocol 0
ikev2 profile set pr1 responder host-gw 192.168.10.1
ikev2 profile set pr1 ike-crypto-alg aes-gcm-16 256 ike-dh modp-2048
ikev2 profile set pr1 esp-crypto-alg aes-gcm-16 256
create ipip tunnel src 192.168.10.2 dst 192.168.10.1
ikev2 profile set pr1 tunnel ipip0
ip route add 192.168.5.0/24 via 192.168.10.1 ipip0
set interface unnumbered ipip0 use host-gw
```
Initiate the IKEv2 connection:
```
vpp# ikev2 initiate sa-init pr1
```
```
vpp# show ikev2 sa details
iip 192.168.10.2 ispi f717b0cbd17e27c3 rip 192.168.10.1 rspi e9b7af7fc9b13361
encr:aes-gcm-16 prf:hmac-sha2-256 dh-group:modp-2048
nonce i:eb0354613b268c6372061bbdaab13deca37c8a625b1f65c073d25df2ecfe672e
r:70e1248ac09943047064f6a2135fa2a424778ba03038ab9c4c2af8aba179ed84
SK_d 96bd4feb59be2edf1930a12a3a5d22e30195ee9f56ea203c5fb6cba5dd2bb80f
SK_e i:00000000: 5b75b9d808c8467fd00a0923c06efee2a4eb1d033c57532e05f9316ed9c56fe9
00000020: c4db9114
r:00000000: 95121b63372d20b83558dc3e209b9affef042816cf071c86a53543677b40c15b
00000020: f169ab67
SK_p i:fb40d1114c347ddc3228ba004d4759d58f9c1ae6f1746833f908d39444ef92b1
r:aa049828240cb242e1d5aa625cd5914dc8f8e980a74de8e06883623d19384902
identifier (i) id-type fqdn data roadwarrior.vpp
identifier (r) id-type fqdn data sswan.vpn.example.com
child sa 0:encr:aes-gcm-16 esn:yes
spi(i) 9dffd57a spi(r) c4e0ef53
SK_e i:290c681694f130b33d511335dd257e78721635b7e8aa87930dd77bb1d6dd3f42
r:0a09fa18cf1cf65c6324df02b46dcc998b84e5397cf911b63e0c096053946c2e
traffic selectors (i):0 type 7 protocol_id 0 addr 192.168.3.0 - 192.168.3.255 port 0 - 65535
traffic selectors (r):0 type 7 protocol_id 0 addr 192.168.5.0 - 192.168.5.255 port 0 - 65535
```
Now we can generate some traffic between responder's and initiator's private networks and see it works.
```
$ sudo ip netns exec ns ping 192.168.5.2
PING 192.168.5.2 (192.168.5.2) 56(84) bytes of data.
64 bytes from 192.168.5.2: icmp_seq=1 ttl=63 time=0.450 ms
64 bytes from 192.168.5.2: icmp_seq=2 ttl=63 time=0.630 ms
```
|
