Page MenuHomeVyOS Platform
Create Task
Maniphest T2701

`vpn ipsec pfs enable` doesn't work with IKE groups
Closed, ResolvedPublicBUG
Actions

Description

VPN IPsec pfs 'enabled' don't work with IKEA-groups.

Configurarion

set interfaces ethernet eth0 address '192.168.122.11/24'
set interfaces vti vti10 address '10.0.0.1/32'

set vpn ipsec esp-group AES256-SHA1 compression 'disable'
set vpn ipsec esp-group AES256-SHA1 lifetime '3600'
set vpn ipsec esp-group AES256-SHA1 mode 'tunnel'
set vpn ipsec esp-group AES256-SHA1 pfs 'enable'
set vpn ipsec esp-group AES256-SHA1 proposal 10 encryption 'aes256'
set vpn ipsec esp-group AES256-SHA1 proposal 10 hash 'sha1'

set vpn ipsec ike-group AES256-SHA1-dh2 close-action 'none'
set vpn ipsec ike-group AES256-SHA1-dh2 ikev2-reauth 'no'
set vpn ipsec ike-group AES256-SHA1-dh2 key-exchange 'ikev2'
set vpn ipsec ike-group AES256-SHA1-dh2 lifetime '86400'
set vpn ipsec ike-group AES256-SHA1-dh2 proposal 10 dh-group '2'
set vpn ipsec ike-group AES256-SHA1-dh2 proposal 10 encryption 'aes256'
set vpn ipsec ike-group AES256-SHA1-dh2 proposal 10 hash 'sha1'

set vpn ipsec ipsec-interfaces interface 'eth0'
set vpn ipsec site-to-site peer 192.168.122.12 authentication id '192.168.122.11'
set vpn ipsec site-to-site peer 192.168.122.12 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 192.168.122.12 authentication pre-shared-secret 'redacted'
set vpn ipsec site-to-site peer 192.168.122.12 authentication remote-id '192.168.122.12'
set vpn ipsec site-to-site peer 192.168.122.12 connection-type 'initiate'
set vpn ipsec site-to-site peer 192.168.122.12 description 'redacted'
set vpn ipsec site-to-site peer 192.168.122.12 ike-group 'AES256-SHA1-dh2'
set vpn ipsec site-to-site peer 192.168.122.12 ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer 192.168.122.12 local-address '192.168.122.11'
set vpn ipsec site-to-site peer 192.168.122.12 vti bind 'vti10'
set vpn ipsec site-to-site peer 192.168.122.12 vti esp-group 'AES256-SHA1'

Logs

[email protected]:~$ sudo journalctl -f /usr/lib/ipsec/charon
-- Logs begin at Mon 2020-07-13 13:57:09 EEST. --
Jul 13 15:41:11 r1 charon[10915]: 09[CFG] rereading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
Jul 13 15:41:11 r1 charon[10915]: 09[CFG] rereading attribute certificates from '/etc/ipsec.d/acerts'
Jul 13 15:41:11 r1 charon[10915]: 09[CFG] rereading crls from '/etc/ipsec.d/crls'
Jul 13 15:41:11 r1 charon[10915]: 11[CFG] received stroke: delete connection 'peer-192.168.122.12-tunnel-vti'
Jul 13 15:41:11 r1 charon[10915]: 11[CFG] connection 'peer-192.168.122.12-tunnel-vti' not found
Jul 13 15:41:11 r1 charon[10915]: 13[CFG] received stroke: add connection 'peer-192.168.122.12-tunnel-vti'
Jul 13 15:41:11 r1 charon[10915]: 13[CFG] algorithm 'unknown' not recognized
Jul 13 15:41:11 r1 charon[10915]: 13[CFG] skipped invalid proposal string: aes256-sha1-unknown
Jul 13 15:41:11 r1 charon[10915]: 15[CFG] received stroke: initiate 'peer-192.168.122.12-tunnel-vti'
Jul 13 15:41:11 r1 charon[10915]: 15[CFG] no config named 'peer-192.168.122.12-tunnel-vti'

The workaround, configuration change to

set vpn ipsec esp-group AES256-SHA1 pfs dh-group2

Details

Difficulty level
Normal (likely a few hours)
Version
VyOS 1.2.5
Why the issue appeared?
Implementation mistake
Is it a breaking change?
Perfectly compatible

Event Timeline

Viacheslav created this task.Jul 13 2020, 12:51 PM
zsdc changed the task status from Open to In progress.Jul 13 2020, 4:13 PM
zsdc claimed this task.
zsdc added a subscriber: zsdc.

https://github.com/vyos/vyatta-cfg-vpn/pull/34

pasik added a subscriber: pasik.Jul 13 2020, 5:25 PM
dmbaturin closed this task as Resolved.Jul 30 2020, 2:57 PM
dmbaturin edited projects, added VyOS 1.2 Crux (VyOS 1.2.6), VyOS 1.3 Equuleus; removed VyOS 1.2 Crux.
dmbaturin changed Difficulty level from Unknown (require assessment) to Normal (likely a few hours).
dmbaturin changed Why the issue appeared? from Will be filled on close to Implementation mistake.
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.
c-po moved this task from Need Triage to Finished on the VyOS 1.3 Equuleus board.Aug 3 2020, 2:13 PM
dmbaturin renamed this task from VPN ipsec pfs "enabled" don't work with IKEA-groups to VPN ipsec pfs "enabled" doesn't work with IKE groups.Sep 7 2020, 9:44 PM
erkin renamed this task from VPN ipsec pfs "enabled" doesn't work with IKE groups to `vpn ipsec pfs enable` doesn't work with IKE groups.Sep 9 2020, 1:03 PM
syncer moved this task from Needs Triage to Finished on the VyOS 1.2 Crux (VyOS 1.2.6) board.Sep 9 2020, 5:24 PM
syncer edited projects, added VyOS 1.3 Equuleus (1.3.0); removed VyOS 1.3 Equuleus.Aug 29 2022, 7:13 PM
syncer moved this task from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.0) board.