Page MenuHomeVyOS Platform

IPsec ike-group parameters are not saved correctly (after reboot)
Closed, ResolvedPublicBUG

Description

Tested in VyOS 1.3.0-epa3

Create ike-group and save:

vyos@vyos:~$ configure
vyos@vyos# set vpn ipsec ike-group IKE close-action 'none'
vyos@vyos# set vpn ipsec ike-group IKE ikev2-reauth 'no'
vyos@vyos# set vpn ipsec ike-group IKE lifetime '86400'
vyos@vyos# set vpn ipsec ike-group IKE proposal 2 dh-group '2'
vyos@vyos# set vpn ipsec ike-group IKE proposal 2 encryption 'aes128'
vyos@vyos# set vpn ipsec ike-group IKE proposal 2 hash 'sha1'
[edit]
vyos@vyos# commit
vyos@vyos# save

Check config:
vyos@vyos:~$ show configuration commands

set vpn ipsec ike-group IKE close-action 'none'
set vpn ipsec ike-group IKE ikev2-reauth 'no'
set vpn ipsec ike-group IKE lifetime '86400'
set vpn ipsec ike-group IKE proposal 2 dh-group '2'
set vpn ipsec ike-group IKE proposal 2 encryption 'aes128'
set vpn ipsec ike-group IKE proposal 2 hash 'sha1'

Reboot.
Check config after:

set vpn ipsec ike-group IKE close-action 'none'
set vpn ipsec ike-group IKE ikev2-reauth 'no'
set vpn ipsec ike-group IKE key-exchange 'ikev1'
set vpn ipsec ike-group IKE lifetime '86400'
set vpn ipsec ike-group IKE proposal 2 dh-group '2'
set vpn ipsec ike-group IKE proposal 2 encryption 'aes128'
set vpn ipsec ike-group IKE proposal 2 hash 'sha1'

Notice the following NEW lines:
set vpn ipsec ike-group IKE key-exchange 'ikev1'

Details

Version
VyOS 1.3.0-epa3
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

Unknown Object (User) created this task.Nov 18 2021, 3:53 AM
Unknown Object (User) added a comment.Nov 20 2021, 9:39 AM

A feature request was made with a change in behavior:
https://phabricator.vyos.net/T4005
(Feature Request: IPsec IKEv1 + IKEv2 for one peer)

Unknown Object (User) closed this task as Resolved.Nov 20 2021, 9:39 AM
Unknown Object (User) claimed this task.