Page MenuHomeVyOS Platform
Create Task
Maniphest T5715

IPSec VPN: restart vpn is not working
Closed, ResolvedPublicBUG
Actions

Description

IPsec VPN op command "restart vpn" is not working even though the ipsec process is running.

vyos@vyos:~$ restart vpn
IPsec VPN not configured


vyos@vyos:~$ show vpn ike sa
Peer ID / IP                            Local ID / IP
------------                            -------------
10.217.80.110                           10.217.80.94

    State  IKEVer  Encrypt  Hash    D-H Group      NAT-T  A-Time  L-Time
    -----  ------  -------  ----    ---------      -----  ------  ------
    up     IKEv2   aes256   sha1_96 2(MODP_1024)   no     3600    86400



vyos@vyos:~$ show vpn ipsec status
IPSec Process Running PID: 1878

1 Active IPsec Tunnels

IPsec Interfaces :
        eth0    (10.217.80.94)

vyos@vyos:~$ show vpn ipsec sa
Connection                   State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
---------------------------  -------  --------  --------------  ----------------  ----------------  -----------  ----------------------------------
peer-10.217.80.110-tunnel-0  up       8m58s     0B/0B           0/0               10.217.80.110     N/A          AES_CBC_256/HMAC_SHA1_96/MODP_1024

Details

Difficulty level
Unknown (require assessment)
Version
VyOS 1.3.4
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Unspecified (please specify)

Related Objects

Mentioned In
1.3.6

Event Timeline

SrividyaA created this task.Nov 5 2023, 8:45 AM
pasik added a subscriber: pasik.Nov 5 2023, 10:06 AM
Viacheslav edited projects, added VyOS 1.3 Equuleus (1.3.5); removed VyOS 1.3 Equuleus (1.3.4).Nov 6 2023, 8:30 AM
giga1699 added a subscriber: giga1699.Nov 6 2023, 7:40 PM

I’m also seeing this error after the update to 1.3.4

giga1699 added a comment.Nov 8 2023, 4:46 AM

It looks like maybe there’s just some op mode command changes.

I found that “reset vpn ipsec-peer <ip/id>” did flap a peer. This won’t reset all peers at once, however.

SrividyaA added a comment.Nov 8 2023, 10:13 AM

submitted PR: https://github.com/vyos/vyatta-op-vpn/pull/37

Viacheslav changed the task status from Open to In progress.Nov 8 2023, 4:34 PM
Viacheslav assigned this task to SrividyaA.
syncer edited projects, added VyOS 1.3 Equuleus (1.3.6); removed VyOS 1.3 Equuleus (1.3.5).Dec 17 2023, 11:36 PM
Viacheslav added a subscriber: Viacheslav.Dec 21 2023, 1:54 PM

@SrividyaA could you re-check and close it?

fernando added a subscriber: fernando.Dec 27 2023, 8:12 PM

this fix is not merge yet : https://github.com/vyos/vyatta-op-vpn/pull/37

SrividyaA added a comment.Dec 28 2023, 7:49 AM

Tested in 1.3.5, the issue still exist as stated by @fernando

vyos@vyos# run restart vpn
IPsec VPN not configured
[edit]
vyos@vyos# run sh vpn ike sa
Peer ID / IP                            Local ID / IP
------------                            -------------
10.xx.xx.110                           10.xx.xx.94

    State  IKEVer  Encrypt  Hash    D-H Group      NAT-T  A-Time  L-Time
    -----  ------  -------  ----    ---------      -----  ------  ------
    up   IKEv1   n/a      n/a     n/a(n/a)       no     0       n/a


vyos@vyos# run sh ver

Version:          VyOS 1.3.5
Release train:    equuleus

Built by:         Sentrium S.L.
Built on:         Mon 04 Dec 2023 21:36 UTC
Build UUID:       c459bdc8-b253-4e7d-af80-d21e91402e20
Build commit ID:  d5f3d5002ffbe9

Architecture:     x86_64
Boot via:         installed image
System type:      KVM guest

Hardware vendor:  QEMU
Hardware model:   Standard PC (i440FX + PIIX, 1996)
Hardware S/N:
Hardware UUID:    eb8135f4-4c76-4203-be4e-c2dd51112195

Copyright:        VyOS maintainers and contributors
[edit]
Viacheslav added a comment.Jan 12 2024, 5:47 PM

PR https://github.com/vyos/vyatta-op-vpn/pull/38

Viacheslav triaged this task as Unbreak Now! priority.Jan 12 2024, 5:47 PM
Viacheslav closed this task as Resolved.Jan 14 2024, 6:54 PM
Viacheslav moved this task from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.6) board.
dmbaturin mentioned this in 1.3.6.Feb 3 2024, 1:59 AM