Page MenuHomeVyOS Platform
Create Task
Maniphest T6084

OpenNHRP DMVPN configuration file clean after reboot if we have any IPSec configuration
Closed, ResolvedPublicBUG
Actions

Description

OpenNHRP DMVPN configuration fuile clean after reboot if we have any IPSec configuration
To reproduce:

set interfaces ethernet eth1 address '192.0.2.14/24'
set interfaces ethernet eth1 description 'WAN'

set vpn ipsec esp-group group-ESP lifetime '3600'
set vpn ipsec esp-group group-ESP mode 'tunnel'
set vpn ipsec esp-group group-ESP pfs 'dh-group14'
set vpn ipsec esp-group group-ESP proposal 10 encryption 'aes128'
set vpn ipsec esp-group group-ESP proposal 10 hash 'sha1'
set vpn ipsec ike-group group-IKE close-action 'none'
set vpn ipsec ike-group group-IKE disable-mobike
set vpn ipsec ike-group group-IKE key-exchange 'ikev2'
set vpn ipsec ike-group group-IKE lifetime '28000'
set vpn ipsec ike-group group-IKE proposal 10 dh-group '14'
set vpn ipsec ike-group group-IKE proposal 10 encryption 'aes256gcm128'
set vpn ipsec ike-group group-IKE proposal 10 hash 'sha1'
set vpn ipsec interface 'eth1'

set interfaces tunnel tun100 address '192.168.250.4/24'
set interfaces tunnel tun100 encapsulation 'gre'
set interfaces tunnel tun100 parameters ip key '1'
set interfaces tunnel tun100 source-address '192.0.2.14'

set protocols nhrp tunnel tun100 cisco-authentication 'secret'
set protocols nhrp tunnel tun100 holding-time '30'
set protocols nhrp tunnel tun100 multicast 'dynamic'
set protocols nhrp tunnel tun100 redirect
set protocols nhrp tunnel tun100 shortcut

Check config before the reboot:

vyos@r1-right# cat /run/opennhrp/opennhrp.conf 
# Created by VyOS - manual changes will be overwritten

interface tun100 #hub 
    cisco-authentication secret
    holding-time 30
    multicast dynamic
    redirect
    shortcut

[edit]
vyos@r1-right# 
[edit]
vyos@r1-right# save
[edit]
vyos@r1-right# run reboot now

Broadcast message from root@r1-right on pts/1 (Fri 2024-03-01 15:46:09 EET):

The system will reboot now!

After reboot the file is clean:

vyos@r1-right:~$ cat /run/opennhrp/opennhrp.conf 
# Created by VyOS - manual changes will be overwritten

vyos@r1-right:~$

Wihout vpn ipsec configuration, the file looks good.

Details

Difficulty level
Unknown (require assessment)
Version
VyOS 1.4.0-epa1
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Related Objects

Event Timeline

Viacheslav triaged this task as High priority.Mar 1 2024, 1:48 PM
Viacheslav created this task.
Viacheslav updated the task description. (Show Details)Mar 1 2024, 1:51 PM
Viacheslav added a project: VyOS 1.5 Circinus.Mar 1 2024, 1:59 PM
Viacheslav mentioned this in T5903: NHRP don´t start on reboot from version 1.5-rolling-202401010026.Mar 2 2024, 9:47 AM
Viacheslav renamed this task from OpenNHRP DMVPN configuration clean after reboot if we have any IPSec configuration to OpenNHRP DMVPN configuration file clean after reboot if we have any IPSec configuration.Mar 2 2024, 11:22 AM
Viacheslav updated the task description. (Show Details)
Viacheslav added a comment.Mar 2 2024, 12:51 PM

If I comment out this line then everything works.

pasik added a subscriber: pasik.Mar 2 2024, 9:43 PM
Viacheslav added a comment.Mar 4 2024, 10:35 AM

PR https://github.com/vyos/vyos-1x/pull/3079

Viacheslav changed the task status from Open to Needs testing.Mar 4 2024, 5:29 PM
Viacheslav added a comment.Mar 5 2024, 10:31 AM

For 1.5 fix works as expected

vyos@r4:~$ cat /run/opennhrp/opennhrp.conf
# Created by VyOS - manual changes will be overwritten

interface tun100 #hub 
    cisco-authentication secret
    holding-time 30
    multicast dynamic
    redirect
    shortcut

vyos@r4:~$
Viacheslav claimed this task.Mar 5 2024, 10:31 AM
Viacheslav moved this task from Need Triage to Finished on the VyOS 1.5 Circinus board.
Viacheslav closed this task as Resolved.Mar 7 2024, 7:54 AM
Viacheslav moved this task from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa1) board.
dmbaturin edited projects, added VyOS 1.4 Sagitta (1.4.0-epa2); removed VyOS 1.4 Sagitta (1.4.0-epa1).Mar 11 2024, 6:54 PM