DMVPN is not working in 1.2
There is an error in NHRP output. It looks like script is using wrong syntax.
[email protected]:/home/ma# opennhrp -v
opennhrp[4359]: OpenNHRP debian/0.14.1-1+vyos2+current1-2-geb8d3d0 starting
opennhrp[4359]: Adding static 10.0.0.1/24 nbma 192.168.100.200 dev tun10
....
Create link from 10.0.0.2 (192.168.100.204) to 10.0.0.1 (192.168.100.200)
10.0.0.2/24
swanctl: invalid option -- 'S'
Error: invalid options
strongSwan 5.5.1 swanctl
usage:
swanctl --terminate --child <name> | --ike <name | --child-id <id> | --ike-id <id>
[--timeout <s>] [--raw|--pretty]
--help (-h) show usage information
--child (-c) terminate by CHILD_SA name
--ike (-i) terminate by IKE_SA name
--child-id (-C) terminate by CHILD_SA reqid
--ike-id (-I) terminate by IKE_SA unique identifier
--timeout (-t) timeout in seconds before detaching
--raw (-r) dump raw response message
--pretty (-P) dump raw response message in pretty print
--loglevel (-l) verbosity of redirected log
--debug (-v) set debug level, default: 1
--options (-+) read command line options from file
--uri (-u) service URI to connect to
swanctl: invalid option -- 'S'
Error: invalid options
strongSwan 5.5.1 swanctl
usage:
swanctl --initiate --child <name> [--timeout <s>] [--raw|--pretty]
--help (-h) show usage information
--child (-c) initate a CHILD_SA configuration
--timeout (-t) timeout in seconds before detaching
--raw (-r) dump raw response message
--pretty (-P) dump raw response message in pretty print
--loglevel (-l) verbosity of redirected log
--debug (-v) set debug level, default: 1
--options (-+) read command line options from file
--uri (-u) service URI to connect to
opennhrp[4359]: [10.0.0.1] Peer up script failed: exitstatus 1
[email protected]:/home/ma# cat /etc/opennhrp/opennhrp-script
!/bin/sh
_nhrp_config="/etc/opennhrp/opennhrp.conf"
_nhrp_ipsec="/etc/opennhrp/opennhrp.ipsec"
_strongswan_pid="/var/run/charon.pid"
_type="hub"
if ! grep "$NHRP_INTERFACE" $_nhrp_config | grep "hub"> /dev/null 2>&1; then
_type="spoke"
fi
case $1 in
interface-up)
ip route flush proto 42 dev $NHRP_INTERFACE
ip neigh flush dev $NHRP_INTERFACE
echo "int up"
;;
peer-register)
;;
peer-up)
if [ -n "$NHRP_DESTMTU" ]; then
ARGS=ip route get $NHRP_DESTNBMA from $NHRP_SRCNBMA | head -1
ip route add $ARGS proto 42 mtu $NHRP_DESTMTU
fi
echo "Create link from $NHRP_SRCADDR ($NHRP_SRCNBMA) to $NHRP_DESTADDR ($NHRP_DESTNBMA)"
if ( ${_type} == "spoke" ) && ( -e ${_strongswan_pid} ); then
if grep "${NHRP_SRCADDR}" "${_nhrp_ipsec}"; then
swanctl -t -S $NHRP_SRCNBMA -R $NHRP_DESTNBMA /dev/null 2>&1
- PROBLEM IS HERE --------
-------WRONG SYNTAX-----------
swanctl -i -c dmvpn -S $NHRP_SRCNBMA -R $NHRP_DESTNBMA || exit 1
- END PROBLEM IS HERE ---------
echo "peer-up error" fi
fi
;;
peer-down)
echo "Delete link from $NHRP_SRCADDR ($NHRP_SRCNBMA) to $NHRP_DESTADDR ($NHRP_DESTNBMA)"
if ( ${_type} == "spoke" ) && ( -e ${_strongswan_pid} ); then
swanctl -t -S $NHRP_SRCNBMA -R $NHRP_DESTNBMA || exit 1
echo "peer-down error"
fi
ip route del $NHRP_DESTNBMA src $NHRP_SRCNBMA proto 42
;;
route-up)
echo "Route $NHRP_DESTADDR/$NHRP_DESTPREFIX is up"
ip route replace $NHRP_DESTADDR/$NHRP_DESTPREFIX proto 42 via $NHRP_NEXTHOP dev $NHRP_INTERFACE
ip route flush cache
;;
route-down)
echo "Route $NHRP_DESTADDR/$NHRP_DESTPREFIX is down"
ip route del $NHRP_DESTADDR/$NHRP_DESTPREFIX proto 42
ip route flush cache
;;
esac
exit 0