I've been doing some debugging of dmvpn on vyos1.2
After compiling the vyos-stronswan repository patched by UnicronNL on 17Aug2018 the code seems to be going and a opennhrp is able to create and teardown ipsec sessions on peer-up/peer-down
but there is still some things thats missing before DMVPN is up and running.
There is a typo in /etc/opennhrp/opennhrp-script on line 27? . a missing > in front of /dev/null
to ease debugging of opennhrp bringup/teardown i've added debug info to opennhrp-script: https://pastebin.com/AiVTHzNH
all output from swanctl is not logged into /tmp/opennhrp
when strongswan is configured the swanctl connection profile is not loaded. this has to be done manually for now with : sudo swanctl --load-all
When all of this is done swanctl tries to load the connection profile when the opennhrp script tries to configure the neighbor bit failes with: no acceptable traffic selectors found .
(from /tmp/opennhrp:
Create link from 172.16.2.2 (xx.xx.xx.xx) to 172.16.2.254 (yy.yy.yy.yy) swanctl -t -S xx.xx.xx.xx -R yy.yy.yy.yy terminate failed: no matching SAs to terminate found swanctl -i -c dmvpn -S xx.xx.xx.xx -R yy.yy.yy.yy initiate failed: establishing CHILD_SA 'dmvpn' failed [IKE] initiating Main Mode IKE_SA vpnprof-dmvpn-tun10[1] to yy.yy.yy.yy [ENC] generating ID_PROT request 0 [ SA V V V V V ] [NET] sending packet: from xx.xx.xx.xx[500] to yy.yy.yy.yy[500] (180 bytes) [NET] received packet: from yy.yy.yy.yy[500] to xx.xx.xx.xx[500] (176 bytes) [ENC] parsed ID_PROT response 0 [ SA V V V V V ] [IKE] received strongSwan vendor ID [IKE] received Cisco Unity vendor ID [IKE] received XAuth vendor ID [IKE] received DPD vendor ID [IKE] received NAT-T (RFC 3947) vendor ID [ENC] generating ID_PROT request 0 [ KE No NAT-D NAT-D ] [NET] sending packet: from xx.xx.xx.xx[500] to yy.yy.yy.yy[500] (244 bytes) [NET] received packet: from yy.yy.yy.yy[500] to xx.xx.xx.xx[500] (228 bytes) [ENC] parsed ID_PROT response 0 [ KE No NAT-D NAT-D ] [ENC] generating ID_PROT request 0 [ ID HASH ] [NET] sending packet: from xx.xx.xx.xx[500] to yy.yy.yy.yy[500] (76 bytes) [NET] received packet: from yy.yy.yy.yy[500] to xx.xx.xx.xx[500] (76 bytes) [ENC] parsed ID_PROT response 0 [ ID HASH ] [IKE] IKE_SA vpnprof-dmvpn-tun10[1] established between xx.xx.xx.xx[xx.xx.xx.xx]...yy.yy.yy.yy[yy.yy.yy.yy] [IKE] scheduling rekeying in 3590s [IKE] maximum IKE_SA lifetime 3950s [ENC] generating QUICK_MODE request 1138715168 [ HASH SA No ID ID ] [NET] sending packet: from xx.xx.xx.xx[500] to yy.yy.yy.yy[500] (172 bytes) [NET] received packet: from yy.yy.yy.yy[500] to xx.xx.xx.xx[500] (156 bytes) [ENC] parsed QUICK_MODE response 1138715168 [ HASH SA No ID ID ] [IKE] no acceptable traffic selectors found Exited with returncode: 1, adding peer aborted
as far as i can se the traffic selector is loaded and all should be good.
$ sudo swanctl --list-conn vpnprof-dmvpn-tun10: IKEv1, reauthentication every 3600s local: %any remote: %any local pre-shared key authentication: id: xx.xx.xx.xx remote pre-shared key authentication: dmvpn: TUNNEL, rekeying every 1800s local: dynamic[gre] remote: dynamic[gre]
could it be any more code in strongswan that need patching?