8

I'm setting up a VPN using strongSwan between a Linux instance on an Amazon EC2 instance and a remote network via its Cisco concentrator. I need to route packets from the Linux instance itself a machine in the remote subnet.

The connection is established OK, but no packets are routed.

I think I need to set up some specific routing rules, how should I go about doing that?

Software

  • Linux kernel 3.5.0-41,
  • Ubuntu 12.10,
  • strongSwan 5.1.1 (built from source),
  • iptables - no rules.

Network

Local

  • Amazon Elastic IP: 56.x.x.x
  • Public facing LAN IP: 172.x.x.x
  • Local virtual subnet: 10.254.0.0/16
  • Local virtual IP: 10.254.5.174

Remote

  • Public IP of Cisco concentrator: 62.x.x.x
  • Remote subnet: 10.192.0.0/12

Configuration

ipsec.conf

config setup

conn %default
    keyexchange = ikev1
    type = tunnel
    ikelifetime = 86400
    keylife = 28800
    keyingtries = %forever
    esp = 3des-sha
    ike = 3des-md5-modp1024
    forceencaps = yes
    leftauth = psk
    rightauth = psk

conn myconnection
    left = 172.x.x.x
    leftsubnet = 10.254.0.0/16
    leftsourceip = 10.254.5.174
    leftfirewall = yes
    right = 62.x.x.x
    rightsubnet = 10.192.0.0/12
    auto = route

include /var/lib/strongswan/ipsec.conf.inc

strongswan.conf

charon {
    cisco_unity             = yes
    install_routes          = yes
    install_virtual_ip      = yes
    threads                 = 16
    plugins {
        sql {
            loglevel = -1
        }
    }

    filelog {
        /var/log/charon.log {
            time_format = %b %e %T
            default = 3
            flush_line = yes
        }
    }
}

pluto {
}

libstrongswan {
}

ipsec statusall

# ipsec statusall
Status of IKE charon daemon (strongSwan 5.1.1, Linux 3.5.0-41-generic, x86_64):
  uptime: 4 days, since Jan 22 14:24:08 2014
  malloc: sbrk 270336, mmap 0, used 222672, free 47664
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 3445
  loaded plugins: charon aes des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic
Listening IP addresses:
  172.x.x.x
  54.x.x.x
Connections:
    smsbrick:  172.x.x.x...62.x.x.x  IKEv1
    smsbrick:   local:  [172.x.x.x] uses pre-shared key authentication
    smsbrick:   remote: [62.x.x.x] uses pre-shared key authentication
    smsbrick:   child:  10.254.0.0/16 === 10.192.0.0/12 TUNNEL
Routed Connections:
    smsbrick{1}:  ROUTED, TUNNEL
    smsbrick{1}:   10.254.0.0/16 === 10.192.0.0/12 
Security Associations (1 up, 0 connecting):
    smsbrick[8150]: ESTABLISHED 1 second ago,    172.x.x.x[172.x.x.x]...62.x.x.x[62.x.x.x]
    smsbrick[8150]: IKEv1 SPIs: xxxxxxxxxxxxxx_i* xxxxxxxxxxxxx_r, pre-shared key reauthentication in 23 hours
    smsbrick[8150]: IKE proposal: 3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024
    smsbrick[8150]: Tasks queued: QUICK_MODE 
    smsbrick[8150]: Tasks active: MODE_CONFIG

ip xfrm

# ip xfrm policy
src 10.192.0.0/12 dst 10.254.0.0/16 
        dir fwd priority 3987 
        tmpl src 62.x.x.x dst 172.x.x.x
                proto esp reqid 1 mode tunnel
src 10.192.0.0/12 dst 10.254.0.0/16 
        dir in priority 3987 
        tmpl src 62.x.x.x dst 172.x.x.x
                proto esp reqid 1 mode tunnel
src 10.254.0.0/16 dst 10.192.0.0/12 
        dir out priority 3987 
        tmpl src 172.x.x.x dst 62.x.x.x
                proto esp reqid 1 mode tunnel
src 0.0.0.0/0 dst 0.0.0.0/0 
        socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
        socket out priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
        socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
        socket out priority 0 
src ::/0 dst ::/0 
        socket in priority 0 
src ::/0 dst ::/0 
        socket out priority 0 
src ::/0 dst ::/0 
        socket in priority 0 
src ::/0 dst ::/0 
        socket out priority 0
1
  • 2
    The connection is not established. The connection seems to be stuck during Mode Config (because you configured leftsourceip), check the log on both sides for details (most likely the Cisco peer doesn't expect a Mode Config exchange). Did you already have a look at the strongSwan wiki?
    – ecdsa
    Jan 27, 2014 at 10:48

1 Answer 1

3

Sorry to necropost on the topic, there's just not much info out there in one place on this particular configuration in terms of troubleshooting.

My config:

  • AWS: Strongswan 5.1.3
  • Corp: Cisco ASA5520 8.4(4)1

Symptoms:

  1. Could initiate tunnel and ping from Cisco ASA private LAN to AWS private LAN always.
  2. On tunnel timeout/restart I could not initiate or ping from AWS to Cisco ASA unless/until traffic was generated from Cisco ASA side. IPSEC STATUSALL revealed

    Tasks active: MODE_CONFIG
    Tasks queued: QUICK_MODE
    

I found that with modeconfig=push and leftsourceip= both configured, it got stuck at:

Tasks active: MODE_CONFIG
Tasks queued: QUICK_MODE

Removing modeconfig=push left it stuck at:

Tasks active: MODE_CONFIG

Removing leftsourceip= did the trick and everything was up and stable both ways.

I take it those two are needed by PIX an maybe some older version of ASA but not this one.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .