Page MenuHomePhabricator

DMVPN with IPSec does not work in HUB mode
Confirmed, HighPublicBUG

Description

If DMVPN use IPSec, related configuration for strongSwan adding via /etc/swanctl/swanctl.conf and reloading configuration with swanctl -q. So, it is not stored inside the strongSwan configuration file permanently and requires reloading with swanctl -q to make configuration active.
Inside ipsec-settings.py in apply function exists ipsec restart operation.

When ipsec-settings.py running after the DMVPN config (dmvpn-config.pl), it restarts strongSwan and, as a result, remove DMVPN-related connections configuration.
If VyOS configured as spoke, this is not critical, as swanctl -q additionally runs by opennhrp-script, but if it acts as a hub, DMVPN IPSec configuration will never being active.

Details

Difficulty level
Normal (likely a few hours)
Version
1.2-rolling-201911021616
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible

Event Timeline

zsdc changed the task status from Open to Confirmed.Sat, Nov 2, 5:09 PM
zsdc created this task.
syncer assigned this task to dmbaturin.Sat, Nov 2, 9:29 PM
syncer triaged this task as High priority.
Dmitry added a subscriber: Dmitry.Sun, Nov 3, 2:06 PM
pasik added a subscriber: pasik.Mon, Nov 4, 9:51 AM