Page MenuHomeVyOS Platform

'show vpn ipsec sa' output wrong when remote or local prefix not in system subnet
Closed, ResolvedPublicBUG

Description

I have setup ipsec VPNs with multiple tunnels.
For some of the tunnels, the local prefix is pointing not to the local subnet, but to a subnet being NAT translated to another system entirely.
When this is the case, those tunnels are always listed as "down", and Peer ID as n/a. The tunnel is not actually down, and data flows.

In the following example, the first Peer ID should be the same as below, and the Local ID should a subnet in a public IP range, which isn't associated with any network devices, but has a working dst-nat rule.

vyos@VyOS-IPSEC-GPA# run show vpn ipsec sa
Peer ID / IP Local ID / IP


n/a n/a

Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
------  -----  -------------  -------  ----    -----  ------  ------  -----
2       down   252.0/252.0    aes256   sha256_128 no     -900    n/a     all

Peer ID / IP Local ID / IP


remotepeer 192.168.101.153

Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
------  -----  -------------  -------  ----    -----  ------  ------  -----
1       up     0.0/0.0        aes256   sha256_128 no     2280    3600    all

On the other side, also a VyOS in this case, shows a similar result:

Peer ID / IP Local ID / IP


n/a n/a

Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
------  -----  -------------  -------  ----    -----  ------  ------  -----
2       down   252.0/252.0    aes256   sha256_128 no     -420    n/a     all

Peer ID / IP Local ID / IP


remotepeer 192.168.55.75

Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
------  -----  -------------  -------  ----    -----  ------  ------  -----
1       up     0.0/0.0        aes256   sha256_128 no     2760    3600    all

Details

Difficulty level
Unknown (require assessment)
Version
1.1.7
Why the issue appeared?
Will be filled on close

Event Timeline

ethomas created this task.Jul 20 2017, 2:37 PM
syncer triaged this task as Low priority.Jul 25 2017, 12:07 AM
syncer added subscribers: JulesT, syncer.

@JulesT it's something that con address in 1.2 code base?

Gimme the ticket, and I'll take a look at it.

It's actually effectively 'fixed' in 1.2 already, as 'show vpn ipsec sa' doesn't do the same thing any more.

However, It's possible that the same bug exists in 'show vpn ipsec sa detail', so I'll take a look at that.

syncer assigned this task to JulesT.Oct 11 2017, 8:51 PM
syncer added a subscriber: c-po.

@c-po wondering if this something that was fixed by you previously?

Certainly not fixed in 1.1.x - but I'll see what I can do with it. 1.2 has such completely different handling that I couldn't even guess what it does. I'll have to work out a lab to reproduce it. Might get to it at the weekend.

syncer edited projects, added VyOS 1.2 Crux; removed VyOS 1.1.x.Oct 11 2017, 9:04 PM

Moving this to 1.2 than.
Let's fix it there

syncer moved this task from Need Triage to Backlog on the VyOS 1.2 Crux board.Oct 11 2017, 9:04 PM
c-po added a comment.Oct 13 2017, 7:41 AM

@syncer this was actually done by @JulesT. Thank you @JulesT.

pasik added a subscriber: pasik.Oct 1 2018, 9:46 AM
dmbaturin closed this task as Resolved.Dec 3 2018, 2:56 AM
dmbaturin added subscribers: hagbard, dmbaturin.

@hagbard "show vpn ipsec sa verbose" is now a thin wrapper for "ipsec statusall" so it's not applicable there either. :)

We definitely need a better implementation of "show vpn ipsec sa", but at least we have something functional.