Page MenuHomeVyOS Platform
Create Task
Maniphest T6085

VTI interfaces are in UP state by default
Closed, ResolvedPublicBUG
Actions

Description

When a VTI interface is just created, it is in UP state by default, even if an IPSec peer is not connected. After the peer is disconnected the interface goes to DOWN state as expected.
This breaks routing logic - for example, static routes through VTI interfaces will be active even if a peer is not connected.

To reproduce:

set interfaces vti vti10
set vpn ipsec authentication psk PEER01 id 'PEER02'
set vpn ipsec authentication psk PEER01 id 'PEER01'
set vpn ipsec authentication psk PEER01 secret 'SECRET123'
set vpn ipsec esp-group ESP_01 lifetime '3600'
set vpn ipsec esp-group ESP_01 mode 'tunnel'
set vpn ipsec esp-group ESP_01 pfs 'dh-group14'
set vpn ipsec esp-group ESP_01 proposal 10 encryption 'aes256'
set vpn ipsec esp-group ESP_01 proposal 10 hash 'sha256'
set vpn ipsec ike-group IKE_01 close-action 'none'
set vpn ipsec ike-group IKE_01 dead-peer-detection action 'clear'
set vpn ipsec ike-group IKE_01 dead-peer-detection interval '30'
set vpn ipsec ike-group IKE_01 dead-peer-detection timeout '120'
set vpn ipsec ike-group IKE_01 key-exchange 'ikev2'
set vpn ipsec ike-group IKE_01 lifetime '28800'
set vpn ipsec ike-group IKE_01 proposal 10 dh-group '14'
set vpn ipsec ike-group IKE_01 proposal 10 encryption 'aes256'
set vpn ipsec ike-group IKE_01 proposal 10 hash 'sha256'
set vpn ipsec interface 'eth0'
set vpn ipsec options disable-route-autoinstall
set vpn ipsec site-to-site peer peer1 authentication local-id 'PEER01'
set vpn ipsec site-to-site peer peer1 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer peer1 authentication remote-id 'PEER02'
set vpn ipsec site-to-site peer peer1 connection-type 'none'
set vpn ipsec site-to-site peer peer1 default-esp-group 'ESP_01'
set vpn ipsec site-to-site peer peer1 ike-group 'IKE_01'
set vpn ipsec site-to-site peer peer1 ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer peer1 local-address '192.0.2.1'
set vpn ipsec site-to-site peer peer1 remote-address 'any'
set vpn ipsec site-to-site peer peer1 vti bind 'vti10'

Check interfaces:

vyos@vyos:~$ show interfaces 
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface    IP Address    MAC                VRF        MTU  S/L    Description
-----------  ------------  -----------------  -------  -----  -----  -------------
eth0         -             0c:7d:ec:ff:00:00  default   1500  u/D
eth1         -             0c:7d:ec:ff:00:01  default   1500  u/D
eth2         -             0c:7d:ec:ff:00:02  default   1500  u/D
eth3         -             0c:7d:ec:ff:00:03  default   1500  u/D
lo           127.0.0.1/8   00:00:00:00:00:00  default  65536  u/u
             ::1/128
vti10        -             n/a                default   1500  u/u

Details

Difficulty level
Normal (likely a few hours)
Version
1.5-rolling-202403011733, 1.4-rolling-202403010309
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Behavior change
Issue type
Bug (incorrect behavior)

Event Timeline

zsdc created this task.Mar 1 2024, 9:58 PM
zsdc changed the task status from Open to Confirmed.Mar 1 2024, 10:01 PM
zsdc triaged this task as High priority.
Apachez added a subscriber: Apachez.EditedMar 1 2024, 10:18 PM

If the peer reconnects after the first disconnect - does the local VTI interface go "UP" again?

Im thinking if it has to be "UP" locally for it to properly exchange IKEv2?

Also since you have DPD, I assume you have waited longer than the configured 120 sec timeout to verify that DPD doesnt kick in and brings the interface into "DOWN" state?

c-po added a subscriber: c-po.Mar 3 2024, 8:22 PM

Do you refer to initially admin-down or oper-down?

pasik added a subscriber: pasik.Mar 4 2024, 8:32 AM
Cheeze_It added a subscriber: Cheeze_It.Mar 6 2024, 4:18 AM

@c-po, while I don't wish to put words in the mouths of others, I believe the belief is that the interface should stay oper-down.

Cheeze_It removed a subscriber: Cheeze_It.Mar 6 2024, 4:18 AM
Viacheslav added a subscriber: Viacheslav.Mar 6 2024, 7:58 AM

The 1.3.x behaviour,

  1. VTI interfaces without IPsec is not created
# 1.3
set interfaces vti vti10 address '10.0.0.1/30'
commit

vyos@r15-left# sudo ip link show dev vti10
Device "vti10" does not exist.
[edit]
vyos@r15-left#

But in 1.5, it is created even without IPsec

vyos@r4# sudo ip link show dev vti10
18: vti10@NONE: <NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/none 
[edit]
vyos@r4#
  1. The VTI has status admin down with IPsec until a connection is established (for 1.3)
set interfaces ethernet eth1 address '192.0.2.2/24'
set interfaces vti vti10 address '10.0.0.1/30'


set vpn ipsec esp-group group-ESP compression 'disable'
set vpn ipsec esp-group group-ESP lifetime '3600'
set vpn ipsec esp-group group-ESP mode 'tunnel'
set vpn ipsec esp-group group-ESP pfs 'dh-group14'
set vpn ipsec esp-group group-ESP proposal 10 encryption 'aes128'
set vpn ipsec esp-group group-ESP proposal 10 hash 'sha1'
set vpn ipsec ike-group IKE-group key-exchange 'ikev2'
set vpn ipsec ike-group IKE-group lifetime '28800'
set vpn ipsec ike-group IKE-group proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-group proposal 1 hash 'sha1'

set vpn ipsec ipsec-interfaces interface 'eth1'
set vpn ipsec options disable-route-autoinstall
set vpn ipsec site-to-site peer 192.0.2.1 authentication id '192.0.2.2'
set vpn ipsec site-to-site peer 192.0.2.1 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 192.0.2.1 authentication pre-shared-secret '1234567890'
set vpn ipsec site-to-site peer 192.0.2.1 authentication remote-id '192.0.2.1'
set vpn ipsec site-to-site peer 192.0.2.1 connection-type 'respond'
set vpn ipsec site-to-site peer 192.0.2.1 ike-group 'IKE-group'
set vpn ipsec site-to-site peer 192.0.2.1 local-address '192.0.2.2'
set vpn ipsec site-to-site peer 192.0.2.1 vti bind 'vti10'
set vpn ipsec site-to-site peer 192.0.2.1 vti esp-group 'group-ESP'


vyos@r15-left# sudo ip --json link show dev vti10
[{"ifindex":18,"link":null,"ifname":"vti10","flags":["POINTOPOINT","NOARP"],"mtu":1500,"qdisc":"noop","operstate":"DOWN","linkmode":"DEFAULT","group":"default","txqlen":1000,"link_type":"ipip","address":"192.0.2.2","link_pointtopoint":true,"broadcast":"192.0.2.1"}]
[edit]
vyos@r15-left# 
[edit]
vyos@r15-left# run show int vti 
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface        IP Address                        S/L  Description
---------        ----------                        ---  -----------
vti10            10.0.0.1/30                       A/D  
[edit]
vyos@r15-left#
fernando added a subscriber: fernando.Mar 6 2024, 1:33 PM
c-po claimed this task.Mar 20 2024, 6:24 PM
c-po added a comment.Mar 20 2024, 7:58 PM

https://github.com/vyos/vyos-1x/pull/3157

c-po moved this task from Need Triage to 1.4.0 on the VyOS 1.4 Sagitta board.Mar 22 2024, 7:14 PM
c-po edited projects, added VyOS 1.4 Sagitta (1.4.0); removed VyOS 1.4 Sagitta.
c-po moved this task from 1.4.0 to 1.4.0-epa3 on the VyOS 1.4 Sagitta board.
c-po edited projects, added VyOS 1.4 Sagitta (1.4.0-epa3); removed VyOS 1.4 Sagitta (1.4.0).
c-po moved this task from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.Mar 22 2024, 7:17 PM
c-po moved this task from Need Triage to Finished on the VyOS 1.5 Circinus board.
c-po moved this task from Finished to In Progress on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
Viacheslav closed this task as Resolved.Mar 24 2024, 10:13 AM
Viacheslav moved this task from In Progress to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.