I could move forward from this issue by reinstalling strongswan and using strongswan-swanctl service, apparently I was not using the patched version, I noticed that because the vici_query.c file I had in the source was different than the one in the patched repo. Now I am seeing something quite strange. I get both spoke and hub to establish an IPSec sessions and SA are being established, I do see the Spoke sending registration message to the hub, I see the Hub receiving it and sending back a reply but the reply never gets to the spoke. Also the message counter in the SA statistics doesn't go up after a few messages. The IP of the spoke gets installed in the hub routing table but I cannot ping it, if I try it, it comes with this error: ping: sendmsg: invalid argument I notice this happens as soon as the hub adds the route of the /32 host in its routing table, after that point communication is broken between hub and spoke and the hub's reply message never gets into the IPsec tunnel nor any other packet. Any ideas about this? Thanks, On Wed, May 9, 2018 at 11:37 PM, Felipe Arturo Polanco < felipeapolanco@gmail.com> wrote:
Hi,
I'm having trouble getting DMVPN to work in FRR.
I followed this guide: https://wiki.alpinelinux.org/wiki/Dynamic_Multipoint_VPN_( DMVPN)_Phase_3_with_Quagga_NHRPd#Hub_Node
I installed patched strongswan as per the instruction in the README file: https://github.com/FRRouting/frr/blob/master/nhrpd/README.nhrpd
But still I cannot figure out how to establish a connection between a hub and a spoke.
There is this error in the logs on both hub and spoke: May 09 23:24:19 FRR01 charon-systemd[107289]: vici initiate 'dmvpn' May 09 23:24:19 FRR01 nhrpd[107823]: VICI: Key 'success'='no' May 09 23:24:19 FRR01 charon-systemd[107289]: unable to resolve %any, initiate aborted May 09 23:24:19 FRR01 nhrpd[107823]: VICI: Key 'errmsg'='establishing CHILD_SA 'dmvpn' failed' May 09 23:24:19 FRR01 charon-systemd[107289]: tried to checkin and delete nonexisting IKE_SA May 09 23:24:19 FRR01 nhrpd[107823]: VICI: strongSwan: establishing CHILD_SA 'dmvpn' failed
Spoke:
FRR01# sh dmvpn Src Dst Flags SAs Identity 192.168.17.131 192.168.17.135 n 0
FRR01# sh ip nhrp Iface Type Protocol NBMA Flags Identity gre1 local 10.255.255.2 - -
interface gre1 ip nhrp holdtime 3600 ip nhrp network-id 1 ip nhrp nhs dynamic nbma 192.168.17.135 ip nhrp registration no-unique ip nhrp shortcut no link-detect tunnel protection vici profile dmvpn tunnel source ens37
-------
Hub:
FRR_RR01# sh dmvpn Src Dst Flags SAs Identity FRR_RR01# sh ip nhrp Iface Type Protocol NBMA Flags Identity gre1 local 10.255.255.1 - -
interface gre1 ip nhrp holdtime 3600 ip nhrp network-id 1 ip nhrp nhs dynamic nbma 192.168.17.135 ip nhrp redirect ip nhrp registration no-unique ip nhrp shortcut no link-detect tunnel protection vici profile dmvpn tunnel source ens37
---
/etc/swanctl/swanctl.conf
[root@FRR_RR01 ~]# cat /etc/swanctl/swanctl.conf connections { dmvpn { version = 2 pull = no mobike = no dpd_delay = 15 dpd_timeout = 30 fragmentation = yes unique = replace rekey_time = 4h reauth_time = 13h proposals = aes256-sha512-ecp384 local { auth = psk id = hub } remote { auth = psk } children { dmvpn { esp_proposals = aes256-sha512-ecp384 local_ts = dynamic[gre] remote_ts = dynamic[gre] inactivity = 90m rekey_time = 100m mode = transport dpd_action = clear reqid = 1 } } } }
---
Any idea what could be wrong?