I could move forward from this issue by reinstalling strongswan and using strongswan-swanctl service, apparently I was not using the patched version, I noticed that because the vici_query.c file I had in the source was different than the one in the patched repo.

Now I am seeing something quite strange.

I get both spoke and hub to establish an IPSec sessions and SA are being established, I do see the Spoke sending registration message to the hub, I see the Hub receiving it and sending back a reply but the reply never gets to the spoke.

Also the message counter in the SA statistics doesn't go up after a few messages.

The IP of the spoke gets installed in the hub routing table but I cannot ping it, if I try it, it comes with this error:

ping: sendmsg: invalid argument

I notice this happens as soon as the hub adds the route of the /32 host in its routing table, after that point communication is broken between hub and spoke and the hub's reply message never gets into the IPsec tunnel nor any other packet.

Any ideas about this?

Thanks,

On Wed, May 9, 2018 at 11:37 PM, Felipe Arturo Polanco <felipeapolanco@gmail.com> wrote:
Hi,

I'm having trouble getting DMVPN to work in FRR.

I followed this guide:
https://wiki.alpinelinux.org/wiki/Dynamic_Multipoint_VPN_(DMVPN)_Phase_3_with_Quagga_NHRPd#Hub_Node

I installed patched strongswan as per the instruction in the README file:
https://github.com/FRRouting/frr/blob/master/nhrpd/README.nhrpd

But still I cannot figure out how to establish a connection between a hub and a spoke.

There is this error in the logs on both hub and spoke:
May 09 23:24:19 FRR01 charon-systemd[107289]: vici initiate 'dmvpn'
May 09 23:24:19 FRR01 nhrpd[107823]: VICI: Key 'success'='no'
May 09 23:24:19 FRR01 charon-systemd[107289]: unable to resolve %any, initiate aborted
May 09 23:24:19 FRR01 nhrpd[107823]: VICI: Key 'errmsg'='establishing CHILD_SA 'dmvpn' failed'
May 09 23:24:19 FRR01 charon-systemd[107289]: tried to checkin and delete nonexisting IKE_SA
May 09 23:24:19 FRR01 nhrpd[107823]: VICI: strongSwan: establishing CHILD_SA 'dmvpn' failed

Spoke:

FRR01# sh dmvpn
Src                      Dst                      Flags  SAs  Identity
192.168.17.131           192.168.17.135           n      0

FRR01# sh ip nhrp
Iface    Type     Protocol                 NBMA                     Flags  Identity
gre1     local    10.255.255.2             -                               -

interface gre1
 ip nhrp holdtime 3600
 ip nhrp network-id 1
 ip nhrp nhs dynamic nbma 192.168.17.135
 ip nhrp registration no-unique
 ip nhrp shortcut
 no link-detect
 tunnel protection vici profile dmvpn
 tunnel source ens37


-------

Hub:

FRR_RR01# sh dmvpn
Src                      Dst                      Flags  SAs  Identity
FRR_RR01# sh ip nhrp
Iface    Type     Protocol                 NBMA                     Flags  Identity
gre1     local    10.255.255.1             -                               -

interface gre1
 ip nhrp holdtime 3600
 ip nhrp network-id 1
 ip nhrp nhs dynamic nbma 192.168.17.135
 ip nhrp redirect
 ip nhrp registration no-unique
 ip nhrp shortcut
 no link-detect
 tunnel protection vici profile dmvpn
 tunnel source ens37

---

/etc/swanctl/swanctl.conf

[root@FRR_RR01 ~]# cat /etc/swanctl/swanctl.conf
connections {
        dmvpn {
                version = 2
                pull = no
                mobike = no
                dpd_delay = 15
                dpd_timeout = 30
                fragmentation = yes
                unique = replace
                rekey_time = 4h
                reauth_time = 13h
                proposals = aes256-sha512-ecp384
                local {
                        auth = psk
                        id = hub
                }
                remote {
                        auth = psk
                }
                children {
                        dmvpn {
                                esp_proposals = aes256-sha512-ecp384
                                local_ts = dynamic[gre]
                                remote_ts = dynamic[gre]
                                inactivity = 90m
                                rekey_time = 100m
                                mode = transport
                                dpd_action = clear
                                reqid = 1
                        }
                }
        }
}


---


Any idea what could be wrong?