Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

T5355:IPSec:op cmd:"sh vpn ike status" not working #2090

Merged
merged 1 commit into from Jul 14, 2023

Conversation

srividya0208
Copy link
Contributor

Change Summary

"show vpn ike sa" shows as "IPsec Process NOT Running" even though the process is running.
Same output show for the sub command as well "sh vpn ike sa peer "

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes)
  • Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
  • Other (please describe):

Related Task(s)

Component(s) name

ipsec

Proposed changes

The strongswan service is changed from charon to charon-systemd that's why the process is not running error
is received, so updated the service.

vyos@vyos# run sh vpn ike status
● strongswan.service - strongSwan IPsec IKEv1/IKEv2 daemon using swanctl
     Loaded: loaded (/lib/systemd/system/strongswan.service; disabled; preset: )
     Active: active (running) since Thu 2023-07-13 08:02:48 UTC; 12min ago
    Process: 2739 ExecReload=/usr/sbin/swanctl --reload (code=exited, status=0/)
    Process: 2744 ExecReload=/usr/sbin/swanctl --load-all --noprompt (code=exit)
   Main PID: 1903 (charon-systemd)
     Status: "charon-systemd running, strongSwan 5.9.8, Linux 6.1.38-amd64-vyos"

How to test

Configure the ipsec setting on both peers:
set vpn ipsec authentication psk test id 'x.x.x.x'
set vpn ipsec authentication psk test secret 'vyos'
set vpn ipsec esp-group ESP-GROUP lifetime '1800'
set vpn ipsec esp-group ESP-GROUP mode 'tunnel'
set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes128'
set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha1'
set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1'
set vpn ipsec ike-group IKE-GROUP lifetime '3600'
set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes128'
set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha1'
set vpn ipsec interface 'x'
set vpn ipsec site-to-site peer test authentication local-id 'x.x.x.x'
set vpn ipsec site-to-site peer test authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer test authentication remote-id 'x.x.x.x'
set vpn ipsec site-to-site peer test connection-type 'initiate'
set vpn ipsec site-to-site peer test default-esp-group 'ESP-GROUP'
set vpn ipsec site-to-site peer test ike-group 'IKE-GROUP'
set vpn ipsec site-to-site peer test local-address 'x.x.x.x'
set vpn ipsec site-to-site peer test remote-address 'x.x.x.x'
set vpn ipsec site-to-site peer test vti bind 'vti0'
set interfaces vti vti0 address 'x.x.x.x'

Once committed, run the command "show vp ike status" to check the status

Checklist:

  • I have read the CONTRIBUTING document
  • I have linked this PR to one or more Phabricator Task(s)
  • I have run the components SMOKETESTS if applicable
  • My commit headlines contain a valid Task id
  • My change requires a change to the documentation
  • I have updated the documentation accordingly

@vyosbot vyosbot requested review from a team, dmbaturin, sarthurdev, zdc, jestabro, sever-sever and c-po and removed request for a team July 13, 2023 12:01
@c-po c-po merged commit 0a248d5 into vyos:current Jul 14, 2023
4 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
3 participants