VPP as IKEv2 initiator and strongSwan as responder


To make the examples easier to configure docker it is required to pull strongSwan docker image. The networking is done using Linux’ veth interfaces and namespaces.


First a topology:            
     +                           loopback
     |                                 +
+----+----+         +-----+----+
|  VPP    |                      |strongSwan|
|initiator+----------------------+responder |
+---------+                      +----------+

Create veth interfaces and namespaces and configure them:

sudo ip link add gw type veth peer name swanif
sudo ip link set dev gw up

sudo ip netns add ns
sudo ip link add veth_priv type veth peer name priv
sudo ip link set dev priv up
sudo ip link set dev veth_priv up netns ns

sudo ip netns exec ns \
  bash -c "
    ip link set dev lo up
    ip addr add dev veth_priv
    ip route add via"

Create directory with strongswan configs that will be mounted to the docker container

mkdir /tmp/sswan

Create the ipsec.conf file in the /tmp/sswan directory with following content:

config setup

conn initiator

# local:

# remote: (gateway)


: PSK 'Vpp123'


charon {
  load_modular = yes
  plugins {
    include strongswan.d/charon/*.conf
  filelog {
    /tmp/charon.log {
      time_format = %b %e %T
      ike_name = yes
      append = no
      default = 2
      flush_line = yes
include strongswan.d/*.conf

Start docker container with strongSwan:

docker run --name sswan -d --privileged --rm --net=none \
 -v /tmp/sswan:/conf -v /tmp/sswan:/etc/ipsec.d philplckthun/strongswan

Finish configuration of initiator’s private network:

pid=$(docker inspect --format "{{.State.Pid}}" sswan)
sudo ip link set netns $pid dev swanif

sudo nsenter -t $pid -n ip addr add dev swanif
sudo nsenter -t $pid -n ip link set dev swanif up

sudo nsenter -t $pid -n ip addr add dev lo
sudo nsenter -t $pid -n ip link set dev lo up

Start VPP …

sudo /usr/bin/vpp unix { \
      cli-listen /tmp/vpp.sock \
      gid $(id -g) } \
      api-segment { prefix vpp } \
      plugins { plugin dpdk_plugin.so { disable } }

… and configure it:

create host-interface name gw
set interface ip addr host-gw
set interface state host-gw up

create host-interface name priv
set interface ip addr host-priv
set interface state host-priv up

ikev2 profile add pr1
ikev2 profile set pr1 auth shared-key-mic string Vpp123
ikev2 profile set pr1 id local fqdn roadwarrior.vpp
ikev2 profile set pr1 id remote fqdn sswan.vpn.example.com

ikev2 profile set pr1 traffic-selector local ip-range - port-range 0 - 65535 protocol 0
ikev2 profile set pr1 traffic-selector remote ip-range - port-range 0 - 65535 protocol 0

ikev2 profile set pr1 responder host-gw
ikev2 profile set pr1 ike-crypto-alg aes-gcm-16 256 ike-dh modp-2048
ikev2 profile set pr1 esp-crypto-alg aes-gcm-16 256

create ipip tunnel src dst
ikev2 profile set pr1 tunnel ipip0
ip route add via ipip0
set interface unnumbered ipip0 use host-gw

Initiate the IKEv2 connection:

vpp# ikev2 initiate sa-init pr1
vpp# show ikev2 sa details
 iip ispi f717b0cbd17e27c3 rip rspi e9b7af7fc9b13361
 encr:aes-gcm-16 prf:hmac-sha2-256  dh-group:modp-2048
 nonce i:eb0354613b268c6372061bbdaab13deca37c8a625b1f65c073d25df2ecfe672e
 SK_d    96bd4feb59be2edf1930a12a3a5d22e30195ee9f56ea203c5fb6cba5dd2bb80f
 SK_e  i:00000000: 5b75b9d808c8467fd00a0923c06efee2a4eb1d033c57532e05f9316ed9c56fe9
         00000020: c4db9114
       r:00000000: 95121b63372d20b83558dc3e209b9affef042816cf071c86a53543677b40c15b
         00000020: f169ab67
 SK_p  i:fb40d1114c347ddc3228ba004d4759d58f9c1ae6f1746833f908d39444ef92b1
 identifier (i) id-type fqdn data roadwarrior.vpp
 identifier (r) id-type fqdn data sswan.vpn.example.com
   child sa 0:encr:aes-gcm-16  esn:yes
    spi(i) 9dffd57a spi(r) c4e0ef53
    SK_e  i:290c681694f130b33d511335dd257e78721635b7e8aa87930dd77bb1d6dd3f42
    traffic selectors (i):0 type 7 protocol_id 0 addr - port 0 - 65535
    traffic selectors (r):0 type 7 protocol_id 0 addr - port 0 - 65535

Now we can generate some traffic between responder’s and initiator’s private networks and see it works.

$ sudo ip netns exec ns ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=63 time=0.450 ms
64 bytes from icmp_seq=2 ttl=63 time=0.630 ms