VPP as IKEv2 responder and strongSwan as initiator


To make the examples easier to configure docker it is required to pull strongSwan docker image. The networking is done using Linux’ veth interfaces and namespaces.


First a topology:            
     +                           loopback
     |                                 +
+----+----+         +-----+----+
|  VPP    |                      |initiator |
+---------+                      +----------+

Create veth interfaces and namespaces and configure them:

sudo ip link add gw type veth peer name swanif
sudo ip link set dev gw up

sudo ip netns add ns
sudo ip link add veth_priv type veth peer name priv
sudo ip link set dev priv up
sudo ip link set dev veth_priv up netns ns

sudo ip netns exec ns \
  bash -c "
    ip link set dev lo up
    ip addr add dev veth_priv
    ip route add via"

Create directory with strongswan configs that will be mounted to the docker container

mkdir /tmp/sswan

Create the ipsec.conf file in the /tmp/sswan directory with following content:

config setup

conn initiator

 # local:

 # remote: (vpp gateway)


: PSK 'Vpp123'


charon {
  load_modular = yes
  plugins {
    include strongswan.d/charon/*.conf
  filelog {
    /tmp/charon.log {
      time_format = %b %e %T
      ike_name = yes
      append = no
      default = 2
      flush_line = yes
include strongswan.d/*.conf

Start docker container with strongSwan:

docker run --name sswan -d --privileged --rm --net=none \
 -v /tmp/sswan:/conf -v /tmp/sswan:/etc/ipsec.d philplckthun/strongswan

Finish configuration of initiator’s private network:

pid=$(docker inspect --format "{{.State.Pid}}" sswan)
sudo ip link set netns $pid dev swanif

sudo nsenter -t $pid -n ip addr add dev swanif
sudo nsenter -t $pid -n ip link set dev swanif up

sudo nsenter -t $pid -n ip addr add dev lo
sudo nsenter -t $pid -n ip link set dev lo up

Start VPP …

sudo /usr/bin/vpp unix { \
      cli-listen /tmp/vpp.sock \
      gid $(id -g) } \
      api-segment { prefix vpp } \
      plugins { plugin dpdk_plugin.so { disable } }

… and configure it:

create host-interface name gw
set interface ip addr host-gw
set interface state host-gw up

create host-interface name priv
set interface ip addr host-priv
set interface state host-priv up

ikev2 profile add pr1
ikev2 profile set pr1 auth shared-key-mic string Vpp123
ikev2 profile set pr1 id local fqdn vpp.home
ikev2 profile set pr1 id remote fqdn roadwarrior.vpn.example.com

ikev2 profile set pr1 traffic-selector local ip-range - port-range 0 - 65535 protocol 0
ikev2 profile set pr1 traffic-selector remote ip-range - port-range 0 - 65535 protocol 0

create ipip tunnel src dst
ikev2 profile set pr1 tunnel ipip0
ip route add via ipip0
set interface unnumbered ipip0 use host-gw

Initiate the IKEv2 connection:

$ sudo docker exec sswan ipsec up initiator

CHILD_SA initiator{1} established with SPIs c320c95f_i 213932c2_o and TS ===
connection 'initiator' established successfully
vpp# show ikev2 sa details

iip ispi 7849021d9f655f1b rip rspi 5a9ca7469a035205
 encr:aes-gcm-16 prf:hmac-sha2-256  dh-group:modp-2048
 nonce i:692ce8fd8f1c1934f63bfa2b167c4de2cff25640dffe938cdfe01a5d7f6820e6
 SK_d    9a9b896ed6c35c78134fcd6e966c04868b6ecacf6d5088b4b2aee8b05d30fdda
 SK_e  i:00000000: 1b1619788d8c812ca5916c07e635bda860f15293099f3bf43e8d88e52074b006
         00000020: 72c8e3e3
       r:00000000: 89165ceb2cef6a6b3319f437386292d9ef2e96d8bdb21eeb0cb0d3b92733de03
         00000020: bbc29c50
 SK_p  i:fe35fca30985ee75e7c8bc0d7bc04db7a0e1655e997c0f5974c31458826b6fef
 identifier (i) id-type fqdn data roadwarrior.vpn.example.com
 identifier (r) id-type fqdn data vpp.home
   child sa 0:encr:aes-gcm-16  esn:yes
    spi(i) c320c95f spi(r) 213932c2
    SK_e  i:2a6c9eae9dbed202c0ae6ccc001621aba5bb0b01623d4de4d14fd27bd5185435
    traffic selectors (i):0 type 7 protocol_id 0 addr - port 0 - 65535
    traffic selectors (r):0 type 7 protocol_id 0 addr - port 0 - 65535

Now we can generate some traffic between responder’s and initiator’s private networks and see it works.

$ sudo ip netns exec ns ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=63 time=1.02 ms
64 bytes from icmp_seq=2 ttl=63 time=0.599 ms