[SOLVED] How to configure GRETAP over IPSEC using XFRM

jlearman · 06-21-2022, 10:59 AM

I need to set up an IPSEC tunnel between two systems using `ip xfrm` commands, suitable for running ISIS over. Thanks to examples on the web, including one from this site, I am able to create either an XFRM or VTI link that works for everything except, of course, running ISIS (because ESP carries only IP, and ISIS Hello packets are LLC/MAC.)

I also am able to set up a GRETAP tunnel between the systems, and ISIS works over that. So I'd like to (if possible) add ESP to the GRETAP tunnel.

Ignoring details on how the GRETAP tunnel interface (tun1) is created, I am trying to add IPSEC using the following, which seems to have no effect (`ip xfrm monitor all` shows nothing.)

Code:

GW=1 # (or 2, for the other system)

SPI=0x1234
NAME=tun1
GW1_PUBIP=192.168.16.5 # `ifconfig eth0  | grep inet | tr -s ' ' | cut -d' ' -f3`
GW2_PUBIP=192.168.32.2
PRIVNET=192.168.12
if [[ $GW == 1 ]]; then
    SRC=$GW1_PUBIP DST=$GW2_PUBIP LOCAL=$PRIVNET.2 REMOTE=$PRIVNET.3
else
    SRC=$GW2_PUBIP DST=$GW1_PUBIP LOCAL=$PRIVNET.3 REMOTE=$PRIVNET.2
fi
KEY1=0x0123456789ABCDEF0123456789ABCDEF
KEY2=0xFEDCBA9876543210FEDCBA9876543210
ID=0xfeed
ip xfrm state flush
ip xfrm policy flush
ip xfrm state add src $SRC dst $DST proto esp spi $ID mode tunnel auth sha256 $KEY1 enc aes $KEY2 sel dev $NAME
ip xfrm state add src $DST dst $SRC proto esp spi $ID mode tunnel auth sha256 $KEY1 enc aes $KEY2 sel dev $NAME
ip xfrm policy add dev $NAME dir out tmpl src $SRC dst $DST proto esp spi $ID mode tunnel mark 0x1234
ip xfrm policy add dev $NAME dir in tmpl src $DST dst $SRC proto esp spi $ID mode tunnel mark 0x1234
tcpdump -nevi eth0 esp &
ping -c 3 $REMOTE

Any pointers on where I'm going wrong?
Thanks!

jlearman · 06-21-2022, 01:19 PM

The "mark" was left over from trying VTI links and was causing the packets not to match the policies. Fix:

Code:

GW=1

GW1_PUBIP=192.168.16.5 # `ifconfig eth0  | grep inet | tr -s ' ' | cut -d' ' -f3`
GW2_PUBIP=192.168.32.2
PRIVNET=192.168.12     # address prefix on the GRETAP link
SPI=0x1234
AUTHKEY=0x0123456789ABCDEF0123456789ABCDEF
ENCKEY=0xFEDCBA9876543210FEDCBA9876543210
ID=0xfeed
if [[ $GW == 1 ]]; then
    NAME=tun_gw2
    LOC_PUB=$GW1_PUBIP REM_PUB=$GW2_PUBIP LOCAL=$PRIVNET.2 REMOTE=$PRIVNET.3
else
    NAME=tun_gw1
    LOC_PUB=$GW2_PUBIP REM_PUB=$GW1_PUBIP LOCAL=$PRIVNET.3 REMOTE=$PRIVNET.2
fi
if [[ $PUBIP == $LOC_PUB ]]; then
    ip xfrm state flush
    ip xfrm policy flush
    ip xfrm state add src $LOC_PUB dst $REM_PUB proto esp spi $ID mode tunnel auth sha256 $AUTHKEY enc aes $ENCKEY sel dev $NAME
    ip xfrm state add src $REM_PUB dst $LOC_PUB proto esp spi $ID mode tunnel auth sha256 $AUTHKEY enc aes $ENCKEY sel dev $NAME
    ip xfrm policy add dev $NAME dir out tmpl src $LOC_PUB dst $REM_PUB proto esp spi $ID mode tunnel
    ip xfrm policy add dev $NAME dir in tmpl src $REM_PUB dst $LOC_PUB proto esp spi $ID mode tunnel
    ip xfrm policy add dev $NAME dir fwd tmpl src $REM_PUB dst $LOC_PUB proto esp spi $ID mode tunnel
    tcpdump -nevi eth0 esp &
    ping -c 5 $REMOTE
fi