IPv6 over IPv4 IPSec tunnel communication error

[Thomas Knobbe]

Hello guys,

I tried with the network-manager-strongswan plugin a connection via IPSec to a Fortigate Firewall.

My goal is a dual-stack connection via IPv4. Therefore I'm trying to setup CHILD_SA for IPv4 and IPv6.

It faild with the network-manager-strongswan plugin, but it works with the native CLI strongswan.

For example, we get this kind of error:
13[KNL] received netlink error: Invalid argument (22)
13[KNL] unable to install source route for X:X::2
13[IKE] installed bypass policy for X:X::2/128

Soloution via CLI-Strongswan:

swanctl.conf

connections {

 ipsec-ikev2-psk {

  dpd_delay = 30s

  dpd_timeout = 150s

  version = 2

  remote_addrs = ikev2.ipsec.host

  vips = 0.0.0.0,::

  rekey_time = 1800s

  fragmentation = no

  proposals = aes256-sha256-modp2048

  mobike = no

  encap = yes

  unique = replace

  local-1 {

   auth = psk

   id = "IPSecID"

  }

  remote {

   auth = psk

   id = %any

  }

  children {

   ikev16-ikev2-psk {

    remote_ts = ::/0

    esp_proposals = aes256-sha256-modp2048

    close_action = start

    start_action = start

   }

  }

  children {

   ipsecv4-ikev2-psk {

    remote_ts = 0.0.0.0/0

    esp_proposals = aes256-sha256-modp2048

    close_action = start

    start_action = start

   }

  }

 }

}

It seems the network-manager-strongswan plugin have a problem to establish the IPv6 routes.

[Tobias Brunner (tobias-strongswan)]

That error doesn't seem related (looks more like something the bypass-lan plugin would log). So please post the complete log.

Also, your manual config creates two CHILD_SAs, one for each family. That's not how the NM plugin operates. It assumes the responder is able to narrow the traffic selectors of a single CHILD_SA appropriately (it proposes 0.0.0.0/0 AND ::/0 as remote traffic selectors). If the device you connect to is unable to do that and requires two CHILD_SAs, you won't be able to use both address families with the NM plugin.

[Thomas Knobbe (yoloknight)]

Hi Tobias,

sorry for the late replay we ask Fortigate about this topic. (the exchange with Fortigate is ongoing)

Here the log:

XXXXX@XXXXXX-ThinkPad-T500:~$ journalctl -f
-- Logs begin at Tue 2020-11-10 16:41:50 CET. --
Nov 20 14:31:40 XXXXXX-ThinkPad-T500 systemd[1383]: Started Tracker metadata extractor.
Nov 20 14:31:50 XXXXXX-ThinkPad-T500 systemd[1383]: tracker-extract.service: Succeed.
Nov 20 14:31:52 XXXXXX-ThinkPad-T500 dbus-daemon[1397]: [session uid=1000 pid=1397] Activating service name='org.gnome.gedit' requested by ':1.176' (uid=1000 pid=72296 XXXm="/usr/bin/nautilus --gapplication-service " label="unconfined")
Nov 20 14:31:52 XXXXXX-ThinkPad-T500 dbus-daemon[1397]: [session uid=1000 pid=1397] Successfully activated service 'org.gnome.gedit'
Nov 20 14:31:56 XXXXXX-ThinkPad-T500 dbus-daemon[1397]: [session uid=1000 pid=1397] Activating via systemd: service name='org.freeXXsktop.Tracker1.Miner.Extract' unit='tracker-extract.service' requested by ':1.1' (uid=1000 pid=1394 XXXm="/usr/libexec/tracker-miner-fs " label="unconfined")
Nov 20 14:31:56 XXXXXX-ThinkPad-T500 systemd[1383]: Starting Tracker metadata extractor...
Nov 20 14:31:56 XXXXXX-ThinkPad-T500 tracker-extract[72449]: Set scheduler policy to SCHED_IDLE
Nov 20 14:31:56 XXXXXX-ThinkPad-T500 tracker-extract[72449]: Setting priority nice level to 19
Nov 20 14:31:56 XXXXXX-ThinkPad-T500 dbus-daemon[1397]: [session uid=1000 pid=1397] Successfully activated service 'org.freeXXsktop.Tracker1.Miner.Extract'
Nov 20 14:31:56 XXXXXX-ThinkPad-T500 systemd[1383]: Started Tracker metadata extractor.
Nov 20 14:32:06 XXXXXX-ThinkPad-T500 systemd[1383]: tracker-extract.service: Succeed.
Nov 20 14:32:10 XXXXXX-ThinkPad-T500 NetworkManager[4602]: <info> [1605879130.5454] audit: op="connection-activate" uuid="24fa5f62-b070-48c9-99f1-40db15d466a9" name="VPN 1" pid=2587 uid=1000 result="success"
Nov 20 14:32:10 XXXXXX-ThinkPad-T500 NetworkManager[4602]: <info> [1605879130.5558] vpn-connection[0x55f97a8e0150,24fa5f62-b070-48c9-99f1-40db15d466a9,"VPN 1",0]: Saw the service appear; activating connection
Nov 20 14:32:10 XXXXXX-ThinkPad-T500 NetworkManager[4602]: <info> [1605879130.5937] vpn-connection[0x55f97a8e0150,24fa5f62-b070-48c9-99f1-40db15d466a9,"VPN 1",0]: VPN connection: (ConnectInteractive) reply received
Nov 20 14:32:10 XXXXXX-ThinkPad-T500 charon-nm[2427]: 05[CFG] received initiate for NetworkManager connection VPN 1
Nov 20 14:32:10 XXXXXX-ThinkPad-T500 charon-nm[2427]: 05[CFG] using gateway certificate, iXXntity 'C=XX, ST=XXXXXXX, L=XXX, O=XXXXXXX, OU=XXXXXXX, CN=XXXXXXX_Server_v2, <email address hidden>'
Nov 20 14:32:10 XXXXXX-ThinkPad-T500 charon-nm[2427]: 05[IKE] initiating IKE_SA VPN 1[3] to X.X.79.8
Nov 20 14:32:10 XXXXXX-ThinkPad-T500 charon-nm[2427]: 05[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Nov 20 14:32:10 XXXXXX-ThinkPad-T500 charon-nm[2427]: 05[NET] sending packet: from X.X.43.5[34693] to X.X.79.8[500] (768 bytes)
Nov 20 14:32:10 XXXXXX-ThinkPad-T500 NetworkManager[4602]: <info> [1605879130.6137] vpn-connection[0x55f97a8e0150,24fa5f62-b070-48c9-99f1-40db15d466a9,"VPN 1",0]: VPN plugin: stat...

[Tobias Brunner (tobias-strongswan)]

As you can see in the log, you receive two IP addresses, but the remote traffic selector is IPv4 only:

Nov 20 14:32:11 XXXXXX-ThinkPad-T500 charon-nm[2427]: 14[IKE] installing new virtual IP X.X.88.100
...
Nov 20 14:32:11 XXXXXX-ThinkPad-T500 charon-nm[2427]: 14[IKE] installing new virtual IP XXXX::XXXX:2
...
Nov 20 14:32:11 XXXXXX-ThinkPad-T500 charon-nm[2427]: 14[IKE] CHILD_SA VPN 1{3} established with SPIs c2f6d125_i 2b492941_o and TS X.X.88.100/32 === 0.0.0.0/0

So the remote box either has no IPv6 traffic selectors configured, or it does not support multiple subnets/families per CHILD_SA. Unless Fortinet added support for the latter recently, that might actually be the case, considering users reported this before on our wiki (https://wiki.strongswan.org/projects/strongswan/wiki/Fortinet).