On Thu, Nov 13, 2014 at 1:26 AM, Mike Bennett <[email protected]> wrote: > hi -- > > I'm trying to understand how to configure ipsec_gre tunnels on OVS (linux). > I have gotten (I *hope*) the hard part done of getting the IPsec > associations set up, where I see messages from racoon similar to: > INFO: IPsec-SA established: ESP/Transport 1.1.1.1[500]->2.2.2.2[500] > spi=111(0x...)
Yes, it seems that IPsec tunnels were negotiated successfully. > > Now, I'm a little confused as to how to build OpenFlow flows for these ports > *after* packets come from the local side of the ipsec_gre tunnel -- does > this emit GRE packets I have to push into local interfaces of type GRE to > capture? The ipsec_gre interface isn't something I can make an ip link from > (iiuc), so it's difficult to grab pcaps from it to see what's going on. I think you should see ESP (a.k.a. IPsec) and GRE packets with tcpdump on physical ethX interface that received that terminated IPsec tunnel. Also, take a look at http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg for more details. Basically ESP packet simply goes through a loop in XFRM Decode box that decrypts packet. > > Related, in my (non-OVS) router configuration, I see discrete endpoints for > IPsec and another for the GRE tunnel contained inside IPsec. In the OVS > options for ipsec_gre, I seem to only be able to set *one* remote_ip. How do > I set the 'gre' source IP address in addition to the IPsec source ip for > packets I send over the tunnel? Not sure I fully understood what you meant... Are you looking for options:local_ip? > > If anyone has an example of a GRE-over-IPsec configuration using ipsec_gre > and would be willing to share the flow table and interface configuration, it > would very appreciated! I can't seem to find a complete example anywhere. I believe you should be able to match on ofport that was assigned to the tunnel Interface (e.g. ovs-ofctl add-flow brX 'in_port=<pop-gre1_ofport>,actions=drop'). Did you try this? > > Thanks very much! > -mike > > ==== > > For version reference: > > # ovs-vsctl show > 6217769e-dc46-45ae-bca2-a5eefb460826 > Bridge pop > fail_mode: secure > Port "pop-gre1" > Interface "pop-gre1" > type: ipsec_gre > options: {psk=xyzzy, remote_ip="2.2.2.2"} > Port pop > Interface pop > type: internal > Port "pop-eth1" > Interface "pop-eth1" > ovs_version: "2.0.2" > > # ovs-vsctl -V > ovs-vsctl (Open vSwitch) 2.0.2 > Compiled Aug 15 2014 14:31:02 > > # ovs-dpctl show > system@ovs-system: > lookups: hit:49 missed:109 lost:0 > flows: 0 > port 0: ovs-system (internal) > port 1: pop (internal) > port 2: pop-eth1 > port 3: gre_system (gre: df_default=false, ttl=0) > > # racoon -V > @(#)ipsec-tools 0.8.0 (http://ipsec-tools.sourceforge.net) > > Compiled with: > - OpenSSL 1.0.1f 6 Jan 2014 (http://www.openssl.org/) > - IPv6 support > - Dead Peer Detection > - IKE fragmentation > - Hybrid authentication > - NAT Traversal > - Admin port > - Monotonic clock > > # /etc/init.d/openvswitch-ipsec status > * Checking status of ovs-monitor-ipsec > [ OK ] > > _______________________________________________ > discuss mailing list > [email protected] > http://openvswitch.org/mailman/listinfo/discuss > _______________________________________________ discuss mailing list [email protected] http://openvswitch.org/mailman/listinfo/discuss
