On 6/29/18 4:10 PM, Ben Greear wrote:
> Hello,
>
> We're trying to create lots of strongswan VPN tunnels on network devices
> bound to different VRFs. We are using Fedora-24 on the client side,
> with a 4.16.15+ kernel
> and updated 'ip' package, etc.
>
> So far, no luck getting it to work.
>
> Any idea if this is supported or not?
Kernel side xfrm code does work; been a couple of years since I tried
it. As I recall strongswan needs an update.
Looking at the 'ip xfrm' based scripts, you need to add 'sel dev ${VRF}'
to the state. eg.,
VRF="sel dev blue"
ip xfrm state add src ${REMIP} dst ${MYIP} \
proto esp spi 0x02122b77 reqid 0 mode tunnel \
replay-window 4 replay-oseq 0x4 \
auth-trunc 'hmac(md5)' 0xd94fcfea65fddf21dc6e0d24a0253508 96 \
enc 'cbc(des3_ede)' 0xfc46c20f8048be9725930ff3fb07ac2a91f0347dffeacf62 \
${VRF}
