Hi All, Need some guidance and help in getting the traffic routed via VTI ( ipsec0 ) interface.I am using the VTI interface to just mark the traffic and forward.
I am not able to get the traffic forwarding via VTI( ipsec0) interface and getting the traffic marked, so that it gets protected. i have the ipsec tunnel up with between two device. i see traffic send from client interface reaching VTI interface , however its not getting forwarded to eth3 , so that it gets protected. Unix Device1: eth3<————— ipsec0 ( vti )<———————vzsi 10.24.18.209 10.24.18.36 10.24.18.203 Routing rules on the device : ip tunnel add ipsec0 local 10.24.18.36 remote 0.0.0.0 mode vti okey 32 ikey 32 ip link set ipsec0 up ip route add default dev ipsec0 table zs-flow-table-inet echo 1 > /proc/sys/net/ipv4/conf/ipsec0/disable_policy echo 1 > /proc/sys/net/ipv4/conf/ipsec0/disable_xfrm echo 300 zs-flow-table-inet >> /etc/iproute2/rt_tables ip rule add iif vzsi-p table zs-flow-table-inet ip route add default dev ipsec0 table zs-flow-table-inet ip rule add iif ipsec0 table internet-eth3 ip rule add oif ipsec0 table internet-eth3 # ip route show table internet-eth3 default via 10.24.18.210 dev eth3 The ipsec policy and sa config is present SPD entry : src 0.0.0.0/0 dst 0.0.0.0/0 dir fwd priority 3075 mark 32/0xffffffff tmpl src 10.24.18.35 dst 10.24.18.209 proto esp reqid 1 mode tunnel src 0.0.0.0/0 dst 0.0.0.0/0 dir in priority 3075 mark 32/0xffffffff tmpl src 10.24.18.35 dst 10.24.18.209 proto esp reqid 1 mode tunnel src 0.0.0.0/0 dst 0.0.0.0/0 dir out priority 3075 mark 32/0xffffffff tmpl src 10.24.18.209 dst 10.24.18.35 proto esp reqid 1 mode tunnel SADB: src 10.24.18.209 dst 10.24.18.35 proto esp spi 0xcfe2aa19 reqid 1 mode tunnel replay-window 32 flag af-unspec mark 32/0xffffffff auth-trunc hmac(md5) 0x830c26f2a8fdaa2a1d6f82c9663f0bf3 96 enc ecb(cipher_null) src 10.24.18.35 dst 10.24.18.209 proto esp spi 0xc377e262 reqid 1 mode tunnel replay-window 32 flag af-unspec mark 32/0xffffffff auth-trunc hmac(md5) 0x99f7adff411b87cb04a652469b6132fd 96 enc ecb(cipher_null) Issue: #ip -s tunnel s ipsec0 ipsec0: ip/ip remote any local 10.24.18.36 ttl inherit key 32 RX: Packets Bytes Errors CsumErrs OutOfSeq Mcasts 0 0 0 0 0 0 TX: Packets Bytes Errors DeadLoop NoRoute NoBufs 0 0 32 0 32 0 I see the traffic on the ipsec0 interface #tcpdump -ni ipsec0 listening on ipsec0, link-type RAW (Raw IP), capture size 65535 bytes 02:18:03.237031 IP 10.24.18.203.52554 > 10.24.18.35.8888: Flags [S], seq 3484231614, win 29200, options [mss 1460,sackOK,TS val 4061593203 ecr 0,nop,wscale 7], length 0 # ifconfig ipsec0 ipsec0 Link encap:IPIP Tunnel HWaddr UP RUNNING NOARP MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:32 dropped:0 overruns:0 carrier:32 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) Thanks, Naveen