Hi all:
I am trying to use strongswan with vpp creating ipsec tunnel, but encount the following problem:
Dec 25 09:29:54 10[KNL] <tunnel|1> received netlink error: No such file or directory (2)
Dec 25 09:29:54 10[KNL] <tunnel|1> unable to add SAD entry with SPI cdbc9ecd (FAILED)
Dec 25 09:29:54 10[KNL] <tunnel|1> received netlink error: No such file or directory (2)
Dec 25 09:29:54 10[KNL] <tunnel|1> unable to add SAD entry with SPI c7f1441e (FAILED)
Dec 25 09:29:54 10[IKE] <tunnel|1> unable to install inbound and outbound IPsec SA (SAD) in kernel
Dec 25 09:29:54 10[IKE] <tunnel|1> failed to establish CHILD_SA, keeping IKE_SA
Dec 25 09:29:54 10[IKE] <tunnel|1> sending DELETE for ESP CHILD_SA with SPI cdbc9ecd
my configuration:
strongswan:
/etc/ipsec.conf:
config setup
charondebug="all"
strictcrlpolicy=no
uniqueids = yes
# Add connections here.
conn %default
conn tunnel #
left=192.168.1.52
leftsubnet=3.3.3.0/24
right=192.168.1.253
rightsubnet=3.3.3.0/24
ike=aes256-sha1-modp2048!
esp=aes256-sha1-esn!
keyingtries=0
ikelifetime=1h
lifetime=8h
dpddelay=30
dpdtimeout=120
dpdaction=restart
authby=secret
auto=start
keyexchange=ikev2
type=tunnel
/etc/ipsec.secrets:
: PSK 'Vpp123'
vpp:
set int ip addr GigabitEthernet0/9/0 192.168.1.253/24
set int state GigabitEthernet0/9/0 up
ikev2 profile add pr1
ikev2 profile set pr1 auth shared-key-mic string Vpp123
ikev2 profile set pr1 id local ip4-addr 192.168.1.253
ikev2 profile set pr1 id remote ip4-addr 192.168.1.52
ikev2 profile set pr1 traffic-selector local ip-range 3.3.3.0-3.3.3.255 port-range 0 - 65535 protocol 0
ikev2 profile set pr1 traffic-selector remote ip-range 3.3.3.0-3.3.3.255 port-range 0 - 65535 protocol 0