Anyone know if strongswan works with vrf?

Anyone know if strongswan works with vrf?

[Ben Greear]

Hello,

We're trying to create lots of strongswan VPN tunnels on network devices
bound to different VRFs.  We are using Fedora-24 on the client side, with a 4.16.15+ kernel
and updated 'ip' package, etc.

So far, no luck getting it to work.

Any idea if this is supported or not?

Thanks,
Ben
-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com

Re: Anyone know if strongswan works with vrf?

[David Ahern]

On 6/29/18 4:10 PM, Ben Greear wrote:
> Hello,
> 
> We're trying to create lots of strongswan VPN tunnels on network devices
> bound to different VRFs.  We are using Fedora-24 on the client side,
> with a 4.16.15+ kernel
> and updated 'ip' package, etc.
> 
> So far, no luck getting it to work.
> 
> Any idea if this is supported or not?

Kernel side xfrm code does work; been a couple of years since I tried
it. As I recall strongswan needs an update.

Looking at the 'ip xfrm' based scripts, you need to add 'sel dev ${VRF}'
to the state. eg.,

VRF="sel dev blue"

ip xfrm state add src ${REMIP} dst ${MYIP} \
    proto esp spi 0x02122b77 reqid 0 mode tunnel \
    replay-window 4 replay-oseq 0x4 \
    auth-trunc 'hmac(md5)' 0xd94fcfea65fddf21dc6e0d24a0253508 96 \
    enc 'cbc(des3_ede)' 0xfc46c20f8048be9725930ff3fb07ac2a91f0347dffeacf62 \
    ${VRF}