From mboxrd@z Thu Jan  1 00:00:00 1970
From: David Ahern <dsahern@gmail.com>
Subject: Re: Anyone know if strongswan works with vrf?
Date: Sat, 30 Jun 2018 14:24:58 -0600
Message-ID: <a041b1db-d392-e79a-5699-358651a0d75b@gmail.com>
References: <95b83150-a6dc-f43b-f605-bc7c7f5986e8@candelatech.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
To: Ben Greear <greearb@candelatech.com>,
        netdev <netdev@vger.kernel.org>
Return-path: <netdev-owner@vger.kernel.org>
Received: from mail-io0-f170.google.com ([209.85.223.170]:32851 "EHLO
        mail-io0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751466AbeF3UZB (ORCPT
        <rfc822;netdev@vger.kernel.org>); Sat, 30 Jun 2018 16:25:01 -0400
Received: by mail-io0-f170.google.com with SMTP id d185-v6so11447971ioe.0
        for <netdev@vger.kernel.org>; Sat, 30 Jun 2018 13:25:01 -0700 (PDT)
In-Reply-To: <95b83150-a6dc-f43b-f605-bc7c7f5986e8@candelatech.com>
Content-Language: en-US
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

On 6/29/18 4:10 PM, Ben Greear wrote:
> Hello,
> 
> We're trying to create lots of strongswan VPN tunnels on network devices
> bound to different VRFs.  We are using Fedora-24 on the client side,
> with a 4.16.15+ kernel
> and updated 'ip' package, etc.
> 
> So far, no luck getting it to work.
> 
> Any idea if this is supported or not?

Kernel side xfrm code does work; been a couple of years since I tried
it. As I recall strongswan needs an update.

Looking at the 'ip xfrm' based scripts, you need to add 'sel dev ${VRF}'
to the state. eg.,

VRF="sel dev blue"

ip xfrm state add src ${REMIP} dst ${MYIP} \
    proto esp spi 0x02122b77 reqid 0 mode tunnel \
    replay-window 4 replay-oseq 0x4 \
    auth-trunc 'hmac(md5)' 0xd94fcfea65fddf21dc6e0d24a0253508 96 \
    enc 'cbc(des3_ede)' 0xfc46c20f8048be9725930ff3fb07ac2a91f0347dffeacf62 \
    ${VRF}