Hi Experts,
I am configuring IPsec over an interface in a VRF. I managed to make the IPEC work with local policy and command “set vrf bind-to-all”.
The problem is VYOS, after sometime(randomly) stops IPsec peers using that Interface/VRF. nothing resolves the issue; restart VPN, restart all, and even reboot VYOS. the only thing that fixes the issue is “delete vrf bind-to-all” and then, after commit, re-enabling it “set vrf bind-to-all”. then IKE starts working.
I did some packet capture, and I saw VYOS is sending icmp unreachable host back to the peer, exactly like when vrf bind-to-all is not enabled. and as soon as I disabled and re-enabled the bind-to-all feature it stopped that icmp message and everything goes back to normal.
I should add I tested this only over GNS3 and EVENG. you can find the config below
Any idea?
Thank you in advance,
Amir Rashidi
CCIEx2 #57101 | Delta Networks
Configuration:
set interfaces ethernet eth3 address ‘200.10.101.10/24’
set interfaces ethernet eth3 vrf ‘INET2’
set policy local-route rule 200 set table ‘102’
set policy local-route rule 200 source ‘200.10.101.10’
set protocols static table 102 route 0.0.0.0/0 interface eth3 vrf ‘ISP2’
set interfaces vti vti41102102 address ‘169.254.41.2/31’
set vpn ipsec esp-group ESP_DEFAULT lifetime ‘3600’
set vpn ipsec esp-group ESP_DEFAULT mode ‘tunnel’
set vpn ipsec esp-group ESP_DEFAULT pfs ‘dh-group20’
set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption ‘aes256’
set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash ‘sha256’
set vpn ipsec ike-group IKEv2_DEFAULT close-action ‘restart’
set vpn ipsec ike-group IKEv2_DEFAULT disable-mobike
set vpn ipsec ike-group IKEv2_DEFAULT key-exchange ‘ikev2’
set vpn ipsec ike-group IKEv2_DEFAULT lifetime ‘10800’
set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group ‘20’
set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption ‘aes256’
set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash ‘sha256’
set vpn ipsec interface ‘eth2’
set vpn ipsec interface ‘eth3’
set vpn ipsec interface ‘eth0’
set vpn ipsec options disable-route-autoinstall
set vpn ipsec site-to-site peer 41_102_102 authentication local-id ‘10_102’
set vpn ipsec site-to-site peer 41_102_102 authentication mode ‘pre-shared-secret’
set vpn ipsec site-to-site peer 41_102_102 authentication pre-shared-secret ‘test!’
set vpn ipsec site-to-site peer 41_102_102 authentication remote-id ‘41_102’
set vpn ipsec site-to-site peer 41_102_102 force-udp-encapsulation
set vpn ipsec site-to-site peer 41_102_102 ike-group ‘IKEv2_DEFAULT’
set vpn ipsec site-to-site peer 41_102_102 local-address ‘200.10.101.10’
set vpn ipsec site-to-site peer 41_102_102 remote-address ‘200.40.104.41’
set vpn ipsec site-to-site peer 41_102_102 vti bind ‘vti41102102’
set vpn ipsec site-to-site peer 41_102_102 vti esp-group ‘ESP_DEFAULT’
set vrf bind-to-all
set vrf name INET2 protocols bgp neighbor 169.254.102.0 description ‘INET2 TO LAN’
set vrf name INET2 protocols bgp neighbor 169.254.102.0 peer-group ‘LAN’
set vrf name INET2 protocols bgp peer-group LAN address-family ipv4-unicast default-originate
set vrf name INET2 protocols bgp peer-group LAN address-family ipv4-unicast nexthop-self
set vrf name INET2 protocols bgp peer-group LAN address-family ipv4-unicast route-map export ‘UNDERLAY_EXPORT_ROUTE_MAP’
set vrf name INET2 protocols bgp peer-group LAN address-family ipv4-unicast route-map import ‘UNDERLAY_IMPORT_ROUTE_MAP’
set vrf name INET2 protocols bgp peer-group LAN address-family ipv4-unicast soft-reconfiguration inbound
set vrf name INET2 protocols bgp peer-group LAN bfd profile ‘DEFAULT’
set vrf name INET2 protocols bgp peer-group LAN remote-as ‘65555’
set vrf name INET2 protocols bgp system-as ‘65555’
set vrf name INET2 protocols static route 0.0.0.0/0 next-hop 200.10.101.101
set vrf name INET2 table ‘102’