Site-to-Site IPSec over VTI w/ OSPF - Routing Issue?

General questions
,
1

I’ve created a ipsec tunnel on a VTI with OFPS configuredi across two sites in my lab. Console is showing that the connection is up both ways. I watch it establish when i reboot but I cannot ping across networks. I can’t even ping local gateway to local gateway. I’m sure I messed something up as I am very new to all of this. Does anyone here see my issue? I may be missing something obvious.

[code]Peer ID / IP Local ID / IP

10.0.0.18 10.0.0.80

Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
------  -----  -------------  -------  ----    -----  ------  ------  -----
vti     up     0.0/0.0        aes256   sha256  no     1368    3600    all

[/code]

Peer ID / IP                            Local ID / IP
------------                            -------------
10.0.0.80                               10.0.0.18

    Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
    ------  -----  -------------  -------  ----    -----  ------  ------  -----
    vti     up     0.0/0.0        aes256   sha256  no     2100    3600    all

SITE1 Config

[code]firewall {
all-ping enable
broadcast-ping disable
config-trap disable
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name OUTSIDE-IN {
default-action drop
rule 10 {
action accept
state {
established enable
related enable
}
}
rule 20 {
action accept
source {
address 10.96.3.0/24
}
}
}
name OUTSIDE-LOCAL {
default-action drop
rule 10 {
action accept
state {
established enable
related enable
}
}
rule 20 {
action accept
icmp {
type-name echo-request
}
protocol icmp
state {
new enable
}
}
rule 30 {
action drop
destination {
port 22
}
protocol tcp
recent {
count 4
time 60
}
state {
new enable
}
}
rule 31 {
action accept
destination {
port 22
}
protocol tcp
state {
new enable
}
}
rule 600 {
action accept
destination {
port 53
}
log enable
protocol tcp_udp
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
twa-hazards-protection disable
}
interfaces {
ethernet eth0 {
address 10.0.0.80/24
description OUTSIDE
duplex auto
firewall {
in {
name OUTSIDE-IN
}
local {
name OUTSIDE-LOCAL
}
}
hw-id 00:15:5d:00:cd:17
smp_affinity auto
speed auto
}
ethernet eth1 {
address 10.96.0.1/24
duplex auto
hw-id 00:15:5d:00:cd:18
smp_affinity auto
speed auto
}
loopback lo {
}
vti vti0 {
address 172.196.17.189/30
description “Virtual Tunnel Interface for VPN tunnel”
firewall {
in {
name OUTSIDE-IN
}
local {
name OUTSIDE-LOCAL
}
}
ip {
ospf {
dead-interval 40
hello-interval 10
network point-to-point
priority 1
retransmit-interval 5
transmit-delay 1
}
}
}
}
nat {
source {
rule 10 {
destination {
address 10.96.3.0/24
}
exclude
outbound-interface eth0
source {
address 10.96.0.0/24
}
}
rule 100 {
outbound-interface eth0
source {
address 10.96.0.0/24
}
translation {
address masquerade
}
}
}
}
protocols {
ospf {
area 0.0.0.0 {
network 10.96.0.0/24
network 10.96.3.0/24
}
parameters {
abr-type cisco
router-id 10.0.0.18
}
}
}
service {
ssh {
port 22
}
}
system {
config-management {
commit-revisions 20
}
console {
device ttyS0 {
speed 9600
}
}
gateway-address 10.0.0.1
host-name vyos
login {
user vyos {
authentication {
encrypted-password $1$anKwFKs9$ScS6200IK4CDaltLpg5rt/
plaintext-password “”
}
level admin
}
}
ntp {
server 0.pool.ntp.org {
}
server 1.pool.ntp.org {
}
server 2.pool.ntp.org {
}
}
package {
auto-sync 1
repository community {
components main
distribution helium
password “”
url http://packages.vyos.net/vyos
username “”
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone UTC
}
vpn {
ipsec {
esp-group ESP-Default {
compression disable
lifetime 3600
mode tunnel
pfs dh-group16
proposal 1 {
encryption aes256
hash sha256
}
}
ike-group IKE-Default {
dead-peer-detection {
action clear
interval 30
timeout 90
}
ikev2-reauth no
key-exchange ikev1
lifetime 86400
proposal 1 {
dh-group 16
encryption aes256
hash sha256
}
}
ipsec-interfaces {
interface eth0
}
logging {
log-modes all
}
site-to-site {
peer 10.0.0.18 {
authentication {
id 10.0.0.80
mode pre-shared-secret
pre-shared-secret secret-password
}
connection-type initiate
default-esp-group ESP-Default
ike-group IKE-Default
ikev2-reauth inherit
local-address 10.0.0.80
vti {
bind vti0
esp-group ESP-Default
}
}
}
}
}

/* Warning: Do not remove the following line. /
/ === vyatta-config-version: “cluster@1:config-management@1:conntrack-sync@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@4:nat@4:qos@1:quagga@2:system@6:vrrp@1:wanloadbalance@3:webgui@1:webproxy@1:zone-policy@1” === /
/ Release version: VyOS 1.1.7 */[/code]

SITE2 CONFIG

[code]firewall {
all-ping enable
broadcast-ping disable
config-trap disable
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name OUTSIDE-IN {
default-action drop
rule 10 {
action accept
state {
established enable
related enable
}
}
rule 20 {
action accept
source {
address 10.96.0.0/24
}
}
}
name OUTSIDE-LOCAL {
default-action drop
rule 10 {
action accept
state {
established enable
related enable
}
}
rule 20 {
action accept
icmp {
type-name echo-request
}
protocol icmp
state {
new enable
}
}
rule 30 {
action drop
destination {
port 22
}
protocol tcp
recent {
count 4
time 60
}
state {
new enable
}
}
rule 31 {
action accept
destination {
port 22
}
protocol tcp
state {
new enable
}
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
twa-hazards-protection disable
}
interfaces {
ethernet eth0 {
address 10.0.0.18/24
description OUTSIDE
duplex auto
firewall {
in {
name OUTSIDE-IN
}
local {
name OUTSIDE-LOCAL
}
}
hw-id 00:15:5d:00:10:0f
smp_affinity auto
speed auto
}
ethernet eth1 {
address 10.96.3.1/24
description PROD
duplex auto
hw-id 00:15:5d:00:10:10
smp_affinity auto
speed auto
}
loopback lo {
}
vti vti0 {
address 172.196.17.190/30
description “Virtual tunnel interface for VPN tunnel”
firewall {
in {
name OUTSIDE-IN
}
local {
name OUTSIDE-LOCAL
}
}
ip {
ospf {
dead-interval 40
hello-interval 10
network point-to-point
priority 1
retransmit-interval 5
transmit-delay 1
}
}
}
}
nat {
source {
rule 10 {
destination {
address 10.96.0.0/24
}
exclude
outbound-interface eth0
source {
address 10.96.3.0/24
}
}
rule 100 {
outbound-interface eth0
source {
address 10.96.3.0/24
}
translation {
address masquerade
}
}
}
}
protocols {
ospf {
area 0.0.0.0 {
network 10.96.0.0/24
network 10.96.3.0/24
}
parameters {
abr-type cisco
router-id 10.0.0.80
}
}
}
service {
ssh {
port 22
}
}
system {
config-management {
commit-revisions 20
}
console {
device ttyS0 {
speed 9600
}
}
gateway-address 10.0.0.1
host-name vyos
login {
user vyos {
authentication {
encrypted-password $1$IYWW7taS$ox3r1K7D34DekpM2buR4.1
plaintext-password “”
}
level admin
}
}
ntp {
server 0.pool.ntp.org {
}
server 1.pool.ntp.org {
}
server 2.pool.ntp.org {
}
}
package {
auto-sync 1
repository community {
components main
distribution helium
password “”
url http://packages.vyos.net/vyos
username “”
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone UTC
}
vpn {
ipsec {
esp-group ESP-Default {
compression disable
lifetime 3600
mode tunnel
pfs dh-group16
proposal 1 {
encryption aes256
hash sha256
}
}
ike-group IKE-Default {
dead-peer-detection {
action clear
interval 30
timeout 90
}
ikev2-reauth no
key-exchange ikev1
lifetime 86400
proposal 1 {
dh-group 16
encryption aes256
hash sha256
}
}
ipsec-interfaces {
interface eth0
}
logging {
log-modes all
}
site-to-site {
peer 10.0.0.80 {
authentication {
id 10.0.0.18
mode pre-shared-secret
pre-shared-secret secret-password
}
connection-type initiate
default-esp-group ESP-Default
ike-group IKE-Default
ikev2-reauth inherit
local-address 10.0.0.18
vti {
bind vti0
esp-group ESP-Default
}
}
}
}
}

/* Warning: Do not remove the following line. /
/ === vyatta-config-version: “cluster@1:config-management@1:conntrack-sync@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@4:nat@4:qos@1:quagga@2:system@6:vrrp@1:wanloadbalance@3:webgui@1:webproxy@1:zone-policy@1” === /
/ Release version: VyOS 1.1.7 */
[/code]

2

anyone?

3

Check logs, they should at least point you to where you should look

4

I have similar problem on VTI tunnel to edgerouterX. Occasionally, (DSL hick-up?) one tunnel end disconnects, but other end has no clue connection is gone, and it keeps sending on the old non-functional tunnel.
At Vyos side, I have a script that checks: if remote peer is pingable, but VTI isn’t, then it issues command:
vbash -ic ‘restart vpn’