Project

General

Profile

Bug #3979

2.2 IPsec NAT-T / MOBIKE IKEv2 control

Added by Chris Buechler almost 5 years ago. Updated over 4 years ago.

Status:
Resolved
Priority:
Normal
Category:
IPsec
Target version:
Start date:
11/03/2014
Due date:
% Done:

100%

Estimated time:
Affected Version:
2.2
Affected Architecture:

Description

The enable/disable/force NAT-T settings from earlier versions don't do anything in 2.2. It appears in newer strongswan versions where charon handles IKEv1, it's not possible to disable NAT-T, it's always on by default. That's problematic, as you probably don't want NAT-T on site to site VPNs, and we've seen a number of scenarios with third party IPsec devices where forcefully disabling NAT-T is necessary for it to behave properly.

Associated revisions

Revision 0810a719 (diff)
Added by Ermal Luçi almost 5 years ago

Restore 3 values back on NAT-T settings Just Enable now its Auto as per strongswan default. and off disabled mobike. Ticket #3979

Revision 065e78b3 (diff)
Added by Chris Buechler over 4 years ago

Add GUI control for MOBIKE. Hide it when IKEv1 selected. Enable toggling of NAT-T field display so it's on for IKEv1, off for IKEv2. Do same for reauth while here. Ticket #3979

Revision 7b404fde (diff)
Added by Chris Buechler over 4 years ago

Add GUI control for MOBIKE. Hide it when IKEv1 selected. Enable toggling of NAT-T field display so it's on for IKEv1, off for IKEv2. Do same for reauth while here. Ticket #3979

History

#1 Updated by Ermal Luçi almost 5 years ago

  • Status changed from New to Feedback

I have pushed them recently to be enforced.

The only remaining task is to remove Force from the options list because its the same as Enable.

#2 Updated by Chris Buechler almost 5 years ago

  • Status changed from Feedback to Confirmed

after further review and discussion with Ermal, the code is there to set forceencaps, it just isn't setting it correctly.

#3 Updated by Chris Buechler almost 5 years ago

  • % Done changed from 0 to 50

this is correct for IKEv1 after my commits earlier. Seems to be working as it should. It'll continue to work on upgraded configurations, though "disable" becomes "auto" by necessity.

There is a potential problem area in that it's not possible to disable NAT-T in strongswan (short of compiling it without it). Suspect that might hit some issues with third party devices we've seen in rare occasions in the past, where some other device wants to use NAT-T where it's not necessary.

Needs review for IKEv2, the mobike config setting is what can disable that there.

#4 Updated by Chris Buechler almost 5 years ago

  • Assignee set to Chris Buechler

I'll finish this.

#5 Updated by Chris Buechler almost 5 years ago

  • Subject changed from 2.2 IPsec NAT-T settings not obeyed to 2.2 IPsec NAT-T / MOBIKE IKEv2 control
  • Priority changed from High to Normal
  • Affected Documentation 0 added
  • Affected Documentation deleted (1)

really needs some javascript to remove NAT-T option where IKEv2 is selected and replace with MOBIKE control. No longer as important since nearly every real world problem case is now fixed, removing RC blocking.

#6 Updated by Chris Buechler over 4 years ago

  • Target version changed from 2.2 to 2.2.1

this is fine as is for now, will revisit for 2.2.1

#7 Updated by Chris Buechler over 4 years ago

  • Status changed from Confirmed to Feedback

this should all be addressed now, needs review and further testing.

#8 Updated by Chris Buechler over 4 years ago

  • Status changed from Feedback to Resolved
  • % Done changed from 50 to 100

fixed

Also available in: Atom PDF