Project

General

Profile

Actions
Copy link

Bug #9592

closed

VTI interface down because interface number created is greater than ipsec32768

Added by Steven Perreau almost 3 years ago. Updated over 1 year ago.

Status:
Resolved
Priority:
Normal
Assignee:
Renato Botelho
Category:
IPsec
Target version:
2.5.0
Start date:
06/18/2019
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.4-p3
Affected Architecture:

Description

In some conditions, when creating a VTI interface for routed IP, the interface number allocated is very high.

<opt9>
<descr><![CDATA[HO_SY1_WAN]]></descr>
<if>ipsec52000</if>
<enable></enable>
<spoofmac></spoofmac>
<mtu>1440</mtu>
<mss>1440</mss>
</opt9>

This seems to be happening with firewalls that already have a large number of traditional ipsec p1/p2 tunnels. The first VTI p2 I made started with ipsec52000 and the interface is permanently offline / down. Any additional VTI interfaces I create get an even higher interface number such as ipsec53000.

Obviously this breaks the VTI and you cannot get routed IP to work.

Actions
Copy link
 #1

Updated by Brett Merrick almost 3 years ago

Suggested fix in pull request: https://github.com/pfsense/pfsense/pull/4071

Actions
Copy link
 #2

Updated by Jim Pingle over 2 years ago

  • Status changed from New to Pull Request Review
Actions
Copy link
 #3

Updated by Jim Pingle about 2 years ago

  • Target version set to 2.5.0
Actions
Copy link
 #4

Updated by Renato Botelho over 1 year ago

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Renato Botelho
  • % Done changed from 0 to 100

PR has been merged. Thanks!

Actions
Copy link
 #6

Updated by Jim Pingle over 1 year ago

  • Status changed from Feedback to Pull Request Review
Actions
Copy link
 #7

Updated by Renato Botelho over 1 year ago

  • Status changed from Pull Request Review to Feedback

PR has been merged. Thanks!

Actions
Copy link
 #8

Updated by Chris Linstruth over 1 year ago

  • Assignee changed from Renato Botelho to Chris Linstruth
Actions
Copy link
 #9

Updated by Chris Linstruth over 1 year ago

I created enough tunnels to get over what used to be 32768. Along the way I created two VTI tunnels. They were given interfaces ipsec3000 and ipsec6000. After there were enough tunnels to push the interface number past 32768, the VTI was given ipsec1.

If that is how it should work, it looks good. If the VTIs are supposed to start at con1 regardless of how many tunnels are already created, it doesn't seem to do that.

Actions
Copy link
 #10

Updated by Chris Linstruth over 1 year ago

  • Assignee changed from Chris Linstruth to Renato Botelho
Actions
Copy link
 #11

Updated by Viktor Gurov over 1 year ago

Chris Linstruth wrote:

I created enough tunnels to get over what used to be 32768. Along the way I created two VTI tunnels. They were given interfaces ipsec3000 and ipsec6000. After there were enough tunnels to push the interface number past 32768, the VTI was given ipsec1.

If that is how it should work, it looks good. If the VTIs are supposed to start at con1 regardless of how many tunnels are already created, it doesn't seem to do that.

This is correct, and used for backward compatibility with pre-2.5 vti interface naming
see https://github.com/pfsense/pfsense/blob/3b88d9712b187602e946faeecc5f4902904b6d4c/src/etc/inc/interfaces.inc#L1379

Actions
Copy link
 #12

Updated by Renato Botelho over 1 year ago

  • Status changed from Feedback to Resolved
Actions
Copy link
 #13

Updated by Viktor Gurov over 1 year ago

  • Status changed from Resolved to New

First IPsec IKEv2 creates bogus vtimap entry:

        <vtimaps>
            <item>
                <reqid></reqid>
                <index>0</index>
                <ifnum>000</ifnum>
            </item>
        </vtimaps>

it also doesn't create vtimap for the first IPsec IKEv2 VTI.

Fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/40

Actions
Copy link
 #14

Updated by Viktor Gurov over 1 year ago

  • Status changed from New to Pull Request Review
Actions
Copy link
 #15

Updated by Renato Botelho over 1 year ago

  • Status changed from Pull Request Review to Feedback

PR has been merged. Thanks!

Actions
Copy link
 #16

Updated by Alhusein Zawi over 1 year ago

VTI map is created

<vtimaps>
<item>
<reqid>1</reqid>
<index>0</index>
<ifnum>1000</ifnum>
</item>
<item>
<reqid>2</reqid>
<index>0</index>
<ifnum>2000</ifnum>
</item>
</vtimaps>

IPsec IKEv2 VTI. 2.5.0.a.20201217.0648

Actions
Copy link
 #17

Updated by Renato Botelho over 1 year ago

  • Status changed from Feedback to Resolved
Actions
Copy link

Also available in: Atom PDF