1

Re: Creating a site to site vpn from ubuntu 22 + strongswan to cisco meraki

Issue: I've established a vpn tunnel but routing between clients on the network is not working.

meraki config: Non-Meraki VPN peer configured. ikeversion: ikev1, public ip: xx.xx.xx.xx (ip to ubuntu gateway), private subnets: 10.124.16.0/20,10.48.0.0/16 (subnets on ubuntu gateway network)

entries for 10.124.16.0/20 and 10.48.0.0/16 are in meraki route table

Meraki native network:

xx.xx.xx.xx (pub ip)
192.168.14.0/24

Ubuntu gateway network:

etho: xx.xx.xx.xx (pub ip)
eth0: 10.48.0.5
eth1: 10.124.16.3

ipsec.conf

config setup
    charondebug="all"
    uniqueids=yes
    strictcrlpolicy=no

conn %default
    ikelifetime=1440m
    rekeymargin=3m
    keyingtries=%forever
    keyexchange=ikev1
    authby=secret
    dpdaction=restart
    dpddelay=30

conn meraki_network
    keyexchange=ikev1
    left=%defaultroute
    leftsubnet=10.124.16.0/20,10.48.0.0/16
    leftid=xx.xx.xx.xx #Public IP to ubuntu gateway 
    right=xx.xx.xx.xx #Public Meraki MX IP 
    rightsubnet=192.168.0.0/16
    rightid=xx.xx.xx.xx #Public Meraki MX IP 
    auto=add
    ike=aes128-sha1-modp1024
    esp=aes128-sha1

$: ipsec up meraki_network

root@Gateway:~# ipsec up meraki_network
initiating Main Mode IKE_SA meraki_network[2] to xx.xx.xx.xx (meraki ip)
generating ID_PROT request 0 [ SA V V V V V ]
sending packet: from xx.xx.xx.xx (gateway ip)[500] to xx.xx.xx.xx (meraki ip)[500] (252 bytes)
received packet: from xx.xx.xx.xx (meraki ip)[500] to xx.xx.xx.xx (gateway ip)[500] (164 bytes)
parsed ID_PROT response 0 [ SA V V V V ]
received XAuth vendor ID
received DPD vendor ID
received FRAGMENTATION vendor ID
received NAT-T (RFC 3947) vendor ID
selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from xx.xx.xx.xx (gateway ip)[500] to xx.xx.xx.xx (meraki ip)[500] (244 bytes)
received packet: from xx.xx.xx.xx (meraki ip)[500] to xx.xx.xx.xx (gateway ip)[500] (244 bytes)
parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
sending packet: from xx.xx.xx.xx (gateway ip)[500] to xx.xx.xx.xx (meraki ip)[500] (108 bytes)
received packet: from xx.xx.xx.xx (meraki ip)[500] to xx.xx.xx.xx (gateway ip)[500] (76 bytes)
parsed ID_PROT response 0 [ ID HASH ]
IKE_SA meraki_network[2] established between xx.xx.xx.xx (gateway ip)[xx.xx.xx.xx (gateway ip)]...xx.xx.xx.xx (meraki ip)[xx.xx.xx.xx (meraki ip)]
scheduling reauthentication in 86075s
maximum IKE_SA lifetime 86255s
generating QUICK_MODE request 40691876 [ HASH SA No ID ID ]
sending packet: from xx.xx.xx.xx (gateway ip)[500] to xx.xx.xx.xx (meraki ip)[500] (236 bytes)
received packet: from xx.xx.xx.xx (meraki ip)[500] to xx.xx.xx.xx (gateway ip)[500] (188 bytes)
parsed QUICK_MODE response 40691876 [ HASH SA No ID ID ]
selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
CHILD_SA meraki_network{1} established with SPIs cc31b306_i c563b15e_o and TS 10.124.16.0/20 === 192.168.14.0/24
generating QUICK_MODE request 40691876 [ HASH ]
connection 'meraki_network' established successfully

meraki vpn log output

Feb 14 11:17:07     Non-Meraki VPN  Non-Meraki VPN negotiation  msg: <remote-peer-3|1625> CHILD_SA net-3-0{1582} established with SPIs c563b15e(inbound) cc31b306(outbound) and TS 192.168.14.0/24 === 10.124.16.0/20
...
...

ping from gateway to local network

@Gateway:~$ ping -I eth1 192.168.14.105
PING 192.168.14.105 (192.168.14.105) from 10.124.16.3 eth1: 56(84) bytes of data.
From (gateway public ip) icmp_seq=1 Destination Host Unreachable

$: ipsec status showall

Listening IP addresses:
  xx.xx.xx.xx
  10.48.0.5
  10.124.16.3
Connections:
meraki_network:  %any...(meraki ip)  IKEv1, dpddelay=30s
meraki_network:   local:  [(gateway ip)] uses pre-shared key authentication
meraki_network:   remote: [(meraki ip)] uses pre-shared key authentication
meraki_network:   child:  10.124.16.0/20 10.48.0.0/16 === 192.168.0.0/16 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 connecting):
meraki_network[500]: ESTABLISHED 3 minutes ago, (gateway ip)...(meraki ip)
meraki_network[500]: IKEv1 SPIs: ea49e4a26499c09c_i 4be0b57d054853e1_r*, pre-shared key reauthentication in 23 hours
meraki_network[500]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
meraki_network{1}:  INSTALLED, TUNNEL, reqid 1, ESP SPIs: cc31b306_i c563b15e_o
meraki_network{1}:  AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 52 seconds
meraki_network{1}:   10.124.16.0/20 === 192.168.14.0/24

Notice we have a good tunnel between subnets according to logs on both ends: 192.168.14.0/24 === 10.124.16.0/20

I am not able to reach clients on either network (192.168.14.0/24 or 10.124.16.0/20)

I feel like maybe I need a static route defined somewhere on the gateway side for the 192.168.14.0/24 network. Does anyone have any clues, I'm stumped at the moment. Although hoping typing this out helps the answer come to me.

2
  • Each end of the tunnel needs to be told of the networks behind the other side of the tunnel. Unfortunately, questions about host/server configurations are off-topic here. You can ask about you Ubuntu on Server Fault for a business network. Someone here may be able to help with the Meraki.
    – Ron Maupin
    Feb 14 at 20:13
  • What's your client network?
    – Turdie
    Feb 14 at 23:16

1 Answer 1

0

Unfortunately I could not find the real answer to this. I simply destroyed the vpn gateway machine and started over from scratch using the config from my original post, and now I am able to ping clients between networks fine.

I compared route tables from the old gateway to the new gateway and they are basically identical, including the route entry that strongswan automatically makes in table 220.

My hunch is there was something off in an iptable rule. I didn't go as far as to see however.

Not the answer you're looking for? Browse other questions tagged or ask your own question.