Question

Hello All:

When I issue the command "uci show strongswan" is get the following:

<snip>

strongswan.SOICCMP.leftfirewall='yes'

strongswan.SOICCMP.forceencaps='no'

strongswan.SOICCMP.dpdaction='restart'

strongswan.SOICCMP.closeaction='restart'

strongswan.SOICCMP.right='164.100.196.79'

strongswan.SOICCMP.allow_webui='1'

<snip>

But then when I look at the ipsec.conf:

 conn SOICC

leftid=keyid:CORS219

leftauth=psk

rightauth=psk

leftsubnet=2.2.2.219/32

right=A.B.C.D

rightid=keyid:CCrouter

keyexchange=ikev2

authby=secret

leftfirewall=yes

rightfirewall=no

auto=start

type=tunnel

aggressive=no

dpdaction=restart

dpddelay=30

dpdtimeout=30

forceencaps=no

keyingtries=%forever

ike=aes256-sha256-modp2048

ikelifetime=5h

esp=aes256-sha256-modp2048

keylife=4h

rightsubnet=1.1.1.10/32

You can see the absence of the "closeaction=restart" option.

Where has it gone? Why is it not there?

Here is my /etc/config/strongswan file:

config conn 'SOICC'

option enabled '1'

option keyexchange 'ikev2'

option ipsec_type 'tunnel'

option leftfirewall 'yes'

option forceencaps 'no'

option dpdaction 'restart'

        option closeaction 'restart'

option right 'A.B.C.D'

option allow_webui '1'

option ike_encryption_algorithm 'aes256'

option ike_authentication_algorithm 'sha256'

option ike_dh_group 'modp2048'

option esp_encryption_algorithm 'aes256'

option esp_hash_algorithm 'sha256'

option esp_pfs_group 'modp2048'

option keylife '4h'

option my_identifier 'keyid:CORS219'

option rightid 'keyid:CCrouter'

option rightfirewall 'no'

option dpddelay '30'

option dpdtimeout '30'

option ikelifetime '5h'

option auto 'start'

option auth 'psk'

list leftsubnet '2.2.2.219/32'

list rightsubnet '1.1.1.10/32'

option aggressive 'no'

So I have enabled the option, why is it not showing up in the /etc/ipsec.conf file after reboot?

Cheers,

John

Answer 1

Hello,

I've looked at this issue and it seems like the UCI output in your initial post seems slightly off when comparing to the actual output when this custom option is configured. Could you try to do one of the following:

WebUI way:

Login to the router via WebUI, navigate to Services > VPN > IPsec, edit IPsec tunnel and in the custom options field, enter command in the following way:

 

Make sure to save the configuration. It should show up in the /etc/ipsec.conf after the tunnel reloads itself.

---

CLI way:

Alternatively, login to the router via CLI (SSH) and run the following commands:

uci del strongswan.SOICCMP.closeaction

uci set strongswan.SOICCMP.custom='closeaction=restart'

uci commit && reload_config && /etc/init.d/ipsec restart && sleep 5 && cat /etc/ipsec.conf | grep restart

This should configure the custom rule as intended and restart the IPsec tunnel immediately. Once the tunnel is restarted, it should show whether the rule was added to the ipsec.conf file.

Let me know if this works.

Best regards,

Tomas.

Comments

I used the UCI interface, it worked perfectly.

Thank you,

cheers,

John

Answer 2

Hi,

I've checked /etc/init.d/ipsec script and there's no support for closeaction option specifically.

To push this option into ipsec.conf  you need to config it as a custom option in /etc/config/ipsec

list custom 'closeaction=none'

e.g.: 

Comments

Hi....

I note that on my routers there is no /etc/config/ipsec. Do I need to create the file?

Cheers,

john

---

Which firmware version you're using?  Usually ipsec connections are configured in /etc/config/ipsec. You can try adding "list custom 'closeaction=none'" into your current config file, if it won't work then please provide troubleshoot file so I could look further into it.

---

FW version: RUT9XX_R_00.06.08.3

---

Hi, 

I've checked RUT9XX_R_00.06.08.3 FW and syntax is the same list custom 'closeaction=none'. The only difference is that config file is named strongswan instead of ipsec.

Does closeaction option appear in your ipsec.conf?

---

the closeaction=restart does not show up in /etc/ipsec.conf even though its in the /etc/config/strongswan file.

Cheers,

john

---

Hi, John,

Have you restarted ipsec service after changing modifying config file?

Could you share troubleshoot file from System -> Administration -> Troubleshoot, so I could further look into this issue?

---

I rebooted, yes.