Community discussions

MUM Europe 2020
 
User avatar
intelfx
just joined
Topic Author
Posts: 19
Joined: Sun Nov 06, 2016 10:30 am
Location: Moscow, Russia
Contact:

6.40rc11 — IPsec peers can now be specified with DNS names, but what about policies?

Sat Aug 12, 2017 8:35 am

Hi folks,

In the 6.40rc11 changelog we have this entry:
ipsec - allow to specify remote peer address as DNS name (CLI only);
That is, it is now possible to say:
> /ip ipsec peer set <N> address=<DNS name>
But if I say a DNS name for sa-dst-address=, the CLI gives me an error:
> /ip ipsec policy set <N> sa-dst-address=<DNS name>
invalid value for argument sa-dst-address:
    invalid value for argument ipv6
    invalid value for argument ip
So, how do I create a matching policy?
 
vacari
just joined
Posts: 7
Joined: Fri Mar 04, 2016 2:56 am

Re: 6.40rc11 — IPsec peers can now be specified with DNS names, but what about policies?

Sat Aug 12, 2017 10:16 pm

same here
+1
 
buzzdee
newbie
Posts: 35
Joined: Mon Apr 22, 2013 1:22 pm

Re: 6.40rc11 — IPsec peers can now be specified with DNS names, but what about policies?

Mon Aug 28, 2017 4:32 pm

Mee too
+1
 
Sob
Forum Guru
Forum Guru
Posts: 4998
Joined: Mon Apr 20, 2009 9:11 pm

Re: 6.40rc11 — IPsec peers can now be specified with DNS names, but what about policies?

Mon Aug 28, 2017 6:16 pm

Sorry if it's stupid idea, but do we need sa-src-address and sa-dst-address options at all? Couldn't policies be simply linked to peer from "/ip ipsec peer" instead? Maybe I'm forgetting some advanced usage, but for all I ever used, it was always sa-src-address=<local-address from peer> and sa-dst-address=<address from peer> anyway. Even if it wouldn't work for all scenarios, it could be nice as option.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply. Not intended as incentive for masochists.
 
pe1chl
Forum Guru
Forum Guru
Posts: 6143
Joined: Mon Jun 08, 2015 12:09 pm

Re: 6.40rc11 — IPsec peers can now be specified with DNS names, but what about policies?

Mon Aug 28, 2017 7:26 pm

Then there would have to be some linkage between "policy" and "peer", currently this is only there in the form of the SA addresses.
When there would be a reference in "policy" to e.g. a "peer name", that could then fill the SA addresses internally in RouterOS.

Note that this is already possible, when you use "generate policy" in the "peer" definition. But of course its usage is limited to
a policy between the SA addreses only, and for a specified set of protocols. But, it still works when you use IPsec as transport
below another tunneling protocol (GRE, IPIP, L2TP). I recommend that anyway, over trying to use IPsec tunnel to send traffic
for specified subnets.
 
andriys
Forum Guru
Forum Guru
Posts: 1193
Joined: Thu Nov 24, 2011 1:59 pm
Location: Kharkiv, Ukraine

Re: 6.40rc11 — IPsec peers can now be specified with DNS names, but what about policies?

Mon Aug 28, 2017 7:35 pm

Sorry if it's stupid idea, but do we need sa-src-address and sa-dst-address options at all?
That's all tied to how IPsec works behind the scene.

For L2L tunnels, policies are expected to come into the game first, and are used to find a proper SA. And only in case there's no established SA, a peer configuration is searched for, and then an ISAKMP or IKEv2 exchange is initiated based on the peer configuration found. Using DNS names in policies in such scenario is not really an option.

For road-warrior-like scenarios, however, a client is usually initiates ISAKMP or IKEv2 connection first. When phase 1 is established, one of the parties initiate phase 2 exchange, at which point both parties generate and install dynamic policies. And this is where the ability to specify peer address as an FQDN instead of IP address comes in handy. For this scenario policy templates are supposed to be used instead of predefined policies, so the ability to specify sa-src-address and sa-dst-address as DNS names is not needed either.

And of course the second setup can also be used for L2L tunnels when necessary.
 
pe1chl
Forum Guru
Forum Guru
Posts: 6143
Joined: Mon Jun 08, 2015 12:09 pm

Re: 6.40rc11 — IPsec peers can now be specified with DNS names, but what about policies?

Mon Aug 28, 2017 8:01 pm

It is actually possible to get a viable IPsec lan2lan tunnel configuration working with dynamic address.
I did this in a plain Linux system. The racoon program can start a script whenever phase1 is established, and this can be used to
fixup the phase2 policy SA address. This is done at the "server" site. At the dynamic address site the policy can be fixed by
a script running when the dynamic address is determined or changes at the "client" site.
At the moment, RouterOS does not yet allow running a script on phase1 establishment. It could be added.
With this support it is also possible to make GRE/IPsec and IPIP/IPsec tunnels work with dynamic address.
 
BertV
just joined
Posts: 5
Joined: Wed Mar 15, 2017 12:17 pm

Re: 6.40rc11 — IPsec peers can now be specified with DNS names, but what about policies?

Wed Nov 28, 2018 12:42 pm

+1
That's all tied to how IPsec works behind the scene.

For L2L tunnels, policies are expected to come into the game first, and are used to find a proper SA. And only in case there's no established SA, a peer configuration is searched for, and then an ISAKMP or IKEv2 exchange is initiated based on the peer configuration found. Using DNS names in policies in such scenario is not really an option.
I understand that there may be limitations, but I believe it must be possible somehow to link peers and policies to eachother.
If policies can't be tied to peers (because of the reason you specify), then perhaps it's possible by link peers to policies (the other way around)?
Either way: in most other VPN-capable devices, it's possible to link the policy to the peer somehow.

Who is online

Users browsing this forum: eworm, Google [Bot] and 110 guests