Introduction
ICN SDEWAN solution leverages IPSec functionality in SD-EWAN CNF to setup security tunnel to enable communication between ONAP4K8S/APPX Manager with Edge cluster or Edge cluster with Edge cluster. There are several solutions in OpenWRT to implement IPSec, include: Openswan, Racoon, and StrongSwan. ICN will use StrongSwan solution.
OpenWRT StrongSwan Basic
Service Start Flow:
StrongSwan application is run by command: "/etc/init.d/ipsec start", this command will generate StrongSwan's configuration (e.g. /etc/ipsec/*) based on openwrt configuration (e.g. /etc/config/ipsec) then start ipsec application as daemon, below diagram shows its flow
Configuration: OpenWRT's IPSec Configuration is defined in /etc/config/ipsec, the detail configuration content and map to StrongSwan configuration are described in below table
| Section | Option | Type | StrongSwan configuration file | StrongSwan configuration option | Description |
|---|---|---|---|---|---|
| ipsec | Global configuration | ||||
| debug | int | strongswan.conf | syslog | whether to enable log information | |
| rtinstall_enabled | boolean | strongswan.conf | install_routes | ||
| ignore_routing_tables | list | strongswan.conf | ignore_routing_tables | ||
| interface | list | strongswan.conf | interfaces_use | ||
| remote | Define a group remote tunnels with same security configuration | ||||
| tunnel | list | ||||
| transport | list | ||||
| enabled | boolean | whether this configuration is enabled | |||
| gateway | String | ipsec.secrets ipsec.conf | local_gateway/remote_gateway right | ||
| pre_shared_key | String | ipsec.secrets | PSK | ||
| auth_method | String | ipsec.conf | leftauth/rightauth | ||
| local_identifier | String | ipsec.secrets ipsec.conf | local_identifier leftid | ||
| remote_identifier | String | ipsec.secrets ipsec.conf | remote_identifier rightid | ||
| crypto_proposal | list | ipsec.conf | ike | ||
| force_crypto_proposal | boolean | ||||
tunnel /transport | Define configuration for a tunnel or transport | ||||
| mode | String | ipsec.conf | auto | ||
| local_subnet | String | ipsec.conf | leftsubnet | ||
| local_nat | String | ipsec.conf | leftsubnet | ||
| local_sourceip | String | ipsec.conf | leftsourceip | ||
| local_updown | String | ipsec.conf | leftupdown | ||
| local_firewall | String | ipsec.conf | leftfirewall | ||
| remote_subnet | String | ipsec.conf | rightsubnet | ||
| remote_sourceip | String | ipsec.conf | rightsourceip | ||
| remote_updown | String | ipsec.conf | rightupdown | ||
| remote_firewall | String | ipsec.conf | rightfirewall | ||
| ikelifetime | String | ipsec.conf | ikelifetime | ||
| lifetime | String | ipsec.conf | lifetime | ||
| margintime | String | ipsec.conf | margintime | ||
| keyingtries | String | ipsec.conf | keyingtries | ||
| dpdaction | String | ipsec.conf | dpdaction | ||
| dpddelay | String | ipsec.conf | dpddelay | ||
| inactivity | boolean | ipsec.conf | inactivity | ||
| keyexchange | String | ipsec.conf | keyexchange | ||
| crypto_proposal | list | ipsec.conf | esp | ||
| proposal | Define configuration for a proposal | ||||
| encryption_algorithm | String | ipsec.conf | ike/esp | ||
| hash_algorithm | String | ipsec.conf | ike/esp | ||
| dh_group | String | ipsec.conf | ike/esp |
IPSec CRD
IPSec CRD will be created by EWAN config Agent to configurate a remote configuration. it is defined as below, with filed map to ipsec configuration.
apiVersion: sdewan.akraino.org/v1alpha1
kind: IPSecRemote
metadata:
name: example1-rule
spec:
node: node1
gateway:
pre_shared_key:
auth_method:
local_identifier:
remote_identifier:
crypto_proposal: "proposal1"
force_crypto_proposal: true
connection:
- type: tunnel/transport
mode:
local_subnet:
local_nat:
local_sourceip:
local_updown:
local_firewall:
remote_subnet:
remote_sourceip:
remote_updown:
remote_firewall:
keyexchange: "ikev2"
inactivity:
crypto_proposal: "proposal1 proposal2"
proposal:
- encryption_algorithm:
hash_algorithm:
dh_group: