Bug 1250723

Summary: Updating IPv4 address lifetime causes VPN disconnection
Product: Red Hat Enterprise Linux 7 Reporter: David Ward <david.ward>
Component: NetworkManagerAssignee: Rashid Khan <rkhan>
Status: CLOSED ERRATA QA Contact: Desktop QE <desktop-qa-list>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.1CC: dcbw, jklimes, thaller, tpelka, vbenes
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-11-19 11:02:47 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description David Ward 2015-08-05 20:17:46 UTC
(Note: this is a separate but related issue to bug 1250705, which applies to the kernel.)

Please update from NetworkManager 1.0.0 to NetworkManager 1.0.4 in RHEL 7, to fix behavior that causes a standalone corporate VPN client to regularly disconnect when operating over a DHCP-enabled NetworkManager connection. (This does not occur with NetworkManager prior to 1.0, i.e., in RHEL 6.)

When the VPN client is started, it installs its own additional routes with a lower metric than existing routes to ensure that all traffic goes through the tunnel interface it creates. To enforce this, the VPN client monitors netlink for routing changes and disconnects immediately if any occur. When the DHCP lease on the NetworkManager connection is renewed and the address lifetime is updated, NetworkManager calls nm_platform_ip4_route_sync() and attempts to restore the routing table to its earlier state prior to starting the VPN client.

This is resolved in NetworkManager 1.0.4, which now attempts to preserve IP confiugration changes that are made outside of NetworkManager. From my examination of the code, this appears to have required substantial changes and so the minor version upgrade of NetworkManager is likely necessary to incorporate these into RHEL 7.

Comment 1 Thomas Haller 2015-08-05 20:30:20 UTC
RHEL-7.2 will contain 1.0.4 release + additional fixes (mostly from nm-1-0 upstream branch).

The current beta-builds for RHEL-7.2 already now contain 1.0.4+, so I think this BZ will be fixed (without need for further action). Yay.

Comment 2 David Ward 2015-08-05 20:36:51 UTC
Excellent! Thanks for the info.

Comment 4 Thomas Haller 2015-08-10 08:45:37 UTC
I am going to add this bug to errata, which eventually leads to the bug being closed (fixed).

The current RHEL-7.2 beta builds already contain 1.0.4+, so that part of the bug is certainly handled.

Presumably 1.0.4 also brings the desired behavior to fix this bug (i.e. play nice with external routes from other VPN clients).



Let's open a new (more specific bug) in case that 1.0.4 has other issues with respect to handling routes. But I'd expect that not to be necessary.

Comment 6 Vladimir Benes 2015-09-21 17:45:07 UTC
tested and working on 2 minutes dhcp connection

Comment 7 errata-xmlrpc 2015-11-19 11:02:47 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2315.html