Red Hat Bugzilla – Bug 1471763
RFE: libreswan MOBIKE support (RFC-4555)
Last modified: 2018-01-11 10:28:18 EST
This document describes the MOBIKE protocol, a mobility and
multihoming extension to Internet Key Exchange (IKEv2). MOBIKE
allows the IP addresses associated with IKEv2 and tunnel mode IPsec
Security Associations to change. A mobile Virtual Private Network
(VPN) client could use MOBIKE to keep the connection with the VPN
gateway active while moving from one address to another. Similarly,
a multihomed host could use MOBIKE to move the traffic to a different
interface if, for instance, the one currently being used stops
This support requires a few recent fixes in the kernel. See associated bug for this status
(In reply to Paul Wouters from comment #4)
> I will upload the test cases for testing, as these are not yet in public
> master upstream
Paul, I just get to this - do you have those test cases or any hint to test mobike support? I see that upstream test cases got updated with mobike=no but there are no mobike=yes test cases in master so far. BTW: ipsec.conf man page does not mention mobike option at all at the moment (3.22-2.el7).
Moreover, from BZ#1460790#c4 I got an impression that MOBIKE libreswan client support is not yet done, or is it? I would like to use the following testing approach - libreswan server with mobike=yes, libreswan client from laptop having both wired and wireless connection with IPsec tunnel to server using wireless, then bringing down wireless connection should keep tunnel on using wired connection. Does it make sense?
the client support is not yet in upstream or this build. Actually, the server side isn't in a public tree yet either and that one contains the test cases (using strongswan as client)
I'll see if mobike lands in master today or tomorrow. If not, I will attach the test cases here.
Note that you also need a patched kernel for this to work, as the mobike fixes have not yet been put into the rhel-7.5.0 kernel either