I have a gateway setup with a ipsec.conf like this:
conn Servers_vpngateway2
left=%defaultroute
leftcert=vpngateway2.domain.com_cert.pem
[email protected]
leftfirewall=yes
leftsubnet=172.16.48.0/22
right=%any
rightid="C=US, ST=IL, L=Chicago, O=Company, OU=Servers_vpngateway2,
CN=*"
rightsourceip=172.16.52.0/24
auto=route
On this gateway I want to only allow those with a valid cert with
OU=Servers_vpngateway2. I have some servers that will also need to
connect to OU=Servers_vpngateway1, and in the future
OU=Servers_vpngateway3, etc and thus have multiple OU's.
Now if I connect with a client with a cert like this it works:
C=US, ST=IL, L=Chicago, O=Company, OU=Servers_vpngateway2,
CN=test.domain.com
If I connect with a client like this it doesn't work:
C=US, ST=IL, L=Chicago, O=Company, OU=Servers_vpngateway1,
OU=Servers_vpngateway2, CN=test.domain.com
However if I change the ipsec.conf conn definition to the following it
does work:
conn Servers_vpngateway2
left=%defaultroute
leftcert=vpngateway2.domain.com_cert.pem
[email protected]
leftfirewall=yes
leftsubnet=172.16.48.0/22
right=%any
rightid="C=US, ST=IL, L=Chicago, O=Company, OU=Servers_vpngateway1,
OU=Servers_vpngateway2, CN=*"
rightsourceip=172.16.52.0/24
auto=route
If I connect with a client like this it doesn't work:
C=US, ST=IL, L=Chicago, O=Company, OU=Servers_vpngateway2,
OU=Servers_vpngateway1, CN=test.domain.com
Likewise if I change the ipsec.conf conn definition to the following it
does work:
conn Servers_vpngateway2
left=%defaultroute
leftcert=vpngateway2.domain.com_cert.pem
[email protected]
leftfirewall=yes
leftsubnet=172.16.48.0/22
right=%any
rightid="C=US, ST=IL, L=Chicago, O=Company, OU=Servers_vpngateway2,
OU=Servers_vpngateway1, CN=*"
rightsourceip=172.16.52.0/24
auto=route
Is there a way to allow servers with valid certs and
OU=Servers_vpngateway2 and ignore all other (there may be one, two,
three, four, etc) OU's that is not writing conn definitions for all the
different combinations?
_______________________________________________
Dev mailing list
[email protected]
https://lists.strongswan.org/mailman/listinfo/dev
