On Tue, 20 Sep 2016, Reuben Farrelly wrote:

Here's after a clean reboot:

lightning ~ # ip route
default via dev eth0  metric 3 dev lo  scope host via dev lo dev eth0  proto kernel  scope link  src
lightning ~ #

The VTI won't come up though. It fails, as towards the end of the negotiation the box loses connectivity with the peer and from the Cisco's perspective never completes negotiation - so I had to add a route to cover the peer's public subnet: via dev eth0

My guess is this would resolve your issue:

diff --git a/programs/_updown.netkey/_updown.netkey.in
index 3031ac5..2fd1a83 100644
--- a/programs/_updown.netkey/_updown.netkey.in
+++ b/programs/_updown.netkey/_updown.netkey.in
@@ -481,9 +481,6 @@ doroute() {

     case "${PLUTO_PEER_CLIENT}" in
-           # need to provide route that eclipses default, without
-           # replacing it.
-           it="ip route $1 ${parms2} && ip route $1
            it="ip route $1 ${parms} ${parms2}"

We should probably check for the conn doing VTI and skip it in that

Can you test this and let me know?

Swan mailing list

Reply via email to