Designation: Non Export-Controlled Information Paul,
Thanks for the response. YES, you hit the nail on the head. "That sounds like you have auto=start..." That was the problem. Thanks again. Mark EXPORT CONTROL DETERMINATION: This document does not contain information defined as either technical data under the U.S. International Traffic in Arms Regulations (ITAR), 22 CFR 120-130, or information defined as technology under the U.S. Export Administration Regulations (EAR), 15 CFR 730-774. -----Original Message----- From: Paul Wouters <[email protected]> Sent: Thursday, June 11, 2026 10:43 AM To: Kozikowski, Mark (Proxy) <[email protected]> Cc: [email protected] Subject: RE: [Swan] is it possible to apply opportunistic ipsec on a Linux Virtual Machine with one network interface that has two IPs On Tue, 9 Jun 2026, Kozikowski, Mark (Proxy) wrote: > I have run into a problem with opportunistic connections. > > I’m using LS/IPSec version 4.15 on RHEL 10 with SELinux in permissive mode > for now. It is better to switch to 5.x > My point-to-point connections work just fine/. > > The opportunistic fails before it even starts. > > For the private connection, I keep getting: “cannot initiate connection > without knowing peer IP address” That sounds like you have auto=start which means it would try to start but it doesnt know where to start to. Opportunistic connections have auto=ondemand (aka auto=route) or auto=add (for responder only triggers) > For the open and block connections it get two different failures. > > 1 – with authby=never: “cannot initiate an authby=never connection Yes that makes no sense and is wrong to use. authby=never is meant for specific blocking connections only (eg those in opportunistic policy "block") > 2 – if I comment out authby in the connection, I get: “no connection “clear” > or “block” exists” It seems you have some configuration errors which are hard to debug without actually seeing the configuration. Paul _______________________________________________ Swan mailing list -- [email protected] To unsubscribe send an email to [email protected]
