Designation: Non Export-Controlled Information Hello again, libreswan,
I now have time to integrate the problem described below. Thanks for the information I received thus far. It was very helpful. I have run into a problem with opportunistic connections. I’m using LS/IPSec version 4.15 on RHEL 10 with SELinux in permissive mode for now. My point-to-point connections work just fine/. The opportunistic fails before it even starts. For the private connection, I keep getting: “cannot initiate connection without knowing peer IP address” For the open and block connections it get two different failures. 1 – with authby=never: “cannot initiate an authby=never connection 2 – if I comment out authby in the connection, I get: “no connection “clear” or “block” exists” I did have this working months ago, on a slightly older installation. But I cannot find any information on-line regarding these error conditions and any possible fixes. I certainly would like some help with this. Thanks again in advance, Mark Kozikowski EXPORT CONTROL DETERMINATION: This document does not contain information defined as either technical data under the U.S. International Traffic in Arms Regulations (ITAR), 22 CFR 120-130, or information defined as technology under the U.S. Export Administration Regulations (EAR), 15 CFR 730-774. From: Paul Wouters <[email protected]> Sent: Wednesday, August 6, 2025 2:10 PM To: Kozikowski, Mark <[email protected]> Cc: [email protected] Subject: Re: [Swan] is it possible to apply opportunistic ipsec on a Linux Virtual Machine with one network interface that has two IPs On Wed, 6 Aug 2025, Kozikowski, Mark wrote: > I have a Linux virtual machine that has a single network interface, letʼs say , ens1f0. > > Configured on that IF, I have assigned a static IP address, e. g. 192. 168. 22. 32 > > And as ZjQcmQRYFpfptBannerStart This Message Is From an Untrusted Sender You have not previously corresponded with this sender. ZjQcmQRYFpfptBannerEnd On Wed, 6 Aug 2025, Kozikowski, Mark wrote: > I have a Linux virtual machine that has a single network interface, letʼs say > , ens1f0. > > Configured on that IF, I have assigned a static IP address, e.g. 192.168.22.32 > > And as it is also part of a cluster, I have assigned the same IF the virtual > IP 192.168.22.102. > > This address will be moved to the primary node of the cluster based on which > node is > the cluster primary node. > I have designated the .32 as part of the opportunistic private communications. > > And the cluster IP as an ʽopenʼ communication. > > > Prior to the cluster assigning the primary node, the tunnels are made, and > 22.32 works correctly for all communications. > > But as soon as this node is selected as the cluster primary, all > communication via 22.32 stops. > > I cannot find any documentation that shows how to setup such a configuration. I think what happens is that your "default outgoing IP address" might be changing from .32 to .102 and the .102 communication isn't part of that private group tunnel? You can have multiple private OE group connections, eg: conn base [...] #left= conn c32 also=base left=192.168.22.32 conn c102 also=base left=192.168.22.102 Then add the "private" IPs to both /etc/ipsec.d/policies/{c32|c102} Note that if you are adding/removing IPs to the machine, you need to run "ipsec whack --listen" to let the pluto daemon know to update its list of interfaces/IPs Paul
_______________________________________________ Swan mailing list -- [email protected] To unsubscribe send an email to [email protected]
