Re: [strongSwan] host to subnet support

Michael C. Cambria Thu, 09 Oct 2014 13:19:33 -0700


Thanks for the help.  I finally had access to the systems in question.

Using 0.0.0.0/0 didn't work. I tried using the IP address of the clientinterface, specifically "rightsubnet=192.168.56.2/32" instead. That didwork. I might not always know that IP address though.


Thanks,
Michael

On 09/27/2014 09:34 AM, Noel Kuntze wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hello Michael,

the rightsubnet / leftsubnet settings default to the value of "right" or 
"left", if ommitted.
If "right" or "left"  and the corresponding subnet setting is set to %any or 
ommitted ,
charon takes the value of the layer three packet and takes it as configured 
value of left/rightsubnet.
The value that is in the IKE packet differes from that, if NAT is used.
That's the reason for it failing. Solution is to set left/rightsubnet to 
0.0.0.0/0 and trust the client in what it does.
Currently, strongSwan has no functionality to propose 0.0.0.0/0, but only 
accept a /32 subnet from a client.

Mit freundlichen Grüßen/Regards,
Noel Kuntze

GPG Key ID: 0x63EC6658
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658

Am 26.09.2014 um 00:16 schrieb Michael C. Cambria:

Hi,

I've been able to successfully set up subnet to subnet connections using IKEv2 
and a self signed cert.  StrongSwan is used at both ends.

Using the same systems, I'm having some problems getting host-to-subnet to work 
in certain cases.  Host-to-subnet is the desired configuration.

Here is the host to host config which works:

conn clinetnet
         left=%defaultroute
         lefthostaccess=yes
         leftsubnet=192.168.1.0/24
         leftfirewall=yes
         right=132.197.247.50
         rightsubnet=172.16.0.0/16
         auto=route

conn srvnetnet
         left=132.197.247.50
         leftsubnet=172.16.0.0/16
         leftfirewall=yes
         right=%any
         rightsubnet=192.168.1.0/24
         righthostaccess=yes
         auto=route


I thought all I need to do is remove leftsubnet= from the "client" ipsec.conf and 
rightsubnet= from the "server", but that works in one case and fails in another.

So I'd like to know if host-to-subnet is supposed to be configured this way or 
not before digging any further.  If it should work, it seems the failing case 
uses NAT in the path between the two machines.  NAT works for the 
subnet-to-subnet configuration.  The failure only happens with the 
host-to-subnet config.

In the failing case, the client receives:

received TS_UNACCEPTABLE notify, no CHILD_SA built

The server log shows (10.1.2.180 is the IPv4 address of the client):

charon: 13[CFG] looking for a child config for 172.16.0.0/16 === 10.1.2.180/32
charon: 09[CFG] proposing traffic selectors for us:
charon: 09[CFG]  172.16.0.0/16
charon: 09[CFG] proposing traffic selectors for other:
charon: 09[CFG]  <IPv4 address of NAT device>/32
charon: 09[IKE] traffic selectors 172.16.0.0/16 === 10.1.2.180/32 inacceptable
charon: 09[IKE] failed to establish CHILD_SA, keeping IKE_SA


In the working case, NAT isn't involved.  The working case server log shows:

charon: 13[CFG] looking for a child config for 172.16.0.0/16 === 10.1.2.180/32
charon: 13[CFG] proposing traffic selectors for us:
charon: 13[CFG]  172.16.0.0/16
charon: 13[CFG] proposing traffic selectors for other:
charon: 13[CFG]  10.1.2.180/32
charon: 13[CFG]   candidate "srvnetnet" with prio 5+5
charon: 13[CFG] found matching child config "srvnetnet" with prio 10

Should this work?  Is there more I need to configure?

Thanks for any help,
MikeC


_______________________________________________
Users mailing list
[email protected]
https://lists.strongswan.org/mailman/listinfo/users


_______________________________________________
Users mailing list
[email protected]
https://lists.strongswan.org/mailman/listinfo/users

Re: [strongSwan] host to subnet support

Reply via email to