<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Tahoma, sans-serif" size="2">
<div>Hi, </div>
<div> </div>
<div>In case of IKEv1 (using strongswan 4.3.5), the connection structure is uploaded to Pluto with IP-address of the FQDN (right-id). However if ip-address changes for the FQDN, could you please tell me how is it reflected back to the connection structure already
uploaded to Pluto?</div>
<div>One of the scenarios is DPD where SA could go down due to change in peer IP address. </div>
<div>In this case, how will Pluto resolve the FQDN to get the new (changed) IP address?? Does it happen on the fly??</div>
<div><font face="FuturaA Bk BT, sans-serif" size="2"> </font></div>
<div>Regards, </div>
<div>Shashank</div>
<div><font face="FuturaA Bk BT, sans-serif" size="2"> </font></div>
<div><font face="FuturaA Bk BT, sans-serif" size="2"> </font></div>
<div><font face="FuturaA Bk BT, sans-serif" size="2"> </font></div>
<div>-----Original Message-----</div>
<div>From: Andreas Steffen [<a href="mailto:andreas.steffen@strongswan.org">mailto:andreas.steffen@strongswan.org</a>]</div>
<div>Sent: Thursday, December 24, 2009 12:12 PM</div>
<div>To: N, SHASHANK (SHASHANK)</div>
<div>Cc: dev@lists.strongswan.org</div>
<div>Subject: Re: [strongSwan-dev] DNS resolution</div>
<div> </div>
<div>Hi Shashank,</div>
<div> </div>
<div>strongSwan uses a Linux system call to resolve FQDNs in "right".</div>
<div>The IKEv1 pluto daemon relies on ipsec starter to resolve any hostnames before the connection data is uploaded to the daemon via the whack interface whereas the IKEv2 charon daemon receives the FQDN as a string via the stroke interface and does name resolution
on the fly shortly before actually negotiating the IPsec tunnel. The name servers are configured in /etc/resolv.conf either statically or via NetworkManager. Using the leftsourceip=%config setting triggers a virtual IP address/DNS request via the IKEv2 Configuration
Payload and the additional internal name servers that are delivered by the VPN server are automatically added to /etc/resolv.conf either via the default resolve plugin or via the nm NetworkManager plugin if using the strongSwan NetworkManager Applet. When the
VPN connection goes down, these internal servers are removed again and only the external or servers remain in /etc/resolv.conf.</div>
<div> </div>
<div>Kind regards</div>
<div> </div>
<div>Andreas</div>
<div><font face="FuturaA Bk BT, sans-serif" size="2" color="#0000FF"> </font></div>
<div>_____________________________________________<br>
<b>From:</b> N, SHASHANK (SHASHANK) <br>
<b>Sent:</b> Thursday, December 24, 2009 10:20 AM<br>
<b>To:</b> 'dev@lists.strongswan.org'<br>
<b>Subject:</b> DNS resolution</div>
<div><font face="FuturaA Bk BT, sans-serif" size="2"> </font></div>
<div>Hi, </div>
<div> </div>
<div>In strongswan 4.3 if I give an FQDN for “right”, how will the DNS resolution happen?</div>
<div>Does it have an inbuilt DNS client? If yes, then how to configure name-servers?</div>
<div>Any help on this is greatly appreciated.</div>
<div> </div>
<div>Thanks and Regards,</div>
<div>Shashank</div>
<div><font face="FuturaA Bk BT, sans-serif" size="2"> </font></div>
</font>
</body>
</html>