<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I am attempting to find a strongSwan configuration that solves a VPN need that is rather different from the (IKEv1) examples in the documentation collection (I am using strongSwan 4.4.0).<div><br></div><div>I am converting (to strongSwan) from a former VPN client software package that has passed end-of-life. The VPN scheme we use has closest similarity to the ikev1/nat-before-esp example (<a href="http://www.strongswan.org/uml/testresults43/ikev1/nat-before-esp">http://www.strongswan.org/uml/testresults43/ikev1/nat-before-esp</a>) with the significant difference that the left gateway (moon) must accept a virtual IP assignment via %modeconfig from the right gateway (which, in my case, is a Cisco ASA).</div><div><br></div><div>My experimental configuration specifies leftsourceip=%modeconfig and leftsubnet=10.1.0.10/16. Since source routing statements are added by the updown script to table 220, I had at first believed, mistakenly, that this would give me the desired behavior. However, 'ip xfrm policy' shows that the SAs were negotiated with the right subnet (10.2.0.0/16) using the assigned virtual IP instead of the left subnet (10.1.0.0/16). Hence, no traffic flows between 10.1.0.0/16 and 10.2.0.0/16.</div><div><br></div><div>If I remove the leftsourceip=%modeconfig, then the SAs are are negotiated between 10.1.0.0/16 and 10.2.0.0/16, and I observe traffic flow between the subnets through the tunnel.</div><div><br></div><div>But - I cannot do without the virtual address. The reason for this is that I will have a collection of many clients such as 'alice', each with its own gateway such as 'moon', and the address space used for a client is at the user's discretion. Furthermore, new clients can be introduced at any time. Address space reuse therefore needs to be accommodated by having the ASA dole out virtual IPs.</div><div><br></div><div>How do I configure this?</div><div><br></div><div><br></div><div>Bill<br><div><div apple-content-edited="true"> <span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Anonymous; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Anonymous; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Anonymous; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div><span class="Apple-style-span" style="font-family: Helvetica; font-size: 12px; "><div>--</div><div>William Bloom</div><div><a href="mailto:williambloom@mac.com">williambloom@mac.com</a></div><div><br class="webkit-block-placeholder"></div></span></div></span></span></div></span><br class="Apple-interchange-newline"> </div><br></div></div></body></html>