<div dir="ltr">Hi Martin!<br><div><br></div><div>Thank you so much for your help! Though, I still can't get this to work as expected. This is how my old tunnel mode ipsec.conf file looks like (strongswan 4.6.4 and 5.0 too):<br>
<div><br>config setup<br> uniqueids=no<br>conn %default<br> type=tunnel<br> keyexchange=ikev2<br> auto=start<br> mark=1/1<br> ike=aes128gcm12-aesxcbc-modp1024<br> esp=aes128gcm12-modp1024<br>conn remote-2.1.1.1<br>
leftupdown="/usr/sbin/updown.sh"<br> left=0.0.0.0<br> leftcert=/etc/client-cert.pem<br> leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> right=2.1.1.1<br> rightcert=/etc/ipsec.d/certs/2.1.1.1.pem<br>
<br><br><br></div><div>So I simply changed "type" from "tunnel" to "transport" and then<br></div><div>1. strongswan 4.6.4 <-> strongswan 5.1 negotiates compatibility tunnel mode as expected, but<br>
</div><div>2. strongswan 5.1 <-> strongswan 5.1 fails to negotiate transport mode (or even tunnel mode):<br><br>Here is a snippet from strongswan 5.1 syslog that confirms this:<br>Jul 6 12:19:11 debian charon: 01[IKE] no acceptable traffic selectors found<br>
Jul 6 12:19:11 debian charon: 01[IKE] failed to establish CHILD_SA, keeping IKE_SA<br>Jul 6 12:19:11 debian charon: 01[ENC] generating IKE_AUTH response 1 [ IDr AUTH N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(TS_UNACCEPT) ]<br>
Jul 6 12:19:11 debian charon: 01[NET] sending packet: from 2.1.1.100[4500] to 2.1.1.1[4500] (519 bytes)
<br></div><div> <br><br><br></div><div>So besides changing tunnel type, I also deleted the "leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>" line from ipsec.conf. As a result:<br><div>1. strongswan 5.1 <-> strongswan 5.1 now is able to negotiate transport mode as expected, but<br>
2. strongswan 4.6.4 <-> strongswan 5.1 fails to negotiate compatibility tunnel mode.<br></div><br></div><div>Here is a snippet from the strongswan 4.6.4 syslog:<br><br>Jul 5 13:33:38 debian charon: 16[IKE] traffic selectors <a href="http://2.1.1.100/32" target="_blank">2.1.1.100/32</a> === <a href="http://1.1.1.100/32" target="_blank">1.1.1.100/32</a> inacceptable<br>
Jul 5 13:33:38 debian charon: 16[IKE] failed to establish CHILD_SA, keeping IKE_SA<br>Jul 5 13:33:38 debian charon: 16[ENC] generating IKE_AUTH response 1 [ IDr AUTH N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(TS_UNACCEPT) ]<br>
Jul 5 13:33:38 debian charon: 16[NET] sending packet: from 2.1.1.100[4500] to 2.1.1.1[4500]
<br></div><div><br><br><br></div><div>In other words I can't figure out how to change ipsec.conf file so that tunnel and transport modes could be negotiated from the same "conn" instance.<br></div><div><br>
</div><div>Strongswan 2.1.1.100 is the one with public IP address. 2.1.1.1 is the firewall IP address and 1.1.1.100 is the IP address of the strongswan that is behind NAT.<br>
</div><div><br></div><div>Best regards,<br></div><div>SW<br></div><div><br>
</div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 10 July 2013 00:05, Martin Willi <span dir="ltr"><<a href="mailto:martin@strongswan.org" target="_blank">martin@strongswan.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Sebastian,<br>
<div class="im"><br>
> 1. IPsec transport mode when peer is using the new strongSwan 5.1.0dr2<br>
> 2. IPsec tunnel mode when peer is using the old strongSwan 5.0.4 (i.e. as a<br>
> fallback mechanism)<br>
<br>
</div>Even if you configure transport mode, 5.1.0 should accept tunnel mode<br>
for that connection. When using transport mode, any client not<br>
supporting it (for example because it detected NAT) just omits the<br>
transport mode notify and the connection uses a tunnel mode fallback.<br>
<div class="im"><br>
> Do I really need two conn templates in ipsec.conf file (one for transport<br>
> mode and one for tunnel mode)?<br>
<br>
</div>No, you'll need just one having type=transport.<br>
<br>
Regards<br>
<span class="HOEnZb"><font color="#888888">Martin<br>
<br>
</font></span></blockquote></div><br></div>