<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Hi <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I have a query on Child SA creation.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I have a ipsec.conf configuration which has two very similar
configurations listed .The only difference between them is the protocol (leftprotoport).<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Here is my ipsec.conf entry with the two configurations<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>conn 211TO60Tunnel<o:p></o:p></p>
<p class=MsoNormal> left=10.201.114.211<o:p></o:p></p>
<p class=MsoNormal> leftcert=peerCert.der<o:p></o:p></p>
<p class=MsoNormal> right=10.201.114.178<o:p></o:p></p>
<p class=MsoNormal> rightid="C=CH, O=strongSwan,
CN=178"<o:p></o:p></p>
<p class=MsoNormal> keyexchange=ikev2<o:p></o:p></p>
<p class=MsoNormal> type=tunnel<o:p></o:p></p>
<p class=MsoNormal> auto=add<o:p></o:p></p>
<p class=MsoNormal> auth=ah<o:p></o:p></p>
<p class=MsoNormal> leftprotoport=udp<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>conn 211TO60TunnelICMP<o:p></o:p></p>
<p class=MsoNormal> left=10.201.114.211<o:p></o:p></p>
<p class=MsoNormal> leftcert=peerCert.der<o:p></o:p></p>
<p class=MsoNormal> right=10.201.114.178<o:p></o:p></p>
<p class=MsoNormal> rightid="C=CH, O=strongSwan,
CN=178"<o:p></o:p></p>
<p class=MsoNormal> keyexchange=ikev2<o:p></o:p></p>
<p class=MsoNormal> type=tunnel<o:p></o:p></p>
<p class=MsoNormal> auto=add<o:p></o:p></p>
<p class=MsoNormal> auth=ah<o:p></o:p></p>
<p class=MsoNormal> leftprotoport=icmp <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>When I do a ipsec start , I see that the “211TO60TunnelICMP”
configuration is added as a child of “211TO60Tunnel” . But I
actually wanted this as a separate SA which can be enabled disabled separately.
<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>How can I achieve this in srongswan 4.3 ?<o:p></o:p></p>
<p class=MsoNormal>And just wanted to know what is the criteria for deciding
that a config should be a child of another one ?<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Thanks in advance.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Regards</span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Shyam</span><o:p></o:p></p>
</div>
<P><strong><span style='font-size:10.0pt;font-family:
"Palatino Linotype","serif";color:green'> Please do not print this email unless it is absolutely necessary. </span></strong><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
<p> The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. </p>
<p>WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. </p>
<p>
www.wipro.com
</p>
</body>
</html>