<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.0.6618.1">
<TITLE>Net2net and ip policy</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial CE">Hi,</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial CE">Please, help me! I have got two strongswan servers and the connection is ok. I must put a router between "left" and "leftsubnet":</FONT></P>
<P><FONT SIZE=2 FACE="Arial CE">Before: 192.168.100.0/22===x.x.x.186---x.x.x.230===192.168.11.0/24</FONT>
<BR><FONT SIZE=2 FACE="Arial CE">Now: 192.168.100.0/22==={router 192.168.100.254-x.x.x.185}===x.x.x.186---x.x.x.230===192.168.11.0/24</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial CE">Ipsec.conf:</FONT>
<BR><FONT SIZE=2 FACE="Arial CE">config setup</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> plutodebug=control</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> charonstart=no</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial CE">conn %default</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> left=%defaultroute</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> leftsubnet=192.168.100.0/22</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial CE">conn paks</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> right=x.x.x.230</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> rightsubnet=192.168.11.0/24</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> authby=secret</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> auth=esp</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> auto=add</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial CE">Ip xfrm policy:</FONT>
<BR><FONT SIZE=2 FACE="Arial CE">src 192.168.100.0/22 dst 192.168.11.0/24</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> dir out priority 2408 ptype main</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> tmpl src x.x.x.186 dst x.x.x.230</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> proto esp reqid 16385 mode tunnel</FONT>
<BR><FONT SIZE=2 FACE="Arial CE">src 192.168.11.0/24 dst 192.168.100.0/22</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> dir fwd priority 2408 ptype main</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> tmpl src x.x.x.230 dst x.x.x.186</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> proto esp reqid 16385 mode tunnel</FONT>
<BR><FONT SIZE=2 FACE="Arial CE">src 192.168.11.0/24 dst 192.168.100.0/22</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> dir in priority 2408 ptype main</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> tmpl src x.x.x.230 dst x.x.x.186</FONT>
<BR><FONT SIZE=2 FACE="Arial CE"> proto esp reqid 16385 mode tunnel</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial CE">Route:</FONT>
<BR><FONT SIZE=2 FACE="Arial CE">192.168.100.0 x.x.x.185 255.255.252.0 UG 0 0 0 eth1</FONT>
<BR><FONT SIZE=2 FACE="Arial CE">0.0.0.0 x.x.x.180 0.0.0.0 UG 0 0 0 eth1</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial CE">The vpn tunnel has been established, of course, but the ping from 192.168.100.2 to 192.168.11.3 has been failed.</FONT>
<BR><FONT SIZE=2 FACE="Arial CE">Tcpdump:</FONT>
<BR><FONT SIZE=2 FACE="Arial CE">12:45:51.760782 IP 192.168.100.2 > 192.168.11.3: ICMP echo request, id 512, seq 15360, length 40</FONT>
<BR><FONT SIZE=2 FACE="Arial CE">12:45:51.760931 IP x.x.x.186.euroweb.hu > 192.168.100.2: ICMP host 192.168.11.3 unreachable - admin prohibited, length 68</FONT></P>
<P><FONT SIZE=2 FACE="Arial CE">The ipsec.conf i did not change. I removed the direct network connection to 192.168.100.0/22 from the "left" server and i rewrote it the routing table.<SPAN LANG="en-us"></SPAN></FONT><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Arial">What it is necessary to do yet, that allowing let the route be? </FONT></SPAN></P>
<P><SPAN LANG="hu"><FONT SIZE=2 FACE="Arial CE">Thank you,</FONT></SPAN>
<BR><SPAN LANG="hu"><FONT SIZE=2 FACE="Arial CE">Zsolt</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN>
</P>
</BODY>
</HTML>