Dear All,<blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><br></div><div>I wonder if anyone can help me with a strongSwan config issue ?</div><div><br></div><div>I'm trying to configure a SeGW running strongSwan (v4.5.1) to accept incoming tunnel attempts and assign them to different virtual address pools.</div>
<div><br></div><div>I thought the easiest way to do this was to create different config entries with different address pools specified by the rightsourceip param.</div><div><br></div><div>Unfortunately, I can't get the wildcarding to work as I would like, meaning that I have to have ONE config entry for each client when I would actually like to reduce these down to the bare minimum using wildcarding.</div>
<div><br></div><div>So, as an example, I have three clients coming in using IDi's of <a href="mailto:310751001@foo.abc751.def310.bar.org">310751001@foo.abc751.def310.bar.org</a>, <a href="mailto:235003002@foo.abc003.def235.bar.org">235003002@foo.abc003.def235.bar.org</a> and <a href="mailto:235010003@foo.abc010.def235.bar.org">235010003@foo.abc010.def235.bar.org</a></div>
<div><br></div><div>I would like the first of these to have it's own ipsec.conf entry:</div><div><br></div><div>conn foo-abc751-def310</div><div> ...</div><div> rightid=*@<a href="http://foo.abc751.def310.bar.org">foo.abc751.def310.bar.org</a></div>
<div> rightsourceip=<a href="http://10.17.0.0/24">10.17.0.0/24</a></div><div> ...</div><div><br></div><div>and I was hoping to cover the other two with a combined ipsec.conf entry:</div><div><br></div><div>conn foo-def235</div>
<div> ...</div><div> rightid=*@foo.abc*.<a href="http://def235.bar.org">def235.bar.org</a></div><div> rightsourceip=<a href="http://10.17.1.0/24">10.17.1.0/24</a></div><div> ...</div><div><br></div><div>However, this does not work. When either of these two try to come in, charon logs that no peer config was found and rejects the tunnel. Instead, I have to split them up:</div>
<div><br></div><div><div>conn foo-abc003-def235</div><div> ...</div><div> rightid=*@<a href="http://foo.abc003.def235.bar.org">foo.abc003.def235.bar.org</a></div><div> rightsourceip=<a href="http://10.17.1.0/24">10.17.1.0/24</a></div>
<div> ...</div></div><div><br></div><div><div>conn foo-abc010-def235</div><div> ...</div><div> rightid=*@<a href="http://foo.abc010.def235.bar.org">foo.abc010.def235.bar.org</a></div><div> rightsourceip=<a href="http://10.17.2.0/24">10.17.2.0/24</a></div>
<div> ...</div></div><div><br></div><div>I could probably get away with specifying the same address pool in both of these cases (i.e. <a href="http://10.17.1.0/24">10.17.1.0/24</a>), but I would REALLY like to combine the two entries.</div>
<div><br></div><div>This also applies to ipsec.secrets, where I want to specify a combined secret entry:</div><div><br></div><div> *@foo.abc*.<a href="http://def235.bar.org">def235.bar.org</a> : THE secret</div><div><br>
</div><div>rather than split the entries up:</div><div><br></div><div> *@<a href="http://foo.abc003.def235.bar.org">foo.abc003.def235.bar.org</a> : THE secret</div><div> *@<a href="http://foo.abc010.def235.bar.org">foo.abc010.def235.bar.org</a> : THE secret</div>
<div><br></div><div>Using *@foo.abc???.<a href="http://def235.bar.org">def235.bar.org</a> would also be perfectly acceptable, but I've seen no mention of this in the documentation or code.</div><div><br></div><div>Does this make sense ? Sound reasonable ?</div>
<div><br></div><div>Or I trying to do things in completely the wrong way (and someone can suggest a much better way) ?</div><div><br></div><div>Graham.</div><div><br></div><div> </div></blockquote>