<div>Hi Andreas,</div>
<div> </div>
<div>Ok. I checked the example you mentioned. So now I need to have different leftid and rightid for each of the tunnels. </div>
<div> </div>
<div>You had mentioned that "The draw back is that two IKE SAs including authentication must be set up." Does this mean that we need separate keys and certificates for each tunnel? In other words, what will the content of the folders /etc/ipsec.d/certs and /etc/ipsec.d/private be? Sorry, but I just find it a bit confusing because from my understanding, the identities are included in the peer cert creation, So if I'll need two identities on each end-point, I'll need two keys/certs as well. </div>
<div> </div>
<div>Could you please help me understand this better?</div>
<div> </div>
<div>Thanks and regards,</div>
<div>Meera <br><br></div>
<div class="gmail_quote">On Wed, Sep 7, 2011 at 4:51 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">Hi Meera,<br><br>this is a well known problem occuring because the<br>mark value cannot be communicated to the other endpoint<br>
via the IKE protocol. Thus the responder will set up<br>the first tunnel which it finds in its list of connections.<br><br>As workaround you must define two different identities<br>for tunnel1 and tunnel2 so that the endpoint is able<br>
to set up the correct SA according to the ID. The<br>draw back is that two IKE SAs including authentication<br>must be set up. Please check my example scenario<br><br><a href="http://www.strongswan.org/uml/testresults/ikev2/net2net-psk-dscp/" target="_blank">http://www.strongswan.org/uml/testresults/ikev2/net2net-psk-dscp/</a><br>
<br>which uses two sets of identities.<br><br>Regards<br><br>Andreas<br>
<div class="im"><br>On 07.09.2011 12:37, Meera Sudhakar wrote:<br>> Hi,<br>><br>> I have two end-points, between which I have created two identical<br>> tunnels. However, the command "ipsec status" does not show the two<br>
> tunnels in the way I expect. Please find the required info below:<br>><br>> _/etc/ipsec.conf on end-point 1:_<br></div>> root@vc1_TPC2 <mailto:<a href="mailto:root@vc1_TPC2">root@vc1_TPC2</a>>:~# cat /etc/ipsec.conf<br>
<div>
<div></div>
<div class="h5">> # ipsec.conf - strongSwan IPsec configuration file<br>> # basic configuration<br>> config setup<br>> #plutostderrlog=/var/log/syslog<br>> # plutodebug=control<br>> # crlcheckinterval=600<br>
> strictcrlpolicy=no<br>> # cachecrls=yes<br>> # nat_traversal=yes<br>> charonstart=yes<br>> charondebug=control<br>> plutostart=no<br>> # Add connections here.<br>
><br>> ca strongswan<br>> cacert=caCert.der<br>> auto=add<br>> conn %default<br>> type=tunnel<br>> left=169.254.0.70<br>> leftcert=VC1Cert.der<br>> right=169.254.1.70<br>
> rightid="C=CH, O=strongSwan, CN=169.254.1.70"<br>> keyexchange=ikev2<br>> auto=start<br>> conn tunnel1<br></div></div>> leftsubnet=<a href="http://169.254.0.0/24" target="_blank">169.254.0.0/24</a> <<a href="http://169.254.0.0/24" target="_blank">http://169.254.0.0/24</a>><br>
> rightsubnet=<a href="http://169.254.1.0/24" target="_blank">169.254.1.0/24</a> <<a href="http://169.254.1.0/24" target="_blank">http://169.254.1.0/24</a>><br>> mark=10<br>> conn tunnel2<br>
> leftsubnet=<a href="http://169.254.0.0/24" target="_blank">169.254.0.0/24</a> <<a href="http://169.254.0.0/24" target="_blank">http://169.254.0.0/24</a>><br>> rightsubnet=<a href="http://169.254.1.0/24" target="_blank">169.254.1.0/24</a> <<a href="http://169.254.1.0/24" target="_blank">http://169.254.1.0/24</a>><br>
<div class="im">> mark=20<br>><br>><br>> _/etc/ipsec.conf on end-point 2:_<br></div>> root@vc2_TPC2 <mailto:<a href="mailto:root@vc2_TPC2">root@vc2_TPC2</a>>:~# cat /etc/ipsec.conf<br>
<div class="im">> # ipsec.conf - strongSwan IPsec configuration file<br>> # basic configuration<br>> config setup<br>> # plutodebug=control<br>> # crlcheckinterval=600<br>> strictcrlpolicy=no<br>
> # cachecrls=yes<br>> # nat_traversal=yes<br>> charonstart=yes<br>> plutostart=no<br>> charondebug=control<br>> # Add connections here.<br>><br>> ca strongswan<br>
> cacert=caCert.der<br>> auto=add<br>> conn %default<br>> type=tunnel<br>> left=169.254.1.70<br>> leftcert=VC2Cert.der<br>> right=169.254.0.70<br>> rightid="C=CH, O=strongSwan, CN=169.254.0.70"<br>
> keyexchange=ikev2<br>> auto=start<br>> conn tunnel1<br></div>> leftsubnet=<a href="http://169.254.1.0/24" target="_blank">169.254.1.0/24</a> <<a href="http://169.254.1.0/24" target="_blank">http://169.254.1.0/24</a>><br>
> rightsubnet=<a href="http://169.254.0.0/24" target="_blank">169.254.0.0/24</a> <<a href="http://169.254.0.0/24" target="_blank">http://169.254.0.0/24</a>><br>> mark=10<br>> conn tunnel2<br>
> leftsubnet=<a href="http://169.254.1.0/24" target="_blank">169.254.1.0/24</a> <<a href="http://169.254.1.0/24" target="_blank">http://169.254.1.0/24</a>><br>> rightsubnet=<a href="http://169.254.0.0/24" target="_blank">169.254.0.0/24</a> <<a href="http://169.254.0.0/24" target="_blank">http://169.254.0.0/24</a>><br>
<div class="im">> mark=20<br>><br>><br>> _ipsec status on end-point 1:_<br></div>> root@vc1_TPC2 <mailto:<a href="mailto:root@vc1_TPC2">root@vc1_TPC2</a>>:~# ipsec status<br>
<div class="im">> Security Associations:<br>> tunnel1[1]: ESTABLISHED 14 minutes ago, 169.254.0.70[C=CH,<br>> O=strongSwan, CN=169.254.0.70]...169.254.1.70[C=CH, O=strongSwan,<br>> CN=169.254.1.70]<br>> tunnel1{3}: INSTALLED, TUNNEL, ESP SPIs: ccd3d0ec_i c8d1ad66_o<br>
</div>> tunnel1{3}: <a href="http://169.254.0.0/24" target="_blank">169.254.0.0/24</a> <<a href="http://169.254.0.0/24" target="_blank">http://169.254.0.0/24</a>> ===<br>> <a href="http://169.254.1.0/24" target="_blank">169.254.1.0/24</a> <<a href="http://169.254.1.0/24" target="_blank">http://169.254.1.0/24</a>><br>
<div class="im">> tunnel2{4}: INSTALLED, TUNNEL, ESP SPIs: cc6da619_i c28e4022_o<br></div>> tunnel2{4}: <a href="http://169.254.0.0/24" target="_blank">169.254.0.0/24</a> <<a href="http://169.254.0.0/24" target="_blank">http://169.254.0.0/24</a>> ===<br>
> <a href="http://169.254.1.0/24" target="_blank">169.254.1.0/24</a> <<a href="http://169.254.1.0/24" target="_blank">http://169.254.1.0/24</a>><br>
<div class="im">><br>> _ipsec status on end-point 2: _<br></div>> root@vc2_TPC2 <mailto:<a href="mailto:root@vc2_TPC2">root@vc2_TPC2</a>>:~# ipsec status<br>
<div class="im">> Security Associations:<br>> tunnel1[2]: ESTABLISHED 14 minutes ago, 169.254.1.70[C=CH,<br>> O=strongSwan, CN=169.254.1.70]...169.254.0.70[C=CH, O=strongSwan,<br>> CN=169.254.0.70]<br>> tunnel1{3}: INSTALLED, TUNNEL, ESP SPIs: c8d1ad66_i ccd3d0ec_o<br>
</div>> tunnel1{3}: <a href="http://169.254.1.0/24" target="_blank">169.254.1.0/24</a> <<a href="http://169.254.1.0/24" target="_blank">http://169.254.1.0/24</a>> ===<br>> <a href="http://169.254.0.0/24" target="_blank">169.254.0.0/24</a> <<a href="http://169.254.0.0/24" target="_blank">http://169.254.0.0/24</a>><br>
<div class="im">> tunnel1{4}: INSTALLED, TUNNEL, ESP SPIs: c28e4022_i cc6da619_o<br></div>> tunnel1{4}: <a href="http://169.254.1.0/24" target="_blank">169.254.1.0/24</a> <<a href="http://169.254.1.0/24" target="_blank">http://169.254.1.0/24</a>> ===<br>
> <a href="http://169.254.0.0/24" target="_blank">169.254.0.0/24</a> <<a href="http://169.254.0.0/24" target="_blank">http://169.254.0.0/24</a>><br>
<div class="im">> The questions I have are:<br>> 1. End-point 1 shows tunnel1{3} and tunnel2{4}, while end-point 2 shows<br>> only tunnel1 with either {3} or {4}. Could you please tell me why it<br>> does not show tunnel2? Also, this varies from time to time. Sometimes<br>
> the numbers in flower brackets are different, and sometimes they are the<br>> same.<br>> 2. What do the numbers in flower brackets denote?<br>><br>> Also, please let me know if I have configured anything incorrectly,<br>
> which may be causing this.<br>><br>> Thanks and regards,<br>> Meera<br>><br>><br>><br></div>> _______________________________________________<br>> Users mailing list<br>> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br><font color="#888888"><br><br>--<br>======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org/" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>University of Applied Sciences Rapperswil<br>CH-8640 Rapperswil (Switzerland)<br>===========================================================[ITA-HSR]==<br></font></blockquote>
</div><br>