<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 12/12/2011 04:37 PM, Martin Willi wrote:
<blockquote cite="mid:1323704239.7313.18.camel@martin" type="cite">
<pre wrap="">Hello Julien,
</pre>
<blockquote type="cite">
<pre wrap="">I would like to set up a VPN where the entry point E (strongswan
server) and the services server S are not in the same place (LAN).
The point is that I want the traffic from clients to S not to be
routed through E.
In some way, E is used only to authenticate the vpn users and to setup
the access between users and S.
</pre>
</blockquote>
<pre wrap="">
By definition, an IKE established tunnel always uses the IKE endpoints
as outer tunnel addresess. This makes it relatively hard to do tunnel
encapsulation on a different IP address, at least with existing
implementations.
</pre>
</blockquote>
I agree, but I saw:
<a class="moz-txt-link-freetext" href="http://tools.ietf.org/html/draft-brunner-ikev2-mediation-00">http://tools.ietf.org/html/draft-brunner-ikev2-mediation-00</a><br>
...<br>
<br>
<blockquote cite="mid:1323704239.7313.18.camel@martin" type="cite">
<pre wrap="">
What's the reason to have E and S in different places? What about doing
the IKE exchange (and tunnel encapsulation) with S, and handle user
authentication and policy decisions by a backend server, via RADIUS for
example?
</pre>
</blockquote>
<br>
The problem is that S is behind a restrictive firewall (no incoming
connection) but on a good network and E is not filtered but on a
poor network (home ADSL).<br>
<br>
Thus, I want E to be the "entry" for the vpn, but, for performance,
I want direct transfer between vpn clients and S.<br>
<br>
Finally, I am interested if there is a strongswan specific solution
(because as you suggest ikev2 mediation is probably strongswan
specific): strongswan clients have mediation, others go through E (a
good motivation for them to move on strongswam :P).<br>
<br>
Julien. <br>
<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Julien Allali
Associate Professor
IPB/LaBRI
-
<a class="moz-txt-link-freetext" href="https://www.labri.fr/~allali/">https://www.labri.fr/~allali/</a>
</pre>
</body>
</html>