Hi Andreas,<div> Any update on this question ?? waiting for your reply.</div><div>Regards,</div><div>Saravanan N<br><br><div class="gmail_quote">On Fri, Mar 30, 2012 at 6:46 AM, SaRaVanAn <span dir="ltr"><<a href="mailto:saravanan.nagarajan87@gmail.com">saravanan.nagarajan87@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Andreas,<br><br>Thanks for your prompt reply. I understand that IKEv2 will accept dynamic port change.<br>We are also trying to understand whether IKEv2 will accept dynamic IP address change in NAT-T.<br>
For example:<br>
Let us assume, IPSec IKEv2 peer response timeout at the VPN client side is very high. <br>After the VPN client is connected, If my NAT device(DSL modem) loses connection with ISP and if its comes back with a different IP address (Note that DSL modem would have cleared the old NAT entries). Will the VPN connection continue without any disconnect using the new NATTED IP address and Port Number? <br>
<br>Regards,<br>Saravanan N<div class="HOEnZb"><div class="h5"><br><br><div class="gmail_quote">On Fri, Mar 30, 2012 at 6:40 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello,<br>
<br>
RFC 4306 defines IKEv2 whereas you are using the obsoleted IKEv1<br>
protocol. IKEv1 does not support the update of NAT ports whereas<br>
our IKEv2 charon daemon does.<br>
<br>
Regards<br>
<br>
Andreas<br>
<div><br>
On 03/30/2012 03:01 PM, SaRaVanAn wrote:<br>
> Hi,<br>
> It seems , dynamic update of the other ends IP address in NAT<br>
> traversal is not supported in StrongSwan.<br>
> According to rfc4306, it should be supported as part of NAT traversal.<br>
> Please find the topology and issue I m facing out of this.<br>
><br>
><br>
> Cisco<br>
> VPN client -------------- Router1 -------------------------------------<br>
> VPN Sever(Strongswan)<br>
><br>
> 20.1.1.1 20.1.1.2 50.1.1.226 50.1.1.227<br>
> (eth1)<br>
> Iptables<br>
> ++++++<br>
> iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE.<br>
><br>
> I have established a VPN connection between VPN client and VPN server<br>
> with the natted IP 50.1.1.226 to 50.1.1.227.<br>
> After some time , eth1 interface IP address have got changed as<br>
> 50.1.1.228 in eth1 of router 1, and tunnel gets disturbed by throwing<br>
> the following error.<br>
><br>
><br>
> Mar 30 14:52:54 uxcasxxx pluto[26817]: "cisco-vpn"[10] <a href="http://50.1.1.226:1797" target="_blank">50.1.1.226:1797</a><br>
</div>> <<a href="http://50.1.1.226:1797" target="_blank">http://50.1.1.226:1797</a>> #17: nat_traversal_new_mapping: address change<br>
<div>> currently not supported [<a href="http://50.1.1.226:1797" target="_blank">50.1.1.226:1797</a><br>
</div>> <<a href="http://50.1.1.226:1797" target="_blank">http://50.1.1.226:1797</a>>,<a href="http://50.1.1.228:1797" target="_blank">50.1.1.228:1797</a> <<a href="http://50.1.1.228:1797" target="_blank">http://50.1.1.228:1797</a>>]<br>
<div>> Mar 30 14:52:56 uxcasxxx pluto[26817]: "cisco-vpn"[10] <a href="http://50.1.1.226:1797" target="_blank">50.1.1.226:1797</a><br>
</div>> <<a href="http://50.1.1.226:1797" target="_blank">http://50.1.1.226:1797</a>> #17: nat_traversal_new_mapping: address change<br>
<div>> currently not supported [<a href="http://50.1.1.226:1797" target="_blank">50.1.1.226:1797</a><br>
</div>> <<a href="http://50.1.1.226:1797" target="_blank">http://50.1.1.226:1797</a>>,<a href="http://50.1.1.228:1797" target="_blank">50.1.1.228:1797</a> <<a href="http://50.1.1.228:1797" target="_blank">http://50.1.1.228:1797</a>>]<br>
<div>> Mar 30 14:52:59 uxcasxxx pluto[26817]: packet from <a href="http://50.1.1.228:1797" target="_blank">50.1.1.228:1797</a><br>
</div>> <<a href="http://50.1.1.228:1797" target="_blank">http://50.1.1.228:1797</a>>: Informational Exchange is for an unknown<br>
<div>> (expired?) SA<br>
> Mar 30 14:53:00 uxcasxxx pluto[26817]: ERROR: asynchronous network error<br>
> report on eth0 for message to 50.1.1.226 port 1797, complainant<br>
</div>> 50.1.1.227 <<a href="http://50.1.1.227" target="_blank">http://50.1.1.227</a>>: No route to host [errno 113, origin ICMP<br>
<div>> type 3 code 1 (not authenticated)]<br>
> Mar 30 14:53:00 uxcasxxx pluto[26817]: ERROR: asynchronous network error<br>
> report on eth0 for message to 50.1.1.226 port 1797, complainant<br>
</div>> 50.1.1.227 <<a href="http://50.1.1.227" target="_blank">http://50.1.1.227</a>>: No route to host [errno 113, origin ICMP<br>
<div>> type 3 code 1 (not authenticated)]<br>
> Mar 30 14:53:04 uxcasxxx pluto[26817]: packet from <a href="http://50.1.1.228:1797" target="_blank">50.1.1.228:1797</a><br>
</div>> <<a href="http://50.1.1.228:1797" target="_blank">http://50.1.1.228:1797</a>>: Informational Exchange is for an unknown<br>
<div>> (expired?) SA<br>
> Mar 30 14:53:09 uxcasxxx pluto[26817]: packet from <a href="http://50.1.1.228:1797" target="_blank">50.1.1.228:1797</a><br>
</div>> <<a href="http://50.1.1.228:1797" target="_blank">http://50.1.1.228:1797</a>>: Informational Exchange is for an unknown<br>
<div>> (expired?) SA<br>
> Mar 30 14:53:14 uxcasxxx pluto[26817]: packet from <a href="http://50.1.1.228:1797" target="_blank">50.1.1.228:1797</a><br>
</div>> <<a href="http://50.1.1.228:1797" target="_blank">http://50.1.1.228:1797</a>>: Informational Exchange is for an unknown<br>
<div>> (expired?) SA<br>
> Mar 30 14:53:19 uxcasxxx pluto[26817]: packet from <a href="http://50.1.1.228:1797" target="_blank">50.1.1.228:1797</a><br>
</div>> <<a href="http://50.1.1.228:1797" target="_blank">http://50.1.1.228:1797</a>>: Informational Exchange is for an unknown<br>
<div><div>> (expired?) SA<br>
><br>
> Do Strongswan have planned to implement dynamic IP address update<br>
> feature in NAT-T ??<br>
><br>
><br>
><br>
> /etc/ipsec.conf<br>
> ++++++++++++<br>
> ca vpnca<br>
> cacert=caCert.pem<br>
> #crluri=crl.pem<br>
> auto=add<br>
><br>
> config setup<br>
> plutostart=yes<br>
> #plutodebug=control<br>
> charonstart=no<br>
> charondebug="net 0"<br>
> nat_traversal=yes<br>
> crlcheckinterval=10m<br>
> strictcrlpolicy=no<br>
><br>
> conn %default<br>
> ikelifetime=60m<br>
> keylife=20m<br>
> keyexchange=ikev1<br>
> rekeymargin=3m<br>
> keyingtries=1<br>
> #leftupdown="sudo -E ipsec _updown"<br>
><br>
> # Add connections here.<br>
> conn cisco-vpn<br>
> type=tunnel<br>
> ike=aes256-sha1-modp1536!<br>
> esp=aes256-sha1!<br>
> #keyexchange=ikev2<br>
> dpdaction=clear<br>
> dpddelay=300s<br>
> rekeymargin=3m<br>
> keyingtries=1<br>
> left=%defaultroute<br>
</div></div>> leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
> #leftsubnetwithin=<a href="http://10.3.1.1/24" target="_blank">10.3.1.1/24</a> <<a href="http://10.3.1.1/24" target="_blank">http://10.3.1.1/24</a>><br>
<div>> leftcert=dutCert.pem<br>
> leftid="C=CH, O=strongSwan, CN=strongswan"<br>
> right=%any<br>
> #rightsourceip=%abcd<br>
> leftfirewall=yes<br>
</div>> rightsourceip=<a href="http://30.1.1.1/24" target="_blank">30.1.1.1/24</a> <<a href="http://30.1.1.1/24" target="_blank">http://30.1.1.1/24</a>><br>
> #rightsubnet=<a href="http://30.1.1.1/24" target="_blank">30.1.1.1/24</a> <<a href="http://30.1.1.1/24" target="_blank">http://30.1.1.1/24</a>><br>
<div>> pfs=no<br>
> authby=xauthrsasig<br>
> xauth=server<br>
><br>
><br>
> ipsec.secrets<br>
> +++++++++++<br>
> : RSA dutKey.pem<br>
> tester : XAUTH "tester"<br>
><br>
><br>
> Regards,<br>
> Saravanan N<br>
><br>
><br>
</div>> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br>
> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
<span><font color="#888888"><br>
<br>
--<br>
======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a><br>
strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
</font></span></blockquote></div><br>
</div></div></blockquote></div><br></div>