<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div>Hi,</div><div><br></div><div>I've been struggling with this problem for a while now and really need to get it resolved.</div><div><br></div><div>I have established an ipsec tunnel(s) from strongswan, left to what I believe is a cisco router, right (I don't have access – it's with a managed provider, softlayer). The right hosts are behind a snat, so I configure a specific translation address I am able to connect from right hosts to left hosts, so I know the tunnel is working. However I am unable to connect from left hosts to right. I believe the issue sits somewhere between IPSEC and IPtables but I'm unable to resolve the issue. </div><div><br></div><div>Essentially, when I connect from left to right it appears the packets are not being tunnelled but instead going out unencrypted. I can see relevant ip xfrm policies but they don't appear to get matched. When I ping from left to right I can see a relevant iptables counter increment once on the first ping but not for subsequent pings. (see iptables below)</div><div><br></div><div>I have 12 subnets on the right side so xfrm policies and ipsec.conf is fairly long winded so I have included relevant excerpts only. I should also add the strongswan server is in a heartbeat HA pair, so the last endpoint address is a secondary IP on the interface. (primary is .241 address, .249 is floating secondary).</div><div><br></div><div>Any help is much appreciated!</div><div><br></div><div>Regards</div><div><br></div><div>Richard</div><div><br></div><div>---------- ipsec.conf -----------</div><div><br></div><div><div>conn am0-am1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>compress=no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>authby=psk</div><div> auth=esp</div><div> left=83.223.223.249</div><div> leftid=83.223.223.249</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftnexthop=83.223.223.249</div><div> leftfirewall=yes</div><div> right=173.192.252.19</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rightid=173.192.252.19</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>pfs=yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>keyexchange=ikev1</div><div> ike=3des-sha1-modp1024</div><div> esp=3des-sha1-modp1024</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auto=start</div><div><br></div><div><div>conn 12-subnet</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftsubnet=192.168.1.0/24</div><div> rightsubnet=10.68.15.0/26</div><div> also=am0-am1</div></div></div><div><br></div><div>-------- ipsec statusall 12-subnet ---------</div><div><br></div><div><div>000 </div><div>000 "12-subnet": 192.168.1.0/24===83.223.223.249---83.223.223.249...173.192.252.19===10.68.15.0/26; erouted; eroute owner: #56</div><div>000 "12-subnet": ike_life: 3600s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3</div><div>000 "12-subnet": policy: PSK+ENCRYPT+TUNNEL+PFS+UP; prio: 24,26; interface: bond1; </div><div>000 "12-subnet": newest ISAKMP SA: #45; newest IPsec SA: #56; </div><div>000 "12-subnet": IKE proposal: 3DES_CBC/HMAC_SHA1/MODP_1024</div><div>000 "12-subnet": ESP proposal: 3DES_CBC/HMAC_SHA1/<Phase1></div><div>000 </div><div>000 #56: "12-subnet" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 3013s; newest IPSEC; eroute owner</div><div>000 #56: "12-subnet" esp.beace286@173.192.252.19 (0 bytes) esp.6e9a9b60@83.223.223.249 (0 bytes); tunnel</div><div>000 #45: "12-subnet" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 543s; newest ISAKMP</div><div>000 #40: "12-subnet" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_EXPIRE in 822s</div><div>000 #40: "12-subnet" esp.beace276@173.192.252.19 (0 bytes) esp.9796994b@83.223.223.249 (0 bytes); tunnel</div><div>000 </div></div><div><br></div><div>------- iptables –t nat ------------</div><div><br></div><div><div>iptables -L -n -v -t nat</div><div>Chain PREROUTING (policy ACCEPT 2717M packets, 151G bytes)</div><div> pkts bytes target prot opt in out source destination </div><div><br></div><div>Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)</div><div> pkts bytes target prot opt in out source destination </div><div> 0 0 SNAT all -- * * 0.0.0.0/0 173.192.252.19 to:83.223.223.249 </div><div> 63 4316 SNAT all -- * * 0.0.0.0/0 10.0.0.0/8 to:83.223.223.249 </div><div> 149M 9058M MASQUERADE all -- * * 0.0.0.0/0 0.0.0.0/0 </div><div> </div><div><br></div><div>Chain OUTPUT (policy ACCEPT 2900M packets, 174G bytes)</div><div> pkts bytes target prot opt in out source destination </div></div><div><br></div><div><br></div><div>------- ip xfrm policy --------------</div><div><div><br></div><div>src 192.168.1.0/24 dst 10.68.15.0/26 </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dir out priority 2342 </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>tmpl src 83.223.223.249 dst 173.192.252.19</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>proto esp reqid 16433 mode tunnel</div></div><div>src 10.68.15.0/26 dst 192.168.1.0/24 </div><div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dir fwd priority 2342 </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>tmpl src 173.192.252.19 dst 83.223.223.249</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>proto esp reqid 16433 mode tunnel</div><div>src 10.68.15.0/26 dst 192.168.1.0/24 </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dir in priority 2342 </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>tmpl src 173.192.252.19 dst 83.223.223.249</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>proto esp reqid 16433 mode tunnel</div></div><div><br></div><div>----- ip xfrm state ---------------------</div><div><br></div><div><div>src 173.192.252.19 dst 83.223.223.249</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>proto esp spi 0x6e9a9b60 reqid 16433 mode tunnel</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>replay-window 32 </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auth hmac(sha1) 0x09ab8bd48d0895e54ad5d15b26a3e1880ca124c3</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>enc cbc(des3_ede) 0x8ee37adfdccefa3f579daa824508d2b80aea82a5afdb39fb</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>sel src 0.0.0.0/0 dst 0.0.0.0/0 </div></div><div><div>src 83.223.223.249 dst 173.192.252.19</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>proto esp spi 0xbeace276 reqid 16433 mode tunnel</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>replay-window 32 </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auth hmac(sha1) 0x662aba286f44c3843a90bf5f18bd4b9eda21bbf9</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>enc cbc(des3_ede) 0x5572b5a7f35b3ce3ef93895db3f4d2d7d06a73d42993668a</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>sel src 0.0.0.0/0 dst 0.0.0.0/0 </div><div>src 173.192.252.19 dst 83.223.223.249</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>proto esp spi 0x9796994b reqid 16433 mode tunnel</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>replay-window 32 </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auth hmac(sha1) 0x60fd58dd50ae73dd378e80789223b0c00f67008b</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>enc cbc(des3_ede) 0xda52049f27ad8ad877c22dce59674f417fad435f7604ec39</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>sel src 0.0.0.0/0 dst 0.0.0.0/0 </div></div><div><br></div><div>---------- ip a ------------------------</div><div><div>bond1: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP </div><div> link/ether 00:22:19:6c:5c:07 brd ff:ff:ff:ff:ff:ff</div><div> inet 83.223.223.241/28 brd 83.223.223.255 scope global bond1</div><div> inet 83.223.223.249/28 brd 83.223.223.255 scope global secondary bond1</div></div><div><br></div><div>----------- traceroute to right host -------------</div><div><br></div><div><div>traceroute 10.68.15.6</div><div>traceroute to 10.68.15.6 (10.68.15.6), 30 hops max, 60 byte packets</div><div> 1 83.223.223.254 (83.223.223.254) 0.449 ms 0.446 ms 0.448 ms</div><div> 2 87.255.36.250 (87.255.36.250) 0.595 ms 0.627 ms 0.736 ms</div><div>^</div><div> 3 * * *</div></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></body></html>