<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:14pt"><div style="RIGHT: auto"><SPAN style="RIGHT: auto">Hi,</SPAN></div>
<div style="RIGHT: auto"><SPAN style="RIGHT: auto"></SPAN> </div>
<div style="RIGHT: auto"><SPAN style="RIGHT: auto">I got the following information from one of my colleague(and I hope it will be useful for someone in this community):</SPAN></div>
<div style="BACKGROUND-COLOR: transparent; FONT-STYLE: normal; FONT-FAMILY: times new roman, new york, times, serif; COLOR: rgb(0,0,0); FONT-SIZE: 19px; RIGHT: auto"><SPAN style="RIGHT: auto"></SPAN> </div><SPAN style="RIGHT: auto">
<div style="MARGIN: 0cm 0cm 0pt" class=MsoNormal><FONT size=3 face=Calibri>I suggest to have a quick look into the kernel-libipsec plugin (</FONT><A href="http://wiki.strongswan.org/projects/strongswan/wiki/Kernel-libipsec"><FONT color=#800080 size=3 face=Calibri>http://wiki.strongswan.org/projects/strongswan/wiki/Kernel-libipsec</FONT></A><FONT size=3 face=Calibri>) coming along with Strongswan 5.1.0. This plugin provides a virtual interface (ipsec0) per tunnel and you can easily switch between IPsec pre- and post-fragmentation by just modifying the MTU size of the interface terminating the tunnel.</FONT></div>
<div style="MARGIN: 0cm 0cm 0pt" class=MsoNormal><?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p><FONT size=3 face=Calibri> </FONT></o:p></div>
<div style="MARGIN: 0cm 0cm 0pt" class=MsoNormal><FONT size=3 face=Calibri>I am not sure if this is the best way to do, however we did a quick test in our lab (we had exactly the same requirement than you) and it was working quite nice. A configuration example can be found at </FONT><A href="http://www.strongswan.org/uml/testresults5rc/libipsec/net2net-cert/"><FONT color=#800080 size=3 face=Calibri>http://www.strongswan.org/uml/testresults5rc/libipsec/net2net-cert/</FONT></A></div>
<div style="BACKGROUND-COLOR: transparent; FONT-STYLE: normal; FONT-FAMILY: times new roman, new york, times, serif; COLOR: rgb(0,0,0); FONT-SIZE: 19px; RIGHT: auto"></SPAN><VAR id=yui-ie-cursor></VAR> </div>
<DIV></DIV>
<DIV style="RIGHT: auto"> </DIV>
<DIV>
<DIV>Best Regards,</DIV>
<DIV>______________</DIV>
<DIV>Shashidhar Patil</DIV><BR></DIV>
<div><BR>
<BLOCKQUOTE style="BORDER-LEFT: rgb(16,16,255) 2px solid; MARGIN-TOP: 5px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px">
<DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 14pt">
<DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 12pt">
<DIV dir=ltr>
<DIV style="BORDER-BOTTOM: #ccc 1px solid; BORDER-LEFT: #ccc 1px solid; PADDING-BOTTOM: 0px; LINE-HEIGHT: 0; MARGIN: 5px 0px; PADDING-LEFT: 0px; PADDING-RIGHT: 0px; HEIGHT: 0px; FONT-SIZE: 0px; BORDER-TOP: #ccc 1px solid; BORDER-RIGHT: #ccc 1px solid; PADDING-TOP: 0px" class=hr contentEditable=false readonly="true"></DIV><FONT size=2 face=Arial><B><SPAN style="FONT-WEIGHT: bold">From:</SPAN></B> Shashidhar Patil <shashi_patil77@yahoo.com><BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B> "users@lists.strongswan.org" <users@lists.strongswan.org> <BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Friday, August 23, 2013 9:48 AM<BR><B><SPAN style="FONT-WEIGHT: bold">Subject:</SPAN></B> Re: [strongSwan] encryption of fragmented packets in linux<BR></FONT></DIV>
<DIV class=y_msg_container><BR>
<DIV id=yiv0264681102>
<DIV>
<DIV style="BACKGROUND-COLOR: #fff; FONT-FAMILY: times new roman, new york, times, serif; COLOR: #000; FONT-SIZE: 14pt">
<DIV><SPAN><BR class=yiv0264681102yui-cursor></SPAN></DIV>
<DIV></DIV>
<DIV> Hi,</DIV>
<DIV><VAR id=yiv0264681102yui-ie-cursor></VAR> </DIV>
<DIV>has some one tried these scenarios ?</DIV>
<DIV>expert advice on this is very much appreciated.</DIV>
<DIV> </DIV>
<DIV>
<DIV>Best Regards,</DIV>
<DIV>______________</DIV>
<DIV>Shashidhar Patil</DIV><BR></DIV>
<DIV><BR>
<BLOCKQUOTE style="BORDER-LEFT: rgb(16,16,255) 2px solid; MARGIN-TOP: 5px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px">
<DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 14pt">
<DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 12pt">
<DIV dir=ltr>
<DIV style="BORDER-BOTTOM: #ccc 1px solid; BORDER-LEFT: #ccc 1px solid; PADDING-BOTTOM: 0px; LINE-HEIGHT: 0; MARGIN: 5px 0px; PADDING-LEFT: 0px; PADDING-RIGHT: 0px; HEIGHT: 0px; FONT-SIZE: 0px; BORDER-TOP: #ccc 1px solid; BORDER-RIGHT: #ccc 1px solid; PADDING-TOP: 0px" class=yiv0264681102hr></DIV><FONT size=2 face=Arial><B><SPAN style="FONT-WEIGHT: bold">From:</SPAN></B> Shashidhar Patil <shashi_patil77@yahoo.com><BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B> "users@lists.strongswan.org" <users@lists.strongswan.org> <BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Thursday, August 22, 2013 10:07 AM<BR><B><SPAN style="FONT-WEIGHT: bold">Subject:</SPAN></B> [strongSwan] encryption of fragmented packets in linux<BR></FONT></DIV>
<DIV class=yiv0264681102y_msg_container><BR>
<DIV id=yiv0264681102>
<DIV>
<DIV style="BACKGROUND-COLOR: #fff; FONT-FAMILY: times new roman, new york, times, serif; COLOR: #000; FONT-SIZE: 14pt">
<DIV><SPAN></SPAN></DIV>
<DIV></DIV>
<DIV> Hi,</DIV>
<DIV> </DIV>
<DIV>Is it possible to enable encryption of fragments in Linux ?</DIV>
<DIV> </DIV>
<DIV>I'm lookin at the following scenarios:</DIV>
<OL>
<LI>
<DIV>the security GW (Linux PC with strongswan) receives IP fragments which needs to encrypted </DIV></LI>
<LI>
<DIV>The Linux applies encryption on these fragments directly with appropriate (matching) policy (and sends them as independant ESP packets)</DIV></LI></OL>
<DIV>OR</DIV>
<OL>
<LI>Linux receives a plain packet which needs to be encrypted but the size of packet will become more than the MTU of the interface on which it needs to be transmitted, after the encryption.<VAR id=yiv0264681102yui-ie-cursor></VAR></LI>
<LI>Linux should do this look-ahead calculation and fragment the IP packet and then encrypt those framgents as independant ESP packets.</LI></OL>
<DIV style="BACKGROUND-COLOR: transparent; FONT-STYLE: normal; FONT-FAMILY: times new roman, new york, times, serif; COLOR: rgb(0,0,0); FONT-SIZE: 19px">Is it possible to achieve either of these options on Linux.</DIV>
<DIV style="BACKGROUND-COLOR: transparent; FONT-STYLE: normal; FONT-FAMILY: times new roman, new york, times, serif; COLOR: rgb(0,0,0); FONT-SIZE: 19px">Are there any settings on Linux to achieve this ?</DIV>
<DIV style="BACKGROUND-COLOR: transparent; FONT-STYLE: normal; FONT-FAMILY: times new roman, new york, times, serif; COLOR: rgb(0,0,0); FONT-SIZE: 19px"> </DIV>
<DIV style="BACKGROUND-COLOR: transparent; FONT-STYLE: normal; FONT-FAMILY: times new roman, new york, times, serif; COLOR: rgb(0,0,0); FONT-SIZE: 19px">Best Regards,</DIV>
<DIV>______________</DIV>
<DIV>Shashidhar Patil</DIV>
<DIV><BR></DIV></DIV></DIV></DIV><BR>_______________________________________________<BR>Users mailing list<BR><A href="mailto:Users@lists.strongswan.org" rel=nofollow target=_blank ymailto="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</A><BR><A href="https://lists.strongswan.org/mailman/listinfo/users" rel=nofollow target=_blank>https://lists.strongswan.org/mailman/listinfo/users</A><BR><BR></DIV></DIV></DIV></BLOCKQUOTE></DIV></DIV></DIV></DIV><BR>_______________________________________________<BR>Users mailing list<BR><A href="mailto:Users@lists.strongswan.org" ymailto="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</A><BR><A href="https://lists.strongswan.org/mailman/listinfo/users" target=_blank>https://lists.strongswan.org/mailman/listinfo/users</A><BR><BR></DIV></DIV></DIV></BLOCKQUOTE></div></div></body></html>