<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"HP Simplified";
panose-1:2 11 6 4 2 2 4 2 2 4;}
@font-face
{font-family:"HP Simplified Light";
panose-1:2 11 4 4 2 2 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"HP Simplified Light","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"HP Simplified Light","sans-serif";color:#1F497D">What is your routing setup on the spokes?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"HP Simplified Light","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"HP Simplified Light","sans-serif";color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"HP Simplified Light","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"HP Simplified","sans-serif";color:black">Andy Paton -
</span></b><span style="font-size:9.0pt;font-family:"HP Simplified","sans-serif";color:#262626">Bsc. (Hons), MBCS</span><b><span style="font-size:9.0pt;font-family:"HP Simplified","sans-serif";color:black"><br>
</span></b><span style="font-size:9.0pt;font-family:"HP Simplified","sans-serif";color:#717172">Innovation Engineer<br>
<br>
<a href="mailto:andy.paton@hp.com"><span style="color:#717172">andy.paton@hp.com</span></a><br>
<br>
<br>
</span><a href="http://www.hp.com/"><span style="font-size:9.0pt;font-family:"HP Simplified","sans-serif";color:#717172;text-decoration:none"><img border="0" width="30" height="30" id="Picture_x0020_2" src="cid:image001.png@01CEA56F.FF58B6C0" alt="HP"></span></a><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"HP Simplified Light","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> users-bounces+andy.paton=hp.com@lists.strongswan.org [mailto:users-bounces+andy.paton=hp.com@lists.strongswan.org]
<b>On Behalf Of </b>Kevin Palmer<br>
<b>Sent:</b> 30 August 2013 10:32<br>
<b>To:</b> users@lists.strongswan.org<br>
<b>Subject:</b> [strongSwan] Strongswan as a VPN Hub with a single network adapter<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Hi,</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">I have just been using Strongswan for the first time and firstly I’d like to say how impressed I was in how easy it was to setup the VPN tunnels. I got my two tunnels working
within about 20 minutes of installing Strongswan.</span><o:p></o:p></p>
</div>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">I have got a hub and two spokes and once the two tunnels were established I can successfully communicate between the spokes and the hub.</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">The problem I’ve got however is that each ‘Spoke’ of the VPN cannot contact other spokes in the VPN.</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">My first thought that this was that IPv4 Forwarding needs to be enabled however enabling IPv4 Forwarding did not solve the problem.</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">I’ve also tried adding each spoke subnet as ‘Left’ subnets in the other connections in ipsec.conf but Strongswan reports “no local address found in traffic
selector <a href="http://10.6.0.0/24">10.6.0.0/24</a>” as that subnet is not allocated to my adapter.</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">The other points to note is that my machine has only one network adapter which is connected to the internet so to get a local subnet I added a second IP
address to the adapter (eth0:0)</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">Does anyone have any suggestions on what I should try text?</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">Configuration below…</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">Thanks,</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">Kevin</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><b><span style="font-family:"Calibri","sans-serif";color:black">Interfaces</span></b><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">auto eth0</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">iface eth0 inet static</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> address xxx.xxx.xxx.xxx</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> gateway zzz.zzz.zzz.zzz</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> netmask 255.255.252.0</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> </span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">auto lo</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">iface lo inet loopback</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> </span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">auto eth0:0</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">iface eth0:0 inet static</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> address 172.16.0.1</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> netmask 255.255.0.0</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><b><span style="font-family:"Calibri","sans-serif";color:black">ipsec.conf</span></b><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"># ipsec.conf - strongSwan IPsec configuration file</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> </span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"># basic configuration</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> </span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">config setup</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> # plutodebug=all</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> # crlcheckinterval=600</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> # strictcrlpolicy=yes</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> # cachecrls=yes</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> nat_traversal=yes</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> charonstart=yes</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> plutostart=yes</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> </span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"># Add connections here.</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> </span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">conn %default</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> ikelifetime=60m</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> keylife=20m</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> rekeymargin=3m</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> keyingtries=1</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> keyexchange=ikev2</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> authby=secret</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> mobike=yes</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> </span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"># CSVNETKP Connection</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> </span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">conn csvnetkp</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> left=%any</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> leftsubnet=<a href="http://172.16.0.0/24,10.6.0.0/24">172.16.0.0/24,10.6.0.0/24</a></span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">
<a href="mailto:leftid=@csvpn.local">leftid=@csvpn.local</a></span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> right=aaa.aaa.aaa.aaa</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> rightsubnet=<a href="http://10.4.0.0/16">10.4.0.0/16</a></span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> auto=route</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> esp=aes256</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> </span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> </span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">conn csvnetmsdn2</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> left=%any</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> leftsubnet=<a href="http://172.16.0.0/24,10.4.0.0/16">172.16.0.0/24,10.4.0.0/16</a></span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black">
<a href="mailto:leftid=@csvpn.cirrasoft.local">leftid=@csvpn.cirrasoft.local</a></span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> right=bbb.bbb.bbb.bbb</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> rightsubnet=<a href="http://10.6.0.0/16">10.6.0.0/16</a></span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> auto=route</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> esp=aes256</span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><i><span style="font-family:"Calibri","sans-serif";color:black"> </span></i><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">Where
</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">xxx.xxx.xxx.xxx is my Public facing address</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">zzz.zzz.zzz.zzz is my ISP gateway</span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">aaa.aaa.aaa.aaa is the Gateway of ‘spoke’ Subnet
<a href="http://10.4.0.0/16">10.4.0.0/16</a></span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black">bbb.bbb.bbb.bbb is the Gateway of ‘spoke’ Subnet
<a href="http://10.6.0.0/16">10.6.0.0/16</a></span><o:p></o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif";color:black"> </span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">And I have my PSK’s in the secrets file mapped to the two gateways.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">If anyone can help this would be much appreciated..</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">I'm sure I am almost there but... not quite!</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Many Thanks,</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Kevin</span><o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>