<div dir="ltr"><div class="gmail_quote"><br><div dir="ltr">Hi<br><br>I have 2 clients with multiple subnets behind them connecting to a single unity-supported vpn-server which also has multiple subnets behind it. <br><br>All are using strongswan-v5.2.1. Now can the below config on each of these GWs work in suucessfully setting up tunnels and protect the traffic between the subnets thru the ipsec tunnels once established. The modeconfig is thought to be used to push all other unity-options except the virtual-ip which is NOT required in this case, bcos we want to protect subnets<br><br>In summary the usage of %dynamic in leftsubnet and/or rightsubnet is an issue observed here. <br><br>On client-1<br>===========<br>- I have the below network config<br>root@OpenWrt:/etc# ifconfig<br>eth0 Link encap:Ethernet HWaddr 00:ED:CD:EF:AA:CC<br> inet addr:1.1.1.2 Bcast:1.1.1.255 Mask:255.255.255.0<br> inet6 addr: 2005::2/64 Scope:Global<br> inet6 addr: fe80::2ed:cdff:feef:aacc/64 Scope:Link<br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> RX packets:5976 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:3697 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:1000<br> RX bytes:641811 (626.7 KiB) TX bytes:435798 (425.5 KiB)<br><br>eth1 Link encap:Ethernet HWaddr 00:AA:BB:CC:DD:EE<br> inet addr:169.254.0.1 Bcast:169.254.255.255 Mask:255.255.0.0<br> inet6 addr: fe80::2aa:bbff:fecc:ddee/64 Scope:Link<br> UP BROADCAST RUNNING NOARP MTU:1500 Metric:1<br> RX packets:31 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:2964 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:0<br> RX bytes:872 (872.0 B) TX bytes:261270 (255.1 KiB)<br> Interrupt:32<br><br>eth2 Link encap:Ethernet HWaddr 00:16:19:2C:9D:18<br> inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0<br> inet6 addr: fe80::216:19ff:fe2c:9d18/64 Scope:Link<br> inet6 addr: 2007::1/64 Scope:Global<br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> RX packets:39746 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:8749 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:1000<br> RX bytes:3258891 (3.1 MiB) TX bytes:848610 (828.7 KiB)<br><br>eth2.10 Link encap:Ethernet HWaddr 00:16:19:2C:9D:18<br> inet addr:192.168.10.1 Bcast:192.168.10.255 Mask:255.255.255.0<br> inet6 addr: fe80::216:19ff:fe2c:9d18/64 Scope:Link<br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> RX packets:0 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:2891 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:0<br> RX bytes:0 (0.0 B) TX bytes:255624 (249.6 KiB)<br><br>eth2.5 Link encap:Ethernet HWaddr 00:16:19:2C:9D:18<br> inet addr:192.168.5.1 Bcast:192.168.5.255 Mask:255.255.255.0<br> inet6 addr: fe80::216:19ff:fe2c:9d18/64 Scope:Link<br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> RX packets:0 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:2892 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:0<br> RX bytes:0 (0.0 B) TX bytes:255694 (249.7 KiB)<br><br>lo Link encap:Local Loopback<br> inet addr:127.0.0.1 Mask:255.0.0.0<br> inet6 addr: ::1/128 Scope:Host<br> UP LOOPBACK RUNNING MTU:16436 Metric:1<br> RX packets:108 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:108 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:0<br> RX bytes:8596 (8.3 KiB) TX bytes:8596 (8.3 KiB)<br><br>root@OpenWrt:/etc#<br><br><br>- and i have used the following sample config (for ikev1 support for multiple subnets)<br>- Here on this client-gw1 i have to protect traffic from <a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a>, <a href="http://192.168.5.0/24" target="_blank">192.168.5.0/24</a> and <a href="http://192.168.10.0/24" target="_blank">192.168.10.0/24</a><br>--------------<br>ipsec.conf<br>------------<br># /etc/ipsec.conf - strongSwan IPsec configuration file<br><br>config setup<br> strictcrlpolicy=no<br><br>conn %default<br> rekeymargin=9m<br> keyingtries=1<br> mobike=no<br> dpdaction=restart<br> dpddelay=30<br> dpdtimeout=120<br><br>conn subntconn1<br> leftsubnet=<a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a><br> also=mainconn<br><br>conn subntconn2<br> leftsubnet=<a href="http://192.168.5.0/24" target="_blank">192.168.5.0/24</a><br> also=mainconn<br><br>conn subntconn3<br> leftsubnet=<a href="http://192.168.10.0/24" target="_blank">192.168.10.0/24</a><br> also=mainconn<br><br>conn mainconn<br> aggressive=yes<br> left=1.1.1.2<br> right=2.2.2.5<br> rightsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> modeconfig=pull<br> leftauth=psk<br> rightauth=psk<br> leftauth2=xauth<br> leftid=@grpname1<br> rightid=2.2.2.5<br> type=tunnel<br> keyexchange=ikev1<br> ike=3des-sha1-modp1024<br> esp=3des-sha1<br> ikelifetime=60m<br> keylife=20m<br> xauth=client<br> xauth_identity=user1<br> auto=add<br>root@OpenWrt:/etc#<br>root@OpenWrt:/etc# cat ipsec.secrets<br># /etc/ipsec.secrets - strongSwan IPsec secrets file<br>@grpname1 2.2.2.5 : PSK "123456"<br>user1 : XAUTH "config123"<br>root@OpenWrt:/etc#<br><br>===================================================<br><br>On client-2 Gw<br>- here i have to protect 2 subnets behind this client-gw2 (<a href="http://192.168.11.0/24" target="_blank">192.168.11.0/24</a> and 192.168.15.0)<br>-----------------<br>ipsec.conf<br>-------------<br><br># /etc/ipsec.conf - strongSwan IPsec configuration file<br><br>config setup<br> strictcrlpolicy=no<br><br>conn %default<br> rekeymargin=9m<br> keyingtries=1<br> mobike=no<br> dpdaction=restart<br> dpddelay=30<br> dpdtimeout=120<br><br>conn mainconn2<br> aggressive=yes<br> left=1.1.1.5<br> leftsubnet=%dynamic<br> right=2.2.2.5<br> rightsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> modeconfig=pull<br> leftauth=psk<br> rightauth=psk<br> leftauth2=xauth<br> leftid=@grpname1<br> rightid=2.2.2.5<br> type=tunnel<br> keyexchange=ikev1<br> ike=3des-sha1-modp1024<br> esp=3des-sha1<br> ikelifetime=60m<br> keylife=20m<br> xauth=client<br> xauth_identity=user1<br> auto=add<br>root@OpenWrt:/etc#<br>===================================================<br><br><br>On Server-side <br>================<br><br>-Here we need to protect multiple subnets behind this server (such as <a href="http://192.168.2.0/24" target="_blank">192.168.2.0/24</a>, <a href="http://172.16.0.0/16" target="_blank">172.16.0.0/16</a>, etc)<br>- This also should assign split-tunnel, split-dns, dns/wins, backup-server ipaddresses, default-domain, etc<br><br>root@suram-OptiPlex-7010:/usr/local/etc# cat ipsec.conf<br>#/etc/ipsec.conf - strongSwan IPsec configuration file<br><br>config setup<br> strictcrlpolicy=no<br> charondebug="ike 3, knl 1, cfg 3, chd 2, net 2, dmn 1, enc 2"<br><br>conn %default<br> rekeymargin=9m<br> keyingtries=1<br> mobike=no<br> dpddelay=30s<br> dpdtimeout=120s<br> dpdaction=clear<br><br>conn ezvpnserver1<br> aggressive=yes<br> left=2.2.2.5<br> leftsubnet=<a href="http://192.168.12.0/24,172.16.0.0/16" target="_blank">192.168.12.0/24,172.16.0.0/16</a><br> right=%any<br> rightsubnet=%dynamic<br> leftid=2.2.2.5<br> rightid=@grpname1<br> leftauth=psk<br> rightauth=psk<br> rightauth2=xauth<br> keyexchange=ikev1<br> ike=3des-sha1-modp1024<br> esp=3des-sha1<br> ikelifetime=60m<br> keylife=20m<br> xauth=server<br> auto=add<br>root@suram-OptiPlex-7010:/usr/local/etc# cat ipsec.secrets<br>#/etc/ipsec.secrets - strongSwan IPsec secrets file<br>2.2.2.5 @grpname1 : PSK "123456"<br>user1 : XAUTH "config123"<br>user2 : XAUTH "config1234"<br>user3 : XAUTH "config12345"<br>root@suram-OptiPlex-7010:/usr/local/etc#<br><br>=============================================================<br><br>On server, the attr.conf file is as below<br>- also enabled unity-plugin and the settings for supporting aggressive mode<br><br># Section to specify arbitrary attributes that are assigned to a peer via<br># configuration payload (CP).<br>attr {<br><br> # <attr> is an attribute name or an integer, values can be an IP address,<br> # subnet or arbitrary value.<br> # <attr> =<br> dns = 192.168.2.20, 192.168.2.21<br> nbns = 172.16.1.2, 172.16.1.3<br> # the attribute for local-lan networks to be excluded from tunneling on the client<br> # #split-exclude = <a href="http://10.0.0.0/8" target="_blank">10.0.0.0/8</a>, <a href="http://172.31.1.0/24" target="_blank">172.31.1.0/24</a><br> # the attribute for backup-server ipaddresses<br> 28681 = 10.232.90.122, 10.232.90.124<br> # the attribute for default-domain name for the connected client<br> 28674 = <a href="http://svt1test.com" target="_blank">svt1test.com</a><br> # the attribute for split-dns domain names for the connected client<br> 28675 = <a href="http://svt1test.com" target="_blank">svt1test.com</a> <a href="http://svt2test.com" target="_blank">svt2test.com</a><br> # the attribute for unity banner name for the connected client<br> 28672 = "Welcome ...You are Connected"<br> # Whether to load the plugin. Can also be an integer to increase the<br> # priority of this plugin.<br> load = yes<br><br>}<br>=========================<br>etc<br>etc<br><br>Now the issue observed is as below (the tunnel is so called u, but the traffic does not go thru at all<br><br><br><br>root@suram-OptiPlex-7010:/usr/local/etc# ipsec status<br>Security Associations (1 up, 0 connecting):<br>ezvpnserver1[1]: ESTABLISHED 16 minutes ago, 2.2.2.5[2.2.2.5]...1.1.1.2[grpname1 ]<br>ezvpnserver1{1}: REKEYING, TUNNEL, expires in 3 minutes<br>ezvpnserver1{1}: <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> === <a href="http://1.1.1.2/32" target="_blank">1.1.1.2/32</a><br>ezvpnserver1{1}: REKEYING, TUNNEL, expires in 15 minutes<br>ezvpnserver1{1}: <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> === <a href="http://1.1.1.2/32" target="_blank">1.1.1.2/32</a><br>ezvpnserver1{1}: INSTALLED, TUNNEL, ESP SPIs: cf16cf05_i c86dd568_o<br>ezvpnserver1{1}: <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> === <a href="http://1.1.1.2/32" target="_blank">1.1.1.2/32</a><br>root@suram-OptiPlex-7010:/usr/local/etc# ipsec statusall<br>Status of IKE charon daemon (weakSwan 5.2.1, Linux 3.11.0-26-generic, x86_64):<br> uptime: 18 minutes, since May 04 00:28:50 2015<br> malloc: sbrk 663552, mmap 0, used 555168, free 108384<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 4<br> loaded plugins: charon aes des blowfish rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt fips-prf gmp xcbc cmac hmac ctr ccm gcm curl attr kernel-netlink resolve socket-default farp stroke updown eap-identity eap-sim eap-aka eap-simaka-pseudonym eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-noauth tnc-tnccs dhcp error-notify unity<br>Listening IP addresses:<br> 2.2.2.5<br> 192.168.12.5<br> 10.232.90.125<br> 192.168.122.1<br> 172.16.1.1<br>Connections:<br>ezvpnserver1: 2.2.2.5...%any IKEv1 Aggressive, dpddelay=30s<br>ezvpnserver1: local: [2.2.2.5] uses pre-shared key authentication<br>ezvpnserver1: remote: [grpname1] uses pre-shared key authentication<br>ezvpnserver1: remote: uses XAuth authentication: any<br>ezvpnserver1: child: <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> <a href="http://172.16.0.0/16" target="_blank">172.16.0.0/16</a> === dynamic TUNNEL, dpdaction=clear<br>Security Associations (1 up, 0 connecting):<br>ezvpnserver1[1]: ESTABLISHED 17 minutes ago, 2.2.2.5[2.2.2.5]...1.1.1.2[grpname1]<br>ezvpnserver1[1]: Remote XAuth identity: user1<br>ezvpnserver1[1]: IKEv1 SPIs: 257bbf22658999eb_i e2852cfe548b691d_r*, pre-shared key reauthentication in 33 minutes<br>ezvpnserver1[1]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br>ezvpnserver1{1}: REKEYING, TUNNEL, expires in 2 minutes<br>ezvpnserver1{1}: <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> === <a href="http://1.1.1.2/32" target="_blank">1.1.1.2/32</a><br>ezvpnserver1{1}: REKEYING, TUNNEL, expires in 14 minutes<br>ezvpnserver1{1}: <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> === <a href="http://1.1.1.2/32" target="_blank">1.1.1.2/32</a><br>ezvpnserver1{1}: INSTALLED, TUNNEL, ESP SPIs: cf16cf05_i c86dd568_o<br>ezvpnserver1{1}: 3DES_CBC/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 2 minutes<br>ezvpnserver1{1}: <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> === <a href="http://1.1.1.2/32" target="_blank">1.1.1.2/32</a><br>root@suram-OptiPlex-7010:/usr/local/etc#<br><br>oot@OpenWrt:/etc# ipsec status<br>Security Associations (1 up, 0 connecting):<br> subntconn1[1]: ESTABLISHED 20 minutes ago, 1.1.1.2[grpname1]...2.2.2.5[2.2.2.5]<br> mainconn{1}: INSTALLED, TUNNEL, ESP SPIs: c86dd568_i cf16cf05_o<br> mainconn{1}: <a href="http://1.1.1.2/32" target="_blank">1.1.1.2/32</a> === <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a><br> mainconn{1}: INSTALLED, TUNNEL, ESP SPIs: c53c99e0_i c34bfdca_o<br> mainconn{1}: <a href="http://1.1.1.2/32" target="_blank">1.1.1.2/32</a> === <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a><br>root@OpenWrt:/etc#<br>root@OpenWrt:/etc#<br>root@OpenWrt:/etc# ip xfrm state<br>src 1.1.1.2 dst 2.2.2.5<br> proto esp spi 0xc34bfdca reqid 1 mode tunnel<br> replay-window 32<br> auth-trunc hmac(sha1) 0xd939e33400f702405d5cc2229228bdc8d29f2955 96<br> enc cbc(des3_ede) 0xe7b2a0b158ff3d666b1d30dfdf8fa6d8e1f99a820d7ea084<br> sel src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br>src 2.2.2.5 dst 1.1.1.2<br> proto esp spi 0xc53c99e0 reqid 1 mode tunnel<br> replay-window 32<br> auth-trunc hmac(sha1) 0xecc7c4f61cbeade1c2258e3f8e2fd8e10580d1ac 96<br> enc cbc(des3_ede) 0x9d5362ac74137929c1e66d1bd0098904ffbefb353911c8bf<br> sel src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br>src 1.1.1.2 dst 2.2.2.5<br> proto esp spi 0xcf16cf05 reqid 1 mode tunnel<br> replay-window 32<br> auth-trunc hmac(sha1) 0x0663a100a9b74f99cfc783f50afa76d1ee66a2fd 96<br> enc cbc(des3_ede) 0x26f824bce9c71b14d8194c397629a279b0c66142664c8637<br> sel src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br>src 2.2.2.5 dst 1.1.1.2<br> proto esp spi 0xc86dd568 reqid 1 mode tunnel<br> replay-window 32<br> auth-trunc hmac(sha1) 0x00485d7a2faa2f6766da23171c89f120a9278c8b 96<br> enc cbc(des3_ede) 0x0a471632c5aa6208ca8c26cd37071ddaaffa57fd5ad95eb7<br> sel src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br>root@OpenWrt:/etc# ip xfrm policy<br>src <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> dst <a href="http://1.1.1.2/32" target="_blank">1.1.1.2/32</a><br> dir fwd priority 1827<br> tmpl src 2.2.2.5 dst 1.1.1.2<br> proto esp reqid 1 mode tunnel<br>src <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> dst <a href="http://1.1.1.2/32" target="_blank">1.1.1.2/32</a><br> dir in priority 1827<br> tmpl src 2.2.2.5 dst 1.1.1.2<br> proto esp reqid 1 mode tunnel<br>src <a href="http://1.1.1.2/32" target="_blank">1.1.1.2/32</a> dst <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a><br> dir out priority 1827<br> tmpl src 1.1.1.2 dst 2.2.2.5<br> proto esp reqid 1 mode tunnel<br>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> socket in priority 0<br>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> socket out priority 0<br>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> socket in priority 0<br>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> socket out priority 0<br>src ::/0 dst ::/0<br> socket in priority 0<br>src ::/0 dst ::/0<br> socket out priority 0<br>src ::/0 dst ::/0<br> socket in priority 0<br>src ::/0 dst ::/0<br> socket out priority 0<br>root@OpenWrt:/etc#<br>=======================================================<br><br><br>On server-side<br><br>root@suram-OptiPlex-7010:~#<br>root@suram-OptiPlex-7010:~# ipsec status<br>Security Associations (1 up, 0 connecting):<br>ezvpnserver1[2]: ESTABLISHED 3 minutes ago, 2.2.2.5[2.2.2.5]...1.1.1.5[grpname1]<br>ezvpnserver1{1}: INSTALLED, TUNNEL, ESP SPIs: c25701e2_i caf30f13_o<br>ezvpnserver1{1}: <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> <a href="http://172.16.0.0/16" target="_blank">172.16.0.0/16</a> === <a href="http://1.1.1.5/32" target="_blank">1.1.1.5/32</a><br>root@suram-OptiPlex-7010:~# ipsec statusall<br>Status of IKE charon daemon (weakSwan 5.2.1, Linux 3.11.0-26-generic, x86_64):<br> uptime: 8 minutes, since May 04 01:31:33 2015<br> malloc: sbrk 663552, mmap 0, used 555168, free 108384<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 5<br> loaded plugins: charon aes des blowfish rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt fips-prf gmp xcbc cmac hmac ctr ccm gcm curl attr kernel-netlink resolve socket-default farp stroke updown eap-identity eap-sim eap-aka eap-simaka-pseudonym eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-noauth tnc-tnccs dhcp error-notify unity<br>Listening IP addresses:<br> 2.2.2.5<br> 192.168.12.5<br> 10.232.90.125<br> 192.168.122.1<br> 172.16.1.1<br>Connections:<br>ezvpnserver1: 2.2.2.5...%any IKEv1 Aggressive, dpddelay=30s<br>ezvpnserver1: local: [2.2.2.5] uses pre-shared key authentication<br>ezvpnserver1: remote: [grpname1] uses pre-shared key authentication<br>ezvpnserver1: remote: uses XAuth authentication: any<br>ezvpnserver1: child: <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> <a href="http://172.16.0.0/16" target="_blank">172.16.0.0/16</a> === dynamic TUNNEL, dpdaction=clear<br>Security Associations (1 up, 0 connecting):<br>ezvpnserver1[2]: ESTABLISHED 3 minutes ago, 2.2.2.5[2.2.2.5]...1.1.1.5[grpname1]<br>ezvpnserver1[2]: Remote XAuth identity: user2<br>ezvpnserver1[2]: IKEv1 SPIs: 500ff39dc6594249_i 42ade588961f947e_r*, pre-shared key reauthentication in 39 minutes<br>ezvpnserver1[2]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br>ezvpnserver1{1}: INSTALLED, TUNNEL, ESP SPIs: c25701e2_i caf30f13_o<br>ezvpnserver1{1}: 3DES_CBC/HMAC_SHA1_96, 2356 bytes_i, 0 bytes_o, rekeying in 17 seconds<br>ezvpnserver1{1}: <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> <a href="http://172.16.0.0/16" target="_blank">172.16.0.0/16</a> === <a href="http://1.1.1.5/32" target="_blank">1.1.1.5/32</a><br>root@suram-OptiPlex-7010:~#<br><br><br><br>root@suram-OptiPlex-7010:~#<br>root@suram-OptiPlex-7010:~#<br>root@suram-OptiPlex-7010:~# ip xfrm state<br>src 2.2.2.5 dst 1.1.1.5<br> proto esp spi 0xc615b1cb reqid 1 mode tunnel<br> replay-window 32 flag af-unspec<br> auth-trunc hmac(sha1) 0xb7a9b68127289d00ae6fc8d0c589d17b89a9230e 96<br> enc cbc(des3_ede) 0x3356fe51ddbeaab6e8509adc83b4f2c0ca69aa5d7c90d2b6<br>src 1.1.1.5 dst 2.2.2.5<br> proto esp spi 0xcd9eb056 reqid 1 mode tunnel<br> replay-window 32 flag af-unspec<br> auth-trunc hmac(sha1) 0xa85edfc052ccb2cf9658cbf7b24e1dbb541a4aa4 96<br> enc cbc(des3_ede) 0x7c08876a5b359835fbfe5a5b1ed310fb5379589c16b09a78<br>src 2.2.2.5 dst 1.1.1.5<br> proto esp spi 0xcaf30f13 reqid 1 mode tunnel<br> replay-window 32 flag af-unspec<br> auth-trunc hmac(sha1) 0x7ce09d510a7266228f97f9e1f7a88bb2e7302c0d 96<br> enc cbc(des3_ede) 0x2f05d3d162128bf5ab004ef94d20d4b112e797f947198563<br>src 1.1.1.5 dst 2.2.2.5<br> proto esp spi 0xc25701e2 reqid 1 mode tunnel<br> replay-window 32 flag af-unspec<br> auth-trunc hmac(sha1) 0xae657f83aad626b12e0a9f2440e9345edc66c0f5 96<br> enc cbc(des3_ede) 0xd92266439aa6957f2019e6394fe4d75c53c30ce55e5b410e<br>root@suram-OptiPlex-7010:~# ip xfrm policy<br>src <a href="http://1.1.1.5/32" target="_blank">1.1.1.5/32</a> dst <a href="http://172.16.0.0/16" target="_blank">172.16.0.0/16</a><br> dir fwd priority 2883<br> tmpl src 1.1.1.5 dst 2.2.2.5<br> proto esp reqid 1 mode tunnel<br>src <a href="http://1.1.1.5/32" target="_blank">1.1.1.5/32</a> dst <a href="http://172.16.0.0/16" target="_blank">172.16.0.0/16</a><br> dir in priority 2883<br> tmpl src 1.1.1.5 dst 2.2.2.5<br> proto esp reqid 1 mode tunnel<br>src <a href="http://172.16.0.0/16" target="_blank">172.16.0.0/16</a> dst <a href="http://1.1.1.5/32" target="_blank">1.1.1.5/32</a><br> dir out priority 2883<br> tmpl src 2.2.2.5 dst 1.1.1.5<br> proto esp reqid 1 mode tunnel<br>src <a href="http://1.1.1.5/32" target="_blank">1.1.1.5/32</a> dst <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a><br> dir fwd priority 2851<br> tmpl src 1.1.1.5 dst 2.2.2.5<br> proto esp reqid 1 mode tunnel<br>src <a href="http://1.1.1.5/32" target="_blank">1.1.1.5/32</a> dst <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a><br> dir in priority 2851<br> tmpl src 1.1.1.5 dst 2.2.2.5<br> proto esp reqid 1 mode tunnel<br>src <a href="http://192.168.12.0/24" target="_blank">192.168.12.0/24</a> dst <a href="http://1.1.1.5/32" target="_blank">1.1.1.5/32</a><br> dir out priority 2851<br> tmpl src 2.2.2.5 dst 1.1.1.5<br> proto esp reqid 1 mode tunnel<br>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> socket in priority 0<br>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> socket out priority 0<br>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> socket in priority 0<br>src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> socket out priority 0<br>src ::/0 dst ::/0<br> socket in priority 0<br>src ::/0 dst ::/0<br> socket out priority 0<br>src ::/0 dst ::/0<br> socket in priority 0<br>src ::/0 dst ::/0<br> socket out priority 0<br>root@suram-OptiPlex-7010:~#<br><br>==========================================<br><br></div><div>thanks & regards<br></div><div>rajiv<br><br></div>
</div><br></div>