<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">When I install the routes via the up down script I use the commands<div class=""><ol style="margin: 0px; padding: 0px 0px 0px 48px; color: rgb(172, 172, 172); font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace, serif; line-height: 21px;" class=""><li class="li2" style="-webkit-user-select: none;"><div class="de2" style="-webkit-user-select: text; padding: 0px 5px; vertical-align: top; color: rgb(0, 0, 0); border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); margin: 0px 0px 0px -7px; position: relative; background-color: rgb(255, 255, 255);">/sbin/ip route del default</div></li><li class="li1" style="-webkit-user-select: none;"><div class="de1" style="-webkit-user-select: text; padding: 0px 5px; vertical-align: top; color: rgb(0, 0, 0); border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); margin: 0px 0px 0px -7px; position: relative; background-color: rgb(255, 255, 255);">/sbin/ip route replace default dev usb1 src "$PLUTO_MY_SOURCEIP”</div></li></ol><div class=""><br class=""></div><div class="">and that puts in a good default route with the source ip address that the traffic selector recognizes for it to do its thing and encrypt the traffic.</div><div class=""><br class=""></div><div class="">-Philip</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><div class="">On Jul 6, 2015, at 6:43 PM, Zhuyj <<a href="mailto:mounter625@163.com" class="">mounter625@163.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="content-type" content="text/html; charset=utf-8" class=""><div dir="auto" class=""><div class="">Do you remove this default route and add several specific routes?<br class=""><br class="">发自我的 iPhone</div><div class=""><br class="">在 2015年7月7日，9:17，Philip L Hutson <<a href="mailto:philip@plh9.com" class="">philip@plh9.com</a>> 写道：<br class=""><br class=""></div><blockquote type="cite" class=""><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class="">I tried 220 and 0 (for the primary table). Neither overwrote of had a higher priority than the default route that was in the table already.<div class="">-Philip</div><div class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On Jul 6, 2015, at 6:01 PM, Zhuyj <<a href="mailto:mounter625@163.com" class="">mounter625@163.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="content-type" content="text/html; charset=utf-8" class=""><div dir="auto" class=""><div class="">table 220 work</div><div class=""><br class=""><br class="">发自我的 iPhone</div><div class=""><br class="">在 2015年7月7日，8:36，Philip L Hutson <<a href="mailto:philip@plh9.com" class="">philip@plh9.com</a>> 写道：<br class=""><br class=""></div><blockquote type="cite" class=""><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class="">I am trying to setup a vpn tunnel from an embedded linux system (Linux system-0004338 2.6.37 #7 Mon Jun 22 14:45:53 PDT 2015 armv7l GNU/Linux) to a cisco asa. I have a working solution but not the preferred one. <div class="">One of my first problems was when I let strong swan add the routes it didn’t over write the default route so no traffic would go through. I was able to solve this by using the an up/down script. But I would prefer that strong swan added/removed the routes. </div><div class="">The routes it added looked like this</div><div class=""><div class=""> ip route</div><div class="">10.255.254.180/30 dev usb1 src 10.255.254.180 </div><div class="">0.0.0.0/1 via 10.255.254.181 dev usb1 src 10.3.10.18 </div><div class="">128.0.0.0/1 via 10.255.254.181 dev usb1 src 10.3.10.18 </div><div class="">default via 10.255.254.181 dev usb1 </div></div><div class=""><br class=""></div><div class="">where the default route at the bottom was there already.</div><div class="">The route table before was</div><div class=""><div class=""> ip route</div><div class="">10.255.254.180/30 dev usb1 src 10.255.254.180 </div><div class="">default via 10.255.254.181 dev usb1 </div></div><div class=""><br class=""></div><div class="">The second issue is with the system time fix plugin. After the device gets a valid time from ntp over the tunnel it invalidates the client sa. </div><div class="">time fix config </div><div class=""><a href="http://pastebin.com/B5WHHbLE" class="">system time fix</a></div><div class=""><a href="http://pastebin.com/0yu1YFKm" class="">LOGFILE</a> showing the sa being invalidated</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">The configuration I would like is where if usb1 goes up (after having been up before) strong swan reconnects the tunnel. Currently if usb1 goes down (for longer than dpd) and then comes up again and the dhcp client gets/assigns an address to usb1 strong swan does not reconnect the tunnel. If I use ipsec up home it comes back up.</div><div class="">My current working <a href="http://pastebin.com/B7vPqqDd" class="">ipsec.conf</a></div><div class=""><a href="http://pastebin.com/zY6ZzZgC" class="">charon.conf</a></div><div class=""><a href="http://pastebin.com/JGksUE8p" class="">updown script</a></div><div class=""><br class=""></div>
</div></blockquote><blockquote type="cite" class=""><div class=""><span class="">_______________________________________________</span><br class=""><span class="">Users mailing list</span><br class=""><span class=""><a href="mailto:Users@lists.strongswan.org" class="">Users@lists.strongswan.org</a></span><br class=""><span class=""><a href="https://lists.strongswan.org/mailman/listinfo/users" class="">https://lists.strongswan.org/mailman/listinfo/users</a></span><br class=""></div></blockquote></div></div></blockquote></div><br class=""></div></div></blockquote><blockquote type="cite" class=""><div class=""><span class="">_______________________________________________</span><br class=""><span class="">Users mailing list</span><br class=""><span class=""><a href="mailto:Users@lists.strongswan.org" class="">Users@lists.strongswan.org</a></span><br class=""><span class=""><a href="https://lists.strongswan.org/mailman/listinfo/users" class="">https://lists.strongswan.org/mailman/listinfo/users</a></span></div></blockquote></div></div></blockquote></div><br class=""></div></body></html>