<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Segoe Script";
panose-1:2 11 5 4 2 0 0 0 0 3;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Hi Noel,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Below code encrypts all the packets on eth1 interface.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Code:<o:p></o:p></p>
<p class="MsoPlainText"> leftsubnet=%dynamic<span style="background:yellow;mso-highlight:yellow">[]</span><o:p></o:p></p>
<p class="MsoPlainText"> rightsubnet=%dynamic<span style="background:yellow;mso-highlight:yellow">[]</span><o:p></o:p></p>
<p class="MsoPlainText"> type=transport<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Listening IP addresses:<o:p></o:p></p>
<p class="MsoPlainText"> 10.64.69.118<o:p></o:p></p>
<p class="MsoPlainText"> 2001:db8:0:f101::2<o:p></o:p></p>
<p class="MsoPlainText"> fd08:2eef:c2ee:0:aabb:cc00:c900:11<o:p></o:p></p>
<p class="MsoPlainText"> fd08:2eef:c2ee:0:aabb:cc00:c900:31<o:p></o:p></p>
<p class="MsoPlainText"> fd08:2fff:c2ee:0:aabb:cc00:c900:2<o:p></o:p></p>
<p class="MsoPlainText">Connections:<o:p></o:p></p>
<p class="MsoPlainText">snbi_new_ipv6: fe80::20c:29ff:fea8:e174%eth1...fe80::20c:29ff:feb2:ae2f%eth1 IKEv2<o:p></o:p></p>
<p class="MsoPlainText">snbi_new_ipv6: local: [fe80::20c:29ff:fea8:e174] uses pre-shared key authentication<o:p></o:p></p>
<p class="MsoPlainText">snbi_new_ipv6: remote: [fe80::20c:29ff:feb2:ae2f] uses pre-shared key authentication<o:p></o:p></p>
<p class="MsoPlainText">snbi_new_ipv6: child: dynamic === dynamic TRANSPORT<o:p></o:p></p>
<p class="MsoPlainText">Security Associations (1 up, 0 connecting):<o:p></o:p></p>
<p class="MsoPlainText">snbi_new_ipv6[1]: ESTABLISHED 38 seconds ago, fe80::20c:29ff:fea8:e174[fe80::20c:29ff:fea8:e174]...fe80::20c:29ff:feb2:ae2f[fe80::20c:29ff:feb2:ae2f]<o:p></o:p></p>
<p class="MsoPlainText">snbi_new_ipv6[1]: IKEv2 SPIs: 608f1bced89f05fa_i 705b6afabeeaafd6_r*, pre-shared key reauthentication in 23 hours<o:p></o:p></p>
<p class="MsoPlainText">snbi_new_ipv6[1]: IKE proposal: AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_512/MODP_1024<o:p></o:p></p>
<p class="MsoPlainText">snbi_new_ipv6{1}: INSTALLED, TRANSPORT, reqid 1, ESP SPIs: c9966614_i cffeac08_o<o:p></o:p></p>
<p class="MsoPlainText">snbi_new_ipv6{1}: AES_CBC_128, 436 bytes_i (7 pkts, 3s ago), 436 bytes_o (7 pkts, 3s ago), rekeying in 55 minutes<o:p></o:p></p>
<p class="MsoPlainText">snbi_new_ipv6{1}: fe80::20c:29ff:fea8:e174/128 === fe80::20c:29ff:feb2:ae2f/128<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><b>I want Only GRE packets on eth1 should get encrypt, So I added<o:p></o:p></b></p>
<p class="MsoPlainText"><b><o:p> </o:p></b></p>
<p class="MsoPlainText"><b>Code:<o:p></o:p></b></p>
<p class="MsoPlainText"><b> leftsubnet=%dynamic<span style="background:yellow;mso-highlight:yellow">[gre]</span><o:p></o:p></b></p>
<p class="MsoPlainText"><b> rightsubnet=%dynamic<span style="background:yellow;mso-highlight:yellow">[gre]</span><o:p></o:p></b></p>
<p class="MsoPlainText"><b> type=transport<o:p></o:p></b></p>
<p class="MsoPlainText"><b><o:p> </o:p></b></p>
<p class="MsoPlainText"><b><span style="color:#C0504D">But now,Packets are not getting encrypted and also ping is not working.<o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><o:p> </o:p></b></p>
<p class="MsoPlainText"><b>Listening IP addresses:<o:p></o:p></b></p>
<p class="MsoPlainText"><b> 10.64.69.118<o:p></o:p></b></p>
<p class="MsoPlainText"><b> 2001:db8:0:f101::2<o:p></o:p></b></p>
<p class="MsoPlainText"><b> fd08:2eef:c2ee:0:aabb:cc00:c900:11<o:p></o:p></b></p>
<p class="MsoPlainText"><b> fd08:2eef:c2ee:0:aabb:cc00:c900:31<o:p></o:p></b></p>
<p class="MsoPlainText"><b> fd08:2fff:c2ee:0:aabb:cc00:c900:2<o:p></o:p></b></p>
<p class="MsoPlainText"><b>Connections:<o:p></o:p></b></p>
<p class="MsoPlainText"><b>snbi_new_ipv6: fe80::20c:29ff:fea8:e174%eth1...fe80::20c:29ff:feb2:ae2f%eth1 IKEv2<o:p></o:p></b></p>
<p class="MsoPlainText"><b>snbi_new_ipv6: local: [fe80::20c:29ff:fea8:e174] uses pre-shared key authentication<o:p></o:p></b></p>
<p class="MsoPlainText"><b>snbi_new_ipv6: remote: [fe80::20c:29ff:feb2:ae2f] uses pre-shared key authentication<o:p></o:p></b></p>
<p class="MsoPlainText"><b>snbi_new_ipv6: child: dynamic[gre] === dynamic[gre] TRANSPORT<o:p></o:p></b></p>
<p class="MsoPlainText"><b>Security Associations (1 up, 0 connecting):<o:p></o:p></b></p>
<p class="MsoPlainText"><b>snbi_new_ipv6[1]: ESTABLISHED 56 seconds ago, fe80::20c:29ff:fea8:e174[fe80::20c:29ff:fea8:e174]...fe80::20c:29ff:feb2:ae2f[fe80::20c:29ff:feb2:ae2f]<o:p></o:p></b></p>
<p class="MsoPlainText"><b>snbi_new_ipv6[1]: IKEv2 SPIs: 4aabd666d01b2aae_i 76b8b8d4769906e9_r*, pre-shared key reauthentication in 23 hours<o:p></o:p></b></p>
<p class="MsoPlainText"><b>snbi_new_ipv6[1]: IKE proposal: AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_512/MODP_1024<o:p></o:p></b></p>
<p class="MsoPlainText"><b>snbi_new_ipv6{1}: INSTALLED, TRANSPORT, reqid 1, ESP SPIs: c7f2305d_i cb2e9d34_o<o:p></o:p></b></p>
<p class="MsoPlainText"><b>snbi_new_ipv6{1}: AES_CBC_128, 0 bytes_i, 0 bytes_o, rekeying in 53 minutes<o:p></o:p></b></p>
<p class="MsoPlainText"><b>snbi_new_ipv6{1}: fe80::20c:29ff:fea8:e174/128<span style="background:yellow;mso-highlight:yellow">[gre</span>] === fe80::20c:29ff:feb2:ae2f/128[<span style="background:yellow;mso-highlight:yellow">gre</span>]<o:p></o:p></b></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks,<o:p></o:p></p>
<p class="MsoPlainText">Sindhu<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: Noel Kuntze [mailto:noel@familie-kuntze.de] <br>
Sent: Wednesday, October 07, 2015 4:37 PM<br>
To: Sindhu S. (sins); users@lists.strongswan.org<br>
Subject: Re: [strongSwan] Reg : Protocal specific encryption in Strongswan 5.3</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----BEGIN PGP SIGNED MESSAGE-----<o:p></o:p></p>
<p class="MsoPlainText">Hash: SHA256<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Hello Sindhu,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">A good first step is change your ESP<o:p></o:p></p>
<p class="MsoPlainText">settings to the default value<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> esp=aes,sha!<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> snbi_new_ipv6{1}: fe80::20c:29ff:fea8:e174/128[gre] === fe80::20c:29ff:feb2:ae2f/128[gre]<o:p></o:p></p>
<p class="MsoPlainText">The tunnel is up.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">That's probably no longer a configuration issue.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">- -- <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Mit freundlichen Grüßen/Kind Regards,<o:p></o:p></p>
<p class="MsoPlainText">Noel Kuntze<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">GPG Key ID: 0x63EC6658<o:p></o:p></p>
<p class="MsoPlainText">Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----BEGIN PGP SIGNATURE-----<o:p></o:p></p>
<p class="MsoPlainText">Version: GnuPG v2<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">iQIcBAEBCAAGBQJWFPzSAAoJEDg5KY9j7GZYjMAP/11z1u/UHFJ1Szg7YUISSkLO<o:p></o:p></p>
<p class="MsoPlainText">WRYp5M3taxa0BUo5U6sdnPE43WhUkNk3nEKg6yP77LziecfYKKiPkH0oYwq30/3N<o:p></o:p></p>
<p class="MsoPlainText">lXqrLK9bZdmd0LTayUN7hmJgavpLTB4GO/7gGzq/xLWzwSE+eoPrZY4Q4dvFmfa6<o:p></o:p></p>
<p class="MsoPlainText">izIkJT5/aAKklDMfZ2PmCtD6R5qoijxgwnpqvHYO4zjWZ/3/31Zc6mUFu/lVNNp4<o:p></o:p></p>
<p class="MsoPlainText">zXeXaaU+DKKktyKwbUiVGZ/K6NScAfK6rxw1RTH8jRAc08rRg71xMU4/skmRxFjE<o:p></o:p></p>
<p class="MsoPlainText">DsGxRMLWDGtxzXwZZGRSn43ucNUh1R0Xqw0aXcRGopHhRrjuYex8lpd5sY+MCO1n<o:p></o:p></p>
<p class="MsoPlainText">zbCDunE6xFeHZb3WywlRsCd+qiidkOFyYIh4gDwzUQyD9lEwj4De7B9E2Org5D7l<o:p></o:p></p>
<p class="MsoPlainText">iNJhLw0s5T2nUYliwf0gPon4FKX8PF/Is8kR7qyjGMqsSwRFgTOLEeiPMcRwvkx6<o:p></o:p></p>
<p class="MsoPlainText">wUVR/WY5mIG2s/7daUXYTtkao2dRhnZRbWta5Ghjm8Mp0l0q6D9tvQu/KnXiwcEH<o:p></o:p></p>
<p class="MsoPlainText">Zw9EeQnxeEmHK5cCU9YHecO6xDdzOnGvJ45RQXRPqR7BZnb2kjrbs66zML4qZfOk<o:p></o:p></p>
<p class="MsoPlainText">K8eQNQVCSHxZ9y4X5s5XDXfJpzMgGKRjijWqvEu2p9166vRlpXzz3XuiMQS7Q58Y<o:p></o:p></p>
<p class="MsoPlainText">xqWqPdfvU5qvXWOWyv7w<o:p></o:p></p>
<p class="MsoPlainText">=dKIk<o:p></o:p></p>
<p class="MsoPlainText">-----END PGP SIGNATURE-----<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
</body>
</html>