<div dir="ltr">Hi Mirko,<div><br></div><div>Thanks for the reply.</div><div>I created loopback interface on each gateway and below is the required info:</div><div><br></div><div><div><div>GW_A:</div><div><br></div><div>****Config*****</div><div>conn ipsec-local</div><div> left=10.1.1.216</div><div> esp=aes128-sha256</div><div><br></div><div>conn ipsec-10.1.1.218</div><div> also=ipsec-local</div><div> leftauth=psk</div><div> right=10.1.1.218</div><div> rightauth=psk</div><div> keyexchange=ikev2</div><div> type=tunnel</div><div> auto=start</div><div><br></div><div>*****ifconfig lo:1****</div><div>lo:1 Link encap:Local Loopback </div><div> inet addr:<b>1.1.1.1</b> Mask:255.255.255.0</div><div> UP LOOPBACK RUNNING MTU:65536 Metric:1</div><div><br></div><div>*****route -n*****</div><div>Kernel IP routing table</div><div>Destination Gateway Genmask Flags Metric Ref Use Iface</div><div>0.0.0.0 10.1.1.1 0.0.0.0 UG 0 0 0 br_if</div><div><b>2.2.2.2 10.1.1.218 255.255.255.255 UGH 0 0 0 br_if</b></div><div>10.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br_if</div><div>10.1.1.218 10.1.1.218 255.255.255.255 UGH 0 0 0 br_if</div><div> </div><div><br></div><div><br></div><div>GW_B:</div><div><br></div><div>****Config****</div><div>conn ipsec-local</div><div> left=10.1.1.218</div><div> esp=aes128-sha256</div><div><br></div><div>conn ipsec-10.1.1.216</div><div> also=ipsec-local</div><div> leftauth=psk</div><div> right=10.1.1.216</div><div> rightauth=psk</div><div> keyexchange=ikev2</div><div> type=tunnel</div><div> auto=start</div><div><br></div><div>****ifconfig lo:1****</div><div>lo:1 Link encap:Local Loopback </div><div> inet addr:<b>2.2.2.2</b> Mask:255.255.255.0</div><div> UP LOOPBACK RUNNING MTU:65536 Metric:1</div><div><br></div><div>****route -n****</div><div>Kernel IP routing table</div><div>Destination Gateway Genmask Flags Metric Ref Use Iface</div><div>0.0.0.0 10.1.1.1 0.0.0.0 UG 0 0 0 br_if</div><div><b>1.1.1.1 10.1.1.216 255.255.255.255 UGH 0 0 0 br_if</b></div><div>10.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br_if</div><div>10.1.1.216 10.1.1.216 255.255.255.255 UGH 0 0 0 br_if</div><div><br></div><div>Logs:</div><div>*****</div><div><br></div><div>****tcpdump -i br_if esp****</div><div><br></div><div>GW_A#ping 10.1.1.218</div><div>PING 10.1.1.218 (10.1.1.218) 56(84) bytes of data.</div><div>64 bytes from <a href="http://10.1.1.218">10.1.1.218</a>: icmp_seq=1 ttl=64 time=1.84 ms</div><div>64 bytes from <a href="http://10.1.1.218">10.1.1.218</a>: icmp_seq=2 ttl=64 time=0.629 ms</div><div><br></div><div>GW_B#tcpdump -i br_if esp</div><div>tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</div><div>listening on br_if, link-type EN10MB (Ethernet), capture size 65535 bytes</div><div>00:19:01.098941 IP test.local > test-2.local: ESP(spi=0xc2511019,seq=0x1), length 136</div><div>00:19:01.099243 IP test-2.local > test.local: ESP(spi=0xcd2a2bdb,seq=0x1), length 136</div><div>00:19:02.099627 IP test.local > test-2.local: ESP(spi=0xc2511019,seq=0x2), length 136</div><div>00:19:02.099888 IP test-2.local > test.local: ESP(spi=0xcd2a2bdb,seq=0x2), length 136</div><div><br></div><div>GW_A#ping -I 1.1.1.1 2.2.2.2</div><div>PING 2.2.2.2 (2.2.2.2) from 1.1.1.1 : 56(84) bytes of data.</div><div>64 bytes from <a href="http://2.2.2.2">2.2.2.2</a>: icmp_seq=1 ttl=64 time=1.42 ms</div><div>64 bytes from <a href="http://2.2.2.2">2.2.2.2</a>: icmp_seq=2 ttl=64 time=0.257 ms</div><div>64 bytes from <a href="http://2.2.2.2">2.2.2.2</a>: icmp_seq=3 ttl=64 time=0.271 ms</div><div><br></div><div>GW_B#tcpdump -i br_if esp</div><div>tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</div><div>listening on br_if, link-type EN10MB (Ethernet), capture size 65535 bytes</div><div>^C</div><div>0 packets captured</div><div>0 packets received by filter</div><div>0 packets dropped by kernel</div></div></div><div><br></div><div><br></div><div>Regards,</div><div>Sarat</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Jul 23, 2016 at 4:11 PM, Mirko Parthey <span dir="ltr"><<a href="mailto:mirko.parthey@web.de" target="_blank">mirko.parthey@web.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Tue, Jul 05, 2016 at 05:40:43PM +0530, Sarat Vajrapu wrote:<br>
> I am new to strongswan and trying to protect host-host traffic using ipsec<br>
> tunnel mode. However I observe that only the traffic between endpoints are<br>
> protected and not complete traffic.<br>
><br>
</span><span class="">> Topology:<br>
><br>
> <<<<<LAN1>>>> ------- GW_A <---------- internet---------------> GW_B<br>
> -------------------- <<<<<LAN2>>>>>><br>
><br>
</span>> [...]<br>
<span class="">> Can you please help me with this - any config addition/any change in routing<br>
> table?<br>
<br>
</span>Hi Sarat,<br>
<br>
Please show us your strongSwan config and gateway routing tables,<br>
if possible.<br>
<br>
Regards,<br>
Mirko<br>
</blockquote></div><br></div>