<div dir="ltr"><div><div><div>Hi Noel,<br><br></div>I have made changes and it is much closer. I thought the leftsourceip was arbitrary like assigning a loopback interface as source in Cisco world, so thanks for the clarification. I added a second spoke and can now pass traffic when initiated from the hub to the spoke but not vice versa, nor spoke to spoke. iptables is set to ACCEPT as policy for FORWARD and INPUT on all devices for testing purposes.<br><br>conn rw-eap<br> esp=aes128-sha256!<br> ike=aes128-sha256-modp2048!<br> left=172.30.5.161<br> leftsubnet=<a href="http://172.21.0.0/23" target="_blank">172.21.0.0/23</a><br> #leftsourceip=172.21.0.1<br> leftid=@moon<a href="http://AwsEastNat1.qoya.io" target="_blank"></a><br> leftcert=/etc/ipsec.d/public/<wbr>peer.der<br> leftauth=pubkey<br> leftfirewall=yes<br> rightid=*@<a href="http://qoya.io" target="_blank">qoya.io</a><br> rightauth=eap-radius<br> rightsourceip=%radius<br> rightsendcert=never<br> eap_identity=%any<br> right=%any<br> #rightsubnet=%any<br> auto=add<br><br></div>root@ip-172-30-5-161:/etc# ip xfrm policy<br>src <a href="http://172.21.0.26/32">172.21.0.26/32</a> dst <a href="http://172.21.0.0/23">172.21.0.0/23</a><br> dir fwd priority 2855 ptype main<br> tmpl src 24.11.199.101 dst 172.30.5.161<br> proto esp reqid 1 mode tunnel<br>src <a href="http://172.21.0.26/32">172.21.0.26/32</a> dst <a href="http://172.21.0.0/23">172.21.0.0/23</a><br> dir in priority 2855 ptype main<br> tmpl src 24.11.199.101 dst 172.30.5.161<br> proto esp reqid 1 mode tunnel<br>src <a href="http://172.21.0.0/23">172.21.0.0/23</a> dst <a href="http://172.21.0.26/32">172.21.0.26/32</a><br> dir out priority 2855 ptype main<br> tmpl src 172.30.5.161 dst 24.11.199.101<br> proto esp reqid 1 mode tunnel<br>src <a href="http://172.21.0.25/32">172.21.0.25/32</a> dst <a href="http://172.21.0.0/23">172.21.0.0/23</a><br> dir fwd priority 2855 ptype main<br> tmpl src 24.11.199.101 dst 172.30.5.161<br> proto esp reqid 2 mode tunnel<br>src <a href="http://172.21.0.25/32">172.21.0.25/32</a> dst <a href="http://172.21.0.0/23">172.21.0.0/23</a><br> dir in priority 2855 ptype main<br> tmpl src 24.11.199.101 dst 172.30.5.161<br> proto esp reqid 2 mode tunnel<br>src <a href="http://172.21.0.0/23">172.21.0.0/23</a> dst <a href="http://172.21.0.25/32">172.21.0.25/32</a><br> dir out priority 2855 ptype main<br> tmpl src 172.30.5.161 dst 24.11.199.101<br> proto esp reqid 2 mode tunnel<br><br>root@ip-172-30-5-161:/etc# ip route sho table 220<br>172.21.0.25 via 172.30.5.1 dev eth0 proto static src 172.21.0.2<br>172.21.0.26 via 172.30.5.1 dev eth0 proto static src 172.21.0.2<br><br>root@ip-172-30-5-161:/etc# ping 172.21.0.25<br>PING 172.21.0.25 (172.21.0.25) 56(84) bytes of data.<br>64 bytes from <a href="http://172.21.0.25">172.21.0.25</a>: icmp_seq=1 ttl=64 time=35.5 ms<br><br>root@ip-172-30-5-161:/etc# ping 172.21.0.26<br>PING 172.21.0.26 (172.21.0.26) 56(84) bytes of data.<br>64 bytes from <a href="http://172.21.0.26">172.21.0.26</a>: icmp_seq=1 ttl=64 time=35.2 ms<br><br><br></div>Client/Spoke:<br><br>conn AWS-EAST-NAT1-IKE2-TUN<br> esp=aes128-sha256!<br> ike=aes128-sha256-modp2048!<br> left=%any<br> #leftsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a><br> leftid=<a href="mailto:HARDA-CORP4@qoya.io">HARDA-CORP4@qoya.io</a><br> eap_identity=HARDA-CORP4<br> leftauth=eap<br> leftsourceip=%config4<br> leftfirewall=yes<br> right=54.209.117.209<br> rightid=@<a href="http://AwsEastNat1.qoya.io">AwsEastNat1.qoya.io</a><br> rightcert=/etc/ipsec.d/certs/peerAwsEastNat1Cert.der<br> rightrsasigkey=/etc/ipsec.d/public/peerAwsEastNat1Key.der<br> rightsubnet=<a href="http://172.21.0.0/23">172.21.0.0/23</a><br> #rightsourceip=%config<br> rightauth=pubkey<br> auto=start<br><br>root@Need-Config:/etc# ip xfrm policy<br>src <a href="http://172.21.0.0/23">172.21.0.0/23</a> dst <a href="http://172.21.0.26/32">172.21.0.26/32</a><br> dir fwd priority 185920<br> tmpl src 54.209.117.209 dst 10.100.0.116<br> proto esp reqid 1 mode tunnel<br>src <a href="http://172.21.0.0/23">172.21.0.0/23</a> dst <a href="http://172.21.0.26/32">172.21.0.26/32</a><br> dir in priority 185920<br> tmpl src 54.209.117.209 dst 10.100.0.116<br> proto esp reqid 1 mode tunnel<br>src <a href="http://172.21.0.26/32">172.21.0.26/32</a> dst <a href="http://172.21.0.0/23">172.21.0.0/23</a><br> dir out priority 185920<br> tmpl src 10.100.0.116 dst 54.209.117.209<br> proto esp reqid 1 mode tunnel<br><br><br><div><div>root@Need-Config:/etc# ping 172.21.0.2<br>PING 172.21.0.2 (172.21.0.2): 56 data bytes<br>^C^C<br>--- 172.21.0.2 ping statistics ---<br>4 packets transmitted, 0 packets received, 100% packet loss<br>root@Need-Config:/etc# ping 172.21.0.25<br>PING 172.21.0.25 (172.21.0.25): 56 data bytes<br>^C<br>--- 172.21.0.25 ping statistics ---<br>3 packets transmitted, 0 packets received, 100% packet loss<br>root@Need-Config:/etc#<br><br><div><br></div><div>Thanks,<br><br></div><div>Chris<br></div><div><br><br></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 5, 2016 at 11:30 AM, C Babcock <span dir="ltr"><<a href="mailto:qoyagoogs@gmail.com" target="_blank">qoyagoogs@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div>Hi Noel,<br><br></div>Thank for the kind response. Something happened when I copy/pasted. <br><br></div>This:<br><br>> leftsubnet=<a href="http://172.21.0.0/23" rel="noreferrer" target="_blank">172.21.0.0/23</a><br>
> leftsourceip=172.21.0.<br><br></div>Actually looks like this:<br><br>> leftsubnet=<a href="http://172.21.0.0/23" rel="noreferrer" target="_blank">172.21.0.0/23</a><br>
> leftsourceip=172.21.0.2<br><br></div>I dont know why the 2 got cut off.<br><br></div>I added this when I could get TS to accept.<br><div><br>> conn AWS-EAST-NAT1-IKE2-TUN<br>
> leftsubnet=%any<br><br></div><div>I will make the other changes you suggested. Thanks.<span class="HOEnZb"><font color="#888888"><br><br></font></span></div><span class="HOEnZb"><font color="#888888"><div>CB<br></div></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 5, 2016 at 5:46 AM, Noel Kuntze <span dir="ltr"><<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello Chris,<br>
<span><br>
On 05.12.2016 05:23, C Babcock wrote:<br>
> however I cant pass traffic to the server from the client and vice versa.<br>
</span>That is because nearly every single setting in your configuration related to the TS is invalid.<br>
<br>
> leftsubnet=<a href="http://172.21.0.0/23" rel="noreferrer" target="_blank">172.21.0.0/23</a><br>
> leftsourceip=172.21.0.<br>
<br>
First of all, you're assigning virtual IPs to the wrong side.<br>
<br>
Then the value of leftsourceip is invalid. It must be the subnet that you want to assign virtual IPs from.<br>
Do not set leftsubnet, if you already set leftsourceip. Vice versa for rightsubnet and rightsourceip.<br>
<br>
> rightsubnet=%any<br>
That's invalid, too.<br>
<span><br>
> ip xfrm policy<br>
> src <a href="http://0.0.0.0/32" rel="noreferrer" target="_blank">0.0.0.0/32</a> dst <a href="http://172.21.0.0/23" rel="noreferrer" target="_blank">172.21.0.0/23</a><br>
> dir fwd priority 2855 ptype main<br>
> tmpl src 24.11.199.101 dst 172.30.5.161<br>
> proto esp reqid 2 mode tunnel<br>
> src <a href="http://0.0.0.0/32" rel="noreferrer" target="_blank">0.0.0.0/32</a> dst <a href="http://172.21.0.0/23" rel="noreferrer" target="_blank">172.21.0.0/23</a><br>
> dir in priority 2855 ptype main<br>
> tmpl src 24.11.199.101 dst 172.30.5.161<br>
> proto esp reqid 2 mode tunnel<br>
> src <a href="http://172.21.0.0/23" rel="noreferrer" target="_blank">172.21.0.0/23</a> dst <a href="http://0.0.0.0/32" rel="noreferrer" target="_blank">0.0.0.0/32</a><br>
> dir out priority 2855 ptype main<br>
> tmpl src 172.30.5.161 dst 24.11.199.101<br>
> proto esp reqid 2 mode tunnel<br>
<br>
</span>Those nonsensical policies are the result of your invalid configuration.<br>
<span><br>
><br>
> ip route show table 220<br>
> 0.0.0.0 via 172.30.5.1 dev eth0 proto static src 172.21.0.2<br>
<br>
</span>Result of the nonsensical policies.<br>
<br>
> conn AWS-EAST-NAT1-IKE2-TUN<br>
> leftsubnet=%any<br>
<br>
Invalid setting. Don't set it when using leftsourceip (Unless you know what you're doing, which you obviously don't).<br>
<span class="m_-6882415495381422016HOEnZb"><font color="#888888"><br>
<br>
<br>
--<br>
<br>
Mit freundlichen Grüßen/Kind Regards,<br>
Noel Kuntze<br>
<br>
GPG Key ID: 0x63EC6658<br>
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
<br>
<br>
</font></span></blockquote></div><br></div>
</div></div></blockquote></div><br></div>