<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hi,</p>
<p>VTI-configured servers (OS CentOS7 updated) according to
<a class="moz-txt-link-freetext" href="https://wiki.strongswan.org/projects/strongswan/wiki/RouteBasedVPN">https://wiki.strongswan.org/projects/strongswan/wiki/RouteBasedVPN</a>.
It works.</p>
<p>Pure IPSec. (without L2TPs)<br>
</p>
<p><br>
</p>
<p>But periodically customers (dynamic) possess the same subnet.</p>
<p>There is another guide
<a class="moz-txt-link-freetext" href="https://strongswan.org/testing/testresults4/ikev2/nat-two-rw-mark/index.html">https://strongswan.org/testing/testresults4/ikev2/nat-two-rw-mark/index.html</a>
<br>
</p>
<p>It's not convenient for me this static solution (customers now
approximately 15 and names can be changed).</p>
<p><br>
</p>
<p>Tried to follow
<a class="moz-txt-link-freetext" href="https://wiki.strongswan.org/projects/strongswan/wiki/Connmark">https://wiki.strongswan.org/projects/strongswan/wiki/Connmark</a> ...
recompile with --enable-connmark</p>
<p>Very simple implementation ... but for unknown for me reasons it
has not worked out.</p>
<p>Tried standard CentOS7 (3.10.0-514.6.1.el7.x86_64) kernel and
4.9.5-1.el7.elrepo.x86_64 keeping in mind that<br>
</p>
<p>"<em><strong>Disclaimer:</strong> VTI devices are supported since
the Linux 3.6 kernel, but some important changes were added
later (3.15+). The information below might not be accurate for
older kernel versions.</em>"</p>
<p><br>
</p>
<p>The question: may someone knows the way how to configure marks
"on fly", per customer.</p>
<p><br>
</p>
<pre>--
Best regards
Oleksandr
</pre>
</body>
</html>