<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000066" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 03/23/2018 11:48 AM, Noel Kuntze
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:fe6c0e0a-a045-1f8c-264e-44de0b61f4b9@thermi.consulting">
<blockquote type="cite">
<pre wrap="">Anyone know why CentOS 7.4 with kernel 4.13.0-1.el7.elrepo.x86_64 makes an:
ipsec0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1400
inet6 fe80::8ad2:285b:b89d:44ea prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 500 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
... interface, when ipsec tunnels were supposed to have gone out years ago? Could some of my traffic be getting diverted here? Should this be set up in the firewall?
</pre>
</blockquote>
<pre wrap="">
That's because you're loading kernel-libipsec, which you shouldn't. Disable loading it.
No, nothing is getting diverted there. No, don't set it up, because you're getting rid of it right now.</pre>
</blockquote>
Gotten rid of.<br>
# yum remove strongswan-libipsec<br>
# systemctl restart strongswan-swanctl<br>
No more ipsec0, thankfully.<br>
<br>
<blockquote type="cite"
cite="mid:fe6c0e0a-a045-1f8c-264e-44de0b61f4b9@thermi.consulting">Anyone
know why Strongswan seems to consider this the correct location
for CA certs:
<blockquote type="cite">
<pre wrap="">Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: loading ca certificates from '/etc/strongswan/ipsec.d/cacerts'
... rather than:
Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: loaded certificate 'C=US, O=Quantum, CN=quantum-equities.com CA'
Mar 23 10:40:35 cygnus.darkmatter.org charon-systemd[41093]: 11[CFG] loaded certificate 'C=US, O=Quantum, CN=quantum-equities.com CA'
Mar 23 10:40:36 cygnus.darkmatter.org swanctl[41112]: loaded certificate from '/etc/strongswan/swanctl/x509ca/aries-CAcert.pem'
</pre>
</blockquote>
<pre wrap="">
It's because you're loading the stroke plugin, which you don't need.</pre>
</blockquote>
<br>
Inferentially then it's considering
/etc/strongswan/swanctl/x509ca/aries-Cert.pem, trusted.<br>
<br>
I'd specify plugins but it warns me to be an expert. :j<br>
<br>
<br>
<blockquote type="cite"
cite="mid:fe6c0e0a-a045-1f8c-264e-44de0b61f4b9@thermi.consulting"><br>
<blockquote type="cite">
<pre wrap="">Attached hereto: charon.log and iptables-save. SELinux is Permissive, and no firewall on the IPSec gateway. No change.
</pre>
</blockquote>
<pre wrap="">Those logs are too verbose, again. Please really use the logger configuration from the HelpRequests page.</pre>
</blockquote>
I've always used the loglevels on the HelpRequests page except long
ago. It's in charon.conf as per my pro forma email of today at US
PDT 11:24. Maybe this isn't the right way to set it?<br>
<br>
<blockquote type="cite"
cite="mid:fe6c0e0a-a045-1f8c-264e-44de0b61f4b9@thermi.consulting">
<pre wrap="">Is there anything logged by the kernel in its ring buffer?
And please add the route I previously mentioned. And stop using ifconfig, or generally the net-tools.
Kind regards
Noel</pre>
</blockquote>
The route you'd previously recommended was based on a mis-paste that
I had made. The correct one is in my pro forma email. Stopping
using net-tools, as evidenced by my pro forma email.<br>
<br>
# dmesg<br>
...<br>
[929793.524099] device eth0 entered promiscuous mode<br>
[929818.711290] device eth0 left promiscuous mode<br>
[929841.911470] device eth0 entered promiscuous mode<br>
[929873.259932] device eth0 left promiscuous mode<br>
[929879.411366] device eth0 entered promiscuous mode<br>
[929908.441305] device eth0 left promiscuous mode<br>
[932883.537484] device eth0 entered promiscuous mode<br>
[932918.924082] device eth0 left promiscuous mode<br>
[935175.378065] device ipsec0 entered promiscuous mode<br>
[935403.095266] device ipsec0 left promiscuous mode<br>
[1002948.521841] device eth0 entered promiscuous mode<br>
[1003442.985805] device eth0 left promiscuous mode<br>
[1003452.933593] device eth0 entered promiscuous mode<br>
[1003514.584868] device eth0 left promiscuous mode<br>
[1018988.659360] device eth0 entered promiscuous mode<br>
[1019027.076530] device eth0 left promiscuous mode<br>
[1020862.863531] device eth0 entered promiscuous mode<br>
[1020891.435220] device eth0 left promiscuous mode<br>
[1090454.269266] device eth0 entered promiscuous mode<br>
[1091211.518341] device eth0 left promiscuous mode<br>
<br>
<br>
<br>
<br>
<br>
</body>
</html>