<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div class=""><div><blockquote type="cite" class=""><div class="">Le 12 juil. 2018 à 15:43, Jean-Daniel Dupas <<a href="mailto:jddupas@xooloo.com" class="">jddupas@xooloo.com</a>> a écrit :</div><br class="Apple-interchange-newline"><div class=""><div class="">Hello,<br class=""><br class="">I'm trying to setup an active-active HA cluster. Actually, I'm close to have a full working setup, but I have a blocking issue.<br class=""><br class="">I have installed a custom kernel (4.15.x family), and setup the CLUSTERIP as described in the HA guide ( <a href="https://wiki.strongswan.org/projects/strongswan/wiki/HighAvailability" class="">https://wiki.strongswan.org/projects/strongswan/wiki/HighAvailability</a> )<br class=""><br class="">Both my nodes receive the traffic, and they properly managed the cluster IP to handle only half of the packets. <br class="">When I'm establishing a session, only one node handle it (as expected), and the other one setup a passive IKE_SA.<br class=""><br class="">My problem is that once the session is up, sometimes, this is the passive node (for that session) that takes over the IPSec traffic and the active node completely ignore it.<br class="">If I sniff the incoming traffic (tcpdump), the decrypted traffic is only detected on the node that setup a passive IKE_SA, and not on the node with the active IKE_SA.<br class=""><br class="">To make it clear, telling I have 2 servers: Alice and Moon. The IKE session is established on moon, and a passive session is created on Alice, but then the decrypted traffic only show up on Alice.<br class="">As Alice is a passive node and don't have iptables entry and routes created to handle that traffic, it rejects it (as expected).<br class=""><br class="">Does anyone know what can cause that inconsistency ? <br class=""><br class="">My iptable rules look like this:<br class=""><br class="">-A INPUT -i enp1s1 -d 1.2.3.4 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:5e:00:00:20 --total-nodes 2 --local-node 0<br class=""><br class="">I don't think this is relevant, but I'm using strongswan systemd 5.6.2 (swanctl) on Ubuntu 18.04.<br class=""><br class="">Thanks<br class=""></div></div></blockquote><br class=""></div><div>I found an hint in the swanctl logs:<div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(244, 244, 244); background-color: rgba(0, 0, 0, 0.8);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class="">07[CFG] installed HA CHILD_SA net{3} 0.0.0.0/0 ::/0 === 10.192.3.3/32 (segment in: 2*, out: 1)</span></div><div><br class=""></div><div>strongswan explicitly choose different segments for input and output. The segment where the connection was established here is the segment 1.</div><div><br class=""></div><div>As it defines segment 2 for input traffic, it obviously does not works. Is there some settings to force strongswan to always use the segment who own the connection for input and output traffic ?</div></div><div><br class=""></div><div><br class=""></div></div><br class=""></div><div class=""><br class=""></div></body></html>