<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Thanks Felipe! I had checked that out in the past and there are no values that are set that could be used in in the script for the same effect (the static side tunnel endpoint address).<div class=""><br class=""></div><div class="">There are two things I am wondering at this point:</div><div class=""><br class=""></div><div class=""><ol class="MailOutline"><li class="">Getting this working probably has something to do with the code in <a href="https://git.strongswan.org/?p=strongswan.git;a=blob;f=src/libcharon/sa/ike_sa.c;h=3d576a0e89a67b6e76e636ed744e88bdbec3a551;hb=HEAD#l948-979" class="">https://git.strongswan.org/?p=strongswan.git;a=blob;f=src/libcharon/sa/ike_sa.c;h=3d576a0e89a67b6e76e636ed744e88bdbec3a551;hb=HEAD#l948-979</a>. As I have seen an error where “site-1-static-ip has both left- and rightsourceip, but IKE can negotiate one virtual IP only, ignoring local virtual IP”, I clearly need to specify the leftsourceip on the static side. But the IP is no longer virtual in that case. And when it is no longer virtual, the code at <a href="https://git.strongswan.org/?p=strongswan.git;a=blob;f=src/libcharon/plugins/updown/updown_listener.c;h=bbefd6a027ceca473da327939da2f70aced887c6;hb=HEAD#l182" class="">https://git.strongswan.org/?p=strongswan.git;a=blob;f=src/libcharon/plugins/updown/updown_listener.c;h=bbefd6a027ceca473da327939da2f70aced887c6;hb=HEAD#l182</a> never finds it. </li><li class="">Alternatively, maybe I should drop this idea of using Strongswan setting up VTIs. Maybe Bird can deal with tunnels that do not have VTIs and I just don’t understand that construction. </li></ol><div class=""><br class=""></div><div class="">I am worried that I will also lose future compatibility with VTI-capable routers (like Cisco et al) if I go with #2. I don’t have any present need for doing so, but if I did, converting everything would be a lot of tears.</div><div><br class=""></div><div>It seems like what I am trying to do in #1 is not possible given that addresses pushed through the updown plugin can only read from IPs found in <span style="font-family: Consolas, "Bitstream Vera Sans Mono", monospace; font-size: 13px; white-space: pre-wrap; background-color: rgb(248, 248, 248);" class="">ike_sa_t->my_vips</span>.</div><div><br class=""></div><div>Brian</div><div><br class=""></div><div><blockquote type="cite" class=""><div class="">On Mar 2, 2019, at 8:22 AM, Felipe Arturo Polanco <<a href="mailto:felipeapolanco@gmail.com" class="">felipeapolanco@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="auto" class="">You can extract the env variables information by using the "set" command, use a temporary updown script that has the following "set > /tmp/output", after establishing the connection, check that output file both in initiator and responder and see if the values are as expected, if they are, try to reproduce the script by typing each command one by one in the console and see its behavior.<div dir="auto" class=""><br class=""></div><div dir="auto" class="">Remember to disable the updown script in strongswan when running it manually. </div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">Sent from mobile. </div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Mar 2, 2019, 2:22 AM Brian Topping <<a href="mailto:brian.topping@gmail.com" class="">brian.topping@gmail.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class="">Hi Felipe,<div class=""><br class=""></div><div class="">That use of `left|rightsubnet` was a huge help.</div><div class=""><br class=""></div><div class="">In an effort to automate the address assignment for a larger network (same theme as the OSPF), I’ve been using the `leftupdown` script in <a href="https://wiki.strongswan.org/projects/strongswan/wiki/RouteBasedVPN#Connection-specific-VTI-Devices" target="_blank" rel="noreferrer" class="">https://wiki.strongswan.org/projects/strongswan/wiki/RouteBasedVPN#Connection-specific-VTI-Devices</a>. </div><div class=""><br class=""></div><div class="">So I’ve updated it as shown:</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class="">=============================</div><div class=""><div class="">Dynamic:</div><div class="">conn site-2-dynamic-ip</div></div></div></div></blockquote><span class="m_6784992401950315231Apple-tab-span" style="white-space:pre-wrap"> </span> mark=%unique<br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class=""><div class=""><span style="white-space:pre-wrap" class=""> </span>left=%defaultroute</div></div></div></div></blockquote> leftsourceip=%config4<br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class=""><div class=""><span style="white-space:pre-wrap" class=""> </span>leftsubnet=<a href="http://10.10.0.0/22,10.9.255.252/30" target="_blank" rel="noreferrer" class="">10.10.0.0/22,10.9.255.252/30</a></div><div class=""><span style="white-space:pre-wrap" class=""> </span>leftfirewall=no</div></div></div></div></blockquote> leftupdown=/etc/strongswan.d/ipsec-vti.sh</div><div class=""> right=st.at.ic.ip</div><div class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class=""><div class=""><span style="white-space:pre-wrap" class=""> </span>rightsubnet=<a href="http://10.10.4.0/22,10.9.255.252/30" target="_blank" rel="noreferrer" class="">10.10.4.0/22,10.9.255.252/30</a></div><div class=""><span style="white-space:pre-wrap" class=""> </span>rightid=%<a href="http://specific.example.com/" target="_blank" rel="noreferrer" class="">specific.example.com</a></div><div class=""><span style="white-space:pre-wrap" class=""> </span>auto=add</div><div class=""><br class=""></div><div class="">Static:</div><div class="">conn site-1-static-ip</div></div></div></div></blockquote> mark=%unique<br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class=""><div class=""><span style="white-space:pre-wrap" class=""> </span>left=st.at.ic.ip</div><div class=""><span style="white-space:pre-wrap" class=""> </span>leftsubnet=<a href="http://10.10.4.0/22,10.9.255.252/30" target="_blank" rel="noreferrer" class="">10.10.4.0/22,10.9.255.252/30</a></div><div class=""><span style="white-space:pre-wrap" class=""> </span>leftid=%<a href="http://specific.example.com/" target="_blank" rel="noreferrer" class="">specific.example.com</a></div><div class=""><span style="white-space:pre-wrap" class=""> </span>leftfirewall=no</div></div></div></div></blockquote><div class=""> leftsourceip=10.9.255.253 </div><div class=""> leftupdown=/etc/strongswan/ipsec-vti.sh</div><blockquote type="cite" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class=""><div class=""><span style="white-space:pre-wrap" class=""> </span>right=%any</div></div></div></div></blockquote> rightsourceip=10.9.255.254<br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class=""><div class=""><span style="white-space:pre-wrap" class=""> </span>rightsubnet=<a href="http://10.10.0.0/22,10.9.255.252/30" target="_blank" rel="noreferrer" class="">10.10.0.0/22,10.9.255.252/30</a></div><div class=""><span style="white-space:pre-wrap" class=""> </span>auto=add</div></div><div class="">===============================</div></div></div></blockquote><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class=""><br class=""></div><div class="">With this configuration, I get full SA and IKE negotiation including TS and dynamic side tunnel configuration:</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><div class="">root@dynamic:/# ip a show vti1</div><div class="">49: vti1@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1472 qdisc noqueue state UNKNOWN group default qlen 1000</div><div class=""> link/ipip dy.na.mi.cip peer st.at.ic.ip</div></blockquote><blockquote type="cite" class=""><div class=""> inet <a href="http://10.9.255.254/32" target="_blank" rel="noreferrer" class="">10.9.255.254/32</a> scope global vti1</div><div class=""> valid_lft forever preferred_lft forever</div></blockquote><div class=""><div class=""><br class=""></div></div></div><div class="">On the static side, I get an error from the script:</div><div class=""><blockquote type="cite" class="">04[CHD] updown: /etc/strongswan/ipsec-vti.sh: line 15: PLUTO_MY_SOURCEIP: unbound variable</blockquote><br class=""></div><div class="">I initially had the same problem on the dynamic side, but the addition of `leftsourceip=%config4` and `rightsourceip` on the static side resolved that.</div><div class=""><br class=""></div><div class="">Is there something I am missing to avoid the "PLUTO_MY_SOURCEIP: unbound variable” problem?</div><div class=""><br class=""></div><div class="">Thanks so much for your insight!</div></div></div></div></div></div></blockquote></div>
</div></blockquote></div><br class=""></div></body></html>