<div dir="ltr">Please recheck how you are getting the environment variables, those values are definitely there.<div><br></div><div>Did you try the exact command I sent on my last email? Put that inside the temporary <span class="gmail-gr_ gmail-gr_91 gmail-gr-alert gmail-gr_spell gmail-gr_inline_cards gmail-gr_run_anim gmail-ContextualSpelling gmail-ins-del gmail-multiReplace" id="gmail-91" style="display:inline;border-bottom:2px solid transparent;background-repeat:no-repeat;color:inherit;font-size:inherit">updown</span> script, put the shebang on the top and make it executable, the output file will contain all environment variables including PLUTO variables.</div><div><br></div><div>From there you can issue each of your commands manually after connection setup and see what specific command is not working.</div><div><br></div><div>I know this works as I set this up for a client some time ago and we faced a similar situation.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Mar 2, 2019 at 6:08 PM Brian Topping <<a href="mailto:brian.topping@gmail.com" target="_blank">brian.topping@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>Thanks Felipe! I had checked that out in the past and there are no values that are set that could be used in in the script for the same effect (the static side tunnel endpoint address).<div><br></div><div>There are two things I am wondering at this point:</div><div><br></div><div><ol class="gmail-m_-6813199994156417795gmail-m_7697670570803360704MailOutline"><li>Getting this working probably has something to do with the code in <a href="https://git.strongswan.org/?p=strongswan.git;a=blob;f=src/libcharon/sa/ike_sa.c;h=3d576a0e89a67b6e76e636ed744e88bdbec3a551;hb=HEAD#l948-979" target="_blank">https://git.strongswan.org/?p=strongswan.git;a=blob;f=src/libcharon/sa/ike_sa.c;h=3d576a0e89a67b6e76e636ed744e88bdbec3a551;hb=HEAD#l948-979</a>. As I have seen an error where “site-1-static-ip has both left- and rightsourceip, but IKE can negotiate one virtual IP only, ignoring local virtual IP”, I clearly need to specify the leftsourceip on the static side. But the IP is no longer virtual in that case. And when it is no longer virtual, the code at <a href="https://git.strongswan.org/?p=strongswan.git;a=blob;f=src/libcharon/plugins/updown/updown_listener.c;h=bbefd6a027ceca473da327939da2f70aced887c6;hb=HEAD#l182" target="_blank">https://git.strongswan.org/?p=strongswan.git;a=blob;f=src/libcharon/plugins/updown/updown_listener.c;h=bbefd6a027ceca473da327939da2f70aced887c6;hb=HEAD#l182</a> never finds it. </li><li>Alternatively, maybe I should drop this idea of using Strongswan setting up VTIs. Maybe Bird can deal with tunnels that do not have VTIs and I just don’t understand that construction. </li></ol><div><br></div><div>I am worried that I will also lose future compatibility with VTI-capable routers (like Cisco et al) if I go with #2. I don’t have any present need for doing so, but if I did, converting everything would be a lot of tears.</div><div><br></div><div>It seems like what I am trying to do in #1 is not possible given that addresses pushed through the updown plugin can only read from IPs found in <span style="font-family:Consolas,"Bitstream Vera Sans Mono",monospace;font-size:13px;white-space:pre-wrap;background-color:rgb(248,248,248)">ike_sa_t->my_vips</span>.</div><div><br></div><div>Brian</div><div><br></div><div><blockquote type="cite"><div>On Mar 2, 2019, at 8:22 AM, Felipe Arturo Polanco <<a href="mailto:felipeapolanco@gmail.com" target="_blank">felipeapolanco@gmail.com</a>> wrote:</div><br class="gmail-m_-6813199994156417795gmail-m_7697670570803360704Apple-interchange-newline"><div><div dir="auto">You can extract the env variables information by using the "set" command, use a temporary updown script that has the following "set > /tmp/output", after establishing the connection, check that output file both in initiator and responder and see if the values are as expected, if they are, try to reproduce the script by typing each command one by one in the console and see its behavior.<div dir="auto"><br></div><div dir="auto">Remember to disable the updown script in strongswan when running it manually. </div><div dir="auto"><br></div><div dir="auto">Sent from mobile. </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Mar 2, 2019, 2:22 AM Brian Topping <<a href="mailto:brian.topping@gmail.com" target="_blank">brian.topping@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>Hi Felipe,<div><br></div><div>That use of `left|rightsubnet` was a huge help.</div><div><br></div><div>In an effort to automate the address assignment for a larger network (same theme as the OSPF), I’ve been using the `leftupdown` script in <a href="https://wiki.strongswan.org/projects/strongswan/wiki/RouteBasedVPN#Connection-specific-VTI-Devices" rel="noreferrer" target="_blank">https://wiki.strongswan.org/projects/strongswan/wiki/RouteBasedVPN#Connection-specific-VTI-Devices</a>. </div><div><br></div><div>So I’ve updated it as shown:</div><div><br></div><div><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div>=============================</div><div><div>Dynamic:</div><div>conn site-2-dynamic-ip</div></div></div></div></blockquote><span class="gmail-m_-6813199994156417795gmail-m_7697670570803360704m_6784992401950315231Apple-tab-span" style="white-space:pre-wrap"> </span> mark=%unique<br><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div><div><span style="white-space:pre-wrap"> </span>left=%defaultroute</div></div></div></div></blockquote> leftsourceip=%config4<br><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div><div><span style="white-space:pre-wrap"> </span>leftsubnet=<a href="http://10.10.0.0/22,10.9.255.252/30" rel="noreferrer" target="_blank">10.10.0.0/22,10.9.255.252/30</a></div><div><span style="white-space:pre-wrap"> </span>leftfirewall=no</div></div></div></div></blockquote> leftupdown=/etc/strongswan.d/ipsec-vti.sh</div><div> right=st.at.ic.ip</div><div><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div><div><span style="white-space:pre-wrap"> </span>rightsubnet=<a href="http://10.10.4.0/22,10.9.255.252/30" rel="noreferrer" target="_blank">10.10.4.0/22,10.9.255.252/30</a></div><div><span style="white-space:pre-wrap"> </span>rightid=%<a href="http://specific.example.com/" rel="noreferrer" target="_blank">specific.example.com</a></div><div><span style="white-space:pre-wrap"> </span>auto=add</div><div><br></div><div>Static:</div><div>conn site-1-static-ip</div></div></div></div></blockquote> mark=%unique<br><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div><div><span style="white-space:pre-wrap"> </span>left=st.at.ic.ip</div><div><span style="white-space:pre-wrap"> </span>leftsubnet=<a href="http://10.10.4.0/22,10.9.255.252/30" rel="noreferrer" target="_blank">10.10.4.0/22,10.9.255.252/30</a></div><div><span style="white-space:pre-wrap"> </span>leftid=%<a href="http://specific.example.com/" rel="noreferrer" target="_blank">specific.example.com</a></div><div><span style="white-space:pre-wrap"> </span>leftfirewall=no</div></div></div></div></blockquote><div> leftsourceip=10.9.255.253 </div><div> leftupdown=/etc/strongswan/ipsec-vti.sh</div><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div><div><span style="white-space:pre-wrap"> </span>right=%any</div></div></div></div></blockquote> rightsourceip=10.9.255.254<br><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div><div><span style="white-space:pre-wrap"> </span>rightsubnet=<a href="http://10.10.0.0/22,10.9.255.252/30" rel="noreferrer" target="_blank">10.10.0.0/22,10.9.255.252/30</a></div><div><span style="white-space:pre-wrap"> </span>auto=add</div></div><div>===============================</div></div></div></blockquote><div><div dir="ltr"><div dir="ltr"><div><br></div><div>With this configuration, I get full SA and IKE negotiation including TS and dynamic side tunnel configuration:</div><div><br></div><div><blockquote type="cite"><div>root@dynamic:/# ip a show vti1</div><div>49: vti1@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1472 qdisc noqueue state UNKNOWN group default qlen 1000</div><div> link/ipip dy.na.mi.cip peer st.at.ic.ip</div></blockquote><blockquote type="cite"><div> inet <a href="http://10.9.255.254/32" rel="noreferrer" target="_blank">10.9.255.254/32</a> scope global vti1</div><div> valid_lft forever preferred_lft forever</div></blockquote><div><div><br></div></div></div><div>On the static side, I get an error from the script:</div><div><blockquote type="cite">04[CHD] updown: /etc/strongswan/ipsec-vti.sh: line 15: PLUTO_MY_SOURCEIP: unbound variable</blockquote><br></div><div>I initially had the same problem on the dynamic side, but the addition of `leftsourceip=%config4` and `rightsourceip` on the static side resolved that.</div><div><br></div><div>Is there something I am missing to avoid the "PLUTO_MY_SOURCEIP: unbound variable” problem?</div><div><br></div><div>Thanks so much for your insight!</div></div></div></div></div></div></blockquote></div>
</div></blockquote></div><br></div></div></blockquote></div>