<html><head></head><body>Because that's how it's implemented in this case. Read the linked pages in the description.<br><br><div class="gmail_quote">Am January 21, 2020 8:27:03 AM UTC schrieb Victor Sudakov <vas@sibptus.ru>:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Victor Sudakov wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><br>If you mean the "Host-To-Host transport mode" example at<br><a href="https://wiki.strongswan.org/projects/strongswan/wiki/UsableExamples">https://wiki.strongswan.org/projects/strongswan/wiki/UsableExamples</a><br>this is exactly what I would like explained a bit:<br><br>1. Why does the example use "right=%any rightsubnet=192.168.1.0/24"<br>instead of just "right=192.168.1.0/24" ?<br><br>2. Does not "right=%any" mean that Strongswan will try to encrypt any outgoing connection?<br><br>I've of course read man ipsec.conf, but the semantics of<br>{left,right}subnet in *transport* mode is still not quite clear to me.<br></blockquote><br>If I understand correctly then<br><br>1. "{left,right}subnet" means the traffic which should trigger the creation of a SA.<br><br>2. {left,right} mean the SA peers (endpoints).<br><br>Is this correct?<br><br>Still I don't understand why the example uses "right=%any" for multiple<br>hosts from the "rightsubnet". How is that (SA peer selection?) is<br>supposed to work?<br></pre></blockquote></div><br>Sent from mobile</body></html>