<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p style="margin: 0in 0in 0.0001pt; font-size: medium; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0)">
<span style="font-size: 11pt">Hello,<span> </span></span><u1:p></u1:p></p>
<p style="margin: 0in 0in 0.0001pt; font-size: medium; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0)">
<span style="font-size: 11pt"> </span><u1:p></u1:p></p>
<span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">I am setting up Strongswan (version 5.7.1) as an IKEv2 IPSec VPN initiator. The responder is a Cisco router. My goal is to get both initiator's virtual IP (tunnel IP)
as well as responder's virtual IP (tunnel IP) dynamically through IPSec negotiation.</span><u1:p style="caret-color: rgb(0, 0, 0)"></u1:p><span style="caret-color: rgb(0, 0, 0); font-family: -webkit-standard; font-size: medium; display: inline !important"></span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">
<p style="margin: 0in 0in 0.0001pt; font-size: medium; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0)">
<span style="font-size: 11pt">I see responder has sent both initiator's virtual IP and responder's virtual IP / subnet in IKEv2 configuration payload.</span><u1:p></u1:p></p>
<p style="margin: 0in 0in 0.0001pt; font-size: medium; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0)">
<span style="font-size: 11pt"> </span><u1:p></u1:p></p>
<p style="margin: 0in 0in 0.0001pt; font-size: medium; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0)">
<span style="font-size: 11pt">I can get intiator's virutal IP if I configure "leftsourceip=%config" in ipsec.conf. Tunnel is up successfully if I also explicitly specify rightsubnet with a valid IP subnet.</span><u1:p></u1:p></p>
<p style="margin: 0in 0in 0.0001pt; font-size: medium; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0)">
<span style="font-size: 11pt"> </span><u1:p></u1:p></p>
<p style="margin: 0in 0in 0.0001pt; font-size: medium; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0)">
<span style="font-size: 11pt">However I could not figure out how I can set ipsec.conf so that responder's virtual IP contained in the configuration payload can be parsed and installed on the initiator.</span><u1:p></u1:p></p>
<span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">I have tried the following different configuration in ipsec.conf <span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">separately.
But with each of them the CHILD_SA setup fails:</span><span style="caret-color: rgb(0, 0, 0); font-family: -webkit-standard; font-size: medium; display: inline !important"></span></span><u1:p style="caret-color: rgb(0, 0, 0)"></u1:p><span style="caret-color: rgb(0, 0, 0); font-family: -webkit-standard; font-size: medium; display: inline !important"></span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">
<p style="margin: 0in 0in 0.0001pt; font-size: medium; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0)">
<span style="font-size: 11pt">rightsourceip=%config</span><u1:p></u1:p></p>
<p style="margin: 0in 0in 0.0001pt; font-size: medium; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0)">
<span style="font-size: 11pt">rightsubnet=%config</span><u1:p></u1:p></p>
<p style="margin: 0in 0in 0.0001pt; font-size: medium; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0)">
<span style="font-size: 11pt">rightsubnet=%dynamic</span><u1:p></u1:p></p>
<br>
</span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">Strongswan
Virtual IP wiki (https://wiki.strongswan.org/projects/strongswan/wiki/VirtualIp) has<span> <span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">stated the following:</span><span style="caret-color: rgb(0, 0, 0); font-family: -webkit-standard; font-size: medium; display: inline !important"></span></span></span><span style="caret-color: rgb(0, 0, 0); font-family: -webkit-standard; font-size: medium; display: inline !important"></span><br>
</span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">
<p style="margin: 0in 0in 0.0001pt; font-size: medium; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0)">
<span style="font-size: 11pt">strongSwan currently implements one scenario with IKEv2 configuration payloads, where an IP address is assigned to the initiator (since 5.0.1 multiple addresses can be assigned from multiple pools). The opposite is possible by
the protocol, but is an uncommon setup and therefore not supported.</span><u1:p></u1:p></p>
<br>
</span></span></span></span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">So
looks like Strongswan <span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">currently does not support the scenario where an initiator can get BOTH initiator's and responder's virtual IP though tunnel negotiation?</span><u1:p style="caret-color: rgb(0, 0, 0)"></u1:p><span style="caret-color: rgb(0, 0, 0); font-family: -webkit-standard; font-size: medium; display: inline !important"></span></span><span style="caret-color: rgb(0, 0, 0); font-family: -webkit-standard; font-size: medium; display: inline !important"></span><br>
</span></span></span></span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><br>
</span></span></span></span></span></span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">Regards,</span></span></span></span></span></span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif"><span style="caret-color: rgb(0, 0, 0); font-size: 11pt; font-family: Calibri, sans-serif">Yanping</span></span></span></span></span></span></span></span></div>
</body>
</html>