<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
Hi Tobias and thank you for the detailed reply.<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
Ok, i think i got it now, so Charon, based on the traffic selectors set when configuring the VPN will install routes but based on physical interface rather than the gateway configured for the tunnel.<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
For most of my client based policy vpns that is ok. But for the site-to-site vpns i configured now, i want to control traffic with static routing, or OSPF later (i.e transport multicast over some kind of tunnel, i think VTI interfaces should suffice for this,
i,e no need for GRE (the other side is a fortigate))<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
Since i have a lot of policy based client VPNs as well as GRE site to site VPNs, how would i go about installing routes in a higher priority table for the new site-to-site i want to configure? From what i gather from your detailed explanation of automatic route
installation by the IKE daemon, if i disable it, i am going to have issues with my policy based VPNs right?<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
I would post config of my tunnels and ipsec configs but its a lot. I will try to obfuscate some IP addressing and reply back with sample config of one of my policy based client vpns, one of my site to site over GRE vpns and the new site to site vpn with vti
interfaces i am setting up now.<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
How can i see charon installed routes? Are these the ones i see with ip xfrm policy?<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
Actually, here is my vpn config for the new vpn im trying to work with. It is already established but obviously traffic is not going through yet due to routing.<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
conn test_forti_s2s<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
type=tunnel<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
auto=start<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
left=X.X.X.X<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
leftsubnet=192.168.132.20/32<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
leftauth=psk<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
right=Y.Y.Y.Y<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
rightsubnet=10.0.10.0/24<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
# rightid=Y.Y.Y.Y<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
rightauth=psk<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
keyexchange=ikev2<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
ike=aes256-sha256-modp2048!<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
esp=aes256-sha1-modp2048!<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
mobike=no<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
mark=111<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
ikelifetime=1440m<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
lifetime=12h<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
margintime=3m <o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
keyingtries=3<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
rekeyfuzz=100%<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
dpddelay=100s<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
dpdtimeout=300s<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
inactivity=600s<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
dpdaction=clear<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
So, if i do <o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
ip tunnel add vti100 local X.X.X.X remote Y.Y.Y.Y mode vti key 111<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
ip link set vti0 up<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
ip route add 10.0.10.0/24 dev vti100<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
Would that be sufficient at least for this /24?<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
This is how my route table looks now<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
Destination Gateway Genmask Flags Metric Ref Use Iface<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
0.0.0.0 Z.Z.Z.Z 0.0.0.0 UG 80 0 0 eth1<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 *<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
10.11.11.0 192.168.191.57 255.255.255.248 UG 4 0 0 eth8<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
.<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
.<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
.<o:p></o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<o:p> </o:p></p>
<p class="MsoNormal" style="-webkit-text-size-adjust: auto; margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
Thanks.</p>
<br>
<div dir="ltr">
<blockquote type="cite"><br>
On 25 Mar 2022, at 12:55, Tobias Brunner <tobias@strongswan.org> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr"><span>Hi Ed,</span><br>
<span></span><br>
<blockquote type="cite"><span>Would that have any effect on the rest of my tunnels? What does disabling route installation by the IKE daemon means exactly in this case and why is it needed?</span><br>
</blockquote>
<span></span><br>
<span>The main reason for the automatic route installation is to select a specific source IP (one contained in the local traffic selectors) to send packets that originate from the IPsec gateway itself through the tunnel. Otherwise, the packets won't match
the negotiated IPsec policies.</span><br>
<span></span><br>
<span>For instance, in our testing environment, if gateways moon and sun negotiate a tunnel between 10.1.0.0/16 and 10.2.0.0/16, we want to make sure that moon uses 10.1.0.1 when sending packets to hosts in 10.2.0.0/16 and not 192.168.0.1, which its default
route might indicate. So a specific route to 10.2.0.0/16 is installed in table 220 that lists 10.1.0.1 as preferred source address.</span><br>
<span></span><br>
<span>Whether such routes are necessary depends on the negotiated traffic selectors, the existing (or any manually installed) routes, and whether the gateway is only forwarding traffic (in which case existing routes might already cover the traffic) or is actually
sending traffic to remote hosts itself.</span><br>
<span></span><br>
<span>Anyway, with any of the route-based approaches the automatically installed routes are generally not correct (they go via physical interfaces), which is why charon.install_routes should be disabled and routes via tunnel interfaces have to be managed externally
(installing them in routing tables that have higher priority than the one strongSwan uses is also an option to still use automatic routes for policy-based tunnels).</span><br>
<span></span><br>
<span>Regards,</span><br>
<span>Tobias</span><br>
</div>
</blockquote>
</body>
</html>