[strongSwan] compatibility strongswan-5.1.1 with 4.xx, routing pb

[s s]

Hello,

Is the 4.xx branch compatible with the 5.x one?
I am unable to establish a tunnel in between 2 strongswan hosts one running the strongSwan U4.3.2/K2.6.38
 and the second strongSwan U5.1.1/K2.6.18-308.16.1.el5PAE

The configuration is more than classical: net-net


conn karmaIKE2
     left=%defaultroute
     leftsubnet=10.0.2.0/24
     leftcert=lnvo.hostCert.pem
     right=192.168.4.10
     rightsubnet=0.0.0.0/0
     rightcert=peercerts/karmaY2034.hostCert.pem
     keyexchange=ikev2
     mobike=yes
     auto=add


root at bt:/etc/ipsec.d# ipsec up karmaIKE2
initiating IKE_SA karmaIKE2[1] to 192.168.4.10
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
sending packet: from 10.0.2.15[500] to 192.168.4.10[500]
received packet: from 192.168.4.10[500] to 10.0.2.15[500]
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]
local host is behind NAT, sending keep alives
received cert request for "STR4.3CA"
received cert request for unknown ca with keyid b0:31:27:8b:2e:4b:cd:53:6d:c4:a7:fb:e9:56:1b:9f:34:cc:71:a7
sending cert request for "STR4.3CA"
authentication of 'STR4.3host.cert' (myself) with RSA signature successful
sending end entity cert "STR4.3host.cert"
establishing CHILD_SA karmaIKE2
generating IKE_AUTH request 1 [ IDi CERT CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) ]
sending packet: from 10.0.2.15[4500] to 192.168.4.10[4500]
retransmit 1 of request with message ID 1
sending packet: from 10.0.2.15[4500] to 192.168.4.10[4500]


But the tunnel 

root at bt:/etc/ipsec.d# ipsec statusall
000 Status of IKEv1 pluto daemon (strongSwan 4.3.2):
000 interface lo/lo ::1:500
000 interface lo/lo 127.0.0.1:500
000 interface eth0/eth0 10.0.2.15:500
000 %myid = (none)
000 loaded plugins: curl ldap random pubkey openssl hmac gmp 
000 debug options: none
000 
Status of IKEv2 charon daemon (strongSwan 4.3.2):
  uptime: 7 minutes, since Dec 23 10:27:59 2013
  worker threads: 9 idle of 16, job queue load: 0, scheduled events: 1
  loaded plugins: curl ldap random x509 pubkey openssl xcbc hmac agent gmp kernel-netlink stroke updown eapidentity eapmd5 eapgtc eapaka eapmschapv2 
Listening IP addresses:
  10.0.2.15
Connections:
   karmaIKE2:  10.0.2.15...192.168.4.10
   karmaIKE2:   local:  [STR4.3host.cert] uses public key authentication
   karmaIKE2:    cert:  "STR4.3host.cert"
   karmaIKE2:   remote: [STR5.1host.cert] uses any authentication
   karmaIKE2:    cert:  STR5.1host.cert"
   karmaIKE2:   child:  10.0.2.0/24 === 0.0.0.0/0 
Security Associations:
   karmaIKE2[1]: CREATED, 10.0.2.15[STR4.3host.cert]...192.168.4.10[STR5.1host.cert]
   karmaIKE2[1]: IKE SPIs: 3483591a1d20afaf_i* 0000000000000000_r
   karmaIKE2[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048

The logs show
Dec 23 10:32:01 bt charon: 16[IKE] establishing CHILD_SA karmaIKE2
Dec 23 10:32:01 bt charon: 16[ENC] generating IKE_AUTH request 1 [ IDi CERT CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) ]
Dec 23 10:32:01 bt charon: 16[NET] sending packet: from 10.0.2.15[4500] to 192.168.4.10[4500]

But this child tunnel could not be setup.
Which result in the inability to reach the hosts and the the networks behind them.

I am still running the routing problem between the same two strongSwan U5.1.1/K2.6.18-308.16.1.el5PAE hosts, one of them being behind the NATed gateway and unable to reach it through the tunnel, which apparently doesn't route the packets.

Any help would be much appreciated.
Rgds,
Serge


----

Is standard Centos 5.x kernel 2.6.18-308.16.1.el5PAE compatible at all with 
[root@ ~]# strongswan version
Linux strongSwan U5.1.1/K2.6.18-308.16.1.el5PAE

We are unable to fix the routing problem. When the remote host is behind the NAT'ed provider's server, it can not be reached at all:


 msc-hmnet{12}:   192.168.4.0/24 === 192.168.3.0/24 
[root at karma ~]# ping 192.168.3.56
PING 192.168.3.56 (192.168.3.56) 56(84) bytes of data.

--- 192.168.3.56 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 999ms

 


----
> > But out of the 2 tunnels only 1 is reachable. The other one doesn't ping.
> Does that tunnel work if you don't establish the other one?
No, it doesn't.
Besides, once the 192.168.3.0/24 host is behind the NAT'ed gateway, neither of the tunnels work.
 
> Also, I'd try to disable IPComp for testing. There seems to be an issue
> with IPcomp on some kernels in some scenarios.
What an IPComp is and how to disable it ?

We use a standard Centos 5.x kernel
2.6.18-308.16.1.el5PAE #1 SMP Tue Oct 2 22:49:17 EDT 2012 i686 i686 i386 GNU/Linux

Could anyone help to troubleshoot the problem and resolve the issue?

Rgds,
Serge