[strongSwan] Dual Stack problems

[Claude Tompers]

Hi Andreas,

Thanks for your answer.

kind regards,
Claude


On 03/26/2013 10:22 AM, Andreas Steffen wrote:
> Hi Claude,
>
> this problem with persistent SQL-based pools was fixed with
> 5.0.3rc1. See also our new example scenario
>
> https://www.strongswan.org/uml/testresults5rc/ikev2/ip-two-pools-v4v6-db/
>
> Regards
>
> Andreas
>
> On 03/26/2013 09:46 AM, Claude Tompers wrote:
> > Hello,
>
> > My strongswan 5.0.2 installation has some bizarre behaviour with
> > IKEv2 connections that ask both an IPv4 and an IPv6 address.
>
> > My client ipsec.conf is as follows :
>
> > conn IKEv2 keyexchange=ikev2 left=%any leftauth=pubkey
> > leftcert=nullpointerexception-cert.pem
> > leftsourceip=%config4,%config6 right=casarrondo.restena.lu
> > rightauth=pubkey rightid=@casarrondo.restena.lu
>
>
> > My server ipsec.conf is as follows :
>
> > conn IKEv2-tech keyexchange=ikev2 rightauth=pubkey
> > rightsendcert=always rightid="C=LU, L=Luxembourg, O=Fondation
> > RESTENA, OU=Technical, CN=*, E=*" rightsourceip=%tech-v4,%tech-v6
> > auto=add
>
>
> > Both pools are defined as follows :
>
> > name           start             end  timeout   size online usage
> > tech-v4   158.64.15.193   158.64.15.206       1h     14     0 ( 0%)
> > 2 (14%) tech-v6 2001:a18:1:40::1 2001:a18:1:40::ff       1h 255
> > 0 ( 0%)     0 ( 0%)
>
>
> > In the server logs, I see the following lines :
>
> > Mar 26 09:35:47 casarrondo charon: 07[CFG] acquired existing lease
> > for address 158.64.15.193 in pool 'tech-v4' Mar 26 09:35:47
> > casarrondo charon: 07[IKE] assigning virtual IP 158.64.15.193 to
> > peer 'C=LU ... Mar 26 09:35:47 casarrondo charon: 07[IKE] peer
> > requested virtual IP %any6 Mar 26 09:35:47 casarrondo charon:
> > 07[CFG] acquired existing lease for address 158.64.15.194 in pool
> > 'tech-v4' Mar 26 09:35:47 casarrondo charon: 07[IKE] assigning
> > virtual IP 158.64.15.194 to peer 'C=LU ...
>
> > The client really ends up with two addresses from tech-v4 pool.
> > I've changed the following line in the server's ipsec.conf :
>
> > rightsourceip=%tech-v6,%tech-v4
>
> > The result was that strongswan distributed 2 addresses from the
> > tech-v6 pool. Is there an error in my configuration ?
>
> > kind regards, Claude
>
>
>
> > _______________________________________________ Users mailing list
> >  Users at lists.strongswan.org
> > https://lists.strongswan.org/mailman/listinfo/users
>
>
>
>

-- 
Claude Tompers
Ingénieur réseau et système
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 263 bytes
Desc: OpenPGP digital signature
URL: <http://lists.strongswan.org/pipermail/users/attachments/20130326/a47bc123/attachment.pgp>