[strongSwan] VTI's as initiator?

Ruel, Ryan rruel at akamai.com
Thu Jul 28 19:08:19 CEST 2016


With a combination of setting the mark correctly and setting the traffic selectors (I ended up using, I am now able to pass traffic through the VTI.

Thanks for your help.


On 7/28/16, 10:05 AM, "Tobias Brunner" <tobias at strongswan.org> wrote:

    Hi Ryan,
    > When acting as a responder, I didn’t have to do this, strongSwan seems to choose a mark value for me.
    Not unless you configured `mark=%unique`.
    > Anything else I should check?
    Yes, the traffic selectors.  As I wrote on [1] the traffic you route
    into a VTI device has to match the negotiated IPsec policies.  Since you
    haven't specified left|rightsubnet the TS will default to left|right.
    Since you want to route traffic to you have to use at least
    [1] https://wiki.strongswan.org/projects/strongswan/wiki/RouteBasedVPN

More information about the Users mailing list