[strongSwan] strange traffic selector selecting behavior
jaehong.park at illumio.com
Mon Aug 12 17:28:48 CEST 2019
Thank you Tobias.
I figured out the second option you suggested and it resolve my problem.
> On Aug 12, 2019, at 7:19 AM, Tobias Brunner <tobias at strongswan.org> wrote:
> Hi Jaehong,
>> the StrongSwan select wrong selector and program xfrm incorrectly.
> No, everything works as it's designed to. However, there are several
> aspects that result in the "wrong" outcome in your case.
> It starts with the ping utility that opens a UDP socket to determine
> which local address it should use as source in the ICMP packets. This
> socket may trigger matching trap policies (auto=route) and the data
> (protocol/ports) of this (unused) UDP connection is received in the
> acquire message from the kernel. By default, strongSwan prepends that
> received traffic selector to the list of traffic selectors (to allow
> responders to select the most specific traffic selector, which is what
> happens here).
> You can avoid the UDP socket in ping by selecting a specific source IP
> via -I <IP>. You can also prevent strongSwan from adding the traffic
> selectors from the acquire by enabling charon.ignore_acquire_ts. You
> could also make the trap policy more specific (e.g. so it doesn't match
> UDP if that's not intended).
More information about the Users