[Swan] not able to establish tunnel with multiple subnets and IKEv2

optimas primat techiek7 at gmail.com
Wed Jun 5 12:17:42 UTC 2019


I am trying to create site-to-site IPsec VPN with two subnets on each
site using libreswan on linux gateways.

Here is my config:

SITE A :

config setup
        protostack=netkey
        nhelpers=0
        syslog=daemon.*

conn siteA_ipsec
        rekey=yes
        keyingtries=10
        type=tunnel
        pfs=yes
        compress=no
        ikev2=yes
        dpddelay=2
        dpdtimeout=2
        dpdaction=clear
        left=172.16.99.11
        leftsourceip=172.16.99.11
        right=%any
        leftsubnets={172.16.55.0/24,172.16.56.0/24}
        rightsubnets={172.16.66.0/24,172.16.67.0/24}
        auto=add
        authby=secret
        leftid=@abcd22
        rightid=@abcd11
        ike=aes128-md5;modp1024
        phase2=esp
        phase2alg=aes128-md5;modp1024
SITE B:

config setup
        protostack=netkey
        nhelpers=0
        uniqueids=yes
        syslog=daemon.*

conn siteB_ipsec
        rekey=yes
        keyingtries=10
        type=tunnel
        pfs=yes
        compress=no
        ikev2=yes
        left=172.16.88.88
        leftsourceip=172.16.88.88
        right=172.16.99.11
        leftsubnets={172.16.66.0/24,172.16.67.0/24}
        rightsubnets={172.16.55.0/24,172.16.56.0/24}
        auto=start
        authby=secret
        leftid=@abcd11
        rightid=@abcd22
        ike=aes128-md5;modp1024
        phase2=esp
        phase2alg=aes128-md5;modp1024

I get TS_UNACCEPTABLE error in pluto logs and tunnel gets established
for only one subnet pair. When I change right=%any to
right=172.16.88.88 in Site A's config, tunnel gets established
successfully for all subnet pairs. As per requirement, I don't want to
specify Site B's IP address at Site A, as it will be dynamic. Hence I
used right=%any initially. But same config works with IKEv1.


More information about the Swan mailing list