[Swan] not able to establish tunnel with multiple subnets and IKEv2
optimas primat
techiek7 at gmail.com
Wed Jun 5 12:17:42 UTC 2019
I am trying to create site-to-site IPsec VPN with two subnets on each
site using libreswan on linux gateways.
Here is my config:
SITE A :
config setup
protostack=netkey
nhelpers=0
syslog=daemon.*
conn siteA_ipsec
rekey=yes
keyingtries=10
type=tunnel
pfs=yes
compress=no
ikev2=yes
dpddelay=2
dpdtimeout=2
dpdaction=clear
left=172.16.99.11
leftsourceip=172.16.99.11
right=%any
leftsubnets={172.16.55.0/24,172.16.56.0/24}
rightsubnets={172.16.66.0/24,172.16.67.0/24}
auto=add
authby=secret
leftid=@abcd22
rightid=@abcd11
ike=aes128-md5;modp1024
phase2=esp
phase2alg=aes128-md5;modp1024
SITE B:
config setup
protostack=netkey
nhelpers=0
uniqueids=yes
syslog=daemon.*
conn siteB_ipsec
rekey=yes
keyingtries=10
type=tunnel
pfs=yes
compress=no
ikev2=yes
left=172.16.88.88
leftsourceip=172.16.88.88
right=172.16.99.11
leftsubnets={172.16.66.0/24,172.16.67.0/24}
rightsubnets={172.16.55.0/24,172.16.56.0/24}
auto=start
authby=secret
leftid=@abcd11
rightid=@abcd22
ike=aes128-md5;modp1024
phase2=esp
phase2alg=aes128-md5;modp1024
I get TS_UNACCEPTABLE error in pluto logs and tunnel gets established
for only one subnet pair. When I change right=%any to
right=172.16.88.88 in Site A's config, tunnel gets established
successfully for all subnet pairs. As per requirement, I don't want to
specify Site B's IP address at Site A, as it will be dynamic. Hence I
used right=%any initially. But same config works with IKEv1.
More information about the Swan
mailing list