<div dir="ltr">I tried it. It looks like "ip auto --add test2" will reload config file and pluto process does not restart.<div><br></div><div>Thanks,</div><div>Xinwei</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 19, 2017 at 11:22 PM, Xinwei Hong <span dir="ltr"><<a href="mailto:xhong@skytap.com" target="_blank">xhong@skytap.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thank you very much. I understand the sourceip part now. Also, I understand I can bring up/down connections using the method you mentioned.<div><br><div>Let's say my ipsec.conf has a conn test1 configured between two subnets. The ipsec.conf is loaded by pluto and everything is working. After sometime, we decide to add another subnet pair between the same endpoints. I need add a new snippet for "conn test2" into ipsec.conf. If I do </div><div>"ip auto --add test2", will it actually work? Does pluto reload ipsec.conf file? Does ip auto cause pluto to restart? Do the phase 1 tunnel and conn test1 get re-established? We don't want to interrupt tunnel for conn test1.</div><div><br></div><div>Thanks,</div><div>Xinwei</div></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 19, 2017 at 8:48 PM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@nohats.ca" target="_blank">paul@nohats.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Thu, 19 Jan 2017, Xinwei Hong wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Another question. If I have multiple networks on both side of the ipsec<br>
tunnel, I assume we would need use leftsubnets/rightsubnets to specify<br>
multiple networks. However, in my last email, we found that<br>
leftsourceip/rightsourceip are required. Since we have multiple networks<br>
now, what address should be used as the sourceip?<br>
</blockquote>
<br></span>
If you need to access more remote subnets on the remote end from the<br>
local server itself, you have two choices:<br>
<br>
- Add host-subnet connections, like:<br>
<br>
conn subnet1<br>
left=a.b.c.d<br>
right=.e.f.g.h<br>
leftsubnet=X.0.0.0/8,Y.0.0.0/8<br>
rightsubnet=W.0.0.0/8,Z.0.0.0/<wbr>0<br>
[...]<br>
<br>
conn host-subnet1<br>
left=a.b.c.d<br>
right=.e.f.g.h<br>
rightsubnet=W.0.0.0/8<br>
[...]<br>
<br>
conn host-subnet2<br>
left=a.b.c.d<br>
right=.e.f.g.h<br>
rightsubnet=Z.0.0.0/8<br>
[...]<br>
<br>
This will result in 4 + 1 +1 tunnels. All the subnets to all the subnets<br>
and the ipsec server to both subnets.<br>
<br>
Since you now have tunnels where your public ip (nearest to the remote<br>
subnet) is part of an IPsec tunnel, your connections will work without<br>
needing sourceip=<br>
<br>
The alternative is to split the subnetS conn into 4 different<br>
subnet to subnet tunnels, and specifying the leftsourceip=<br>
But that only makes sense if you have an IP from those local<br>
subnets specified on the machine itself. Again, if you are just<br>
routing those subnets locally to another machine, sourceip= is<br>
not needed.<span><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Also, with our current setting using racoon, we can add/remove subnets on<br>
the fly once the tunnel is established. We just do some spdadd to tell the<br>
tunnel new subnets. To do the same thing, do we have to make change to<br>
ipsec.conf file and restart pluto daemon now? We want the existing<br>
connections uninterrupted.<br>
</blockquote>
<br></span>
If you use separate conns, then you can simply run:<br>
<br>
ipsec auto --add connXXX<br>
ipsec auto --up connXXX<br>
ipsec auto --down connXXX<br>
ipsec auto --delete connXXX<br>
<br>
to manually add/remove them. If you use the subnetS= contruct, then<br>
you will see numbered conns appearing. For example:<br>
<br>
conn test<br>
left=a.b.c.d<br>
right=.e.f.g.h<br>
leftsubnet=X.0.0.0/8,Y.0.0.0/8<br>
rightsubnet=W.0.0.0/8,Z.0.0.0/<wbr>0<br>
[...]<br>
<br>
when this connections is added and brougt up using --add and --up,<br>
you will see in "ipsec status"<br>
<br>
conn test1x1<br>
conn test1x2<br>
conn test2x1<br>
conn test2x2<br>
<br>
You can treat those as regular conns, so you can do:<br>
<br>
ipsec auto --delete test2x1<br>
<br>
Note that if you use DPD, and the base connection gets restarted,<br>
it will re-add this deleted conn again.<span class="m_-2992313342756161981HOEnZb"><font color="#888888"><br>
<br>
Paul<br>
</font></span></blockquote></div><br></div>
</div></div></blockquote></div><br></div>