<div dir="ltr">Hi Paul,<div><br></div><div>One follow-up question. Assume we have conn1 and conn2 (or probably more conn's), they both using same endpoints for tunnel, but will support different subnet pairs. We want to bring up/down individual conn freely. All conns should share the same phase 1 IKE tunnel. How do we guarantee that? </div><div>I tried to put left/right/ike into </div><div>conn %default</div><div> left=a.b.c.d</div><div> right=e.f.g.h</div><div> ike=xxxxx</div><div> phase2alg=....</div><div><br></div><div>conn conn1</div><div> leftsubnet=x.x.x.x/24</div><div> rightsubnet=y.y.y.y/24</div><div><br></div><div><div>conn conn2</div><div> leftsubnet=v.v.v.v/24</div><div> rightsubnet=w.w.w.w/24</div></div><div><br></div><div>When I do "ip xfrm state", it returns 8 entries, similar to:</div><div>
<p class="gmail-p1"><span class="gmail-s1">src 10.2.128.170 dst 10.2.128.171<br></span>proto esp spi 0x90c639bd reqid 16409 mode tunnel<br>replay-window 32 flag af-unspec<br>auth-trunc hmac(sha1) 0x3438409b19952d08acf41b4c7d8fec1b845a5567 96<br>enc cbc(aes) 0x860183c7fb90aaa9c52c03eaf853c749<br>anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p><p class="gmail-p1"><span class="gmail-s1">with diffenent spi.</span></p><p class="gmail-p1"><span class="gmail-s1">with only conn1 or conn2, it return 4 entries.</span></p><p class="gmail-p1"><span class="gmail-s1">Why does it have 8 entries? Does it mean multiple IKE tunnels were created?</span></p><p class="gmail-p1"><br></p><p class="gmail-p1">Thanks,<br>Xinwei</p></div>
<div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jan 20, 2017 at 1:21 PM, Xinwei Hong <span dir="ltr"><<a href="mailto:xhong@skytap.com" target="_blank">xhong@skytap.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I tried it. It looks like "ip auto --add test2" will reload config file and pluto process does not restart.<div><br></div><div>Thanks,</div><div>Xinwei</div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 19, 2017 at 11:22 PM, Xinwei Hong <span dir="ltr"><<a href="mailto:xhong@skytap.com" target="_blank">xhong@skytap.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thank you very much. I understand the sourceip part now. Also, I understand I can bring up/down connections using the method you mentioned.<div><br><div>Let's say my ipsec.conf has a conn test1 configured between two subnets. The ipsec.conf is loaded by pluto and everything is working. After sometime, we decide to add another subnet pair between the same endpoints. I need add a new snippet for "conn test2" into ipsec.conf. If I do </div><div>"ip auto --add test2", will it actually work? Does pluto reload ipsec.conf file? Does ip auto cause pluto to restart? Do the phase 1 tunnel and conn test1 get re-established? We don't want to interrupt tunnel for conn test1.</div><div><br></div><div>Thanks,</div><div>Xinwei</div></div></div><div class="m_7186551427004857843HOEnZb"><div class="m_7186551427004857843h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 19, 2017 at 8:48 PM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@nohats.ca" target="_blank">paul@nohats.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Thu, 19 Jan 2017, Xinwei Hong wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Another question. If I have multiple networks on both side of the ipsec<br>
tunnel, I assume we would need use leftsubnets/rightsubnets to specify<br>
multiple networks. However, in my last email, we found that<br>
leftsourceip/rightsourceip are required. Since we have multiple networks<br>
now, what address should be used as the sourceip?<br>
</blockquote>
<br></span>
If you need to access more remote subnets on the remote end from the<br>
local server itself, you have two choices:<br>
<br>
- Add host-subnet connections, like:<br>
<br>
conn subnet1<br>
left=a.b.c.d<br>
right=.e.f.g.h<br>
leftsubnet=X.0.0.0/8,Y.0.0.0/8<br>
rightsubnet=W.0.0.0/8,Z.0.0.0/<wbr>0<br>
[...]<br>
<br>
conn host-subnet1<br>
left=a.b.c.d<br>
right=.e.f.g.h<br>
rightsubnet=W.0.0.0/8<br>
[...]<br>
<br>
conn host-subnet2<br>
left=a.b.c.d<br>
right=.e.f.g.h<br>
rightsubnet=Z.0.0.0/8<br>
[...]<br>
<br>
This will result in 4 + 1 +1 tunnels. All the subnets to all the subnets<br>
and the ipsec server to both subnets.<br>
<br>
Since you now have tunnels where your public ip (nearest to the remote<br>
subnet) is part of an IPsec tunnel, your connections will work without<br>
needing sourceip=<br>
<br>
The alternative is to split the subnetS conn into 4 different<br>
subnet to subnet tunnels, and specifying the leftsourceip=<br>
But that only makes sense if you have an IP from those local<br>
subnets specified on the machine itself. Again, if you are just<br>
routing those subnets locally to another machine, sourceip= is<br>
not needed.<span><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Also, with our current setting using racoon, we can add/remove subnets on<br>
the fly once the tunnel is established. We just do some spdadd to tell the<br>
tunnel new subnets. To do the same thing, do we have to make change to<br>
ipsec.conf file and restart pluto daemon now? We want the existing<br>
connections uninterrupted.<br>
</blockquote>
<br></span>
If you use separate conns, then you can simply run:<br>
<br>
ipsec auto --add connXXX<br>
ipsec auto --up connXXX<br>
ipsec auto --down connXXX<br>
ipsec auto --delete connXXX<br>
<br>
to manually add/remove them. If you use the subnetS= contruct, then<br>
you will see numbered conns appearing. For example:<br>
<br>
conn test<br>
left=a.b.c.d<br>
right=.e.f.g.h<br>
leftsubnet=X.0.0.0/8,Y.0.0.0/8<br>
rightsubnet=W.0.0.0/8,Z.0.0.0/<wbr>0<br>
[...]<br>
<br>
when this connections is added and brougt up using --add and --up,<br>
you will see in "ipsec status"<br>
<br>
conn test1x1<br>
conn test1x2<br>
conn test2x1<br>
conn test2x2<br>
<br>
You can treat those as regular conns, so you can do:<br>
<br>
ipsec auto --delete test2x1<br>
<br>
Note that if you use DPD, and the base connection gets restarted,<br>
it will re-add this deleted conn again.<span class="m_7186551427004857843m_-2992313342756161981HOEnZb"><font color="#888888"><br>
<br>
Paul<br>
</font></span></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>