<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p>Thank you, Paul.</p>
<p><br>
</p>
<p>I read both wiki and I found a problem for me: I'm trying to connect using the AWS VPN Service instead EC2 with libreswan running. In my side, I have an CentOS 7.</p>
<p><br>
</p>
<p>The second wiki [Route-based VPN using VTI] have a section named "<span>Setting up a route-based VPN with Amazon", but no one write yet.</span></p>
<p><br>
</p>
<p>I found this wiki[1] reporting the problem with 2 connections simultaneously and I will try to do with EC2.</p>
<p><br>
</p>
<p><br>
</p>
<p>Thanks for your help.</p>
<p><br>
</p>
<p> </p>
<p>[1] <a href="https://libreswan.org/wiki/Interoperability#Multiple_tunnels_fail_with_Amazon.27s_VPN" class="OWAAutoLink" id="LPlnk701620">https://libreswan.org/wiki/Interoperability#Multiple_tunnels_fail_with_Amazon.27s_VPN</a></p>
<br>
<div id="Signature">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p></p>
<div>--</div>
<div><br>
Eduardo Fontinelle</div>
<br>
<p></p>
</div>
</div>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>De:</b> Paul Wouters <paul@nohats.ca><br>
<b>Enviado:</b> terça-feira, 11 de abril de 2017 17:12<br>
<b>Para:</b> Eduardo Oliveira<br>
<b>Cc:</b> swan@lists.libreswan.org<br>
<b>Assunto:</b> Re: [Swan] Help with failover</font>
<div> </div>
</div>
<div>
<div><br>
<a href="https://libreswan.org/wiki/High_Availability_/_Failover_VPN_in_AWS_using_libreswan" id="LPlnk266514" previewremoved="true">https://libreswan.org/wiki/High_Availability_/_Failover_VPN_in_AWS_using_libreswan</a></div>
<div id="LPBorder_GT_14919984474280.32803435387635904" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14919984474250.6720246281285891" role="presentation" cellspacing="0" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="TextCell_14919984474260.5162801605851732" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14919984474260.1072220388059173"></div>
<div id="LPTitle_14919984474260.9707830360257739" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14919984474270.3427581238382802" href="https://libreswan.org/wiki/High_Availability_/_Failover_VPN_in_AWS_using_libreswan" target="_blank" style="text-decoration: none;">High Availability / Failover VPN in AWS using libreswan - Swan</a></div>
<div id="LPMetadata_14919984474270.9577514629177606" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols, sans-serif; font-size: 14px; line-height: 14px;">
libreswan.org</div>
<div id="LPDescription_14919984474270.9215484331458468" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
AWS Configuration. The first requirement is to configure some options in AWS. I will be specifying addresses here for the work in VPC1. This process will need to be ...</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<div><br>
</div>
<div>Or look at VTI </div>
<div><br>
</div>
<div><a href="https://libreswan.org/wiki/Route-based_VPN_using_VTI" id="LPlnk307755" previewremoved="true">https://libreswan.org/wiki/Route-based_VPN_using_VTI</a></div>
<div id="LPBorder_GT_14919984474150.023321576653922316" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14919984474120.370786031113276" role="presentation" cellspacing="0" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="TextCell_14919984474130.4303243451249865" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14919984474130.9011428100575356"></div>
<div id="LPTitle_14919984474130.7875828971674008" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14919984474140.3524935375724385" href="https://libreswan.org/wiki/Route-based_VPN_using_VTI" target="_blank" style="text-decoration: none;">Route-based VPN using VTI - Swan - Libreswan</a></div>
<div id="LPMetadata_14919984474140.17589561177215862" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols, sans-serif; font-size: 14px; line-height: 14px;">
libreswan.org</div>
<div id="LPDescription_14919984474140.25417116840867027" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
Create a single VTI device for all VPN clients. If you run a VPN server, it is difficult to monitor all VPN connections using tcpdump because it mixes up encrypted ...</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<div><br>
<div>Sent from my iPhone</div>
</div>
<div><br>
On Apr 11, 2017, at 15:41, Eduardo Oliveira <<a href="mailto:eduardo.oliveira@gerencianet.com.br">eduardo.oliveira@gerencianet.com.br</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Hi all,</p>
<p><br>
</p>
<p>I'm trying to create a connection between my local and AWS VPC with failover or HA using libreswan, but I don't know how to do it. </p>
<p><br>
</p>
<p>Try #1: Just create 2 tunnels, up both and wait the success. Fail.</p>
<p>When I up the tunnel 1, works well. But the second tunnel fails because it is not possible add 2 routes to the same subnet at the same time. Log: </p>
<p><br>
</p>
<p></p>
<div><span style="font-family:"Courier New",monospace">117 "aws-t2" #5: STATE_QUICK_I1: initiate</span></div>
<div><span style="font-family:"Courier New",monospace">003 "aws-t2" #5: cannot install eroute -- it is in use for "aws-t1" #3</span></div>
<div><span style="font-family:"Courier New",monospace">032 "aws-t2" #5: STATE_QUICK_I1: internal error</span></div>
<br>
<p></p>
<p>Try #2: use the "<span>overlapip" and "<span>metric" option. In my brain would work because both tunnels with equal routes, but with different metrics. Fail.<br>
When both tunnels was up, the packages up using one tunnel and down using another. I don't know why but the packages was not forwarded.</span></span></p>
<p><span><span><br>
</span></span></p>
<p><span><span><br>
</span></span></p>
<p><span><span>Try #3: find some feature to config a failover. When one tunnel downs, the other up. Fail.</span></span></p>
<p><span><span>I didn't find how to do this.</span></span></p>
<p><br>
</p>
<p><br>
</p>
<p>Can someone help me?</p>
<p><br>
</p>
<p><br>
</p>
<p>=================================</p>
<p>Config files:</p>
<p>------ Try #1 ---------</p>
<p></p>
<div>conn aws-t1</div>
<div> authby=secret</div>
<div> auto=start</div>
<div> left=%defaultroute</div>
<div> leftid=LOCAL_IP_1</div>
<div> right=AWS_Peer_1</div>
<div> type=tunnel</div>
<div> ikelifetime=8h</div>
<div> keylife=1h</div>
<div> phase2alg=aes128-sha1;modp1024</div>
<div> ike=aes128-sha1;modp1024</div>
<div> auth=esp</div>
<div> keyingtries=%forever</div>
<div> keyexchange=ike</div>
<div> leftsubnet=0.0.0.0/0</div>
<div> rightsubnet=172.21.0.0/16</div>
<div> dpddelay=5</div>
<div> dpdtimeout=10</div>
<div> dpdaction=restart_by_peer</div>
<div>conn aws-t2</div>
<div> authby=secret</div>
<div> auto=start</div>
<div> left=%defaultroute</div>
<div> leftid=LOCAL_IP_1</div>
<div> right=AWS_Peer_2</div>
<div> type=tunnel</div>
<div> ikelifetime=8h</div>
<div> keylife=1h</div>
<div> phase2alg=aes128-sha1;modp1024</div>
<div> ike=aes128-sha1;modp1024</div>
<div> auth=esp</div>
<div> keyingtries=%forever</div>
<div> keyexchange=ike</div>
<div> leftsubnet=0.0.0.0/0</div>
<div> rightsubnet=172.21.0.0/16</div>
<div> dpddelay=5</div>
<div> dpdtimeout=10</div>
<div> dpdaction=restart_by_peer</div>
<br>
<p></p>
<p><br>
</p>
<p><span style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:16px">------ Try #2 ---------</span></p>
<p></p>
<div>conn aws-t1</div>
<div> [...] # Same of try #1</div>
<div> metric=1</div>
<div> overlapip=yes</div>
<div> </div>
<div>conn aws-t2</div>
<div> [...] # Same of try #1 </div>
<div> metric=2</div>
<div> overlapip=yes</div>
<p></p>
<p><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p></p>
<div>--</div>
<div><br>
</div>
<div>Eduardo Fontinelle <br>
<br>
</div>
<br>
<p></p>
</div>
</div>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>Swan mailing list</span><br>
<span><a href="mailto:Swan@lists.libreswan.org">Swan@lists.libreswan.org</a></span><br>
<span><a href="https://lists.libreswan.org/mailman/listinfo/swan">https://lists.libreswan.org/mailman/listinfo/swan</a></span><br>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>