<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Verdana,Geneva,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;" dir="ltr">
<p><span id="ms-rterangepaste-start"></span></p>
<div class="_rp_N4 ms-font-weight-regular ms-font-color-neutralDark rpHighlightAllClass rpHighlightBodyClass" id="Item.MessageUniqueBody" style="font-family: "wf_segoe-ui_normal","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,"EmojiFont";" tabindex="0">
<div>
<div dir="ltr">
<div id="divtagdefaultwrapper" style="font-family: "wf_segoe-ui_normal","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,"EmojiFont","EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;">
<font style="font-family: Verdana,Geneva,sans-serif,serif,"EmojiFont";" color="black" size="3" face="Verdana,Geneva,sans-serif"><span style="font-size:12pt;" id="divtagdefaultwrapper">
<div>
<div style="margin-top:0;margin-bottom:0;">Howdy IPsec masters, <br>
</div>
<div style="margin-top:0;margin-bottom:0;"><br>
</div>
<div style="margin-top:0;margin-bottom:0;">We have a solution that drives LibreSWAN IPsec connections from a small set of central servers out to our customer's environments. Our customers use a variety of IPsec routers (Cisco's, HP's, Juniper's, etc) configured
to expose a small /29 or /30 subnet of the customer's internal network, which has the target system(s) we want to reach.
<br>
</div>
<div style="margin-top:0;margin-bottom:0;"><br>
</div>
<div style="margin-top:0;margin-bottom:0;">Currently we require that the subnet exposed by each customer be unique. But this is met with resistance, understandably, since many customers use the same internal RFC-1918 private address spaces (10.0.0.0/8, 172.[16-31].0.0/16,
192.168.0.0/16). <br>
</div>
<div style="margin-top:0;margin-bottom:0;"><br>
</div>
<div style="margin-top:0;margin-bottom:0;">Is there a way to create host-to-subnet or subnet-to-subnet IPsec connections where the rightsubnets (customer-side) are the same or overlap? It's my understanding that connections are indexed by the (leftsubnet, rightsubnet)
tuple, but when I try this I get "cannot route -- route already in use" errors when I bring up the second+ connection of those with duplicate rightsubnets.
<br>
</div>
<div style="margin-top:0;margin-bottom:0;"><br>
</div>
<div style="margin-top:0;margin-bottom:0;">We control the leftsubnets and we can manage a pool of these so we assign a unique leftsubnet to each customer. The left IP address is fixed, as that's our server's public IP; and the customer's right IP is also a
given and cannot be changed. Most of these connections will be up at the same time.
<br>
</div>
<div style="margin-top:0;margin-bottom:0;"><br>
</div>
<div style="margin-top:0;margin-bottom:0;">Example (fixed-width font, apologies to those with proportional font):
<br>
</div>
<div style="margin-top:0;margin-bottom:0;"><br>
</div>
<div style="margin-top:0;margin-bottom:0;"><font style="font-family: Courier New,monospace,serif,"EmojiFont";" face="Courier New,monospace"> </font><font style="font-family: Courier New,monospace,serif,"EmojiFont";" face="Courier New,monospace">leftsubnet
left right rightsubnet who</font><br>
<font style="font-family: Courier New,monospace,serif,"EmojiFont";" face="Courier New,monospace"> </font><font style="font-family: Courier New,monospace,serif,"EmojiFont";" face="Courier New,monospace"> </font><font style="font-family: Courier New,monospace,serif,"EmojiFont";" face="Courier New,monospace">
</font><font style="font-family: Courier New,monospace,serif,"EmojiFont";" face="Courier New,monospace">172.16.0.1/32 === 16.16.16.16 ... 99.99.99.99 === 192.168.0.1/30 cust-00001</font><br>
<font style="font-family: Courier New,monospace,serif,"EmojiFont";" face="Courier New,monospace"> 172.16.0.2/32 === 16.16.16.16 ... 12.34.56.78 === 192.168.0.1/30 cust-00002</font><br>
<font style="font-family: Courier New,monospace,serif,"EmojiFont";" face="Courier New,monospace"> 172.16.0.3/32 === 16.16.16.16 ... 77.88.99.11 === 192.168.0.1/30 cust-00003</font><br>
</div>
<div style="padding-left:30pt;"><font style="font-family: Courier New,monospace,serif,"EmojiFont";" face="Courier New,monospace"> ...
</font></div>
<font style="font-family: Courier New,monospace,serif,"EmojiFont";" face="Courier New,monospace"> 172.31.255.254/32 === 16.16.16.16 ... 55.66.77.88 === 192.168.0.1/30 cust-ffffe</font><br>
<br>
<div style="margin-top:0;margin-bottom:0;">In the above, the "left" is the same server, while the right's are all different customer routers/networks.
<br>
</div>
<div style="margin-top:0;margin-bottom:0;"><br>
</div>
<div style="margin-top:0;margin-bottom:0;">If this isn't the the correct approach, perhaps NAT-games would help?<br>
</div>
<div style="margin-top:0;margin-bottom:0;"><br>
</div>
<div style="margin-top:0;margin-bottom:0;">Thanx all, any help appreciated! </div>
<div style="margin-top:0;margin-bottom:0;">- Steve </div>
</div>
</span></font></div>
</div>
</div>
</div>
<span id="ms-rterangepaste-end"></span><br>
<p></p>
</div>
</body>
</html>