<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
OK, I promise I won't reply "fixed it!" in a couple hours. <span id="🙂">🙂</span> I've been beating my head against the wall all day on this so I've decided to admit defeat and consult the gurus here.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
In my testing setup I have a pair of VPN systems, each with an VPNExternal interface (ens8), a VPNInternal (ens9) interface and a management interface (eth0) which is the default gateway for each machine. Each machine is connected to a test firewall and those
firewalls are connected together with a pretend “Internet” segment.</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
I would like to have the isakmp and ipsec-nat-t traffic bound for the peer gateway travel out the interface identified as left on each machine, rather than out the default gateway as directed by the routing table. I thought this was the purpose of leftnexthop,
but when I set it to the IP of the firewall’s address on the VPNExternal interface, traffic still goes to the default gateway whose interface on the firewall is NOT configured to pass this traffic and the tunnel does not come up.</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
Here are the configs and routing tables where each VPN system tries to send traffic out the default gateway which doesn’t work.</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnnj ~]$ sudo cat /etc/ipsec.d/intersitetunnel.conf</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
# /etc/ipsec.d/intersitetunnel.conf</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
conn intersitetunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
left=10.1.2.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
leftnexthop=10.1.2.1</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
leftid=@vpnnj</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
leftsubnet=10.1.4.0/24</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
leftrsasigkey=0sAwEAAcQQa4wVLATC...</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
right=172.16.1.10</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
rightid=@vpnca</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
rightsubnet=10.1.7.0/24</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
rightrsasigkey=0sAwEAAcp4iq2wyRGr212...</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
authby=rsasig</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auto=start</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnnj ~]$ ip route</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
default via 192.168.1.1 dev eth0 proto static metric 100 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.2.0/24 dev ens8 proto kernel scope link src 10.1.2.2 metric 101 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.3.0/24 dev ens9 proto kernel scope link src 10.1.3.2 metric 102 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.4.0/24 via 10.1.3.1 dev ens9 proto static metric 102 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.214 metric 100 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnnj ~]$ sudo systemctl start ipsec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnnj ~]$ sudo ip xfrm state</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnnj ~]$ </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnca ~]$ sudo cat /etc/ipsec.d/intersitetunnel.conf</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
# /etc/ipsec.d/intersitetunnel.conf</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
conn intersitetunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
left=10.1.5.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
leftnexthop=10.1.5.1</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
leftid=@vpnca</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
leftsubnet=10.1.7.0/24</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
leftrsasigkey=0sAwEAAcp4iq2wyRGr212...</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
right=172.16.1.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
rightid=@vpnnj</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
rightsubnet=10.1.4.0/24</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
rightrsasigkey=0sAwEAAcQQa4wVLATC...</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
authby=rsasig</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auto=start</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnca ~]$ ip route</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
default via 192.168.1.1 dev eth0 proto static metric 100 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.5.0/24 dev ens8 proto kernel scope link src 10.1.5.2 metric 101 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.6.0/24 dev ens9 proto kernel scope link src 10.1.6.2 metric 102 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.7.0/24 via 10.1.6.1 dev ens9 proto static metric 102 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.215 metric 100 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnca ~]$ sudo systemctl start ipsec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnca ~]$ sudo ip xfrm state</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnca ~]$ <br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<span id="🙁">🙁</span> <br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
But when I add an explicit route to the peer VPN server on each side, the tunnel comes up and passes traffic.</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnnj ~]$ sudo nmcli con mod tobr20 +ipv4.routes "172.16.1.10/32 10.1.2.1"</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnnj ~]$ sudo systemctl restart network</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnnj ~]$ sudo ip xfrm state</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 172.16.1.10 dst 10.1.2.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0xc7c336b4 reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0x5c2563f818e5e411e08e2d78f5327afc80d1eb16 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x22888c791947836f61d0f899d0c835d1</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 10.1.2.2 dst 172.16.1.10</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0x7729d983 reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0x783f6a9ee168efddc3e38cbb4440a9e6c4497277 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x114e1305eefabd753d02f8140a08d328</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 172.16.1.10 dst 10.1.2.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0xb07520a7 reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0x9cd14cc3fd16c4780f8fb714fd083fbccbb26630 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x801047bbe092a3bca30f7d938fd94a3b</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 10.1.2.2 dst 172.16.1.10</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0xc259c0ec reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0x43eb34e0c29e9c8e4bf0b4be47e1deff2e7c32a0 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x2c0d85159e213dee7876cd8508a945e7</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 172.16.1.10 dst 10.1.2.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0x468f70f9 reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0x8daf260644eb32cf958b4fc67e6674123a4d2175 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x5908770ce43fe778944115953787fe64</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 10.1.2.2 dst 172.16.1.10</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0x1ff6106f reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0xd6eef64a653b77b6c5c68724dcbdb2a81d3efd6a 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x833e3d2c824519571d7df8ed948f501c</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnnj ~]$ ip route</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
default via 192.168.1.1 dev eth0 proto static metric 100 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.2.0/24 dev ens8 proto kernel scope link src 10.1.2.2 metric 101 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.3.0/24 dev ens9 proto kernel scope link src 10.1.3.2 metric 102 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.4.0/24 via 10.1.3.1 dev ens9 proto static metric 102 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
172.16.1.10 via 10.1.2.1 dev ens8 proto static metric 101 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.214 metric 100 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnnj ~]$ </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnca ~]$ sudo nmcli con mod tobr50 +ipv4.routes "172.16.1.2/32 10.1.5.1"</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnca ~]$ sudo systemctl restart network</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnca ~]$ sudo ip xfrm state</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 172.16.1.2 dst 10.1.5.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0x7729d983 reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0x783f... 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x114e...</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 10.1.5.2 dst 172.16.1.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0xc7c336b4 reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0x5c25... 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x2288...</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 172.16.1.2 dst 10.1.5.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0xc259c0ec reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0x43eb... 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x2c0d...</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 10.1.5.2 dst 172.16.1.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0xb07520a7 reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0x9cd1... 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x8010...</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 172.16.1.2 dst 10.1.5.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0x1ff6106f reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0xd6ee... 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x833e...</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
src 10.1.5.2 dst 172.16.1.2</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
proto esp spi 0x468f70f9 reqid 16389 mode tunnel</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
replay-window 32 flag af-unspec</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
auth-trunc hmac(sha1) 0x8daf... 96</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
enc cbc(aes) 0x5908...</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnca ~]$ ip route</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
default via 192.168.1.1 dev eth0 proto static metric 100 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.5.0/24 dev ens8 proto kernel scope link src 10.1.5.2 metric 101 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.6.0/24 dev ens9 proto kernel scope link src 10.1.6.2 metric 102 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
10.1.7.0/24 via 10.1.6.1 dev ens9 proto static metric 102 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
172.16.1.2 via 10.1.5.1 dev ens8 proto static metric 101 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.215 metric 100 </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
[sawozny@vpnca ~]$ </p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
This was how I had things working before I started messing around with nexthop. I can live with this as a workaround, but can anyone tell me what I did wrong with the use of nexthop?</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
Thanks,</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
<br>
</p>
<p style="margin-bottom: 0.1in; line-height: 115%;margin-bottom: 0in; line-height: 100%">
Scott</p>
<br>
</div>
</body>
</html>