<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Add overlapip=yes to both connections and see if that is enough ?<br><br><div dir="ltr">Sent using a virtual keyboard on a phone</div><div dir="ltr"><br><blockquote type="cite">On Jul 15, 2021, at 10:55, Wei Huang <wei.hu.huang@oracle.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I tried to set up 2 IPSec tunnels to remote site with same protected networks. Only one tunnel can be fully setup. The other one got the following error message:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Jul 13 21:58:48.166338: "MPLS_Group_2" #26: cannot route -- route already in use for "MPLS_Group_1"<br>
Jul 13 21:58:48.166352: "MPLS_Group_2" #26: encountered fatal error in state STATE_PARENT_I2<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Is this use case supported in libreswan? If yes, what do I need to do? Iam using Libreswan 3.32.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
My side's config:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
conn MPLS_Group_1
<div>left=10.0.0.6</div>
<div>leftsubnet=10.0.0.0/16</div>
<div><br>
</div>
<div>right=10.104.0.100</div>
<div>rightsubnet=10.104.0.0/16</div>
<div><br>
</div>
<div>authby=secret</div>
<div>nat-keepalive=yes</div>
<div>auto=start</div>
<div>rekey=yes</div>
<div>ikev2=yes</div>
<div>ike=aes128-sha2;dh5</div>
<div>ikelifetime=3600</div>
<div>dpdtimeout=300</div>
<div>dpddelay=15</div>
<div>phase2=esp</div>
<div>phase2alg=aes_gcm256-null</div>
<div>pfs=no</div>
<span>salifetime=86400</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>conn MPLS_Group_2
<div>left=10.0.0.6</div>
<div>leftsubnet=10.0.0.0/16</div>
<div><br>
</div>
<div>right=10.104.0.101</div>
<div>rightsubnet=10.104.0.0/16</div>
<div><br>
</div>
<div>authby=secret</div>
<div>nat-keepalive=yes</div>
<div>auto=start</div>
<div>rekey=yes</div>
<div>ikev2=yes</div>
<div>ike=aes128-sha2;dh5</div>
<div>ikelifetime=3600</div>
<div>dpdtimeout=300</div>
<div>dpddelay=15</div>
<div>phase2=esp</div>
<div>phase2alg=aes_gcm256-null</div>
<div>pfs=no</div>
<span>salifetime=86400</span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span><br>
</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span><br>
</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span>Remote site is 2 VMs, each has StrongSwan running. </span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span>Config on VM1:</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span>conn talari
<div> left=10.104.0.101</div>
<div> leftid=10.104.0.101</div>
<div> leftsubnet=10.104.1.0/16</div>
<div> leftauth=psk</div>
<div><br>
</div>
<div> right=10.0.0.6</div>
<div> rightid=10.0.0.6</div>
<div> rightsubnet=10.0.0.0/16</div>
<div> rightauth=psk</div>
<div> auto=start</div>
<div> ike=aes128-sha1-modp1536<br>
</div>
<div> esp=aes256gcm16<br>
</div>
<div><br>
</div>
<div>Config on VM2:</div>
<div>conn talari
<div> left=10.104.0.100</div>
<div> leftid=10.104.0.100</div>
<div> leftsubnet=10.104.1.0/16</div>
<div> leftauth=psk<br>
</div>
<div><br>
</div>
<div> right=10.0.0.6</div>
<div> rightid=10.0.0.6</div>
<div> rightsubnet=10.0.0.0/16</div>
<div> rightauth=psk</div>
<div> auto=start</div>
<div> ike=aes128-sha1-modp1536</div>
<span> esp=aes256gcm16</span><br>
</div>
<div><span><br>
</span></div>
<div><span><br>
</span></div>
<div><span>Thanks,</span></div>
<div><span>Wei</span></div>
</span></span></div>
<span>_______________________________________________</span><br><span>Swan mailing list</span><br><span>Swan@lists.libreswan.org</span><br><span>https://lists.libreswan.org/mailman/listinfo/swan</span><br></div></blockquote></body></html>