<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I tried to set up 2 IPSec tunnels to remote site with same protected networks. Only one tunnel can be fully setup. The other one got the following error message:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Jul 13 21:58:48.166338: "MPLS_Group_2" #26: cannot route -- route already in use for "MPLS_Group_1"<br>
Jul 13 21:58:48.166352: "MPLS_Group_2" #26: encountered fatal error in state STATE_PARENT_I2<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Is this use case supported in libreswan? If yes, what do I need to do? Iam using Libreswan 3.32.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
My side's config:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
conn MPLS_Group_1
<div>left=10.0.0.6</div>
<div>leftsubnet=10.0.0.0/16</div>
<div><br>
</div>
<div>right=10.104.0.100</div>
<div>rightsubnet=10.104.0.0/16</div>
<div><br>
</div>
<div>authby=secret</div>
<div>nat-keepalive=yes</div>
<div>auto=start</div>
<div>rekey=yes</div>
<div>ikev2=yes</div>
<div>ike=aes128-sha2;dh5</div>
<div>ikelifetime=3600</div>
<div>dpdtimeout=300</div>
<div>dpddelay=15</div>
<div>phase2=esp</div>
<div>phase2alg=aes_gcm256-null</div>
<div>pfs=no</div>
<span>salifetime=86400</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>conn MPLS_Group_2
<div>left=10.0.0.6</div>
<div>leftsubnet=10.0.0.0/16</div>
<div><br>
</div>
<div>right=10.104.0.101</div>
<div>rightsubnet=10.104.0.0/16</div>
<div><br>
</div>
<div>authby=secret</div>
<div>nat-keepalive=yes</div>
<div>auto=start</div>
<div>rekey=yes</div>
<div>ikev2=yes</div>
<div>ike=aes128-sha2;dh5</div>
<div>ikelifetime=3600</div>
<div>dpdtimeout=300</div>
<div>dpddelay=15</div>
<div>phase2=esp</div>
<div>phase2alg=aes_gcm256-null</div>
<div>pfs=no</div>
<span>salifetime=86400</span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span><br>
</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span><br>
</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span>Remote site is 2 VMs, each has StrongSwan running. </span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span>Config on VM1:</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span>conn talari
<div> left=10.104.0.101</div>
<div> leftid=10.104.0.101</div>
<div> leftsubnet=10.104.1.0/16</div>
<div> leftauth=psk</div>
<div><br>
</div>
<div> right=10.0.0.6</div>
<div> rightid=10.0.0.6</div>
<div> rightsubnet=10.0.0.0/16</div>
<div> rightauth=psk</div>
<div> auto=start</div>
<div> ike=aes128-sha1-modp1536<br>
</div>
<div> esp=aes256gcm16<br>
</div>
<div><br>
</div>
<div>Config on VM2:</div>
<div>conn talari
<div> left=10.104.0.100</div>
<div> leftid=10.104.0.100</div>
<div> leftsubnet=10.104.1.0/16</div>
<div> leftauth=psk<br>
</div>
<div><br>
</div>
<div> right=10.0.0.6</div>
<div> rightid=10.0.0.6</div>
<div> rightsubnet=10.0.0.0/16</div>
<div> rightauth=psk</div>
<div> auto=start</div>
<div> ike=aes128-sha1-modp1536</div>
<span> esp=aes256gcm16</span><br>
</div>
<div><span><br>
</span></div>
<div><span><br>
</span></div>
<div><span>Thanks,</span></div>
<div><span>Wei</span></div>
</span></span></div>
</body>
</html>