<div dir="ltr"><div style="color:rgb(0,0,0);font-size:12.8px">Hi All</div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">Thank you for supporting this important opensource initiative. </div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">I'm using openswan(2.6.37)/netkey running on an AWS/EC2/Ubuntu/14.04 machine to connect to a CheckPoint device where the CP device is configured to establish an SA per GW (as oppose per subnet pair)</div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">This means that the negotiated subnets during IPSec phase that the CP devices will send and accept are<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> and <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">The connection can be established but once the IPSec phase is complete it will install xfrm policies that will shutdown communication (src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> [in/out/fwd]...)</div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">Since openswan installs xfrm policies automatically I thought to use the leftupdown option to write a script that manage xfrm policies myself (basically allow the wildcard to be negotiated during IPSec phase but afterwards install a more specific xfrm policies so communication will not shutdown.</div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">My script works fine until IPSec re-key happens, once re-key happens swan installs an xfrm policy w/o making a call to the leftupdown script I provide. The new installed xfrm policy is not complete and looks like this (I call it partial since it only deploy the "out" policy w/o the "in" and "fwd") </div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">Here is how the partial policy it looks like </div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div><div style="color:rgb(0,0,0);font-size:12.8px"><span style="white-space:pre-wrap"> </span>dir out priority 3128</div><div style="color:rgb(0,0,0);font-size:12.8px"><span style="white-space:pre-wrap"> </span>tmpl src <my ip> dst <remote ip></div><div style="color:rgb(0,0,0);font-size:12.8px"><span style="white-space:pre-wrap"> </span>proto esp reqid 16401 mode tunnel </div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">The above policy also shut down my communication to/from the machine.</div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">Here is my connection config...</div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px"><div>conn connLG</div><div> connaddrfamily=ipv4</div><div><span style="white-space:pre-wrap"> </span>authby=secret</div><div><span style="white-space:pre-wrap"> </span>dpdaction=restart_by_peer</div><div><span style="white-space:pre-wrap"> </span>dpddelay=30</div><div><span style="white-space:pre-wrap"> </span>dpdtimeout=120</div><div><span style="white-space:pre-wrap"> </span>forceencaps=yes</div><div><span style="white-space:pre-wrap"> </span>ike=aes128-sha1;modp1024</div><div><span style="white-space:pre-wrap"> </span>ikelifetime=86400s</div><div><span style="white-space:pre-wrap"> </span>keyingtries=3</div><div><span style="white-space:pre-wrap"> </span>left=<my ip></div><div><span style="white-space:pre-wrap"> </span>leftid=<mu id></div><div><span style="white-space:pre-wrap"> </span>leftsubnets=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div><div> leftupdown="/etc/ipsec.d/myUpDown.sh"</div><div><span style="white-space:pre-wrap"> </span>pfs=yes</div><div><span style="white-space:pre-wrap"> </span>phase2alg=aes128-sha1</div><div><span style="white-space:pre-wrap"> </span>right=<right ip></div><div><span style="white-space:pre-wrap"> </span>rightid=<right id></div><div><span style="white-space:pre-wrap"> </span>rightsubnets=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div><div><span style="white-space:pre-wrap"> </span>salifetime=180s</div></div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">My questions are:</div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">1) Is this the right way to do it (how else can i connect to a peer device that negotiates wildcard subnets)?</div><div style="color:rgb(0,0,0);font-size:12.8px">2) How can I better control xfrm policies (there are more options I would like to use like mark and using multiple tmpl in the same policy) that are not supported by <span style="font-size:12.8px">openswan</span>?</div><div style="color:rgb(0,0,0);font-size:12.8px">3) Is the <span style="line-height:19.2px">behaviour</span> I described above regarding IPSec re-key and partial xfrm policy instrumentation is a known issue or am I missing something here in how it should work?</div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div style="color:rgb(0,0,0);font-size:12.8px">Will appreciate any response regarding this one</div><div style="color:rgb(0,0,0);font-size:12.8px"> </div><div style="color:rgb(0,0,0);font-size:12.8px">Kind Regards,</div><div style="color:rgb(0,0,0);font-size:12.8px"><br></div><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div style="color:rgb(0,0,0)"><div style="color:rgb(136,136,136);font-size:12.8px"><b><font color="#000000"><span>Amir</span> Naftali</font></b> | <b><font face="arial, helvetica, sans-serif"><font color="#0000ff">CTO and Co-Founder</font> | </font>+972 54 497 2622</b></div><div style="color:rgb(136,136,136);font-size:12.8px"><br></div><div style="color:rgb(136,136,136);font-size:12.8px"><a href="http://www.fortycloud.com/?utm_campaign=amir_email&utm_medium=email&utm_source=signature&utm_content=link&utm_term=amir_sig" style="color:rgb(0,0,255);font-family:'Courier New';font-size:14px;line-height:21px" target="_blank"><img align="none" height="37" src="https://gallery.mailchimp.com/805c65e3dbe647f677fe8ee38/images/bde29e88-9385-4f4b-ae97-60c704de1547.png" width="200" alt="" style="width: 200px; min-height: 37px; margin: 0px;"></a><br></div></div></div></div></div></div></div>
</div>