<span style="font-family: courier new,monospace;">Hi,</span><br style="font-family: courier new,monospace;"><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">I have a question regarding the eroute selection in KLIPS. We have a big network and we want to build a sort of hierarchical VPN network. We have many branch offices that are subordinate to a regional office and all regional offices are subordinate to the central office.
</span><br style="font-family: courier new,monospace;"><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">Example address plan:</span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;">Branch Office1 - </span><a style="font-family: courier new,monospace;" href="http://10.2.10.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.2.10.0/24
</a><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">Branch Office2 - </span><a style="font-family: courier new,monospace;" href="http://10.2.11.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
10.2.11.0/24</a><br style="font-family: courier new,monospace;"><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">Regional Office1: </span><a style="font-family: courier new,monospace;" href="http://10.2.0.0/16" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
10.2.0.0/16
</a><span style="font-family: courier new,monospace;"> - this network includes the network in the regional office itself and the networks in the branch offices subordinate to this regional office(e.g. both of the above branches are subordinate to this one).
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">Regional Office2:
</span><a style="font-family: courier new,monospace;" href="http://10.3.0.0/16" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.3.0.0/16</a><span style="font-family: courier new,monospace;"> and so on...
</span><br style="font-family: courier new,monospace;"><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">Central Office: </span><a style="font-family: courier new,monospace;" href="http://10.0.0.0/16" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
10.0.0.0/16</a><br style="font-family: courier new,monospace;"><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">We want to build IPsec connections like this:</span><br style="font-family: courier new,monospace;">
<br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> <a href="http://10.2.0.0/24">10.2.0.0/24</a></span><br style="font-family: courier new,monospace;">
<span style="font-family: courier new,monospace;"> |</span><br style="font-family: courier new,monospace;"><a style="font-family: courier new,monospace;" href="http://10.2.10.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
10.2.10.0/24
</a><span style="font-family: courier new,monospace;"> ----- RBO1 =====\ |</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> |===== RRO1 =====\
<br><a href="http://10.2.11.0/24">10.2.11.0/24</a> ----- RBO2 =====/ |======== RCO ------- <a href="http://10.0.0.0/24">10.0.0.0/24</a><br> |<br> ===== RRO2 =====/
</span><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;"> (net <a href="http://10.3.0.0/16">10.3.0.0/16</a>)<br><br>Where:<br> RBO - Router Branch Office
<br> RRO - Router Regional Office<br> RCO - Router Central Office<br> "=" - IPsec tunnel<br> "-" - Connection to LAN<br><br>We want to build the net this way in order the RROs to be able to enforce policies on branch offices interconnections and RCO to enforce policies on Regional Offices interconnections.
<br><br>But we have problems because eroute is selected based on source IP first. For example:<br>eroute branch office:<br>84 <a href="http://10.2.10.0/24">10.2.10.0/24</a> -> <a href="http://0.0.0.0/0">0.0.0.0/0
</a> => <a href="mailto:tun0x10c2@X.X.X.X">tun0x10c2@X.X.X.X</a><br>i.e. we want all traffic to be forwarded through the tunnel to the RRO. No problems here.<br><br>eroute regional office:<br>108 <a href="http://0.0.0.0/0">
0.0.0.0/0</a> -> <a href="http://10.2.10.0/24">10.2.10.0/24</a> => <a href="mailto:tun0x1012@X.X.X.X">tun0x1012@X.X.X.X</a> (to branch office)<br>299 <a href="http://10.2.0.0/16">10.2.0.0/16</a>
-> <a href="http://10.0.0.0/8">10.0.0.0/8</a> => <a href="mailto:tun0x1014@X.X.X.X">tun0x1014@X.X.X.X</a> (to the central and other Regional Offices)<br><br>The problem that I see is with this eroutes. Let see what happens when an user from the Regional Office 1 LAN want to send packet to the branch office.
<br>For example:<br><a href="http://10.2.0.1">10.2.0.1</a> -> <a href="http://10.2.10.1">10.2.10.1</a><br><br>The route is selected based on the best matched source address first, so the KLIPS tries to send the packet to the
</span><span style="font-family: courier new,monospace;"><a href="http://10.2.0.0/16">10.2.0.0/16</a> -> <a href="http://10.0.0.0/8">10.0.0.0/8</a> eroute, instead of </span><span style="font-family: courier new,monospace;">
<a href="http://0.0.0.0/0">0.0.0.0/0</a> -> <a href="http://10.2.10.0/24">10.2.10.0/24</a>. So the packet is sent to Central Office and not to Branch Office.<br><br>Is there way to override this eroute selection algorithm?
<br><br>Thank you for your patience :).<br><br>Best Regards,<br>Vassil<br></span><span style="font-family: courier new,monospace;"><br><br><br><br style="font-family: courier new,monospace;"></span>