<blockquote class="gmail_quote" style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; ">
<span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); ">You'd probably need to do some NAT to actually make<br>that happen too, and ensure the NAT rules don't bite IPsec.</span></blockquote>
<div><br></div><div>Besides enabling NAT_transversal, is there any additional configuration that I have to perform to get NAT-T working? Is there any way to test whether or not NAT is up and running?</div><div><br></div>
<div>-James</div><br><div class="gmail_quote">On Wed, Sep 14, 2011 at 11:09 AM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">On Wed, 14 Sep 2011, James Nelson wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
1) If the handshake occurs between the elastic ip and the client gateway,<br>
does the client see the traffic coming from the elastic IP or the<br>
10.5.5.5 encrypted domain?<br>
</blockquote>
<br></div>
The remote endpoint sees a UDP 4500 packet from the elastic ip (assuming<br>
the right end is outside the amazon cloud, else it sees the local ip),<br>
containing an IPsec packet that has after decryption results in a packet<br>
with source 10.5.5.5 and destination whatever the IP in the remote subnet.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
2) If the latter, is it possible to make it so that the traffic looks<br>
like its coming from the elastic ip?<br>
</blockquote>
<br></div>
You'd need to build a tunnel where you use left=elasticip instead<br>
of left=10.5.5.5. You'd probably need to do some NAT to actually make<br>
that happen too, and ensure the NAT rules don't bite IPsec.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
3) I have created in ifconfig ethX to be the encrypted domain. Do I have<br>
to add a change to the routing table to ensure traffic flows properly to<br>
the client?<br>
</blockquote>
<br></div>
You should never need to manually add/remove routes. IPsec policies will<br>
enforce src/dst on the packets, so routing random things into ipsec will<br>
never work.<br><font color="#888888">
<br>
Paul</font></blockquote></div>