<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Hi,</div>
<div>I'm trying to setup a connection form a linux roadwarrior to checkpoint ng Firewall </div>
<div><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">client environment: debian wheezy 7.6 amd64, openswan 2.6.37-3+deb7u1, kernel </span>3.2.60-1+deb7u3 x86_64, NETKEY</div>
<div> </div>
<div>Topology:</div>
<div> </div>
<div>client (dhcp ip <span style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">192.168.1.11</span>)</div>
<div> |</div>
<div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> |</div>
</div>
<div><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">ADSL GW/NAT(public ip unknown)</span></div>
<div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> |</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> |</div>
(INTERNET)</div>
<div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> |</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> |</div>
<div><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">CP FIREWALL (public ip Y.Z.W.T)</span></div>
<div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> |</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> |</div>
</div>
<div><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">two subnets (</span><span style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">192.168.2.0/24 192.168.3.0/24)</span></div>
</div>
<div> </div>
<div><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">The connection works fine using this setup:</span></div>
<div> </div>
<div>
<div># /etc/ipsec.conf - Openswan IPsec configuration file</div>
<div>version 2.0 # conforms to second version of ipsec.conf specification</div>
<div>config setup<br/>
dumpdir=/var/run/pluto/<br/>
nat_traversal=yes<br/>
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10<br/>
oe=off<br/>
protostack=netkey # I set this to avoid warning message at connection startup</div>
<div> </div>
<div>conn roadwarrior<br/>
left=%defaultroute<br/>
leftsubnet=192.168.1.11/32 # client IP, I need to set it because I'm using also a "<span style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">rightsubnets" list</span><br/>
leftcert=client_crt.pem<br/>
leftrsasigkey=%cert<br/>
leftid=%fromcert<br/>
#<br/>
right=Y.Z.W.T<br/>
rightsubnets={ 192.168.2.0/24 192.168.3.0/24 }<br/>
rightcert=firewall_cert.pem<br/>
rightrsasigkey=%cert<br/>
rightid=Y.Z.W.T<br/>
#<br/>
auto=start</div>
</div>
<div> </div>
<div>PROBLEM: <span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">This setup works fine until I use client IP </span>192.168.1.11, which is registered and well known by checkpoint firewall as a valid client IP address.</div>
<div>BUT when I go home, my client gets a different ip (let's say <span style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">192.168.100.100), since at home I'm using a different subnet (to allow connections also to my office).</span></div>
<div> </div>
<div><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">Now, in my understanding, checkpoint has found a workaround to solve this issue.</span></div>
<div><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">Usually, under windows, roadwarrior clients connect to the CP firewalls using a dedicated software made by Checkpoint developers. </span></div>
<div><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">This software creates a virtual network interface, assigns to this interface the well known client ip (</span><span style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">192.168.1.11)</span><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;"> and route all traffic through this interface.</span></div>
<div><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">I've tested this software at my home and it works fine.</span></div>
<div> </div>
<div><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">I would like to mimic this behaviour under linux, so </span><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">I set an ip alias to my eth0; now my eth0 will have </span>192.168.100.100 (assigned by DHCP server) AND 192.168.1.11 which I set manually on the interface, BUT I found no working configuration for openswan.</div>
<div> </div>
<div> </div>
<div>Then I've done the following tests:</div>
<div> </div>
<div> </div>
<div>1) set <span style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">leftsubnet using the home network ip, i.e.: leftsubnet=192.168.100.100/32 (%defaultroute will automagically set to 192.168.100.100)</span></div>
<div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> Connection seems to be OK, I can read in the logs the following message:</div>
<div> STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x20906a71 <0x22c34963 xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=none DPD=none}</div>
<div><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;"> *** BUT *** </span><span style="font-family: Verdana, sans-serif, Arial, 'Trebuchet MS'; font-size: 13px; line-height: 1.6em;">ip route list shows that there is no route to servers</span></div>
</div>
<div> </div>
<div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">2) then I've add leftsourceip=192.168.1.11</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> Connection seems to be OK, I can read in the logs the following message:</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xcd521b9a <0xc6eb8d94 xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=none DPD=none}</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> ip route list shows that now the routes are available:</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> 192.168.3.0/24 dev eth0 scope link src 192.168.1.11</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> *** BUT *** if I try to connect to a server, I receive the message:</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> >ssh <span style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">192.168.3.10</span><br/>
>ssh: connect to host <span style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">192.168.3.10</span> port 22: No route to host</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> </div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">3) use leftsubnet=192.168.1.11/32 (that is the office subnet)</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> Connection cannot be established, in the logs I can see:</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> "roadwarrior/0x6" #1: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000<br/>
"roadwarrior/0x6" #1: received and ignored informational message</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> This is NOT working at all.</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> </div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">4) set leftsubnets={ 192.168.1.11/32 192.168.100.100/32}</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> at start I receive, after the usual message: "ipsec_setup: multiple ip addresses, using 192.168.100.100 on eth0"</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> the followin (more promising!) message: "ipsec_setup: defaulting leftsubnet to 192.168.1.11"</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> *** BUT *** in the logs, I see:</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> "roadwarrior/2x6" #1: ignoring informational payload, type INVALID_ID_INFORMATION msgid=00000000</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> "roadwarrior/2x6" #1: received and ignored informational message<br/>
"roadwarrior/1x2" #3: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2<br/>
"roadwarrior/1x2" #3: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xfcb61ef1 <0x228bfdf9 xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=none DPD=none}</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> so it looks like that really only the first subnet is working, and still I have "no route to host message" when I try to connect.</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> </div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">=== CONCLUSION ===</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> </div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">I guess that the 2 configuration is the right one, but I'm missing something...</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">Can someone help me?</div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;"> </div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">Thanks, </div>
<div style="font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px;">larzeni</div>
</div></div></body></html>