<div dir="ltr"><div>I am new in OpenSwan and ipsec, so please guide me carefully :)</div><div><br></div><div>My local network is <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a>. I need to get access to networks: 10.12.0.{0,1,2}/24</div><div>My "right" side owns some Cisco device and playing some kind of "hub" role asks me to set:</div><div><div> leftsubnet=<a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a></div><div> rightsubnet=<a href="http://10.12.0.0/16" target="_blank">10.12.0.0/16</a></div></div><div>If I am setting it that way I immediately loosing the connection to my local 3.0/24 network peers, And that looks obvious for me, because AFAIK, routing decision goes after encryption. Mediation to tcpdump, iptables counters and ip xfrm monitor outputs confirm my suggestions.</div><div><br></div><div>Can I tune my ipsec configuration somehow to fix it?</div><div><br></div><div>Before writing to this list I tried to fix it by tuning xfrm subsystem by removing overlapping networks, like:</div><div>leftupdown="/etc/ipsec.d/updown.sh"<br></div><div><br></div><div>cat /etc/ipsec.d/updown.sh</div><div><br></div><div><div>if [ $PLUTO_VERB = 'up-client' ] ; then</div><div> logger "$PLUTO_VERB detected. Will apply SUDOE xfrm patch. See $0 for details"</div><div> ip xfrm policy del dir in src <a href="http://10.12.0.0/16" target="_blank">10.12.0.0/16</a> dst <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> > /dev/null 2>&1</div><div> ip xfrm policy del dir fwd src <a href="http://10.12.0.0/16" target="_blank">10.12.0.0/16</a> dst <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> > /dev/null 2>&1</div><div> ip xfrm policy del dir out src <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> dst <a href="http://10.12.0.0/16" target="_blank">10.12.0.0/16</a> > /dev/null 2>&1</div><div> ip xfrm policy add dir in src <a href="http://10.12.2.0/24" target="_blank">10.12.2.0/24</a> dst <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> priority 16385 tmpl src 178.255.105.19 dst 193.52.26.135 proto esp reqid 16385 mode tunnel > /dev/null 2>&1</div><div> ip xfrm policy add dir fwd src <a href="http://10.12.2.0/24" target="_blank">10.12.2.0/24</a> dst <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> priority 16385 tmpl src 178.255.105.19 dst 193.52.26.135 proto esp reqid 16385 mode tunnel > /dev/null 2>&1</div><div> ip xfrm policy add dir out src <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> dst <a href="http://10.12.2.0/24" target="_blank">10.12.2.0/24</a> priority 16385 tmpl src 193.52.26.135 dst 178.255.105.19 proto esp reqid 16385 mode tunnel > /dev/null 2>&1</div><div> ip xfrm policy add dir fwd src <a href="http://10.12.1.0/24" target="_blank">10.12.1.0/24</a> dst <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> priority 16385 tmpl src 178.255.105.19 dst 193.52.26.135 proto esp reqid 16385 mode tunnel > /dev/null 2>&1</div><div> ip xfrm policy add dir out src <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> dst <a href="http://10.12.1.0/24" target="_blank">10.12.1.0/24</a> priority 16385 tmpl src 193.52.26.135 dst 178.255.105.19 proto esp reqid 16385 mode tunnel > /dev/null 2>&1</div><div> ip xfrm policy add dir in src <a href="http://10.12.0.0/24" target="_blank">10.12.0.0/24</a> dst <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> priority 16385 tmpl src 178.255.105.19 dst 193.52.26.135 proto esp reqid 16385 mode tunnel > /dev/null 2>&1</div><div> ip xfrm policy add dir fwd src <a href="http://10.12.0.0/24" target="_blank">10.12.0.0/24</a> dst <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> priority 16385 tmpl src 178.255.105.19 dst 193.52.26.135 proto esp reqid 16385 mode tunnel > /dev/null 2>&1</div><div> ip xfrm policy add dir out src <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> dst <a href="http://10.12.0.0/24" target="_blank">10.12.0.0/24</a> priority 16385 tmpl src 193.52.26.135 dst 178.255.105.19 proto esp reqid 16385 mode tunnel > /dev/null 2>&1</div></div><div><br></div><div>But it is working only for couple of hours. The overlapping record are back after some time:</div><div><div># ip xfrm policy | grep -A3 "\/16"</div><div>src <a href="http://10.12.3.0/24" target="_blank">10.12.3.0/24</a> dst <a href="http://10.12.0.0/16" target="_blank">10.12.0.0/16</a> </div><div> dir out priority 2352 ptype main </div><div> tmpl src 193.52.26.135 dst 178.255.105.19</div><div> proto esp reqid 16385 mode tunnel</div></div><div><br></div><div>And (that is very wierd) these lines are not dissapearing after restart ipsec service:</div><div><div># ip xfrm policy | grep "src 10"</div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.0.0/16">10.12.0.0/16</a> </div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.0.0/24">10.12.0.0/24</a> </div><div>src <a href="http://10.12.0.0/24">10.12.0.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.0.0/24">10.12.0.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.1.0/24">10.12.1.0/24</a> </div><div>src <a href="http://10.12.1.0/24">10.12.1.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.2.0/24">10.12.2.0/24</a> </div><div>src <a href="http://10.12.2.0/24">10.12.2.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.2.0/24">10.12.2.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div># service ipsec stop; service ipsec start</div><div>ipsec_setup: Stopping Openswan IPsec...</div><div>ipsec_setup: Starting Openswan IPsec U2.6.32/K2.6.32-431.el6.x86_64...</div><div>ipsec_setup: /usr/libexec/ipsec/addconn Non-fips mode set in /proc/sys/crypto/fips_enabled</div><div># ip xfrm policy | grep "src 10"</div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.0.0/16">10.12.0.0/16</a> </div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.0.0/24">10.12.0.0/24</a> </div><div>src <a href="http://10.12.0.0/24">10.12.0.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.0.0/24">10.12.0.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.1.0/24">10.12.1.0/24</a> </div><div>src <a href="http://10.12.1.0/24">10.12.1.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.2.0/24">10.12.2.0/24</a> </div><div>src <a href="http://10.12.2.0/24">10.12.2.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.2.0/24">10.12.2.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div></div><div><br></div><div>and going away only with manual deleting:</div><div><div># ip xfrm policy del dir out src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.0.0/16">10.12.0.0/16</a></div><div># ip xfrm policy | grep "src 10"</div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.0.0/24">10.12.0.0/24</a> </div><div>src <a href="http://10.12.0.0/24">10.12.0.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.0.0/24">10.12.0.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.1.0/24">10.12.1.0/24</a> </div><div>src <a href="http://10.12.1.0/24">10.12.1.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.2.0/24">10.12.2.0/24</a> </div><div>src <a href="http://10.12.2.0/24">10.12.2.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.2.0/24">10.12.2.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div># service ipsec stop; service ipsec start >/dev/null 2>&1</div><div>ipsec_setup: Stopping Openswan IPsec...</div><div># ip xfrm policy | grep "src 10"</div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.0.0/24">10.12.0.0/24</a> </div><div>src <a href="http://10.12.0.0/24">10.12.0.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.0.0/24">10.12.0.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.1.0/24">10.12.1.0/24</a> </div><div>src <a href="http://10.12.1.0/24">10.12.1.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.3.0/24">10.12.3.0/24</a> dst <a href="http://10.12.2.0/24">10.12.2.0/24</a> </div><div>src <a href="http://10.12.2.0/24">10.12.2.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div><div>src <a href="http://10.12.2.0/24">10.12.2.0/24</a> dst <a href="http://10.12.3.0/24">10.12.3.0/24</a> </div></div><div><br></div><div>So I have 3 options to fix it:</div><div>1) To make "right" side not to use overlapping networks</div><div>2) To tune ipsec configuration</div><div>3) To fix xfrm permanent</div><div><br></div><div>My versions:</div><div><div># uname -r</div><div>2.6.32-431.el6.x86_64</div></div><div><div># cat /etc/redhat-release </div><div>Scientific Linux release 6.6 (Carbon)</div></div><div><div># rpm -qf /etc/ipsec.conf</div><div>openswan-2.6.32-37.el6.x86_64</div></div><div><div># ipsec --version</div><div>Linux Openswan U2.6.32/K2.6.32-431.el6.x86_64 (netkey)</div></div><div><br></div><div>Thank you in advance.</div><br clear="all"><div><div><div dir="ltr">Kind regards,<div>Dmitry</div></div></div></div>
</div>