<html><body>
<p><font size="2" face="sans-serif">Thanks Nick and Daniel.</font><br>
<br>
<font size="2" face="sans-serif">my gateway.conf is using "auto=add" and as Nick pointed out it should route automatically so something else going on.</font><br>
<font size="2" face="sans-serif">I sent a separate email showing my entire configuration in case you guys see something wrong.</font><br>
<font size="2" face="sans-serif">In this email my main question was when using a configuration that uses %any it looks like pluto assigns each tunnel an index number. So if my gateway.conf uses a connection name of gateway-conn then doing an "ipsec auto status" will show </font><br>
<font size="2" face="sans-serif">"gateway-conn"[1] 10.62.66.49:500...</font><br>
<font size="2" face="sans-serif">"gateway-conn"[2] 10.62.66.50:500...</font><br>
<font size="2" face="sans-serif">using an index [x] for each connection. </font><br>
<br>
<font size="2" face="sans-serif">Now if I want to do a "ipsec auto --delete <connection-name>" for just gateway-conn[2] what connection name do I use?</font><br>
<br>
<font size="2" face="sans-serif">Thanks</font><br>
<br>
<br>
<font size="2" face="sans-serif">Jesse N. Perez<br>
IBM Software Group | Cloud and Smarter Infrastructure Division<br>
(352) 341-3872 | perezje@us.ibm.com<br>
</font><br>
<br>
<img width="16" height="16" src="cid:1__=0ABBF4C4DFFC0A438f9e8a93df938@us.ibm.com" border="0" alt="Inactive hide details for Daniel Cave ---05/28/2015 09:41:33 AM---Jesse, are your 'connections' listed and setup as 'backup' vp"><font size="2" color="#424282" face="sans-serif">Daniel Cave ---05/28/2015 09:41:33 AM---Jesse, are your 'connections' listed and setup as 'backup' vpn tunnels? Have you set them up like Ni</font><br>
<br>
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBF4C4DFFC0A438f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<ul style="padding-left: 4pt"><font size="1" color="#5F5F5F" face="sans-serif">From:</font></ul>
</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBF4C4DFFC0A438f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="1" face="sans-serif">Daniel Cave <dan.cave@icloud.com></font></td></tr>
<tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBF4C4DFFC0A438f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<ul style="padding-left: 4pt"><font size="1" color="#5F5F5F" face="sans-serif">To:</font></ul>
</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBF4C4DFFC0A438f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="1" face="sans-serif">Jesse N Perez/Tampa/IBM@IBMUS</font></td></tr>
<tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBF4C4DFFC0A438f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<ul style="padding-left: 4pt"><font size="1" color="#5F5F5F" face="sans-serif">Cc:</font></ul>
</td><td width="100%" valign="middle"><img width="1" height="1" src="cid:2__=0ABBF4C4DFFC0A438f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="1" face="sans-serif">users@lists.openswan.org</font></td></tr>
<tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBF4C4DFFC0A438f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<ul style="padding-left: 4pt"><font size="1" color="#5F5F5F" face="sans-serif">Date:</font></ul>
</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBF4C4DFFC0A438f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="1" face="sans-serif">05/28/2015 09:41 AM</font></td></tr>
<tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBF4C4DFFC0A438f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<ul style="padding-left: 4pt"><font size="1" color="#5F5F5F" face="sans-serif">Subject:</font></ul>
</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBF4C4DFFC0A438f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="1" face="sans-serif">Re: [Openswan Users] Determing connection name</font></td></tr>
</table>
<hr width="100%" size="2" align="left" noshade style="color:#8091A5; "><br>
<br>
<br>
<font size="3" face="serif">Jesse, are your 'connections' listed and setup as 'backup' vpn tunnels?</font><br>
<br>
<font size="3" face="serif">Have you set them up like Nick says, as 'auto=add' or can you just 'parse' the /etc/ipsec.conf by looking for the string "conn [xxxx]" then using some scripting to work out what you're trying to do ?</font><br>
<br>
<font size="3" face="serif">I also noticed from the ipsec.conf man page, there's an option called 'leftupdown' which you can define as a script and run to adjust routing/firewalling when the status of the connection changes.. you might want to look into that.</font><br>
<font size="3" face="serif"><br>
On May 28, 2015, at 08:03 AM, Nick Howitt <nick@howitts.co.uk> wrote:<br>
</font>
<ul style="padding-left: 36pt"><font size="3" face="serif">I don't think you see the correct conn name until Quick Mode is <br>
negotiated. In Main Mode it can pick any valid conn name to match <br>
against. If you are using "auto=add" in your conn, it should route <br>
automatically. This looks more like a configuration error with a failed <br>
negotiation rather than a failure to route.<br>
<br>
Regards,<br>
<br>
Nick<br>
<br>
On 2015-05-28 01:40, Jesse N Perez wrote:</font>
<ul style="padding-left: 36pt"><font size="3" face="serif">I'm looking for a way to determine the connection name that I can use</font><br>
<font size="3" face="serif">in a call to "ipsec auto --route <conn-name>" for a gateway.conf using</font><br>
<font size="3" face="serif">"right=%any"</font><br>
<br>
<font size="3" face="serif">When I do a "ipsec auto --status | grep 10.107.76.160" I get...</font><br>
<font size="3" face="serif">000 "gateway-conn"[4682]:</font><br>
<font size="3" face="serif">10.60.87.6<10.60.87.6>[+S=C]...10.107.76.160[+S=C]; unrouted; eroute</font><br>
<font size="3" face="serif">owner: #0</font><br>
<font size="3" face="serif">000 #34977: "gateway-conn"[4682] 10.107.76.160:500 STATE_MAIN_R2</font><br>
<font size="3" face="serif">(sent MR2, expecting MI3); EVENT_RETRANSMIT in 19s; lastdpd=-1s(seq</font><br>
<font size="3" face="serif">in:0 out:0); idle; import:not set</font><br>
<br>
<font size="3" face="serif">and see its unrouted. Note the conn-name is shown as</font><br>
<font size="3" face="serif">gateway-conn[4682] where 4682 is the index number pluto must have</font><br>
<font size="3" face="serif">chosen for this connection.</font><br>
<br>
<font size="3" face="serif">So if I want to route this connection using "ipsec auto --route</font><br>
<font size="3" face="serif"><conn-name>" how can I find the connection name?</font><br>
<br>
<font size="3" face="serif">Thanks,</font><br>
<br>
<font size="3" face="serif">Jesse N. Perez</font></ul>
<br>
<br>
</ul>
</body></html>