<div dir="ltr">On Wed, Apr 13, 2016 at 2:31 PM, John Whiteside <span dir="ltr"><<a href="mailto:john.whiteside@orionhealth.com" target="_blank">john.whiteside@orionhealth.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>
<div>
<div>Its due to high availability requirements. Its just a backup if the softwaregoes down on one node</div></div></div></div></blockquote><div><br></div><div style="">You could also set up both IPSec and OpenVPN tunnels and run a routing protocol over them to prefer one (or load balance) that way if one dies your routing protocol keeps things reachable. And they're both VPNs so your data is still confidential.</div><div style=""><br></div><div style="">Broadcast and multicast traffic over IPSec won't work. Though there at least 2 options: unless tunneled in GRE ... so that's GRE within IPSec _OR_ set your routing protocol to use unicast instead of multicast.</div><div style=""><a href="https://www.centos.org/forums/viewtopic.php?f=17&t=42315">https://www.centos.org/forums/viewtopic.php?f=17&t=42315</a><br></div><div style=""><a href="http://openmaniak.com/openvpn_routing.php">http://openmaniak.com/openvpn_routing.php</a><br></div><div style=""><br></div><div style="">If you truly want plain text, my GRE tunnel suggestion still applies too (along with a routing protocol).</div><div style=""><a href="https://www.linickx.com/gre-example-for-centosrhel">https://www.linickx.com/gre-example-for-centosrhel</a><br></div><div style=""><a href="http://lartc.org/howto/lartc.tunnel.gre.html">http://lartc.org/howto/lartc.tunnel.gre.html</a><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif"><div><div>
</div>
</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;border-width:1pt medium medium;border-style:solid none none;padding:3pt 0in 0in;border-top-color:rgb(181,196,223)">
<span style="font-weight:bold">From: </span>Mike - st257 <<a href="mailto:silvertip257@gmail.com" target="_blank">silvertip257@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, 13 April 2016 6:08 pm<br>
<span style="font-weight:bold">To: </span>John Whiteside <<a href="mailto:john.whiteside@orionhealth.com" target="_blank">john.whiteside@orionhealth.com</a>>, "<a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a>" <<a href="mailto:users@lists.openswan.org" target="_blank">users@lists.openswan.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openswan Users] Revert to non encrypted traffic if IPSEC down<br>
</div><div><div class="h5">
<div><br>
</div>
<div>
<div>
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, Apr 13, 2016 at 4:34 AM, John Whiteside <span dir="ltr">
<<a href="mailto:john.whiteside@orionhealth.com" target="_blank">john.whiteside@orionhealth.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Hi,<br>
<br>
Thanks for the response - unfortunately I¹m not sure what you mean - I<br>
have been testing this in AWS on RHEL6.6 with no firewalls or filtering<br>
between the nodes. If I run openswan on one node and not the other, no<br>
comms are possible between the nodes. Is it possible to configure<br>
openswan to revert to non encrypted comms if one nodes software is down?<br>
</blockquote>
<div><br>
</div>
<div>I'm troubled by this ... why would you want to do this?!</div>
<div><br>
</div>
<div>I guess if you want to, you could set up a GRE tunnel. On that GRE and IPSec tunnel run something to monitor connectivity and then fail over to the one that's working (a routing protocol would fit there).</div>
<div><br>
</div>
<div>BUT I'd recommend ditching any plain text communication all together.</div>
<div>In a world with wiretapping and so forth, plain text is strongly discouraged.</div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
<br>
Thanks<br>
<br>
<br>
<br>
On 9/04/16 9:15 am, "Daniel Cave" <<a href="mailto:dan.cave@me.com" target="_blank">dan.cave@me.com</a>> wrote:<br>
<br>
>Just allow ip connections from each host on the respective opposite<br>
>firewalls if you are using static ips that is<br>
><br>
>Sent from my iPhone<br>
><br>
>> On 8 Apr 2016, at 15:06, John Whiteside<br>
>><<a href="mailto:john.whiteside@orionhealth.com" target="_blank">john.whiteside@orionhealth.com</a>> wrote:<br>
>><br>
>> Hi,<br>
>><br>
>> I¹m new to configuring openswan and if I have configured IPSEC between<br>
>>two nodes, and one node is not running the openswan software, it seems<br>
>>to block all traffic between the two nodes. Whilst this seems sensible<br>
>>I¹d like to know if its possible to configure the connections so that if<br>
>>one node is not running openswan, it defaults to allowing non tunneled<br>
>>communication.<br>
>><br>
>> Many thanks,<br>
>><br>
>> John<br>
>> _______________________________________________<br>
>> <a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a><br>
>> <a href="https://lists.openswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">
https://lists.openswan.org/mailman/listinfo/users</a><br>
>> Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" rel="noreferrer" target="_blank">
https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
>> Building and Integrating Virtual Private Networks with Openswan:<br>
>> <a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" rel="noreferrer" target="_blank">
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
<br>
_______________________________________________<br>
<a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" rel="noreferrer" target="_blank">
https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" rel="noreferrer" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div>---~~.~~---<br>
Mike<br>
// SilverTip257 //</div>
</div>
</div>
</div>
</div>
</div></div></span>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">---~~.~~---<br>Mike<br>// SilverTip257 //</div>
</div></div>