<div dir="ltr">I've figured this out now.<div><br></div><div>It appears that the Cisco ASA treats each access-list rule as a separate connection and your ipsec.conf needs to have a connection for each server eg:</div><div><br></div><div><div><font face="monospace, monospace">config setup</font></div><div><font face="monospace, monospace"> protostack=netkey</font></div><div><font face="monospace, monospace"> klipsdebug="none"</font></div><div><font face="monospace, monospace"> plutodebug="none"</font></div><div><font face="monospace, monospace"> uniqueids=yes</font></div><div><font face="monospace, monospace"> nat_traversal=yes</font></div></div><div><font face="monospace, monospace"> virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.123.0/255.255.255.0,%v4:!10.0.123.123/255.255.255.255,%v4:!10.0.123.124/255.255.255.255">10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.123.0/255.255.255.0,%v4:!10.0.123.123/255.255.255.255,%v4:!10.0.123.124/255.255.255.255</a><br></font></div><div><font face="monospace, monospace"><br></font></div><div><div><font face="monospace, monospace">conn %default</font></div><div><font face="monospace, monospace"> keyingtries=0</font></div><div><font face="monospace, monospace"> disablearrivalcheck=no</font></div><div><font face="monospace, monospace"> leftupdown=/usr/local/bin/ipsecupdown.sh</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">#</font></div><div><font face="monospace, monospace"># net-2-net to RED</font></div><div><font face="monospace, monospace">conn Site2</font></div><div><font face="monospace, monospace"> left=<public IP - site1></font></div><div><font face="monospace, monospace"> leftsubnet=<a href="http://192.168.123.0/255.255.255.0">192.168.123.0/255.255.255.0</a></font></div><div><font face="monospace, monospace"> right=<public IP - site2></font></div><div><font face="monospace, monospace"> ike=aes256-sha-modp1024</font></div><div><font face="monospace, monospace"> esp=aes256-sha1</font></div><div><font face="monospace, monospace"> ikelifetime=8h</font></div><div><font face="monospace, monospace"> keylife=8h</font></div><div><font face="monospace, monospace"> dpddelay=30</font></div><div><font face="monospace, monospace"> dpdtimeout=120</font></div><div><font face="monospace, monospace"> dpdaction=hold</font></div><div><font face="monospace, monospace"> pfs=no</font></div><div><font face="monospace, monospace"> authby=secret</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"># Server 1</font></div><div><font face="monospace, monospace">conn Site2-Server1</font></div><div><font face="monospace, monospace"> also=Site2</font></div><div><font face="monospace, monospace"> rightsubnet=<a href="http://10.0.123.123/255.255.255.255">10.0.123.123/255.255.255.255</a></font></div><div><font face="monospace, monospace"> auto=start</font></div><div><br></div><div><span style="font-family:monospace,monospace"># Server 2</span><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">conn Site2-Server2</font></div><div><font face="monospace, monospace"> also=Site2</font></div><div><font face="monospace, monospace"> rightsubnet=<a href="http://10.0.123.124/255.255.255.255">10.0.123.124/255.255.255.255</a></font></div><div><font face="monospace, monospace"> auto=start</font></div></div><div><br></div><div>Best,</div><div>James</div><div><br></div><div class="gmail_extra"><div><div class="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><font size="2"><br></font></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On 28 April 2016 at 13:54, Patrick Naubert <span dir="ltr"><<a href="mailto:patrickn@xelerance.com" target="_blank">patrickn@xelerance.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">Rescued from the spam bucket. Please remember to subscribe to the mailing list before posting to it.<br><div><br><div><div><span style="font-family:-webkit-system-font,'Helvetica Neue',Helvetica,sans-serif;color:rgb(127,127,127)"><b>From: </b></span><span style="font-family:-webkit-system-font,'Helvetica Neue',Helvetica,sans-serif">James Bewley <<a href="mailto:james.bewley@telemisis.com" target="_blank">james.bewley@telemisis.com</a>></span></div><div><div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px"><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif;color:rgba(127,127,127,1.0)"><b>Subject: </b></span><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif"><b>OpenSwan to Cisco ASA with Access Control Lists</b><br></span></div><div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px"><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif;color:rgba(127,127,127,1.0)"><b>Date: </b></span><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif">April 28, 2016 at 5:02:49 AM EDT<br></span></div><div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px"><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif;color:rgba(127,127,127,1.0)"><b>To: </b></span><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif"><a href="mailto:users@lists.openswan.org" target="_blank">users@lists.openswan.org</a><br></span></div><br><br><div dir="ltr">Hi,<div><br></div><div>I am using IPCop which uses OpenSwan under the hood for IPSec. I am trying to set-up a tunnel between this router and a remote site (Cisco ASA).</div><div><br></div><div>With a simple setup bridging both networks works and I can get traffic through the tunnel in both directions across the entire IP range.</div><div><br></div><div>The remote site now wants to limit the access using an ACL and informs me that our end will also need to implement this ACL for the connection to be established. Once they apply the ACL the IPSec tunnel goes down so assume he is right.</div><div><br></div><div>So, how do I configure OpenSwan to match the ACL; do i need to defined a 'subnet' for each remote IP address? Is there another way?</div><div><br></div><div><div><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><br>Best,<br><font size="2">James <br></font></div></div></div></div></div></div></div></div>
</div></div>
<br><br></div></div></div><br></div><br>_______________________________________________<br>
<a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" rel="noreferrer" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" rel="noreferrer" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br></blockquote></div><br></div></div>