[Openswan Users] rightsubnet limitation

[Fabio Corazza]

Andy wrote:
> On Tue, 2006-06-13 at 16:27 +0100, Fabio Corazza wrote:
[cut]
>> This is the configuration needed to work. There's an issue with the
>> "rightsubnet" parameter, you can just specify a subnet or a single host.
>> The Cisco wants this parameter to be configured as the singlehost in the
>> above configuration, while in the Cisco access list there are more than
>> 1 IP allowed to access (also from different class C subnets).
> 
> Shouldn't be a problem. If the Cisco has multiple access list entries
> for the crypto map, each entry will map to 1 ESP SA. Doesn't matter if
> they are entire subnets or single hosts - really a single host,
> specified as a /32 address, is just a special case of a subnet.
> 
> So just duplicate the config you have changing only the rightsubnet (and
> the conn name, of course) so you have 1 conn for each ACL entry. 
> 
> Because left= and right= are the same in each conn, only 1 ISAKMP SA
> will be used, but you'll get 1 ESP SA for each conn.
> 
> Hope that's clear....
[cut]

Thank you very much Andy, that did the trick.
Really appreciated! :-)


Thanks,
Fabio