Hi,<br>
It seems , dynamic update of the other ends IP address in NAT traversal is not supported in OpenSwan. <br>
According to rfc4306, it should be supported as part of NAT traversal.
Please find the topology and issue I m facing out of this.<br>
<br>
<br>
Cisco <br>
VPN client -------------- Router1 ------------------------------------- VPN Sever(OpenSwan)<br>
<br>
20.1.1.1 20.1.1.2 50.1.1.226 50.1.1.227<br>
(eth1)<br>
Iptables<br>
++++++<br>
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE.<br>
<br>
I have established a VPN connection between VPN client and VPN server with the natted IP 50.1.1.226 to 50.1.1.227.<br>
After some time , eth1 interface IP address have got changed as
50.1.1.228 in eth1 of router 1, and tunnel gets disturbed by throwing
the following error.<br>
<br>
<br>
Mar 30 14:52:54 uxcasxxx pluto[26817]: "cisco-vpn"[10] <a href="http://50.1.1.226:1797">50.1.1.226:1797</a>
#17: nat_traversal_new_mapping: address change currently not supported
[<a href="http://50.1.1.226:1797">50.1.1.226:1797</a>,<a href="http://50.1.1.228:1797">50.1.1.228:1797</a>]<br>
Mar 30 14:52:56 uxcasxxx pluto[26817]: "cisco-vpn"[10] <a href="http://50.1.1.226:1797">50.1.1.226:1797</a>
#17: nat_traversal_new_mapping: address change currently not supported
[<a href="http://50.1.1.226:1797">50.1.1.226:1797</a>,<a href="http://50.1.1.228:1797">50.1.1.228:1797</a>]<br>
Mar 30 14:52:59 uxcasxxx pluto[26817]: packet from <a href="http://50.1.1.228:1797">50.1.1.228:1797</a>: Informational Exchange is for an unknown (expired?) SA<br>
Mar 30 14:53:00 uxcasxxx pluto[26817]: ERROR: asynchronous network error
report on eth0 for message to 50.1.1.226 port 1797, complainant
<a href="http://50.1.1.227">50.1.1.227</a>: No route to host [errno 113, origin ICMP type 3 code 1 (not
authenticated)]<br>
Mar 30 14:53:00 uxcasxxx pluto[26817]: ERROR: asynchronous network error
report on eth0 for message to 50.1.1.226 port 1797, complainant
<a href="http://50.1.1.227">50.1.1.227</a>: No route to host [errno 113, origin ICMP type 3 code 1 (not
authenticated)]<br>
Mar 30 14:53:04 uxcasxxx pluto[26817]: packet from <a href="http://50.1.1.228:1797">50.1.1.228:1797</a>: Informational Exchange is for an unknown (expired?) SA<br>
Mar 30 14:53:09 uxcasxxx pluto[26817]: packet from <a href="http://50.1.1.228:1797">50.1.1.228:1797</a>: Informational Exchange is for an unknown (expired?) SA<br>
Mar 30 14:53:14 uxcasxxx pluto[26817]: packet from <a href="http://50.1.1.228:1797">50.1.1.228:1797</a>: Informational Exchange is for an unknown (expired?) SA<br>
Mar 30 14:53:19 uxcasxxx pluto[26817]: packet from <a href="http://50.1.1.228:1797">50.1.1.228:1797</a>: Informational Exchange is for an unknown (expired?) SA<br>
<br>
Do Openswan have planned to implement dynamic IP address update feature in NAT-T ??<br>
<br>
<br>
Regards,<br>
Saravanan N<br>