Hello,
After the upgrade from 1.8.5 to 1.9.0, something very strange is happening now and my tunnels are down.
I have a dual-wan setup(failback/failover) and my ipsec is replying through another interface.
1.1.1.1 is my pppoe0 IP
2.2.2.2 is my remote IP on a datacenter
3.3.3.3 is my eth2 IP(dhcp)
strongswan replying using the other interface:
root@erl01:~# tcpdump -i pppoe0 -n host 2.2.2.2 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on pppoe0, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes 15:41:50.652064 IP 2.2.2.2 > 1.1.1.1: ESP(spi=0xc315f5a3,seq=0x9a), length 116 15:42:00.651811 IP 2.2.2.2 > 1.1.1.1: ESP(spi=0xc315f5a3,seq=0x9b), length 116 root@erl01:~# tcpdump -i eth2 -n host 2.2.2.2 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes 15:41:54.602056 IP 1.1.1.1 > 2.2.2.2: ESP(spi=0x054cf9d4,seq=0x87), length 116 15:42:03.605475 IP 1.1.1.1 > 2.2.2.2: ESP(spi=0x054cf9d4,seq=0x88), length 116 2 packets captured 2 packets received by filter 0 packets dropped by kernel
pppoe0 is the default route, eth2 is the "backup".
# ip ro default dev pppoe0 scope link 1.1.1.1 dev pppoe0 proto kernel scope link 3.3.3.0/24 dev eth2 proto kernel scope link src 3.3.3.3 4.4.4.4 dev pppoe0 proto kernel scope link src 1.1.1.1
My configuration is below:
auto-firewall-nat-exclude enable
esp-group ESP-AES128-SHA1-DH2-TRANSPORT {
compression disable
lifetime 3600
mode transport
pfs dh-group2
proposal 1 {
encryption aes128
hash sha1
}
}
ike-group IKE-AES128-SHA1-DH2 {
dead-peer-detection {
action hold
interval 120
timeout 120
}
ikev2-reauth no
key-exchange ikev1
lifetime 86400
proposal 1 {
dh-group 2
encryption aes128
hash sha1
}
}
ipsec-interfaces {
interface pppoe0
}
site-to-site {
peer 2.2.2.2 {
authentication {
mode pre-shared-secret
pre-shared-secret SOMETHING
}
connection-type initiate
default-esp-group ESP-AES128-SHA1-DH2-TRANSPORT
ike-group IKE-AES128-SHA1-DH2
ikev2-reauth inherit
local-address 1.1.1.1
tunnel 0 {
allow-nat-networks disable
allow-public-networks disable
protocol all
}
}
}