I'm trying to implement a strongswan solution for a site to site tunnel between me and a third party vendor. My tunnel establishes fine between myself and the vendor however I am wondering if this is the correct way of doing this?
When I attempt to telnet to a specific port/host on the remote end I don't see any traffic hit the tunnel or my counters increase. I think I just may need a suggestion or two on how to diagnose.
I have two hosts that I control, 1.1.1.1 and 1.1.1.2 (same subnet and also external IPs). There's no nat involved.
1.1.1.1 is my strongswan server
1.1.1.2 is sending the interesting traffic. This has a static route for 5.5.5.5/27 that points to 1.1.1.1
5.5.5.5/27 is the third party
My strongswan server:
# cat /etc/sysctl.conf | grep forward
# Controls IP packet forwarding
net.ipv4.ip_forward = 1
config setup
# strictcrlpolicy=yes
# uniqueids = no
conn %default
ikelifetime=1440m
keylife=60m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
authby=secret
conn vendor
left=1.1.1.1 #strongswan outside address
leftsubnet=1.1.1.2/32 #network behind strongswan
leftid=1.1.1.1 #IKEID sent by strongswan
right=5.5.5.5 #IOS outside address
rightsubnet=5.5.5.5/27 #network behind IOS
rightid=5.5.5.5 #IKEID sent by IOS
auto=add
ike=3des-sha1-modp1024 #P1
esp=3des-sha1 #P2
and my server (1.1.1.2) that is sending traffic.
# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
5.5.5.5 1.1.1.1 255.255.255.224 UG 0 0 0 eth0
IP
# ip xfrm policy
src 5.5.5.5/27 dst 1.1.1.2/32
dir fwd priority 2839 ptype main
tmpl src 5.5.5.5 dst 1.1.1.1
proto esp reqid 1 mode tunnel
src 5.5.5.5/27 dst 1.1.1.2/32
dir in priority 2839 ptype main
tmpl src 5.5.5.5 dst 1.1.1.1
proto esp reqid 1 mode tunnel
src 1.1.1.2/32 dst 5.5.5.5/27
dir out priority 2839 ptype main
tmpl src 1.1.1.1 dst 5.5.5.5
proto esp reqid 1 mode tunnel
src 0.0.0.0/0 dst 0.0.0.0/0
dir 3 priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
dir 4 priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
dir 3 priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
dir 4 priority 0 ptype main
src ::/0 dst ::/0
dir 3 priority 0 ptype main
src ::/0 dst ::/0
dir 4 priority 0 ptype main
src ::/0 dst ::/0
dir 3 priority 0 ptype main
src ::/0 dst ::/0
dir 4 priority 0 ptype main