I've setup strongswan on the router (Debian Stretch) and strongswan configuration works well, but only for connections issued from router.
However, once the tunnel goes up clients behind the router (192.168.10.0/24 from below) lose all connectivity completely. Meaning they are no longer able to access Internet, nor they get routed through tunnel, nor even ping/telnet/ssh the router itself (192.168.10.1). The goal is for those clients to be able to access Internet by tunneling all their traffic via ASA.
The setup is as follows:
network (the clients from left LAN should have their traffic go through tunnel and get internet access behind right LAN):
+---------------+ +------------------+ +-----------+ +------------+
| local LAN | | router | | Cisco ASA | | local LAN |
|192.168.10.0/24+-+eth0:192.168.1.1 +-Network-+ 1.1.1.1 +-+10.10.0.0/24+-Internet
| | |eth1:192.168.10.1 | | | | |
+---------------+ +------------------+ +-----------+ +------------+
ipsec.conf:
config setup
conn tunnel
authby=psk
auto=start
keyingtries=%forever
rekey=yes
dpdaction=restart
closeaction=restart
keyexchange=ikev1
aggressive=yes
fragmentation=yes
ike=aes-sha-modp1024
esp=aes-sha
type=tunnel
forceencaps=yes
left=%defaultroute
leftid=@GroupName
leftauth=psk
leftauth2=xauth
xauth_identity=user.name
leftsourceip=%config
right=1.1.1.1
rightauth=psk
rightsubnet=0.0.0.0/0
iptables-save:
*filter
:INPUT ACCEPT [762:57704]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [457:52596]
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -s 192.168.10.0/24 ! -d 192.168.10.0/24 -o eth0 -j ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT [3:984]
:INPUT ACCEPT [3:984]
:OUTPUT ACCEPT [1:104]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -s 10.10.0.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
